系统 ： Windows xp

程序 ： noodles-crackme2

程序下载地址 ：http://pan.baidu.com/s/1mhJ4Ems

要求 ： 编写KeyFile

使用工具 ： OD

可在看雪论坛中查找关于此程序的破文：传送门

 

废话不多说，直接下断点

CreateFileA

断在系统函数中，然后ctrl+k查看调用栈，回溯到文件处理代码：

00401499   > \6A 00         push 0x0                                 ; /hTemplateFile = NULL
0040149B   .  68 80000000   push 0x80                                ; |Attributes = NORMAL
004014A0   .  6A 03         push 0x3                                 ; |Mode = OPEN_EXISTING
004014A2   .  6A 00         push 0x0                                 ; |pSecurity = NULL
004014A4   .  6A 00         push 0x0                                 ; |ShareMode = 0
004014A6   .  68 00000080   push 0x80000000                          ; |Access = GENERIC_READ
004014AB   .  68 F1354000   push noodles-.004035F1                   ; |FileName = "spook.key"
004014B0   .  E8 6F010000   call <jmp.&KERNEL32.CreateFileA>         ; \CreateFileA
004014B5   .  83F8 FF       cmp eax,-0x1
004014B8   .  0F84 99000000 je noodles-.00401557
004014BE   .  A3 E9354000   mov dword ptr ds:[0x4035E9],eax
004014C3   .  FF35 E9354000 push dword ptr ds:[0x4035E9]             ; /hFile = NULL
004014C9   .  E8 32010000   call <jmp.&KERNEL32.GetFileType>         ; \GetFileType
004014CE   .  68 FB354000   push noodles-.004035FB                   ; /pFileSizeHigh = noodles-.004035FB
004014D3   .  FF35 E9354000 push dword ptr ds:[0x4035E9]             ; |hFile = NULL
004014D9   .  E8 1C010000   call <jmp.&KERNEL32.GetFileSize>         ; \GetFileSize
004014DE   .  A3 ED354000   mov dword ptr ds:[0x4035ED],eax
004014E3   .  83F8 08       cmp eax,0x8                              ;  大小是否等于8？
004014E6   .  75 6F         jnz Xnoodles-.00401557
004014E8   .  6A 00         push 0x0                                 ; /pOverlapped = NULL
004014EA   .  68 FB354000   push noodles-.004035FB                   ; |pBytesRead = noodles-.004035FB
004014EF   .  50            push eax                                 ; |BytesToRead
004014F0   .  68 FF354000   push noodles-.004035FF                   ; |Buffer = noodles-.004035FF
004014F5   .  FF35 E9354000 push dword ptr ds:[0x4035E9]             ; |hFile = NULL
004014FB   .  E8 BE000000   call <jmp.&KERNEL32.ReadFile>            ; \ReadFile
00401500   .  85C0          test eax,eax
00401502   .  74 53         je Xnoodles-.00401557
00401504   .  33C0          xor eax,eax
00401506   .  FF35 E9354000 push dword ptr ds:[0x4035E9]             ; /hObject = NULL
0040150C   .  E8 A7000000   call <jmp.&KERNEL32.CloseHandle>         ; \CloseHandle
00401511   .  B8 FF354000   mov eax,noodles-.004035FF
00401516   .  C100 05       rol dword ptr ds:[eax],0x5
00401519   .  8300 0F       add dword ptr ds:[eax],0xF
0040151C   .  C148 04 07    ror dword ptr ds:[eax+0x4],0x7
00401520   .  8368 04 05    sub dword ptr ds:[eax+0x4],0x5
00401524   .  8178 04 BDD84>cmp dword ptr ds:[eax+0x4],0xC642D8BD
0040152B   .  75 2A         jnz Xnoodles-.00401557
0040152D   .  8138 FC098E2E cmp dword ptr ds:[eax],0x2E8E09FC
00401533   .  75 22         jnz Xnoodles-.00401557
00401535   .  68 88130000   push 0x1388
0040153A   .  68 94334000   push noodles-.00403394                   ; /Text = "Your keyfile is fine happy happy joy joy"
0040153F   .  68 8B130000   push 0x138B                              ; |ControlID = 138B (5003.)
00401544   .  FF75 08       push dword ptr ss:[ebp+0x8]              ; |hWnd
00401547   .  E8 62010000   call <jmp.&USER32.SetDlgItemTextA>       ; \SetDlgItemTextA
0040154C   .  8B25 BD334000 mov esp,dword ptr ds:[0x4033BD]
00401552   .^ E9 CBFDFFFF   jmp noodles-.00401322
00401557   >  6A 00         push 0x0                                 ; /Style = MB_OK|MB_APPLMODAL
00401559   .  68 63364000   push noodles-.00403663                   ; |Title = "Error!"
0040155E   .  68 6A364000   push noodles-.0040366A                   ; |Text = "Ketfile not present

or incorrect"
00401563   .  6A 00         push 0x0                                 ; |hOwner = NULL
00401565   .  E8 4A010000   call <jmp.&USER32.MessageBoxA>           ; \MessageBoxA
0040156A   .  6A 01         push 0x1                                 ; /ExitCode = 1
0040156C   .  E8 5F000000   call <jmp.&KERNEL32.ExitProcess>         ; \ExitProcess

可以看出这是一个很简单的数据运算过程，只要反推四步即可得到keyfile的内容。

以下上生成keyfile的c++代码：

#include <iostream>
#include <fstream>

using namespace std;

int main( void )
{
    unsigned int v1 = 0x2E8E09FC,v2 = 0xC642D8BD;

    __asm{
        push eax
        push ebx

        mov eax,v1
        mov ebx,v2

        sub eax,0xF
        ror eax,0x5

        add ebx,0x5
        rol ebx,0x7

        mov v1,eax
        mov v2,ebx

        pop ebx
        pop eax
    }

    ofstream out( "spook.key",ios::out | ios::binary | ios::trunc );
    if ( out.is_open() ){
        out.write( (const char *)&v1,4 );
        out.write( (const char *)&v2,4 );
    }
    else
        cout << "Open file failed." << endl;

    out.close();

    return 0;
}

给出可用的KeyFIle内容：

4F 70 74 69 63 61 6C 21