1 004016D5 . 83C4 1C add esp,0x1C 2 004016D8 . 52 push edx ; |FileName => "KwazyWeb.bit" 3 004016D9 . E8 1C010000 call <jmp.&KERNEL32.CreateFileA> ; CreateFileA 4 004016DE . 83F8 FF cmp eax,-0x1 5 004016E1 . 74 64 je short PacMe.00401747 6 004016E3 . A3 44344000 mov dword ptr ds:[0x403444],eax 7 004016E8 . 6A 00 push 0x0 ; /pOverlapped = NULL 8 004016EA . 68 48344000 push PacMe.00403448 ; |pBytesRead = PacMe.00403448 9 004016EF . 6A 01 push 0x1 ; |BytesToRead = 0x1 10 004016F1 . 68 FA344000 push PacMe.004034FA ; |Buffer = PacMe.004034FA 11 004016F6 . FF35 44344000 push dword ptr ds:[0x403444] ; |hFile = 00000264 (window) 12 004016FC . E8 11010000 call <jmp.&KERNEL32.ReadFile> ; ReadFile 设读取出的为number 13 00401701 . 0FB605 FA344000 movzx eax,byte ptr ds:[0x4034FA] ; 文件中第一个字符指明个数eax=number 14 00401708 . 85C0 test eax,eax 15 0040170A . 74 3B je short PacMe.00401747 ; 如果文件内容空 退出 16 0040170C . 6A 00 push 0x0 ; /pOverlapped = NULL 17 0040170E . 68 48344000 push PacMe.00403448 ; |pBytesRead = PacMe.00403448 18 00401713 . 50 push eax ; |BytesToRead 19 00401714 . 68 88324000 push PacMe.00403288 ; |Buffer = PacMe.00403288 20 00401719 . FF35 44344000 push dword ptr ds:[0x403444] ; |hFile = 00000264 (window) 21 0040171F . E8 EE000000 call <jmp.&KERNEL32.ReadFile> ; ReadFile 22 00401724 . E8 D7F8FFFF call PacMe.00401000 ; 根据上面的eax=number读取number个字符 23 { 24 00401000 /$ 33C0 xor eax,eax 25 00401002 |. 33D2 xor edx,edx 26 00401004 |. 33C9 xor ecx,ecx 27 00401006 |. 8A0D FA344000 mov cl,byte ptr ds:[0x4034FA] 28 0040100C |. BE 88324000 mov esi,PacMe.00403288 ; ASCII 29 00401011 |> AC /lods byte ptr ds:[esi] ; 从esi指向的空间取出一个字符 30 00401012 |. 03D0 |add edx,eax ; 相加 31 00401014 |.^ E2 FB loopd short PacMe.00401011 32 00401016 |. 8815 FB344000 mov byte ptr ds:[0x4034FB],dl ;将number个字符相加最后得到的低8位(设为k1)放到4034FB中 33 0040101C . C3 retn 34 } 35 00401729 . 6A 00 push 0x0 ; /pOverlapped = NULL 36 0040172B . 68 48344000 push PacMe.00403448 ; |pBytesRead = PacMe.00403448 37 00401730 . 6A 12 push 0x12 ; |BytesToRead = 12 (18.) 38 00401732 . 68 E8344000 push PacMe.004034E8 ; |Buffer = PacMe.004034E8 39 00401737 . FF35 44344000 push dword ptr ds:[0x403444] ; |hFile = 00000264 (window) 40 0040173D . E8 D0000000 call <jmp.&KERNEL32.ReadFile> ; ReadFile 此处读取的是在number之后的字符串
1 ;这里可以猜测key的组成为 : n(指代后面有n位username) n位字符 18个要跟n位进行异或的字符 2 00401742 . E8 82F9FFFF call PacMe.004010C9 ; 验证核心 3 { 4 004010C9 /$ 55 push ebp 5 004010CA |. 8BEC mov ebp,esp 6 004010CC |. 83C4 FC add esp,-0x4 7 004010CF |. 68 65334000 push PacMe.00403365 8 ; /String2 = 9 ; **************** 10 ; C*......*...**** 11 ; .*.****...*....* 12 ; .*..**********.* 13 ; ..*....*...*...* 14 ; *.****.*.*...*** 15 ; *.*....*.******* 16 ; ..*.***..*.....* 17 ; .*..***.**.***.* 18 ; ...****....*X..* 19 ; **************** 20 004010D4 |. 68 BC314000 push PacMe.004031BC ; |String1 = PacMe.004031BC 21 004010D9 |. E8 3A070000 call <jmp.&KERNEL32.lstrcpyA> ; lstrcpyA 22 004010DE |. C705 84314000 CC3>mov dword ptr ds:[0x403184],PacMe.004031CC ; ASCII 23 ; C*......*...**** 24 ; .*.****...*....* 25 ; .*..**********.* 26 ; ..*....*...*...* 27 ; *.****.*.*...*** 28 ; *.*....*.******* 29 ; ..*.***..*.....* 30 ; .*..***.**.***.* 31 ; ...****....*X..* 32 004010E8 |. E8 30FFFFFF call PacMe.0040101D ; 对上面的字符串和文件内容字符的和作异或 33 { 34 0040101D /$ 8A15 FB344000 mov dl,byte ptr ds:[0x4034FB] ; 第二次求和的值放到dl中 35 00401023 |. B9 12000000 mov ecx,0x12 36 00401028 |. B8 E8344000 mov eax,PacMe.004034E8 ; eax指向第三次读取的数据 37 0040102D |> 3010 /xor byte ptr ds:[eax],dl ; ds:[eax] xor k1 38 0040102F |. 40 |inc eax 39 00401030 |.^ E2 FB loopd short PacMe.0040102D 40 00401032 . C3 retn 41 } 42 004010ED |. C645 FE 00 mov byte ptr ss:[ebp-0x2],0x0 ; y=0 43 004010F1 |. 33C0 xor eax,eax 44 004010F3 |. 33C9 xor ecx,ecx ; 清零 45 004010F5 |> C645 FF 08 /mov byte ptr ss:[ebp-0x1],0x8 ; x=8 46 004010F9 |> 806D FF 02 |/sub byte ptr ss:[ebp-0x1],0x2 ; x=x-2=6 47 004010FD |. 0FB64D FE ||movzx ecx,byte ptr ss:[ebp-0x2] ; ecx=y=0 48 ; 每次这里拿异或后的字符其中两位(从高到低)作为移动方向 49 00401101 |. 81C1 E8344000 ||add ecx,PacMe.004034E8 ; ecx+第三次处理后字符串首地址 s 50 00401107 |. 8A01 ||mov al,byte ptr ds:[ecx] ; al = s[ecx] 51 00401109 |. 8A4D FF ||mov cl,byte ptr ss:[ebp-0x1] 52 0040110C |. D2E8 ||shr al,cl ; al >> x 53 0040110E |. 24 03 ||and al,0x3 ; al & 3 这个时候al取值有四种 代表四种方向 54 00401110 |. E8 1EFFFFFF ||call PacMe.00401033 ; 根据al的值进行移动 55 { 56 ; 0: 向上移 57 ; 1: 向右移 58 ; 2: 向下移 59 ; 3: 向左移 60 00401033 $ 55 push ebp 61 00401034 . 8BEC mov ebp,esp 62 00401036 . 83C4 F8 add esp,-0x8 63 00401039 . 8B15 84314000 mov edx,dword ptr ds:[0x403184] ; PacMe.004031CC 64 0040103F . 8955 FC mov dword ptr ss:[ebp-0x4],edx 65 00401042 . 0AC0 or al,al ; Switch (cases 0..2) 66 00401044 . 75 09 jnz short PacMe.0040104F 67 00401046 . 832D 84314000 10 sub dword ptr ds:[0x403184],0x10 ; c - 10h; Case 0 of switch 00401042 68 0040104D . EB 1F jmp short PacMe.0040106E 69 0040104F > 3C 01 cmp al,0x1 70 00401051 . 75 08 jnz short PacMe.0040105B 71 00401053 . FF05 84314000 inc dword ptr ds:[0x403184] ; c + 1; Case 1 of switch 00401042 72 00401059 . EB 13 jmp short PacMe.0040106E 73 0040105B > 3C 02 cmp al,0x2 74 0040105D . 75 09 jnz short PacMe.00401068 75 0040105F . 8305 84314000 10 add dword ptr ds:[0x403184],0x10 ; c + 10h; Case 2 of switch 00401042 76 00401066 . EB 06 jmp short PacMe.0040106E 77 00401068 > FF0D 84314000 dec dword ptr ds:[0x403184] ; c - 1; Default case of switch 00401042 78 0040106E > 8B15 84314000 mov edx,dword ptr ds:[0x403184] ; edx指向移动后的位置 79 00401074 . 8A02 mov al,byte ptr ds:[edx] 80 00401076 . 3C 2A cmp al,0x2A ; 检查al是否为* 81 00401078 . 75 06 jnz short PacMe.00401080 ; 是* 则不移动 返回0 82 0040107A . 33C0 xor eax,eax 83 0040107C . C9 leave 84 0040107D . C3 retn 85 0040107E . EB 33 jmp short PacMe.004010B3 86 00401080 > 3C 58 cmp al,0x58 ; 看al是不是X 87 00401082 75 2F jnz short PacMe.004010B3 ; 是X就注册成功 否则跳转 88 00401084 . 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL 89 00401086 . 8D15 59334000 lea edx,dword ptr ds:[0x403359] ; | 90 0040108C . 52 push edx ; |Title => "Success.." 91 0040108D . 8D15 EC324000 lea edx,dword ptr ds:[0x4032EC] ; | 92 00401093 . 52 push edx ; |Text => "Congratulations! 93 00401094 . 6A 00 push 0x0 ; |hOwner = NULL 94 00401096 . 8D15 AC174000 lea edx,dword ptr ds:[0x4017AC] ; | 95 0040109C . FFD2 call edx ; MessageBoxA 96 0040109E . 8D15 7B324000 lea edx,dword ptr ds:[0x40327B] 97 004010A4 . 52 push edx ; /Text => "Cracked by : uuuuuuu" 98 004010A5 . FF35 20344000 push dword ptr ds:[0x403420] ; |hWnd = 001E01D0 ('UNREGISTERED!',class='Edit',parent=001B0394) 99 004010AB . 8D15 DC174000 lea edx,dword ptr ds:[0x4017DC] ; | 100 004010B1 . FFD2 call edx ; SetWindowTextA 101 004010B3 > 8B15 84314000 mov edx,dword ptr ds:[0x403184] ; 当前位置记录为C 102 004010B9 . C602 43 mov byte ptr ds:[edx],0x43 103 004010BC . 8B55 FC mov edx,dword ptr ss:[ebp-0x4] 104 004010BF . C602 20 mov byte ptr ds:[edx],0x20 ; 刚刚走的位置记录为空格 105 004010C2 . B8 01000000 mov eax,0x1 ; 返回1代表没有结束 106 004010C7 . C9 leave 107 004010C8 . C3 retn 108 } 109 00401115 |. 85C0 ||test eax,eax ; eax如果返回0 则注册成功 110 00401117 |. 74 11 ||je short PacMe.0040112A 111 00401119 |. 0FB655 FF ||movzx edx,byte ptr ss:[ebp-0x1] ; 不为0 则 edx=x 112 0040111D |. 85D2 ||test edx,edx ; 如果四个方向遍历了，就结束内层循环 113 0040111F |.^ 75 D8 |jnz short PacMe.004010F9 ; 否则再小循环，往其他方向走 114 00401121 |. FE45 FE |inc byte ptr ss:[ebp-0x2] ; y+1 115 00401124 |. 807D FE 12 |cmp byte ptr ss:[ebp-0x2],0x12 ; if y>18 结束外层循环 116 00401128 |.^ 75 CB jnz short PacMe.004010F5 ; 外层循环18次 117 ;总共循环 18*4 次 在这个范围内必须走到X 118 0040112A |> C9 leave 119 0040112B . C3 retn 120 } 121 122 00401754 > FF75 14 push dword ptr ss:[ebp+0x14] ; /lParam; Default case of switch 004012D8 123 00401757 . FF75 10 push dword ptr ss:[ebp+0x10] ; |wParam 124 0040175A . FF75 0C push dword ptr ss:[ebp+0xC] ; |Message 125 0040175D . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd 126 00401760 . E8 17000000 call <jmp.&USER32.DefWindowProcA> ; DefWindowProcA 127 00401765 . C9 leave 128 00401766 . C2 1000 retn 0x10 129 00401769 > 33C0 xor eax,eax 130 0040176B . C9 leave 131 0040176C . C2 1000 retn 0x10
这个程序主要就是进行一个深搜 - - 保证在 18*4内搜索到X就好
1 #include <iostream> 2 #include <fstream> 3 #include <iomanip> 4 using namespace std; 5 #define ROW 9 6 #define COL 16 7 #define TIMES 18*4 8 9 unsigned char key[TIMES] = { 0 }; 10 int des[4][2]= 11 { 12 {-1,0},//上 13 {0,1},//右 14 {1,0},//下 15 {0,-1}//左 16 }; 17 bool keygen(char g[ROW][COL],int x,int y,int keyn) 18 { 19 if (g[x][y] == 'X') 20 return true; 21 if (keyn > TIMES) 22 return false; 23 g[x][y] = ' '; 24 for (int i = 0;i < 4;i++) 25 { 26 int nx = des[i][0] + x; 27 int ny = des[i][1] + y; 28 if (nx >= 0 && ny >= 0 && (nx < ROW) && (ny < COL)&&g[nx][ny]!='*'&&g[nx][ny] != ' ') 29 { 30 key[keyn] = i; 31 if (keyn == 70) 32 cout << ' '; 33 if (keygen(g, nx, ny, keyn + 1)) 34 return true; 35 g[nx][ny] = '.'; 36 key[keyn] = -1; 37 } 38 } 39 } 40 41 int main() 42 { 43 unsigned char name[8] = { 0 }; 44 char g[ROW][COL] = { 0 }; 45 unsigned char kk[TIMES / 4] = { 0 }; 46 for (int i = 0;i < TIMES;i++) 47 key[i] = -1; 48 for (int i = 0;i < ROW;i++) 49 for (int j = 0; j < COL; j++) 50 cin >> g[i][j]; 51 ofstream outfile; 52 outfile.open("KwazyWeb.bit"); 53 if (keygen(g, 0, 0, 0)) 54 { 55 for (int i = 0;i < TIMES;i += 4) 56 { 57 char kx = key[i]; 58 kx = (kx << 2) | key[i + 1]; 59 kx = (kx << 2) | key[i + 2]; 60 kx = (kx << 2) | key[i + 3]; 61 cout << hex<< kx << ' '; 62 kk[i / 4] = kx; 63 } 64 cout << endl; 65 } 66 unsigned int number; 67 cout << "请输入用户名字符个数"; 68 cin >> number; 69 outfile << hex << unsigned char(number); 70 cout << "请输入用户名"; 71 cin >> name; 72 unsigned int c = 0; 73 for (int i = 0;i < number;i++) 74 { 75 c += name[i]; 76 outfile << hex << name[i]; 77 } 78 cout << unsigned char(c); 79 for (int i = 0;i < TIMES / 4;i++) 80 { 81 kk[i] ^= unsigned char(c); 82 cout << hex << kk[i]<<' '; 83 outfile << hex << kk[i]; 84 } 85 outfile.close(); 86 system("pause"); 87 return 0; 88 }
嗯 基本对了 0 0 .。 之后看python怎么样。。。C++不是太会字符处理
----------------------------------之后终于改好了---------------------------------------效果如下：
还好很好玩的 - - 不过本人愚笨，弄了一天