新160个crackme - 042-crackme

2024-08-31 01:04

文章标签 crackme 160 042

本文主要是介绍新160个crackme - 042-crackme，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

运行分析

在这里插入图片描述

提示需要key.dat文件
同目录下创建一个key.dat，提示key.dat内容不对

PE分析

在这里插入图片描述

C++程序，32位，无壳

静态分析&动态调试

在这里插入图片描述

ida搜索字符串，找到关键字符串双击进入关键函数

在这里插入图片描述

对关键函数进行分析，注释如上
当满足67行公式时，将会执行下面函数
发现89行有个VirtualProtect，即SMC
SMC（Self-Modifying Code，自修改代码）是一种特殊的代码技术，通过在运行时修改自身代码，使得程序的实际行为与反汇编结果不符。可以通过动态调试绕过

在这里插入图片描述

一共有4个循环计算，其中第二个循环
第一个循环：key内容每一位与key长度亦或
第二个循环：决定key[3/4]
第三个循环：计算byte_405030
然后需满足byte_405030 * byte_405031 * byte_405032 != 2788340
第四个循环：key中需含有0x20

算法分析


byte_405030 = [0x1E, 0xBF, 0xA2, 0x1A, 0xF3, 0x0B, 0xB7, 0x34, 0x4E, 0x4B,0x34, 0xC5, 0x0E, 0x38, 0x88, 0x4B, 0x32, 0xC5, 0x06, 0x38,0x88, 0x0A, 0x35, 0x43, 0xC0, 0x61, 0x42, 0x8D, 0x76, 0x4C,0x45, 0xBF, 0x0B, 0x47, 0xF2, 0x0E, 0x48, 0x3A, 0xC5, 0x06,0x38, 0x88, 0x0A, 0x30, 0x52, 0xC0, 0x61, 0x42, 0x8D, 0x76,0x4B, 0x1F, 0xBF, 0x0B, 0x47, 0xF2, 0x0E, 0x4D, 0x0A, 0xC5,0x06, 0x38, 0x88, 0x0A, 0x33, 0x68, 0xC0, 0x61, 0x42, 0x8D,0x76, 0x46, 0x63, 0xBF, 0x0B, 0x47, 0xF2, 0x0E, 0x42, 0x17,0xC5, 0x06, 0x38, 0x88, 0x0A, 0x3E, 0x33, 0xC0, 0x61, 0x42,0x8D, 0x76, 0x45, 0x6B, 0xBF, 0x0B, 0x47, 0xF2, 0x0E, 0x47,0x33, 0xC5, 0x06, 0x38, 0x88, 0x0A, 0x39, 0x1D, 0xC0, 0x61,0x42, 0x8D, 0x76, 0x40, 0x6B, 0xBF, 0x0B, 0x47, 0xBE, 0x46,0xCB, 0xC5, 0x1A, 0xC0, 0x61, 0x42, 0xC3, 0x3E, 0xC5, 0x0E,0x38, 0xC4, 0x03, 0x35, 0xCE, 0xBA, 0x5C, 0xC5, 0x1E, 0x38,0xC6, 0x01, 0x35, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x36, 0xCE,0xBA, 0x5D, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x36, 0xC5, 0x0E,0x38, 0xC4, 0x03, 0x37, 0xCE, 0xBA, 0x53, 0xC5, 0x1E, 0x38,0xC6, 0x01, 0x37, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x30, 0xCE,0xBA, 0x5B, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x30, 0xC5, 0x0E,0x38, 0xC4, 0x03, 0x31, 0xCE, 0xBA, 0x14, 0xC5, 0x1E, 0x38,0xC6, 0x01, 0x31, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x32, 0xCE,0xBA, 0x6F, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x32, 0xC5, 0x0E,0x38, 0xC4, 0x03, 0x33, 0xCE, 0xBA, 0x60, 0xC5, 0x1E, 0x38,0xC6, 0x01, 0x33, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x3C, 0xCE,0xBA, 0x79, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x3C, 0xC5, 0x0E,0x38, 0xC4, 0x03, 0x3D, 0xCE, 0xBA, 0x73, 0xC5, 0x1E, 0x38,0xC6, 0x01, 0x3D, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x3E, 0xCE,0xBA, 0x69, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x3E, 0xC5, 0x0E,0x38, 0xC4, 0x03, 0x3F, 0xCE, 0xBA, 0x60, 0xC5, 0x1E, 0x38,0xC6, 0x01, 0x3F, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x38, 0xCE,0xBA, 0x5C, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x38, 0xC5, 0x0E,0x38, 0xC4, 0x03, 0x39, 0xCE, 0xBA, 0x5D, 0xC5, 0x1E, 0x38,0xC6, 0x01, 0x39, 0x89, 0x0E, 0xC8, 0x4E, 0x4B, 0x34, 0x4E,0xC0, 0x71, 0x42, 0x48, 0x71, 0xB2, 0xC0, 0x79, 0x46, 0x48,0x79, 0xB2, 0xC1, 0x25, 0xC6, 0x1B, 0x3B, 0xC5, 0x0E, 0xC8,0xCD, 0x8B, 0x35, 0xC7, 0x0E, 0xC8, 0xC5, 0x06, 0x3C, 0x4D,0x06, 0xC8, 0x41, 0xF5, 0x25, 0xCB, 0x99, 0x41, 0x97, 0xC0,0x71, 0x42, 0x48, 0x71, 0xB2, 0x8D, 0x74, 0x41, 0x4B, 0xBF,0xAB, 0x16, 0xF7, 0xFF]
v8 = [0] * len(byte_405030)# 假设key为4位，其中最后一位为'0'
for key_0 in range(32,128):for key_1 in range(32,128):for key_2 in range(32,128):for length in range(4,5):key = [key_0,key_1,key_2]res = [key_0,key_1,key_2,0]# 第一个循环for i in range(0,3):key[i] ^= lengthkey[0] ^= 0x54key[1] ^= 0x4dkey[2] ^= 0x47# 第三个循环for i in range(0,3):v8[i] = byte_405030[i] ^ key[i]if v8[0] * v8[1] * v8[2] == 2788340:res[3] = 0x20 ^ key[0] ^ lengthprint("".join([chr(i)for i in res]))