160 - 37 CyberBlade.1

環境
Windows xp sp3

工具
1.exeinfo PE
2.ollydbg

查殼
OD載入是VB程序。

測試

OD載入直接搜字符串。
這個是當輸入為空時會彈出消息框告訴你要輸入9個字符。

0040E005   > \8B4D E4       mov ecx,dword ptr ss:[ebp-0x1C]
0040E008   .  51            push ecx
0040E009   .  68 4C344000   push CyberBla.0040344C
0040E00E   .  FF15 28114100 call dword ptr ds:[<&MSVBVM50.__vbaStrCm>;  MSVBVM50.__vbaStrCmp
0040E014   .  8BF0          mov esi,eax
0040E016   .  8D4D E4       lea ecx,dword ptr ss:[ebp-0x1C]
0040E019   .  F7DE          neg esi
0040E01B   .  1BF6          sbb esi,esi
0040E01D   .  46            inc esi
0040E01E   .  F7DE          neg esi
0040E020   .  FF15 8C114100 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>;  MSVBVM50.__vbaFreeStr
0040E026   .  8D4D E0       lea ecx,dword ptr ss:[ebp-0x20]
0040E029   .  FF15 90114100 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>;  MSVBVM50.__vbaFreeObj
0040E02F   .  66:3BF7       cmp si,di
0040E032   .  74 7D         je XCyberBla.0040E0B1
0040E034   .  BF 0A000000   mov edi,0xA
0040E039   .  BB 04000280   mov ebx,0x80020004
0040E03E   .  897D A0       mov dword ptr ss:[ebp-0x60],edi
0040E041   .  897D B0       mov dword ptr ss:[ebp-0x50],edi
0040E044   .  8B3D 78114100 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>;  MSVBVM50.__vbaVarDup
0040E04A   .  BE 08000000   mov esi,0x8
0040E04F   .  8D55 80       lea edx,dword ptr ss:[ebp-0x80]
0040E052   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
0040E055   .  895D A8       mov dword ptr ss:[ebp-0x58],ebx
0040E058   .  895D B8       mov dword ptr ss:[ebp-0x48],ebx
0040E05B   .  C745 88 EC344>mov dword ptr ss:[ebp-0x78],CyberBla.004>;  UNICODE "Error"
0040E062   .  8975 80       mov dword ptr ss:[ebp-0x80],esi
0040E065   .  FFD7          call edi                                 ;  <&MSVBVM50.__vbaVarDup>
0040E067   .  8D55 90       lea edx,dword ptr ss:[ebp-0x70]
0040E06A   .  8D4D D0       lea ecx,dword ptr ss:[ebp-0x30]
0040E06D   .  C745 98 94344>mov dword ptr ss:[ebp-0x68],CyberBla.004>;  UNICODE "You have to enter an 9 number key first."
0040E074   .  8975 90       mov dword ptr ss:[ebp-0x70],esi
0040E077   .  FFD7          call edi
0040E079   .  8D55 A0       lea edx,dword ptr ss:[ebp-0x60]
0040E07C   .  8D45 B0       lea eax,dword ptr ss:[ebp-0x50]
0040E07F   .  52            push edx
0040E080   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
0040E083   .  50            push eax
0040E084   .  51            push ecx
0040E085   .  8D55 D0       lea edx,dword ptr ss:[ebp-0x30]
0040E088   .  6A 40         push 0x40
0040E08A   .  52            push edx
0040E08B   .  FF15 04114100 call dword ptr ds:[<&MSVBVM50.#595>]     ;  MSVBVM50.rtcMsgBox

這里比較

0040E0EB   .  51            push ecx                                 ;  輸入的serial存進來
0040E0EC   .  FF15 5C114100 call dword ptr ds:[<&MSVBVM50.__vbaR8Str>;  MSVBVM50.__vbaR8Str
0040E0F2   .  DB43 4C       fild dword ptr ds:[ebx+0x4C]             ;  這里會有一個值
0040E0F5   .  DD9D 38FFFFFF fstp qword ptr ss:[ebp-0xC8]
0040E0FB   .  DCA5 38FFFFFF fsub qword ptr ss:[ebp-0xC8]             ;  輸入的serial與上面的值相減
0040E101   .  DFE0          fstsw ax
0040E103   .  A8 0D         test al,0xD
0040E105   .  0F85 EB030000 jnz CyberBla.0040E4F6
0040E10B   .  FF15 14114100 call dword ptr ds:[<&MSVBVM50.__vbaFpR8>>;  MSVBVM50.__vbaFpR8
0040E111   .  DC1D 08104000 fcomp qword ptr ds:[0x401008]            ;  將上面的結果與0比較
0040E117   .  DFE0          fstsw ax                                 ;  相等的話下面的跳轉不實現，彈出正確消息框框
0040E119   .  F6C4 40       test ah,0x40
0040E11C   .  74 05         je XCyberBla.0040E123
0040E11E   .  BF 01000000   mov edi,0x1
0040E123   >  8D4D E4       lea ecx,dword ptr ss:[ebp-0x1C]
0040E126   .  FF15 8C114100 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>;  MSVBVM50.__vbaFreeStr
0040E12C   .  8D4D E0       lea ecx,dword ptr ss:[ebp-0x20]
0040E12F   .  FF15 90114100 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>;  MSVBVM50.__vbaFreeObj
0040E135   .  F7DF          neg edi
0040E137   .  66:85FF       test di,di
0040E13A   .  0F84 2C010000 je CyberBla.0040E26C
0040E140   .  BB 04000280   mov ebx,0x80020004
0040E145   .  BF 0A000000   mov edi,0xA
0040E14A   .  BE 08000000   mov esi,0x8
0040E14F   .  8D55 80       lea edx,dword ptr ss:[ebp-0x80]
0040E152   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
0040E155   .  895D A8       mov dword ptr ss:[ebp-0x58],ebx
0040E158   .  897D A0       mov dword ptr ss:[ebp-0x60],edi
0040E15B   .  895D B8       mov dword ptr ss:[ebp-0x48],ebx
0040E15E   .  897D B0       mov dword ptr ss:[ebp-0x50],edi
0040E161   .  C745 88 5C354>mov dword ptr ss:[ebp-0x78],CyberBla.004>;  UNICODE "Correct password"
0040E168   .  8975 80       mov dword ptr ss:[ebp-0x80],esi
0040E16B   .  FF15 78114100 call dword ptr ds:[<&MSVBVM50.__vbaVarDu>;  MSVBVM50.__vbaVarDup
0040E171   .  8D55 90       lea edx,dword ptr ss:[ebp-0x70]
0040E174   .  8D4D D0       lea ecx,dword ptr ss:[ebp-0x30]
0040E177   .  C745 98 FC344>mov dword ptr ss:[ebp-0x68],CyberBla.004>;  UNICODE "Not bad, you have found the correct password."
0040E17E   .  8975 90       mov dword ptr ss:[ebp-0x70],esi
0040E181   .  FF15 78114100 call dword ptr ds:[<&MSVBVM50.__vbaVarDu>;  MSVBVM50.__vbaVarDup
0040E187   .  8D55 A0       lea edx,dword ptr ss:[ebp-0x60]
0040E18A   .  8D45 B0       lea eax,dword ptr ss:[ebp-0x50]
0040E18D   .  52            push edx
0040E18E   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
0040E191   .  50            push eax
0040E192   .  51            push ecx
0040E193   .  8D55 D0       lea edx,dword ptr ss:[ebp-0x30]
0040E196   .  6A 40         push 0x40
0040E198   .  52            push edx
0040E199   .  FF15 04114100 call dword ptr ds:[<&MSVBVM50.#595>]     ;  MSVBVM50.rtcMsgBox

其實就是明文比較：315751288

本文來自互聯網用戶投稿，該文觀點僅代表作者本人，不代表本站立場。本站僅提供信息存儲空間服務，不擁有所有權，不承擔相關法律責任。
如若轉載，請注明出處：http://www.pswp.cn/news/376388.shtml
繁體地址，請注明出處：http://hk.pswp.cn/news/376388.shtml
英文地址，請注明出處：http://en.pswp.cn/news/376388.shtml

如若內容造成侵權/違法違規/事實不符，請聯系多彩編程網進行投訴反饋email:809451989@qq.com，一經查實，立即刪除！