環境：

Windows xp sp3

工具：

exeinfope, ollydbg

查殼：

用exeinfope查殼，發現加了殼 --?WWPack32 ver 1.xx?，用f8單步調試法，脫殼。

脫掉之后發現是delphi寫的

運行之后發現界面整潔，目標明確，輸入一個serial后會生成一串數字，使得生成的數字和界面的數字相同。

因為這次即使輸入不正確，也不會出現錯誤提示。幸好，當serial為空的時候點“spider"會有錯誤消息框出現。

在棧中找到這次錯誤消息框函數調用的位置，下斷點，再輸入serial，觀察是否被斷下，如果沒有就找更前一點的函數調用的位置。

直到當輸入serial后點確定會被斷下來。

可以找到這里：

0044A314 |. E8 EFD6FBFF call unpack.00407A08 0044A319 |. 8BF0 mov esi,eax 0044A31B |. 8B45 FC mov eax,[local.1] 0044A31E |. E8 5DD7FBFF call unpack.00407A80 ; 這里是算出serial的值的地方 0044A323 |. 52 push edx 0044A324 |. 50 push eax 0044A325 |. 8BC6 mov eax,esi 0044A327 |. 99 cdq 0044A328 |. 030424 add eax,dword ptr ss:[esp] ; 這里是加上算出來的值 0044A32B |. 135424 04 adc edx,dword ptr ss:[esp+0x4] 0044A32F |. 83C4 08 add esp,0x8 0044A332 |. 52 push edx 0044A333 |. 50 push eax 0044A334 |. 8BC6 mov eax,esi 0044A336 |. 99 cdq 0044A337 |. 030424 add eax,dword ptr ss:[esp] ; 這里也是，所以可以理解為算出的serial *= 3 0044A33A |. 135424 04 adc edx,dword ptr ss:[esp+0x4] 0044A33E |. 83C4 08 add esp,0x8
在0044A31E進去：

00407A80 /$ 55 push ebp 00407A81 |. 8BEC mov ebp,esp 00407A83 |. 83C4 E8 add esp,-0x18 00407A86 |. 53 push ebx 00407A87 |. 33D2 xor edx,edx 00407A89 |. 8955 F0 mov [local.4],edx 00407A8C |. 8BD8 mov ebx,eax 00407A8E |. 33C0 xor eax,eax 00407A90 |. 55 push ebp 00407A91 |. 68 EB7A4000 push unpack.00407AEB 00407A96 |. 64:FF30 push dword ptr fs:[eax] 00407A99 |. 64:8920 mov dword ptr fs:[eax],esp 00407A9C |. 8D55 F4 lea edx,[local.3] 00407A9F |. 8BC3 mov eax,ebx 00407AA1 |. E8 4ECEFFFF call unpack.004048F4 ; 這里是計算的地方 00407AA6 |. 8945 F8 mov [local.2],eax 00407AA9 |. 8955 FC mov [local.1],edx 00407AAC |. 837D F4 00 cmp [local.3],0x0 00407AB0 |. 74 23 je Xunpack.00407AD5 00407AB2 |. 8D55 F0 lea edx,[local.4] 00407AB5 |. A1 7CBC4400 mov eax,dword ptr ds:[0x44BC7C] 00407ABA |. E8 2DD6FFFF call unpack.004050EC 00407ABF |. 8B45 F0 mov eax,[local.4] 00407AC2 |. 50 push eax 00407AC3 |. 895D E8 mov [local.6],ebx 00407AC6 |. C645 EC 0B mov byte ptr ss:[ebp-0x14],0xB 00407ACA |. 8D55 E8 lea edx,[local.6] 00407ACD |. 33C9 xor ecx,ecx 00407ACF |. 58 pop eax 00407AD0 |. E8 B7FCFFFF call unpack.0040778C 00407AD5 |> 33C0 xor eax,eax 00407AD7 |. 5A pop edx 00407AD8 |. 59 pop ecx 00407AD9 |. 59 pop ecx 00407ADA |. 64:8910 mov dword ptr fs:[eax],edx 00407ADD |. 68 F27A4000 push unpack.00407AF2 00407AE2 |> 8D45 F0 lea eax,[local.4] 00407AE5 |. E8 72BDFFFF call unpack.0040385C 00407AEA \. C3 retn
在00407AA1跟進去：

004048F4 /$ 53 push ebx 004048F5 |. 56 push esi 004048F6 |. 57 push edi 004048F7 |. 55 push ebp 004048F8 |. 83C4 EC add esp,-0x14 004048FB |. 891424 mov dword ptr ss:[esp],edx 004048FE |. 8BF0 mov esi,eax 00404900 |. BD 01000000 mov ebp,0x1 00404905 |. 33FF xor edi,edi 00404907 |. C74424 08 000>mov dword ptr ss:[esp+0x8],0x0 0040490F |. C74424 0C 000>mov dword ptr ss:[esp+0xC],0x0 00404917 |. 85F6 test esi,esi 00404919 |. 75 0B jnz Xunpack.00404926 0040491B |. 8B0424 mov eax,dword ptr ss:[esp] 0040491E |. 8928 mov dword ptr ds:[eax],ebp 00404920 |. E9 E1010000 jmp unpack.00404B06 00404925 |> 45 /inc ebp 00404926 |> 807C2E FF 20 cmp byte ptr ds:[esi+ebp-0x1],0x20 0040492B |.^ 74 F8 \je Xunpack.00404925 0040492D |. C64424 10 00 mov byte ptr ss:[esp+0x10],0x0 00404932 |. 8A442E FF mov al,byte ptr ds:[esi+ebp-0x1] 00404936 |. 3C 2D cmp al,0x2D 00404938 |. 75 08 jnz Xunpack.00404942 0040493A |. C64424 10 01 mov byte ptr ss:[esp+0x10],0x1 0040493F |. 45 inc ebp 00404940 |. EB 05 jmp Xunpack.00404947 00404942 |> 3C 2B cmp al,0x2B 00404944 |. 75 01 jnz Xunpack.00404947 00404946 |. 45 inc ebp 00404947 |> B3 01 mov bl,0x1 00404949 |. 807C2E FF 24 cmp byte ptr ds:[esi+ebp-0x1],0x24 0040494E |. 74 1B je Xunpack.0040496B 00404950 |. 807C2E FF 30 cmp byte ptr ds:[esi+ebp-0x1],0x30 00404955 |. 0F85 DA000000 jnz unpack.00404A35 0040495B |. 8A042E mov al,byte ptr ds:[esi+ebp] 0040495E |. E8 99DEFFFF call unpack.004027FC 00404963 |. 3C 58 cmp al,0x58 00404965 |. 0F85 CA000000 jnz unpack.00404A35 0040496B |> 807C2E FF 30 cmp byte ptr ds:[esi+ebp-0x1],0x30 00404970 |. 75 01 jnz Xunpack.00404973 00404972 |. 45 inc ebp 00404973 |> 45 inc ebp 00404974 |> 8A442E FF /mov al,byte ptr ds:[esi+ebp-0x1] 00404978 |. 8BD0 |mov edx,eax 0040497A |. 80C2 D0 |add dl,0xD0 ; Switch (cases FFFFFD61..FFFFFF39) 0040497D |. 80EA 0A |sub dl,0xA 00404980 |. 72 12 |jb Xunpack.00404994 00404982 |. 80C2 F9 |add dl,0xF9 00404985 |. 80EA 06 |sub dl,0x6 00404988 |. 72 17 |jb Xunpack.004049A1 0040498A |. 80C2 E6 |add dl,0xE6 0040498D |. 80EA 06 |sub dl,0x6 00404990 |. 72 1C |jb Xunpack.004049AE 00404992 |. EB 7A |jmp Xunpack.00404A0E 00404994 |> 8BF8 |mov edi,eax ; Cases FFFFFF30,FFFFFF31,FFFFFF32,FFFFFF33,FFFFFF34,FFFFFF35,FFFFFF36,FFFFFF37,FFFFFF38,FFFFFF39 of switch 0040497A 00404996 |. 81E7 FF000000 |and edi,0xFF 0040499C |. 83EF 30 |sub edi,0x30 0040499F |. EB 18 |jmp Xunpack.004049B9 004049A1 |> 8BF8 |mov edi,eax ; Cases FFFFFE41,FFFFFE42,FFFFFE43,FFFFFE44,FFFFFE45,FFFFFE46 of switch 0040497A 004049A3 |. 81E7 FF000000 |and edi,0xFF 004049A9 |. 83EF 37 |sub edi,0x37 004049AC |. EB 0B |jmp Xunpack.004049B9 004049AE |> 8BF8 |mov edi,eax ; Cases FFFFFD61,FFFFFD62,FFFFFD63,FFFFFD64,FFFFFD65,FFFFFD66 of switch 0040497A 004049B0 |. 81E7 FF000000 |and edi,0xFF 004049B6 |. 83EF 57 |sub edi,0x57 004049B9 |> 837C24 0C 00 |cmp dword ptr ss:[esp+0xC],0x0 004049BE |. 75 09 |jnz Xunpack.004049C9 004049C0 |. 837C24 08 00 |cmp dword ptr ss:[esp+0x8],0x0 004049C5 |. 72 47 |jb Xunpack.00404A0E 004049C7 |. EB 02 |jmp Xunpack.004049CB 004049C9 |> 7C 43 |jl Xunpack.00404A0E 004049CB |> 817C24 0C FFF>|cmp dword ptr ss:[esp+0xC],0xFFFFFFF 004049D3 |. 75 09 |jnz Xunpack.004049DE 004049D5 |. 837C24 08 FF |cmp dword ptr ss:[esp+0x8],-0x1 004049DA |. 76 04 |jbe Xunpack.004049E0 004049DC |. EB 30 |jmp Xunpack.00404A0E 004049DE |> 7F 2E |jg Xunpack.00404A0E 004049E0 |> 8BC7 |mov eax,edi 004049E2 |. 99 |cdq 004049E3 |. 52 |push edx 004049E4 |. 50 |push eax 004049E5 |. 8B4424 10 |mov eax,dword ptr ss:[esp+0x10] 004049E9 |. 8B5424 14 |mov edx,dword ptr ss:[esp+0x14] 004049ED |. 0FA4C2 04 |shld edx,eax,0x4 004049F1 |. C1E0 04 |shl eax,0x4 004049F4 |. 030424 |add eax,dword ptr ss:[esp] 004049F7 |. 135424 04 |adc edx,dword ptr ss:[esp+0x4] 004049FB |. 83C4 08 |add esp,0x8 004049FE |. 894424 08 |mov dword ptr ss:[esp+0x8],eax 00404A02 |. 895424 0C |mov dword ptr ss:[esp+0xC],edx 00404A06 |. 45 |inc ebp 00404A07 |. 33DB |xor ebx,ebx 00404A09 |.^ E9 66FFFFFF \jmp unpack.00404974 00404A0E |> 807C24 10 00 cmp byte ptr ss:[esp+0x10],0x0 ; Default case of switch 0040497A 00404A13 |. 0F84 D3000000 je unpack.00404AEC 00404A19 |. 8B4424 08 mov eax,dword ptr ss:[esp+0x8] 00404A1D |. 8B5424 0C mov edx,dword ptr ss:[esp+0xC] 00404A21 |. F7D8 neg eax 00404A23 |. 83D2 00 adc edx,0x0 00404A26 |. F7DA neg edx 00404A28 |. 894424 08 mov dword ptr ss:[esp+0x8],eax 00404A2C |. 895424 0C mov dword ptr ss:[esp+0xC],edx 00404A30 |. E9 B7000000 jmp unpack.00404AEC 00404A35 |> 8A442E FF /mov al,byte ptr ds:[esi+ebp-0x1] ; 前面的作用也不大，主要看這里 00404A39 |. 8BD0 |mov edx,eax 00404A3B |. 80C2 D0 |add dl,0xD0 00404A3E |. 80EA 0A |sub dl,0xA 00404A41 |. 73 62 |jnb Xunpack.00404AA5 00404A43 |. 8BF8 |mov edi,eax 00404A45 |. 81E7 FF000000 |and edi,0xFF ; 00404A4B |. 83EF 30 |sub edi,0x30 ; 這里是將輸入的字符轉成對應的值。 00404A4E |. 837C24 0C 00 |cmp dword ptr ss:[esp+0xC],0x0 00404A53 |. 75 09 |jnz Xunpack.00404A5E 00404A55 |. 837C24 08 00 |cmp dword ptr ss:[esp+0x8],0x0 00404A5A |. 72 49 |jb Xunpack.00404AA5 00404A5C |. EB 02 |jmp Xunpack.00404A60 00404A5E |> 7C 45 |jl Xunpack.00404AA5 00404A60 |> 817C24 0C CCC>|cmp dword ptr ss:[esp+0xC],0xCCCCCCC 00404A68 |. 75 0C |jnz Xunpack.00404A76 00404A6A |. 817C24 08 CCC>|cmp dword ptr ss:[esp+0x8],0xCCCCCCCC 00404A72 |. 76 04 |jbe Xunpack.00404A78 00404A74 |. EB 2F |jmp Xunpack.00404AA5 00404A76 |> 7F 2D |jg Xunpack.00404AA5 00404A78 |> 6A 00 |push 0x0 00404A7A |. 6A 0A |push 0xA 00404A7C |. 8B4424 10 |mov eax,dword ptr ss:[esp+0x10] 00404A80 |. 8B5424 14 |mov edx,dword ptr ss:[esp+0x14] 00404A84 |. E8 F30E0000 |call unpack.0040597C ; 這個call是將之前算出的值*0xA，第一次執行循環時為0 00404A89 |. 52 |push edx 00404A8A |. 50 |push eax 00404A8B |. 8BC7 |mov eax,edi 00404A8D |. 99 |cdq 00404A8E |. 030424 |add eax,dword ptr ss:[esp] ; 這里是將上面的call算出來的值加上字符對應的值(也就是00404A4B算出的結果的值) 00404A91 |. 135424 04 |adc edx,dword ptr ss:[esp+0x4] 00404A95 |. 83C4 08 |add esp,0x8 00404A98 |. 894424 08 |mov dword ptr ss:[esp+0x8],eax 00404A9C |. 895424 0C |mov dword ptr ss:[esp+0xC],edx 00404AA0 |. 45 |inc ebp 00404AA1 |. 33DB |xor ebx,ebx 00404AA3 |.^ EB 90 \jmp Xunpack.00404A35 00404AA5 |> 807C24 10 00 cmp byte ptr ss:[esp+0x10],0x0 00404AAA |. 74 17 je Xunpack.00404AC3 00404AAC |. 8B4424 08 mov eax,dword ptr ss:[esp+0x8] 00404AB0 |. 8B5424 0C mov edx,dword ptr ss:[esp+0xC] 00404AB4 |. F7D8 neg eax 00404AB6 |. 83D2 00 adc edx,0x0 00404AB9 |. F7DA neg edx 00404ABB |. 894424 08 mov dword ptr ss:[esp+0x8],eax 00404ABF |. 895424 0C mov dword ptr ss:[esp+0xC],edx 00404AC3 |> 837C24 0C 00 cmp dword ptr ss:[esp+0xC],0x0 00404AC8 |. 75 05 jnz Xunpack.00404ACF 00404ACA |. 837C24 08 00 cmp dword ptr ss:[esp+0x8],0x0 00404ACF |> 74 1B je Xunpack.00404AEC 00404AD1 |. 837C24 0C 00 cmp dword ptr ss:[esp+0xC],0x0 00404AD6 |. 75 0A jnz Xunpack.00404AE2 00404AD8 |. 837C24 08 00 cmp dword ptr ss:[esp+0x8],0x0 00404ADD |. 0F92C0 setb al 00404AE0 |. EB 03 jmp Xunpack.00404AE5 00404AE2 |> 0F9CC0 setl al 00404AE5 |> 3A4424 10 cmp al,byte ptr ss:[esp+0x10] 00404AE9 |. 74 01 je Xunpack.00404AEC 00404AEB |. 4D dec ebp 00404AEC |> 807C2E FF 00 cmp byte ptr ds:[esi+ebp-0x1],0x0 00404AF1 |. 0F95C0 setne al 00404AF4 |. 0AD8 or bl,al 00404AF6 |. 74 07 je Xunpack.00404AFF 00404AF8 |. 8B0424 mov eax,dword ptr ss:[esp] 00404AFB |. 8928 mov dword ptr ds:[eax],ebp 00404AFD |. EB 07 jmp Xunpack.00404B06 00404AFF |> 8B0424 mov eax,dword ptr ss:[esp] 00404B02 |. 33D2 xor edx,edx 00404B04 |. 8910 mov dword ptr ds:[eax],edx 00404B06 |> 8B4424 08 mov eax,dword ptr ss:[esp+0x8] 00404B0A |. 8B5424 0C mov edx,dword ptr ss:[esp+0xC] 00404B0E |. 83C4 14 add esp,0x14 00404B11 |. 5D pop ebp 00404B12 |. 5F pop edi 00404B13 |. 5E pop esi 00404B14 |. 5B pop ebx 00404B15 \. C3 retn

上面這段看上去很長，很復雜，其實就是將輸入的serial從字符串轉成數值，所以在0044A31E函數中返回的就是輸入的serial對應的數值，然后將對應的數值乘以3，與“3E74984B”比較，是否相同。所以輸入的serial應該是dec(3E74984B / 3) ，即"349276185"

創作挑戰賽新人創作獎勵來咯，堅持創作打卡瓜分現金大獎

總結

以上是生活随笔為你收集整理的160 - 20 BuLLeT.8的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。