keyFile 巩固练习

系统 ： Windows xp

程序 ： noodles-crackme2

程序下载地址 ：http://pan.baidu.com/s/1mhJ4Ems

要求 ： 编写KeyFile

使用工具 ： OD

可在看雪论坛中查找关于此程序的破文：传送门

废话不多说，直接下断点

CreateFileA

断在系统函数中，然后ctrl+k查看调用栈，回溯到文件处理代码：

   > \6A          push 0x0                                 ; /hTemplateFile = NULL
0040149B   .      push 0x80                                ; |Attributes = NORMAL
004014A0   .  6A          push 0x3                                 ; |Mode = OPEN_EXISTING
004014A2   .  6A          push 0x0                                 ; |pSecurity = NULL
004014A4   .  6A          push 0x0                                 ; |ShareMode = 0
004014A6   .      push 0x80000000                          ; |Access = GENERIC_READ
004014AB   .   F1354000   push noodles-.004035F1                   ; |FileName = "spook.key"
004014B0   .  E8 6F010000   call <jmp.&KERNEL32.CreateFileA>         ; \CreateFileA
004014B5   .  83F8 FF       cmp eax,-0x1
004014B8   .  0F84  je noodles-.
004014BE   .  A3 E9354000   mov dword ptr ds:[0x4035E9],eax
004014C3   .  FF35 E9354000 push dword ptr ds:[0x4035E9]             ; /hFile = NULL
004014C9   .  E8    call <jmp.&KERNEL32.GetFileType>         ; \GetFileType
004014CE   .   FB354000   push noodles-.004035FB                   ; /pFileSizeHigh = noodles-.004035FB
004014D3   .  FF35 E9354000 push dword ptr ds:[0x4035E9]             ; |hFile = NULL
004014D9   .  E8 1C010000   call <jmp.&KERNEL32.GetFileSize>         ; \GetFileSize
004014DE   .  A3 ED354000   mov dword ptr ds:[0x4035ED],eax
004014E3   .  83F8        cmp eax,0x8                              ;  大小是否等于8？
004014E6   .   6F         jnz Xnoodles-.
004014E8   .  6A          push 0x0                                 ; /pOverlapped = NULL
004014EA   .   FB354000   push noodles-.004035FB                   ; |pBytesRead = noodles-.004035FB
004014EF   .              push eax                                 ; |BytesToRead
004014F0   .   FF354000   push noodles-.004035FF                   ; |Buffer = noodles-.004035FF
004014F5   .  FF35 E9354000 push dword ptr ds:[0x4035E9]             ; |hFile = NULL
004014FB   .  E8 BE000000   call <jmp.&KERNEL32.ReadFile>            ; \ReadFile
   .  85C0          test eax,eax
   .            je Xnoodles-.
   .  33C0          xor eax,eax
   .  FF35 E9354000 push dword ptr ds:[0x4035E9]             ; /hObject = NULL
0040150C   .  E8 A7000000   call <jmp.&KERNEL32.CloseHandle>         ; \CloseHandle
   .  B8 FF354000   mov eax,noodles-.004035FF
   .  C100        rol dword ptr ds:[eax],0x5
   .   0F       add dword ptr ds:[eax],0xF
0040151C   .  C148      ror dword ptr ds:[eax+0x4],0x7
   .        sub dword ptr ds:[eax+0x4],0x5
   .    BDD84>cmp dword ptr ds:[eax+0x4],0xC642D8BD
0040152B   .   2A         jnz Xnoodles-.
0040152D   .   FC098E2E cmp dword ptr ds:[eax],0x2E8E09FC
   .            jnz Xnoodles-.
   .      push 0x1388
0040153A   .      push noodles-.                   ; /Text = "Your keyfile is fine happy happy joy joy"
0040153F   .   8B130000   push 0x138B                              ; |ControlID = 138B (5003.)
   .  FF75        push dword ptr ss:[ebp+0x8]              ; |hWnd
   .  E8    call <jmp.&USER32.SetDlgItemTextA>       ; \SetDlgItemTextA
0040154C   .  8B25 BD334000 mov esp,dword ptr ds:[0x4033BD]
   .^ E9 CBFDFFFF   jmp noodles-.
   >  6A          push 0x0                                 ; /Style = MB_OK|MB_APPLMODAL
   .      push noodles-.                   ; |Title = "Error!"
0040155E   .   6A364000   push noodles-.0040366A                   ; |Text = "Ketfile not present

or incorrect"
00401563   .  6A 00         push 0x0                                 ; |hOwner = NULL
00401565   .  E8 4A010000   call <jmp.&USER32.MessageBoxA>           ; \MessageBoxA
0040156A   .  6A 01         push 0x1                                 ; /ExitCode = 1
0040156C   .  E8 5F000000   call <jmp.&KERNEL32.ExitProcess>         ; \ExitProcess

可以看出这是一个很简单的数据运算过程，只要反推四步即可得到keyfile的内容。

以下上生成keyfile的c++代码：

#include <iostream>
#include <fstream>

using namespace std;

int main( void )
{
    unsigned int v1 = 0x2E8E09FC,v2 = 0xC642D8BD;

    __asm{
        push eax
        push ebx

        mov eax,v1
        mov ebx,v2

        sub eax,0xF
        ror eax,0x5

        add ebx,0x5
        rol ebx,0x7

        mov v1,eax
        mov v2,ebx

        pop ebx
        pop eax
    }

    ofstream out( "spook.key",ios::out | ios::binary | ios::trunc );
    if ( out.is_open() ){
        out.write( (const char *)&v1, );
        out.write( (const char *)&v2, );
    }
    else
        cout << "Open file failed." << endl;

    out.close();

    return ;
}

给出可用的KeyFIle内容：

4F 70 74 69 63 61 6C 21