[转载]变形的 MD5
<P>文章作者:<FONT face=宋体>rdsnow[BCG][PYG][D.4s]</FONT></P><P><FONT face=宋体>【破文作者】rdsnow[BCG][PYG][D.4s]<BR>【作者主页】</FONT><A href="http://rdsnow.ys168.com/" target=_blank><FONT face=宋体 color=#000000>[url]http://rdsnow.ys168.com[/url]</FONT></A><BR><FONT face=宋体>【E-mail】</FONT><A href="mailto:rdsnow@163.com"><FONT face=宋体 color=#000000>rdsnow@163.com</FONT></A><BR><FONT face=宋体>【作者QQ】83757177<BR>【文章题目】变形的MD5<BR>【软件名称】AutoRunProEnterprise<BR>【软件版本】V4.0.0.32<BR>【下载地址】</FONT><A href="http://www.longtion.com/" target=_blank><FONT face=宋体 color=#000000>[url]http://www.longtion.com[/url]</FONT></A><BR><BR><FONT face=宋体>----------------------------------------------------------------------------------------<BR>【加密方式】序列号<BR>【破解工具】ODbyDYKv1.10[05.09]<BR>【软件限制】功能限制<BR>【破解平台】MicrosoftWindowsXPProfessional<BR>【平台版本】5.1.2600ServicePack2内部版本号2600<BR><BR>----------------------------------------------------------------------------------------<BR>【软件简介】<BR><BR>AutoRunProEnterprisecancreate,editprofessionalautoruninterfaceandgenerateautorunfilesforCD/DVDsinaWYSIWYGenvironment.<BR>Displayaprofessionalandbeautifulinterfaceforuserstoopenorexecutefiles,printdocuments,sende-mail,visitWebsites,browseCDs,<BR><BR>playsound,musicandsoon,whenyourCDisinserted.It'sfastandeasytouse.AnyonecanquicklycreateautorunCD-ROMswithinminutes.<BR><BR>【文章简介】<BR><BR>我编程只有5、6年前学习的一点turboc的基础，为了学习编程，一般的程序都是尽可能的学出keygen，这下遇到了个采用变形MD5算法的软件，也来试了下。<BR><BR>给变形的MD5的程序要写出keygen，必须找到变形的地方，然后在标准MD5源码中作出相应的修改。<BR><BR>----------------------------------------------------------------------------------------<BR>【破解过程】<BR><BR>程序注册窗口要输入三个编辑框：username，serial和key，从后面代码看出serial的前四位必须是"0018"<BR><BR>所以输入：<BR>username＝rdsnow[BCG][PYG][D.4s]<BR>serial＝001812345678cdef<BR>key＝9898989832323232<BR><BR>因为有注册码错误的对话框，所以很容易找到关键的地方。<BR><BR>00562BD2.8B8314030000MOVEAX,DWORDPTR[EBX+314]<BR>00562BD8.E83F78F1FFCALLAutoRunP.0047A41C;取得username<BR>00562BDD.8B45E4MOVEAX,DWORDPTR[EBP-1C]<BR>00562BE0.8D55FCLEAEDX,DWORDPTR[EBP-4]<BR>00562BE3.E88460EAFFCALLAutoRunP.00408C6C<BR>00562BE8.8D55E0LEAEDX,DWORDPTR[EBP-20]<BR>00562BEB.8B83F8020000MOVEAX,DWORDPTR[EBX+2F8]<BR>00562BF1.E82678F1FFCALLAutoRunP.0047A41C;取得serial<BR>00562BF6.8B45E0MOVEAX,DWORDPTR[EBP-20]<BR>00562BF9.8D55F8LEAEDX,DWORDPTR[EBP-8]<BR>00562BFC.E86B60EAFFCALLAutoRunP.00408C6C<BR>00562C01.8D55DCLEAEDX,DWORDPTR[EBP-24]<BR>00562C04.8B83FC020000MOVEAX,DWORDPTR[EBX+2FC]<BR>00562C0A.E80D78F1FFCALLAutoRunP.0047A41C;取得key<BR>00562C0F.8B45DCMOVEAX,DWORDPTR[EBP-24]<BR>00562C12.8D55F4LEAEDX,DWORDPTR[EBP-C]<BR>00562C15.E85260EAFFCALLAutoRunP.00408C6C<BR>00562C1A.8B45F4MOVEAX,DWORDPTR[EBP-C]<BR>00562C1D.50PUSHEAX;压入key<BR>00562C1E.A1709E5600MOVEAX,DWORDPTR[569E70]<BR>00562C23.8B00MOVEAX,DWORDPTR[EAX]<BR>00562C25.8B4DF8MOVECX,DWORDPTR[EBP-8];serial<BR>00562C28.8B55FCMOVEDX,DWORDPTR[EBP-4];username<BR>00562C2B.E85466FFFFCALLAutoRunP.00559284;关键CALL<BR>00562C30.84C0TESTAL,AL<BR>00562C32.751DJNZSHORTAutoRunP.00562C51;关键跳转<BR>00562C34.6A10PUSH10<BR>00562C36.B9602D5600MOVECX,AutoRunP.00562D60;ASCII"Register"<BR>00562C3B.BA6C2D5600MOVEDX,AutoRunP.00562D6C;ASCII"Incompleteorincorrectinformation."<BR>00562C40.A15CA15600MOVEAX,DWORDPTR[56A15C]<BR>00562C45.8B00MOVEAX,DWORDPTR[EAX]<BR>00562C47.E8788DF3FFCALLAutoRunP.0049B9C4;错误的对话框<BR>00562C4C.E9C8000000JMPAutoRunP.00562D19<BR>00562C51>33C0XOREAX,EAX<BR><BR>如果是爆破，不建议在00562C32关键跳转处改跳转，应该跟进关键CALL,修改注册标志<BR><BR>----------------------------------------------------------------------------------------<BR>下面就跟进吧：<BR><BR>005592F5.8B45E4MOVEAX,DWORDPTR[EBP-1C]<BR>005592F8.E8F7B3EAFFCALLAutoRunP.004046F4;取Serial的长度<BR>005592FD.8BD8MOVEBX,EAX<BR>005592FF.83FB01CMPEBX,1<BR>00559302.7C1EJLSHORTAutoRunP.00559322;Serial为空就跳走<BR>00559304>8B45E4MOVEAX,DWORDPTR[EBP-1C]<BR>00559307.807C18FF20CMPBYTEPTR[EAX+EBX-1],20<BR>0055930C.750FJNZSHORTAutoRunP.0055931D<BR>0055930E.8D45E4LEAEAX,DWORDPTR[EBP-1C]<BR>00559311.B901000000MOVECX,1<BR>00559316.8BD3MOVEDX,EBX<BR>00559318.E877B6EAFFCALLAutoRunP.00404994;去掉Serial中的空格<BR>0055931D>4BDECEBX<BR>0055931E.85DBTESTEBX,EBX<BR>00559320.^75E2JNZSHORTAutoRunP.00559304<BR>00559322>8B45E0MOVEAX,DWORDPTR[EBP-20]<BR>00559325.E8CAB3EAFFCALLAutoRunP.004046F4;取key的长度<BR>0055932A.8BD8MOVEBX,EAX<BR>0055932C.83FB01CMPEBX,1<BR>0055932F.7C1EJLSHORTAutoRunP.0055934F;key为空就跳走<BR>00559331>8B45E0MOVEAX,DWORDPTR[EBP-20]<BR>00559334.807C18FF20CMPBYTEPTR[EAX+EBX-1],20<BR>00559339.750FJNZSHORTAutoRunP.0055934A<BR>0055933B.8D45E0LEAEAX,DWORDPTR[EBP-20]<BR>0055933E.B901000000MOVECX,1<BR>00559343.8BD3MOVEDX,EBX<BR>00559345.E84AB6EAFFCALLAutoRunP.00404994;去掉key中的空格<BR>0055934A>4BDECEBX<BR>0055934B.85DBTESTEBX,EBX<BR>0055934D.^75E2JNZSHORTAutoRunP.00559331<BR>0055934F>8B45E4MOVEAX,DWORDPTR[EBP-1C]<BR>00559352.E89DB3EAFFCALLAutoRunP.004046F4;取Serial的长度<BR>00559357.83F810CMPEAX,10<BR>0055935A.0F8598010000JNZAutoRunP.005594F8;Serial的长度不等于16就跳走<BR>00559360.8B45E0MOVEAX,DWORDPTR[EBP-20]<BR>00559363.E88CB3EAFFCALLAutoRunP.004046F4;取key的长度<BR>00559368.83F810CMPEAX,10<BR>0055936B.0F8587010000JNZAutoRunP.005594F8;key的长度不等于16就跳走<BR>00559371.33C0XOREAX,EAX<BR>00559373.55PUSHEBP<BR>00559374.684B945500PUSHAutoRunP.0055944B<BR>00559379.64:FF30PUSHDWORDPTRFS:[EAX]<BR>0055937C.64:8920MOVDWORDPTRFS:[EAX],ESP<BR>0055937F.8D45D4LEAEAX,DWORDPTR[EBP-2C]<BR>00559382.50PUSHEAX<BR>00559383.B908000000MOVECX,8<BR>00559388.BA01000000MOVEDX,1<BR>0055938D.8B45E4MOVEAX,DWORDPTR[EBP-1C]<BR>00559390.E8BFB5EAFFCALLAutoRunP.00404954;取Serial的前8个字符<BR>00559395.8B4DD4MOVECX,DWORDPTR[EBP-2C]<BR>00559398.8D45D8LEAEAX,DWORDPTR[EBP-28]<BR>0055939B.BA3C955500MOVEDX,AutoRunP.0055953C<BR>005593A0.E89BB3EAFFCALLAutoRunP.00404740;准备转换<BR>005593A5.8B45D8MOVEAX,DWORDPTR[EBP-28]<BR>005593A8.E863FCEAFFCALLAutoRunP.00409010;将8个字符组成的Hex文本转为数值a<BR>005593AD.8945F8MOVDWORDPTR[EBP-8],EAX;保存a进inbuff<BR>005593B0.8D45CCLEAEAX,DWORDPTR[EBP-34]<BR>005593B3.50PUSHEAX<BR>005593B4.B908000000MOVECX,8<BR>005593B9.BA09000000MOVEDX,9<BR>005593BE.8B45E4MOVEAX,DWORDPTR[EBP-1C]<BR>005593C1.E88EB5EAFFCALLAutoRunP.00404954;取Serial的后8个字符<BR>005593C6.8B4DCCMOVECX,DWORDPTR[EBP-34]<BR>005593C9.8D45D0LEAEAX,DWORDPTR[EBP-30]<BR>005593CC.BA3C955500MOVEDX,AutoRunP.0055953C<BR>005593D1.E86AB3EAFFCALLAutoRunP.00404740;准备转换<BR>005593D6.8B45D0MOVEAX,DWORDPTR[EBP-30]<BR>005593D9.E832FCEAFFCALLAutoRunP.00409010;将8个字符组成的Hex文本转为数值b<BR>005593DE.8945F4MOVDWORDPTR[EBP-C],EAX;保存b进入inbuff<BR>005593E1.8D45C4LEAEAX,DWORDPTR[EBP-3C]<BR>005593E4.50PUSHEAX<BR>005593E5.B908000000MOVECX,8<BR>005593EA.BA01000000MOVEDX,1<BR>005593EF.8B45E0MOVEAX,DWORDPTR[EBP-20]<BR>005593F2.E85DB5EAFFCALLAutoRunP.00404954;取key的前8个字符<BR>005593F7.8B4DC4MOVECX,DWORDPTR[EBP-3C]<BR>005593FA.8D45C8LEAEAX,DWORDPTR[EBP-38]<BR>005593FD.BA3C955500MOVEDX,AutoRunP.0055953C<BR>00559402.E839B3EAFFCALLAutoRunP.00404740;准备转换<BR>00559407.8B45C8MOVEAX,DWORDPTR[EBP-38]<BR>0055940A.E801FCEAFFCALLAutoRunP.00409010;将8个字符组成的Hex文本转为数值c<BR>0055940F.8BD8MOVEBX,EAX;c保存到EBX<BR>00559411.8D45BCLEAEAX,DWORDPTR[EBP-44]<BR>00559414.50PUSHEAX<BR>00559415.B908000000MOVECX,8<BR>0055941A.BA09000000MOVEDX,9<BR>0055941F.8B45E0MOVEAX,DWORDPTR[EBP-20]<BR>00559422.E82DB5EAFFCALLAutoRunP.00404954;取key的后8个字符<BR>00559427.8B4DBCMOVECX,DWORDPTR[EBP-44]<BR>0055942A.8D45C0LEAEAX,DWORDPTR[EBP-40]<BR>0055942D.BA3C955500MOVEDX,AutoRunP.0055953C<BR>00559432.E809B3EAFFCALLAutoRunP.00404740;准备转换<BR>00559437.8B45C0MOVEAX,DWORDPTR[EBP-40]<BR>0055943A.E8D1FBEAFFCALLAutoRunP.00409010;将8个字符组成的Hex文本转为数值d<BR>0055943F.8BF0MOVESI,EAX;d保存到ESI<BR>00559441.33C0XOREAX,EAX<BR>00559443.5APOPEDX<BR>00559444.59POPECX<BR>00559445.59POPECX<BR>00559446.64:8910MOVDWORDPTRFS:[EAX],EDX<BR>00559449.EB14JMPSHORTAutoRunP.0055945F<BR>0055944B.^E990A6EAFFJMPAutoRunP.00403AE0<BR>00559450.E8F3A9EAFFCALLAutoRunP.00403E48<BR>00559455.E99E000000JMPAutoRunP.005594F8<BR>0055945A.E8E9A9EAFFCALLAutoRunP.00403E48<BR>0055945F>8B45F4MOVEAX,DWORDPTR[EBP-C];取出b<BR>00559462.83E00FANDEAX,0F;取b的低4位<BR>00559465.8945DCMOVDWORDPTR[EBP-24],EAX;保存,他会作为其中一个注册标志，不要等于0<BR>00559468.8B45F8MOVEAX,DWORDPTR[EBP-8];取出a<BR>0055946B.C1E810SHREAX,10;取a的高16位<BR>0055946E.66:83F818CMPAX,18<BR>00559472.0F8580000000JNZAutoRunP.005594F8;a的高16位不等于0x18就跳<BR>00559478.8B45F8MOVEAX,DWORDPTR[EBP-8];取a<BR>0055947B.8945F0MOVDWORDPTR[EBP-10],EAX;保存a进inbuff<BR>0055947E.8B45F4MOVEAX,DWORDPTR[EBP-C];取b<BR>00559481.8945ECMOVDWORDPTR[EBP-14],EAX;保存b进inbuff<BR>00559484.8B45F8MOVEAX,DWORDPTR[EBP-8];取a<BR>00559487.25FFFF0000ANDEAX,0FFFF;取a的低16位<BR>0055948C.8BF8MOVEDI,EAX<BR>0055948E.C1E710SHLEDI,10;放在32位数据的高16位<BR>00559491.8B45F4MOVEAX,DWORDPTR[EBP-C];取b的高16位<BR>00559494.C1E810SHREAX,10;放在32位数据的低16位<BR>00559497.03F8ADDEDI,EAX;a的高16位和b的低16位拼成一个32位数值<BR>00559499.8D45ECLEAEAX,DWORDPTR[EBP-14]<BR>0055949C.50PUSHEAX;此时inbuff在内存中显示成baba<BR>0055949D.8D4DF0LEAECX,DWORDPTR[EBP-10]<BR>005594A0.8D55F4LEAEDX,DWORDPTR[EBP-C]<BR>005594A3.8D45F8LEAEAX,DWORDPTR[EBP-8]<BR>005594A6.E8295DFCFFCALLAutoRunP.0051F1D4;baba组成的128位进行MD5编码<BR>005594AB.3B5DF8CMPEBX,DWORDPTR[EBP-8];c跟MD5结果的前32位比较<BR>005594AE.7511JNZSHORTAutoRunP.005594C1<BR>005594B0.3B75F4CMPESI,DWORDPTR[EBP-C];d跟MD5结果的32-64位比较<BR>005594B3.750CJNZSHORTAutoRunP.005594C1;即key跟MD5结果的前64位比较<BR>005594B5.8B45E8MOVEAX,DWORDPTR[EBP-18];取name<BR>005594B8.E8FF5BFCFFCALLAutoRunP.0051F0BC;计算serial<BR>005594BD.3BF8CMPEDI,EAX<BR>005594BF.7404JESHORTAutoRunP.005594C5<BR>005594C1>33C0XOREAX,EAX;＝0<BR>005594C3.EB02JMPSHORTAutoRunP.005594C7<BR>005594C5>B001MOVAL,1;＝1<BR>005594C7>8845FFMOVBYTEPTR[EBP-1],AL;保存注册标志<BR>005594CA.807DFF00CMPBYTEPTR[EBP-1],0;判断注册标志是不是0<BR>005594CE.7428JESHORTAutoRunP.005594F8<BR>005594D0.837DDC00CMPDWORDPTR[EBP-24],0;判断另外一个注册标志是不是0<BR>005594D4.750AJNZSHORTAutoRunP.005594E0<BR><BR>程序是这样判断的：serial和key都是16个字符组成。<BR><BR>1、看serial的前4位是不是"0018"，serial的最后一位不能是'0'<BR><BR>2、将serial填充到inbuff中，注意，因为程序是用dword传送的，所以内存中低位在前，高位在后，我的serial在buff中显示成：<BR>0012F104EFCD785634121800EFCD785634121800锿xV4.锿xV4.<BR><BR>3、inbuff中数据进行变形MD5编码，得到<BR>0012F104E5F90F72A3469E09B25AABE343EE3D3F妁r?瞆C??<BR><BR>4、这个结果从后面开始的3F3DEE43AB5AB209组成的字符串"3F3DEE43AB5AB209"是个符合要求的key是个符合要求的serial，但是这个时候serial还没有<BR><BR>得到验证，所以用serial生成的key只能躲过第一次跳转。<BR><BR>5、程序把serial的验证放在最后。<BR><BR>----------------------------------------------------------------------------------------<BR><BR>大致跟了下serial的生成，前四位必须是"0018"，中间8个字符由username生成，最后四位任意。<BR><BR>跟进，在005594B8CALLAutoRunP.0051F0BC来到：<BR><BR>0051F0E6|.8B45ECMOVEAX,DWORDPTR[EBP-14]<BR>0051F0E9|.E80656EEFFCALLAutoRunP.004046F4;取name的长度Length<BR>0051F0EE|.2507000080ANDEAX,80000007;长度%8,准备下面消息分组<BR>0051F0F3|.7905JNSSHORTAutoRunP.0051F0FA<BR>0051F0F5|.48DECEAX<BR>0051F0F6|.83C8F8OREAX,FFFFFFF8<BR>0051F0F9|.40INCEAX<BR>0051F0FA|>BA08000000MOVEDX,8<BR>0051F0FF|.2BD0SUBEDX,EAX;8-余数＝在用户名的后面添加0的个数<BR>0051F101|.8BC2MOVEAX,EDX<BR>0051F103|.8BD8MOVEBX,EAX<BR>0051F105|.85DBTESTEBX,EBX<BR>0051F107|.7E10JLESHORTAutoRunP.0051F119<BR>0051F109|>8D45EC/LEAEAX,DWORDPTR[EBP-14]<BR>0051F10C|.BAB0F15100|MOVEDX,AutoRunP.0051F1B0<BR>0051F111|.E8E655EEFF|CALLAutoRunP.004046FC;在用户名信息后面添加0<BR>0051F116|.4B|DECEBX<BR>0051F117|.^75F0\JNZSHORTAutoRunP.0051F109<BR><BR>这个地方要小心的是即使用户名本身的长度是8的倍数，也会在后面加上8个0，不是8的倍数，正好通过补0，补0后的用户名的长度应该是8的倍数。<BR><BR>0051F119|>8B45ECMOVEAX,DWORDPTR[EBP-14]<BR>0051F11C|.E8D355EEFFCALLAutoRunP.004046F4<BR>0051F121|.33D2XOREDX,EDX<BR>0051F123|.8955FCMOVDWORDPTR[EBP-4],EDX<BR>0051F126|.33D2XOREDX,EDX<BR>0051F128|.8955F8MOVDWORDPTR[EBP-8],EDX<BR>0051F12B|.8BD8MOVEBX,EAX<BR>0051F12D|.85DBTESTEBX,EBX<BR>0051F12F|.7903JNSSHORTAutoRunP.0051F134<BR>0051F131|.83C307ADDEBX,7<BR>0051F134|>C1FB03SAREBX,3<BR>0051F137|.4BDECEBX<BR>0051F138|.85DBTESTEBX,EBX<BR>0051F13A|.7C3EJLSHORTAutoRunP.0051F17A<BR>0051F13C|.43INCEBX<BR>0051F13D|.33F6XORESI,ESI<BR>0051F13F|>8D45E8/LEAEAX,DWORDPTR[EBP-18]<BR>0051F142|.50|PUSHEAX<BR>0051F143|.8BD6|MOVEDX,ESI<BR>0051F145|.C1E203|SHLEDX,3<BR>0051F148|.42|INCEDX<BR>0051F149|.B908000000|MOVECX,8<BR>0051F14E|.8B45EC|MOVEAX,DWORDPTR[EBP-14]<BR>0051F151|.E8FE57EEFF|CALLAutoRunP.00404954;取出分组后的各组消息，每组8个字符<BR>0051F156|.8B45E8|MOVEAX,DWORDPTR[EBP-18]<BR>0051F159|.8D4DF0|LEAECX,DWORDPTR[EBP-10]<BR>0051F15C|.8D55F4|LEAEDX,DWORDPTR[EBP-C]<BR>0051F15F|.E8D0FEFFFF|CALLAutoRunP.0051F034;将得到的8个字符顺序颠倒,并填入inbuff息的高64位<BR>0051F164|.8D45F0|LEAEAX,DWORDPTR[EBP-10]<BR>0051F167|.50|PUSHEAX<BR>0051F168|.8D4DF4|LEAECX,DWORDPTR[EBP-C]<BR>0051F16B|.8D55F8|LEAEDX,DWORDPTR[EBP-8]<BR>0051F16E|.8D45FC|LEAEAX,DWORDPTR[EBP-4]<BR>0051F171|.E85E000000|CALLAutoRunP.0051F1D4;MD5(inbuff)<BR>0051F176|.46|INCESI<BR>0051F177|.4B|DECEBX<BR>0051F178|.^75C5\JNZSHORTAutoRunP.0051F13F<BR>0051F17A|>8B5DFCMOVEBX,DWORDPTR[EBP-4]<BR>0051F17D|.33C0XOREAX,EAX<BR><BR>这里就是将用户名添0后成8字节的倍数，然后分成n组，分别用每一组消息修改inbuff的前8个字节，然后进行MD5编码，循环n次。<BR><BR>----------------------------------------------------------------------------------------<BR><BR>要写出keygen，必须跟进CALLAutoRunP.0051F034，跟进MD5函数<BR><BR>0051F1FF|.64:8920MOVDWORDPTRFS:[EAX],ESP<BR>0051F202|.C745E46745>MOVDWORDPTR[EBP-1C],1234567;传递四个链接变量(已经变形)<BR>0051F209|.C745E8EFCD>MOVDWORDPTR[EBP-18],89ABCDE><BR>0051F210|.C745ECDCFE>MOVDWORDPTR[EBP-14],BA98FED><BR>0051F217|.C745F02143>MOVDWORDPTR[EBP-10],7650432><BR><BR>★★★★★变形1★★★★★<BR><BR>这里已经不是：<BR>A＝0x67452301<BR>B＝0xefcdab89<BR>C＝0x98badcfe<BR>D＝0x10325476<BR>找到一个变形<BR><BR>0051F21E|.8B45F0MOVEAX,DWORDPTR[EBP-10]<BR>0051F221|.8903MOVDWORDPTR[EBX],EAX;复制四个链接变量的副本<BR>0051F223|.8B45ECMOVEAX,DWORDPTR[EBP-14]<BR>0051F226|.8906MOVDWORDPTR[ESI],EAX;复制四个链接变量的副本<BR>0051F228|.8B45E8MOVEAX,DWORDPTR[EBP-18]<BR>0051F22B|.8907MOVDWORDPTR[EDI],EAX;复制四个链接变量的副本<BR>0051F22D|.8B45E4MOVEAX,DWORDPTR[EBP-1C]<BR>0051F230|.8945D4MOVDWORDPTR[EBP-2C],EAX;复制四个链接变量的副本<BR>0051F233|.6A10PUSH10<BR>0051F235|.8D45D0LEAEAX,DWORDPTR[EBP-30]<BR>0051F238|.B901000000MOVECX,1<BR>0051F23D|.8B15B4F15100MOVEDX,DWORDPTR[51F1B4];AutoRunP.0051F1B8<BR>0051F243|.E87465EEFFCALLAutoRunP.004057BC<BR>0051F248|.83C404ADDESP,4;下面将128位信息填充成512位<BR>0051F24B|.8B45FCMOVEAX,DWORDPTR[EBP-4]<BR>0051F24E|.8B00MOVEAX,DWORDPTR[EAX]<BR>0051F250|.8B55D0MOVEDX,DWORDPTR[EBP-30]<BR>0051F253|.8902MOVDWORDPTR[EDX],EAX;填充<BR>……………………（总共有16个填充）<BR>0051F2EF|.8B45FCMOVEAX,DWORDPTR[EBP-4]<BR>0051F2F2|.8B00MOVEAX,DWORDPTR[EAX]<BR>0051F2F4|.8B55D0MOVEDX,DWORDPTR[EBP-30]<BR>0051F2F7|.89423CMOVDWORDPTR[EDX+3C],EAX;填充<BR>0051F2FA|.8B45D4MOVEAX,DWORDPTR[EBP-2C]<BR><BR><BR>★★★★★变形2★★★★★<BR><BR>和标准的MD5的填充不一样，并不是加个1在消息后然后填充0，最后附上消息长度<BR><BR>而是将消息分为四个dword，逆序、顺序、逆序、顺序填充成512位<BR><BR>比如消息是：<BR>0012F104313233343536373839304142434445461234567890ABCDEF<BR><BR>填充后是：<BR>0106CF7443444546393041423536373831323334CDEF90AB56781234<BR>0106CF84313233343536373839304142434445461234567890ABCDEF<BR>0106CF9443444546393041423536373831323334CDEF90AB56781234<BR>0106CFA4313233343536373839304142434445461234567890ABCDEF<BR><BR>//-------------round1-------------//<BR>0051F2FD|.50PUSHEAX;/Arg4<BR>0051F2FE|.8B45D0MOVEAX,DWORDPTR[EBP-30];|<BR>0051F301|.8B00MOVEAX,DWORDPTR[EAX];|<BR>0051F303|.50PUSHEAX;|Arg3<BR>0051F304|.6A07PUSH7;|Arg2=00000007<BR>0051F306|.6878A46AD7PUSHD76AA478;|Arg1=D76AA478<BR>0051F30B|.8BC3MOVEAX,EBX;|<BR>0051F30D|.8B0FMOVECX,DWORDPTR[EDI];|<BR>0051F30F|.8B16MOVEDX,DWORDPTR[ESI];|<BR>0051F311|.E8CE070000CALLAutoRunP.0051FAE4;\AutoRunP.0051FAE4<BR>0051F316|.8B07MOVEAX,DWORDPTR[EDI]<BR>……………………<BR>0051F4C2|.8B17MOVEDX,DWORDPTR[EDI];|<BR>0051F4C4|.E81B060000CALLAutoRunP.0051FAE4;\AutoRunP.0051FAE4<BR>0051F4C9|.8B45D4MOVEAX,DWORDPTR[EBP-2C]<BR><BR>//-------------round2-------------//<BR>0051F4CC|.50PUSHEAX;/Arg4<BR>0051F4CD|.8B45D0MOVEAX,DWORDPTR[EBP-30];|<BR>0051F4D0|.8B4004MOVEAX,DWORDPTR[EAX+4];|<BR>0051F4D3|.50PUSHEAX;|Arg3<BR>0051F4D4|.6A05PUSH5;|Arg2=00000005<BR>0051F4D6|.6862251EF6PUSHF61E2562;|Arg1=F61E2562<BR>0051F4DB|.8BC3MOVEAX,EBX;|<BR>0051F4DD|.8B0FMOVECX,DWORDPTR[EDI];|<BR>0051F4DF|.8B16MOVEDX,DWORDPTR[ESI];|<BR>0051F4E1|.E83A060000CALLAutoRunP.0051FB20;\AutoRunP.0051FB20<BR>0051F4E6|.8B07MOVEAX,DWORDPTR[EDI]<BR>……………………<BR>0051F691|.8B17MOVEDX,DWORDPTR[EDI];|<BR>0051F693|.E888040000CALLAutoRunP.0051FB20;\AutoRunP.0051FB20<BR>0051F698|.8B45D4MOVEAX,DWORDPTR[EBP-2C]<BR><BR>//-------------round3-------------//<BR>0051F69B|.50PUSHEAX;/Arg4<BR>0051F69C|.8B45D0MOVEAX,DWORDPTR[EBP-30];|<BR>0051F69F|.8B4014MOVEAX,DWORDPTR[EAX+14];|<BR>0051F6A2|.50PUSHEAX;|Arg3<BR>0051F6A3|.6A04PUSH4;|Arg2=00000004<BR>0051F6A5|.684239FAFFPUSHFFFA3942;|Arg1=FFFA3942<BR>0051F6AA|.8BC3MOVEAX,EBX;|<BR>0051F6AC|.8B0FMOVECX,DWORDPTR[EDI];|<BR>0051F6AE|.8B16MOVEDX,DWORDPTR[ESI];|<BR>0051F6B0|.E8A7040000CALLAutoRunP.0051FB5C;\AutoRunP.0051FB5C<BR>0051F6B5|.8B07MOVEAX,DWORDPTR[EDI]<BR>……………………<BR>0051F860|.8B17MOVEDX,DWORDPTR[EDI];|<BR>0051F862|.E8F5020000CALLAutoRunP.0051FB5C;\AutoRunP.0051FB5C<BR>0051F867|.8B45D4MOVEAX,DWORDPTR[EBP-2C]<BR><BR>//-------------round4-------------//<BR>0051F86A|.50PUSHEAX;/Arg4<BR>0051F86B|.8B45D0MOVEAX,DWORDPTR[EBP-30];|<BR>0051F86E|.8B00MOVEAX,DWORDPTR[EAX];|<BR>0051F870|.50PUSHEAX;|Arg3<BR>0051F871|.6A06PUSH6;|Arg2=00000006<BR>0051F873|.68442229F4PUSHF4292244;|Arg1=F4292244<BR>0051F878|.8BC3MOVEAX,EBX;|<BR>0051F87A|.8B0FMOVECX,DWORDPTR[EDI];|<BR>0051F87C|.8B16MOVEDX,DWORDPTR[ESI];|<BR>0051F87E|.E815030000CALLAutoRunP.0051FB98;\AutoRunP.0051FB98<BR>0051F883|.8B07MOVEAX,DWORDPTR[EDI]<BR>……………………<BR>0051FA2F|.8B17MOVEDX,DWORDPTR[EDI];|<BR>0051FA31|.E862010000CALLAutoRunP.0051FB98;\AutoRunP.0051FB98<BR>0051FA36|.8B45F0MOVEAX,DWORDPTR[EBP-10]<BR><BR>0051FA39|.0303ADDEAX,DWORDPTR[EBX];+d<BR>0051FA3B|.8B55FCMOVEDX,DWORDPTR[EBP-4]<BR>0051FA3E|.8902MOVDWORDPTR[EDX],EAX;save<BR>0051FA40|.8B45ECMOVEAX,DWORDPTR[EBP-14]<BR>0051FA43|.0306ADDEAX,DWORDPTR[ESI];+c<BR>0051FA45|.8B55F8MOVEDX,DWORDPTR[EBP-8]<BR>0051FA48|.8902MOVDWORDPTR[EDX],EAX;save<BR>0051FA4A|.8B45E8MOVEAX,DWORDPTR[EBP-18]<BR>0051FA4D|.0307ADDEAX,DWORDPTR[EDI];+b<BR>0051FA4F|.8B55F4MOVEDX,DWORDPTR[EBP-C]<BR>0051FA52|.8902MOVDWORDPTR[EDX],EAX;save<BR>0051FA54|.8B45E4MOVEAX,DWORDPTR[EBP-1C]<BR>0051FA57|.0345D4ADDEAX,DWORDPTR[EBP-2C];+a<BR>0051FA5A|.8B5508MOVEDX,DWORDPTR[EBP+8]<BR>0051FA5D|.8902MOVDWORDPTR[EDX],EAX;save<BR><BR>★★★★★变形3★★★★★<BR><BR>跟进后发现HASH函数本身没有变形，但是参与运算的链接变量的顺序变化了。<BR><BR>----------------------------------------------------------------------------------------<BR><BR>【破解心得】<BR><BR>要得到正确的serial和key，按照下面的流程：<BR><BR>先对用户名添0后分成n组，再反序，分别用每一组消息修改inbuff的前8个字节，然后进行MD5编码，循环n次后，结果的最后32位作为dword转为十六进制<BR><BR>文本作为serial的中间8个字符。<BR><BR>然后前面接上"0018",后面接上长度是4的任意16进制文本，总共16个字符作为serial<BR><BR>将serial填入inbuff的高64位，同时也填入低64位，MD5(inbuff)得到key<BR><BR>这个MD5有三处变形，变形没有什么新意，还是老一套：<BR>(1)四个变量的变形<BR>(2)数据填充变形<BR>(3)参与HASH运算的变量的顺序变形，HASH本身没有变形。<BR><BR>----------------------------------------------------------------------------------------<BR><BR>【注册机源码】<BR><BR>因为程序只对128位消息进行MD5编码，为了便于编辑，没有采用类，大家直接看吧。<BR><BR>//响应Generate按钮<BR>voidCkeygenDlg::OnOK()<BR>{<BR>//TODO:Addextravalidationhere<BR>CkeygenDlg::OnChangeEdit1();<BR>}<BR><BR>voidCkeygenDlg::OnChangeEdit1()<BR>{<BR>//TODO:IfthisisaRICHEDITcontrol,thecontrolwillnot<BR>//sendthisnotificationunlessyouoverridetheCDialog::OnInitDialog()<BR>//functionandcallCRichEditCtrl().SetEventMask()<BR>//withtheENM_CHANGEflagORedintothemask.<BR><BR>//TODO:Addyourcontrolnotificationhandlercodehere<BR>UpdateData(true);<BR>Beep(1000,50);<BR>charinbuff[16]={0},name[12];<BR>unsignedlongstate[4];<BR>inti,n,namelen;<BR><BR>//对用户名处理<BR>namelen=m_Edit1.GetLength();<BR>n=namelen>>3;<BR>for(i=0;i<n;i++){<BR>strcpy(name,m_Edit1.Mid(i<<3,8))//取用户名的8个字符<BR>strrev(name);//将8个字符顺序反转<BR>memcpy(inbuff,name,8);//复制到待加密信息的高64位<BR>MD5(inbuff,state);//MD5编码<BR>memcpy(inbuff,state,16);//替换掉待加密信息<BR>}<BR>n=namelen&7;//判断用户名有没有处理完毕<BR>strcpy(name,m_Edit1.Mid(i<<3,n));;//取出剩余字符<BR>strrev(name);//剩余字符顺序反转<BR>i=8-n;//计算补0的个数<BR>memset(inbuff,0,i);//将0填入待加密信息<BR>memcpy(inbuff+i,name,n);//将反转字符填入待加密信息<BR>MD5(inbuff,state);//MD5编码<BR>m_Edit2.Format("%08X",state[3]);//将State[3]转为16进制字符串作为Serial的一部分<BR>m_Edit2.Insert(0,"0018");//serial前面插入"0018"<BR>n=rand();<BR>sprintf(inbuff,"%04X",n);<BR>m_Edit2+=inbuff;//serial的最后四位任意，并且传递给编辑框<BR><BR>memcpy(inbuff,&n,2);<BR>memcpy(inbuff+2,state+3,4);<BR>inbuff[6]=char(0x18);<BR>inbuff[7]=char(0);<BR>memcpy(inbuff+8,inbuff,8);//serial填充到inbuff<BR><BR>MD5(inbuff,state);//对serialMD5编码<BR>sprintf(inbuff,"%08X",state[2]);<BR>m_Edit3.Format("%08X",state[3]);//取state[2]和state[2]作为Code<BR>m_Edit3+=inbuff;//将code传递给编辑框<BR>UpdateData(false);<BR>}<BR><BR>//将128待加密信息填充成512位，即16个整数<BR>voidCkeygenDlg::FillBuff(unsignedlong*buff,char*inbuff)<BR>{<BR>int*from=(int*)inbuff;<BR>buff[3]=*from;buff[2]=*(from+1);buff[1]=*(from+2);buff[0]=*(from+3);<BR>buff[4]=*from;buff[5]=*(from+1);buff[6]=*(from+2);buff[7]=*(from+3);<BR>buff[11]=*from;buff[10]=*(from+1);buff[9]=*(from+2);buff[8]=*(from+3);<BR>buff[12]=*from;buff[13]=*(from+1);buff[14]=*(from+2);buff[15]=*(from+3);<BR>}<BR><BR>//四个函数定义1FF<BR>unsignedlongCkeygenDlg::FF(unsignedlonga,unsignedlongb,unsignedlongc,unsignedlongd,unsignedlongx,bytes,unsignedlongac)<BR>{<BR>a=((b&c)|((~b)&d))+a+x+ac;<BR>a=(a<<s)|(a>>(32-s));<BR>a+=b;<BR>returna;<BR>}<BR><BR>//四个函数定义2GG<BR>unsignedlongCkeygenDlg::GG(unsignedlonga,unsignedlongb,unsignedlongc,unsignedlongd,unsignedlongx,bytes,unsignedlongac)<BR>{<BR>a=((b&d)|(c&(~d)))+a+x+ac;<BR>a=(a<<s)|(a>>(32-s));<BR>a+=b;<BR>returna;<BR>}<BR><BR>//四个函数定义3HH<BR>unsignedlongCkeygenDlg::HH(unsignedlonga,unsignedlongb,unsignedlongc,unsignedlongd,unsignedlongx,bytes,unsignedlongac)<BR>{<BR>a=(b^c^d)+a+x+ac;<BR>a=(a<<s)|(a>>(32-s));<BR>a+=b;<BR>returna;<BR>}<BR><BR>//四个函数定义4II<BR>unsignedlongCkeygenDlg::II(unsignedlonga,unsignedlongb,unsignedlongc,unsignedlongd,unsignedlongx,bytes,unsignedlongac)<BR>{<BR>a=(c^(b|(~d)))+a+x+ac;<BR>a=(a<<s)|(a>>(32-s));<BR>a+=b;<BR>returna;<BR>}<BR><BR>//MD5运算主函数待加密信息保存在在inbuff中，结果保存在state[4]中<BR>voidCkeygenDlg::MD5(char*inbuff,unsignedlong*state)<BR>{<BR>unsignedlongcontext[16];<BR>state[0]=0x1234567;<BR>state[1]=0x89ABCDEF;<BR>state[2]=0xBA98FEDC;<BR>state[3]=0x76504321;<BR>FillBuff(context,inbuff);<BR>//-------------round1-------------//<BR>state[3]=FF(state[3],state[2],state[1],state[0],context[0],7,0xd76aa478);//-1<BR>state[0]=FF(state[0],state[3],state[2],state[1],context[1],12,0xe8c7b756);//-2<BR>state[1]=FF(state[1],state[0],state[3],state[2],context[2],17,0x242070db);//-3<BR>state[2]=FF(state[2],state[1],state[0],state[3],context[3],22,0xc1bdceee);//-4<BR>state[3]=FF(state[3],state[2],state[1],state[0],context[4],7,0xf57c0faf);//-5<BR>state[0]=FF(state[0],state[3],state[2],state[1],context[5],12,0x4787c62a);//-6<BR>state[1]=FF(state[1],state[0],state[3],state[2],context[6],17,0xa8304613);//-7<BR>state[2]=FF(state[2],state[1],state[0],state[3],context[7],22,0xfd469501);//-8<BR>state[3]=FF(state[3],state[2],state[1],state[0],context[8],7,0x698098d8);//-9<BR>state[0]=FF(state[0],state[3],state[2],state[1],context[9],12,0x8b44f7af);//-10<BR>state[1]=FF(state[1],state[0],state[3],state[2],context[10],17,0xffff5bb1);//-11<BR>state[2]=FF(state[2],state[1],state[0],state[3],context[11],22,0x895cd7be);//-12<BR>state[3]=FF(state[3],state[2],state[1],state[0],context[12],7,0x6b901122);//-13<BR>state[0]=FF(state[0],state[3],state[2],state[1],context[13],12,0xfd987193);//-14<BR>state[1]=FF(state[1],state[0],state[3],state[2],context[14],17,0xa679438e);//-15<BR>state[2]=FF(state[2],state[1],state[0],state[3],context[15],22,0x49b40821);//-16<BR><BR>//-------------round2-------------//<BR>state[3]=GG(state[3],state[2],state[1],state[0],context[1],5,0xf61e2562);//-17<BR>state[0]=GG(state[0],state[3],state[2],state[1],context[6],9,0xc040b340);//-18<BR>state[1]=GG(state[1],state[0],state[3],state[2],context[11],14,0x265e5a51);//-19<BR>state[2]=GG(state[2],state[1],state[0],state[3],context[0],20,0xe9b6c7aa);//-20<BR>state[3]=GG(state[3],state[2],state[1],state[0],context[5],5,0xd62f105d);//-21<BR>state[0]=GG(state[0],state[3],state[2],state[1],context[10],9,0x2441453);//-22<BR>state[1]=GG(state[1],state[0],state[3],state[2],context[15],14,0xd8a1e681);//-23<BR>state[2]=GG(state[2],state[1],state[0],state[3],context[4],20,0xe7d3fbc8);//-24<BR>state[3]=GG(state[3],state[2],state[1],state[0],context[9],5,0x21e1cde6);//-25<BR>state[0]=GG(state[0],state[3],state[2],state[1],context[14],9,0xc33707d6);//-26<BR>state[1]=GG(state[1],state[0],state[3],state[2],context[3],14,0xf4d50d87);//-27<BR>state[2]=GG(state[2],state[1],state[0],state[3],context[8],20,0x455a14ed);//-28<BR>state[3]=GG(state[3],state[2],state[1],state[0],context[13],5,0xa9e3e905);//-28<BR>state[0]=GG(state[0],state[3],state[2],state[1],context[2],9,0xfcefa3f8);//-30<BR>state[1]=GG(state[1],state[0],state[3],state[2],context[7],14,0x676f02d9);//-31<BR>state[2]=GG(state[2],state[1],state[0],state[3],context[12],20,0x8d2a4c8a);//-32<BR><BR>//-------------round3-------------//<BR>state[3]=HH(state[3],state[2],state[1],state[0],context[5],4,0xfffa3942);//-33<BR>state[0]=HH(state[0],state[3],state[2],state[1],context[8],11,0x8771f681);//-34<BR>state[1]=HH(state[1],state[0],state[3],state[2],context[11],16,0x6d9d6122);//-35<BR>state[2]=HH(state[2],state[1],state[0],state[3],context[14],23,0xfde5380c);//-36<BR>state[3]=HH(state[3],state[2],state[1],state[0],context[1],4,0xa4beea44);//-37<BR>state[0]=HH(state[0],state[3],state[2],state[1],context[4],11,0x4bdecfa9);//-38<BR>state[1]=HH(state[1],state[0],state[3],state[2],context[7],16,0xf6bb4b60);//-39<BR>state[2]=HH(state[2],state[1],state[0],state[3],context[10],23,0xbebfbc70);//-40<BR>state[3]=HH(state[3],state[2],state[1],state[0],context[13],4,0x289b7ec6);//-41<BR>state[0]=HH(state[0],state[3],state[2],state[1],context[0],11,0xeaa127fa);//-42<BR>state[1]=HH(state[1],state[0],state[3],state[2],context[3],16,0xd4ef3085);//-43<BR>state[2]=HH(state[2],state[1],state[0],state[3],context[6],23,0x4881d05);//-44<BR>state[3]=HH(state[3],state[2],state[1],state[0],context[9],4,0xd9d4d039);//-45<BR>state[0]=HH(state[0],state[3],state[2],state[1],context[12],11,0xe6db99e5);//-46<BR>state[1]=HH(state[1],state[0],state[3],state[2],context[15],16,0x1fa27cf8);//-47<BR>state[2]=HH(state[2],state[1],state[0],state[3],context[2],23,0xc4ac5665);//-48<BR><BR>//-------------round4-------------//<BR>state[3]=II(state[3],state[2],state[1],state[0],context[0],6,0xf4292244);//-49<BR>state[0]=II(state[0],state[3],state[2],state[1],context[7],10,0x432aff97);//-50<BR>state[1]=II(state[1],state[0],state[3],state[2],context[14],15,0xab9423a7);//-51<BR>state[2]=II(state[2],state[1],state[0],state[3],context[5],21,0xfc93a039);//-52<BR>state[3]=II(state[3],state[2],state[1],state[0],context[12],6,0x655b59c3);//-53<BR>state[0]=II(state[0],state[3],state[2],state[1],context[3],10,0x8f0ccc92);//-54<BR>state[1]=II(state[1],state[0],state[3],state[2],context[10],15,0xffeff47d);//-55<BR>state[2]=II(state[2],state[1],state[0],state[3],context[1],21,0x85845dd1);//-56<BR>state[3]=II(state[3],state[2],state[1],state[0],context[8],6,0x6fa87e4f);//-57<BR>state[0]=II(state[0],state[3],state[2],state[1],context[15],10,0xfe2ce6e0);//-58<BR>state[1]=II(state[1],state[0],state[3],state[2],context[6],15,0xa3014314);//-59<BR>state[2]=II(state[2],state[1],state[0],state[3],context[13],21,0x4e0811a1);//-60<BR>state[3]=II(state[3],state[2],state[1],state[0],context[4],6,0xf7537e82);//-61<BR>state[0]=II(state[0],state[3],state[2],state[1],context[11],10,0xbd3af235);//-62<BR>state[1]=II(state[1],state[0],state[3],state[2],context[2],15,0x2ad7d2bb);//-63<BR>state[2]=II(state[2],state[1],state[0],state[3],context[9],21,0xeb86d391);//-64<BR><BR>state[0]+=0x1234567;<BR>state[1]+=0x89ABCDEF;<BR>state[2]+=0xBA98FEDC;<BR>state[3]+=0x76504321;<BR>}<BR><BR>----------------------------------------------------------------------------------------<BR>【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享:)<BR><BR>【版权声明】本文纯属技术交流,转载请注明作者并保持文章的完整,谢谢!<BR>----------------------------------------------------------------------------------------<BR>文章写于2006-1-2118:10:17</FONT><BR></P>
页:
[1]