160 - 28 CoSH.2
2017-11-20 16:03
155 查看
环境
Windows xp sp3
工具
exeinfope
ollydbg
查壳
无壳的MFC程序
![](https://img-blog.csdn.net/20171120155139696?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvZ29vZG5hbWV1c2Vk/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast)
测试
![](https://img-blog.csdn.net/20171120155250053?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvZ29vZG5hbWV1c2Vk/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast)
![](https://img-blog.csdn.net/20171120155324911?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvZ29vZG5hbWV1c2Vk/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast)
输入
Nmae:123456
Serial:12345
点击“CHECK”后弹出错误提示的消息框,然后程序自己结束掉
依然是字符串搜索:
[00401513]处开始比较内容:
不相同则跳转到错误信息,于是就得到了一个字符串,但是并不知道这个比较的内容是对Name进行比较还是对Serial进行比较。
往上看一看有几个:
可以猜测输入的两个内容长度都要大于5
先猜猜比较的内容是Serial,于是有:
![](https://img-blog.csdn.net/20171120160225251?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvZ29vZG5hbWV1c2Vk/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast)
Windows xp sp3
工具
exeinfope
ollydbg
查壳
无壳的MFC程序
测试
输入
Nmae:123456
Serial:12345
点击“CHECK”后弹出错误提示的消息框,然后程序自己结束掉
依然是字符串搜索:
004014DB . 8B1D FC214000 mov ebx,dword ptr ds:[<&USER32.PostQuitMessag>; USER32.PostQuitMessage 004014E1 . 83F8 05 cmp eax,0x5 004014E4 . 7E 50 jle XCoSH_2.00401536 004014E6 . 8D6E 60 lea ebp,dword ptr ds:[esi+0x60] 004014E9 . 8BCD mov ecx,ebp 004014EB . E8 5A030000 call <jmp.&MFC42.#CWnd::GetWindowTextLengthA_> 004014F0 . 83F8 05 cmp eax,0x5 004014F3 . 7E 41 jle XCoSH_2.00401536 004014F5 . 8D86 E0000000 lea eax,dword ptr ds:[esi+0xE0] 004014FB . 8BCF mov ecx,edi 004014FD . 50 push eax 004014FE . E8 41030000 call <jmp.&MFC42.#CWnd::GetWindowTextA_3874> 00401503 . 8DBE E4000000 lea edi,dword ptr ds:[esi+0xE4] 00401509 . 8BCD mov ecx,ebp 0040150B . 57 push edi 0040150C . E8 33030000 call <jmp.&MFC42.#CWnd::GetWindowTextA_3874> 00401511 . 8B07 mov eax,dword ptr ds:[edi] 00401513 . 8038 36 cmp byte ptr ds:[eax],0x36 00401516 . 75 1E jnz XCoSH_2.00401536 00401518 . 8078 01 32 cmp byte ptr ds:[eax+0x1],0x32 0040151C . 75 18 jnz XCoSH_2.00401536 0040151E . 8078 02 38 cmp byte ptr ds:[eax+0x2],0x38 00401522 . 75 12 jnz XCoSH_2.00401536 00401524 . 8078 03 37 cmp byte ptr ds:[eax+0x3],0x37 00401528 . 75 0C jnz XCoSH_2.00401536 0040152A . 8078 04 2D cmp byte ptr ds:[eax+0x4],0x2D 0040152E . 75 06 jnz XCoSH_2.00401536 00401530 . 8078 05 41 cmp byte ptr ds:[eax+0x5],0x41 00401534 . 74 17 je XCoSH_2.0040154D 00401536 > 6A 00 push 0x0 00401538 . 68 64304000 push CoSH_2.00403064 ; ASCII "ERROR" 0040153D . 68 38304000 push CoSH_2.00403038 ; ASCII "One of the Details you entered was wrong" 00401542 . 8BCE mov ecx,esi 00401544 . E8 F5020000 call <jmp.&MFC42.#CWnd::MessageBoxA_4224> 00401549 . 6A 00 push 0x0 0040154B . FFD3 call ebx 0040154D > 8D8E E0000000 lea ecx,dword ptr ds:[esi+0xE0] 00401553 . 8D5424 14 lea edx,dword ptr ss:[esp+0x14] 00401557 . 51 push ecx 00401558 . 68 2C304000 push CoSH_2.0040302C ; ASCII "Well done," 0040155D . 52 push edx 0040155E . E8 D5020000 call <jmp.&MFC42.#operator+_926> 00401563 . 68 3C314000 push CoSH_2.0040313C 00401568 . 50 push eax 00401569 . 8D4424 18 lea eax,dword ptr ss:[esp+0x18] 0040156D . C74424 28 000>mov dword ptr ss:[esp+0x28],0x0 00401575 . 50 push eax 00401576 . E8 B7020000 call <jmp.&MFC42.#operator+_924> 0040157B . 8B00 mov eax,dword ptr ds:[eax] 0040157D . 6A 00 push 0x0 0040157F . 68 20304000 push CoSH_2.00403020 ; ASCII "YOU DID IT" 00401584 . 50 push eax 00401585 . 8BCE mov ecx,esi 00401587 . C64424 2C 01 mov byte ptr ss:[esp+0x2C],0x1 0040158C . E8 AD020000 call <jmp.&MFC42.#CWnd::MessageBoxA_4224>
[00401513]处开始比较内容:
00401513 . 8038 36 cmp byte ptr ds:[eax],0x36 00401516 . 75 1E jnz XCoSH_2.00401536 00401518 . 8078 01 32 cmp byte ptr ds:[eax+0x1],0x32 0040151C . 75 18 jnz XCoSH_2.00401536 0040151E . 8078 02 38 cmp byte ptr ds:[eax+0x2],0x38 00401522 . 75 12 jnz XCoSH_2.00401536 00401524 . 8078 03 37 cmp byte ptr ds:[eax+0x3],0x37 00401528 . 75 0C jnz XCoSH_2.00401536 0040152A . 8078 04 2D cmp byte ptr ds:[eax+0x4],0x2D 0040152E . 75 06 jnz XCoSH_2.00401536 00401530 . 8078 05 41 cmp byte ptr ds:[eax+0x5],0x41 00401534 . 74 17 je XCoSH_2.0040154D
不相同则跳转到错误信息,于是就得到了一个字符串,但是并不知道这个比较的内容是对Name进行比较还是对Serial进行比较。
往上看一看有几个:
004014E1 . 83F8 05 cmp eax,0x5 004014F0 . 83F8 05 cmp eax,0x5
可以猜测输入的两个内容长度都要大于5
先猜猜比较的内容是Serial,于是有:
相关文章推荐
- LeetCode 2015.7.25 125,28,169,155,7,160,1
- 适配器模式【Adapter Pattern 】
- Atitit.java swing打印功能 api attilax总结
- 装饰模式【Decorator Pattern 】
- Atitit 文件上传 架构设计 实现机制 解决方案 实践java php c#.net js javascript c++ python
- JavaEE Tutorials (28) - Duke书店案例研究示例
- LeetCode 160:Intersection of Two Linked Lists
- [.net 面向对象程序设计进阶] (28) 结束语——告别2015
- ios 下创建,删除文件夹的方法   NSFileManager
- atitit.groovy 语法特性
- 28.广搜:被围住的面积
- IOS 快速将网络数据转化为所需的对象
- 【python】编程语言入门经典100例--28
- Atitit.aticmd v4 新特性q39 添加定时器释放功能
- iOS个人整理28-CoreData,数据表关系,数据库迁移
- java语言程序设计第十版(Introduce to java 10th) 课后习题 chapter6-28
- Object-C基础(3)—— 流程控制与数组
- 3. Longest Substring Without Repeating Characters【M】【28】【leetcode】
- LeetCode(28)-Remove Duplicates from Sorted Array
- Monocular slam 中的理论基础(2)