0040332F MOV AX, WORD PTR DS:[ESI+2] ; AX <==DS:[ESI+2](取二位)=DS:[0093266E]=3130 ('01')
00403333 MOV WORD PTR SS:[ESP+10], AX ; AX ==>SS:[0012F514]
00403338 LEA EAX, DWORD PTR SS:[ESP+10]
0040333C MOV BYTE PTR SS:[ESP+12], 0
00403341 PUSH EAX ; EAX =0012F514,(ASCII "01") 第三 四位
00403342 CALL Revival.0041F800 *********第一次调用
------------------------
CALL Revival.0041F800
|
|
0041F800 MOV EAX, DWORD PTR SS:[ESP+4]
0041F804 PUSH EAX ; EAX =0012F514,(ASCII "01") 第三 四位
0041F805 CALL Revival.0041F750 ; 计算的CALL
0041F80A ADD ESP, 4
0041F80D RETN
-----------------------
CALL Revival.0041F750
|
|
0041F750 PUSH EBX
0041F751 PUSH ESI
0041F752 MOV ESI, DWORD PTR SS:[ESP+C] ; ESI =0012F514,(ASCII "01") 第三 四位
0041F756 PUSH EDI
0041F757 PUSH EBP
0041F758 MOV EDI, 1 ; EDI=1
0041F75D /CMP DWORD PTR DS:[45D9DC], EDI
0041F763 |JLE SHORT Revival.0041F776
0041F765 |PUSH 8
0041F767 |XOR EAX, EAX
0041F769 |MOV AL, BYTE PTR DS:[ESI]
0041F76B |PUSH EAX
0041F76C |CALL Revival.00423610
0041F771 |ADD ESP, 8
0041F774 |JMP SHORT Revival.0041F789
0041F776 |XOR EDX, EDX
0041F778 |MOV ECX, DWORD PTR DS:[45D7D0] ; ECX <== DS:[0045D7D0] (参数的基地址)
0041F77E |MOV DL, BYTE PTR DS:[ESI] ; DL <== DS:[0012F514]=30 ('0')
0041F780 |XOR EAX, EAX
0041F782 |MOV AX, WORD PTR DS:[ECX+EDX*2] ; 用DL值做寻值的指针,偏移量=DL*2
0041F786 |AND EAX, 8 ; 计算方法
0041F789 |TEST EAX, EAX ; 注册码的判断条件,即DL*2偏移处的值AND 8 不能等于0
0041F78B |JE SHORT Revival.0041F790 ; 条件不成立就跳
0041F78D |INC ESI
0041F78E \JMP SHORT Revival.0041F75D
++++++++++++++++++++++++++++++++++++++++++++++++++++++
这是内存中数组的值:
0045D7D0 DA D7 45 00 DA D7 45 00 谧E.谧E.
0045D7D8 00 00 20 00 20 00 20 00 .. . . .
0045D7E0 20 00 20 00 20 00 20 00 . . . .
0045D7E8 20 00 20 00 28 00 28 00 . .(.(.
0045D7F0 28 00 28 00 28 00 20 00 (.(.(. .
0045D7F8 20 00 20 00 20 00 20 00 . . . .
0045D800 20 00 20 00 20 00 20 00 . . . .
0045D808 20 00 20 00 20 00 20 00 . . . .
0045D810 20 00 20 00 20 00 20 00 . . . .
0045D818 20 00 48 00 10 00 10 00 .H...
0045D820 10 00 10 00 10 00 10 00 ....
0045D828 10 00 10 00 10 00 10 00 ....
0045D830 10 00 10 00 10 00 10 00 ....
0045D838 10 00 84 00 84 00 84 00 .??? ;由于偏移量最小是从45D83A开始的.
0045D840 84 00 84 00 84 00 84 00 ???? ;分析下面的各个值没有符合条件的.
0045D848 84 00 84 00 84 00 10 00 ???.
0045D850 10 00 10 00 10 00 10 00 ....
0045D858 10 00 10 00 81 00 81 00 ..??
0045D860 81 00 81 00 81 00 81 00 ????
0045D868 01 00 01 00 01 00 01 00 ....
0045D870 01 00 01 00 01 00 01 00 ....
0045D878 01 00 01 00 01 00 01 00 ....
0045D880 01 00 01 00 01 00 01 00 ....
0045D888 01 00 01 00 01 00 01 00 ....
0045D890 10 00 10 00 10 00 10 00 ....
0045D898 10 00 10 00 82 00 82 00 ..??
0045D8A0 82 00 82 00 82 00 82 00 ????
0045D8A8 02 00 02 00 02 00 02 00 ....
0045D8B0 02 00 02 00 02 00 02 00 ....
0045D8B8 02 00 02 00 02 00 02 00 ....
0045D8C0 02 00 02 00 02 00 02 00 ....
0045D8C8 02 00 02 00 02 00 02 00 ....
0045D8D0 10 00 10 00 10 00 10 00 ....
0045D8D8 20 00 00 00 00 00 00 00 .......
--------------
这一段只是为下面服务的
==============================================
继续:
-----
|
|
0041F790 XOR EBX, EBX
0041F792 MOV BL, BYTE PTR DS:[ESI] ; BL <== DS:[0012F514]=30 ('0') || =33 ||=37
0041F794 INC ESI ; ESI ++
0041F795 MOV EDI, EBX ; EDI <== 30
0041F797 CMP EBX, 2D
0041F79A JE SHORT Revival.0041F7A1
0041F79C CMP EBX, 2B
0041F79F JNZ SHORT Revival.0041F7A6
0041F7A1 XOR EBX, EBX
0041F7A3 MOV BL, BYTE PTR DS:[ESI]
0041F7A5 INC ESI
0041F7A6 XOR EBP, EBP
0041F7A8 /CMP DWORD PTR DS:[45D9DC], 1 ; DS:[45D9DC]=01
0041F7AF |JLE SHORT Revival.0041F7BE
0041F7B1 |PUSH 4
0041F7B3 |PUSH EBX
0041F7B4 |CALL Revival.00423610
0041F7B9 |ADD ESP, 8
0041F7BC |JMP SHORT Revival.0041F7CD
0041F7BE |MOV ECX, DWORD PTR DS:[45D7D0] ; 如果上面的条件都不成立,就跳到这里 ECX <== DS:[00457D0] (基地址)
0041F7C4 |XOR EAX, EAX
0041F7C6 |MOV AX, WORD PTR DS:[ECX+EBX*2] ; EBX =30 还是用第三位的hex值来做指针寻址
0041F7CA |AND EAX, 4 ; 计算方法
0041F7CD |TEST EAX, EAX ; 注册码的判断条件,即DL*2偏移处的值AND 4 不能等于0
0041F7CF |JE SHORT Revival.0041F7E1
0041F7D1 |LEA EAX, DWORD PTR SS:[EBP+EBP*4] ; EBP=0 ,第二次它就是把试验码*5==>EAX中,这个值有用
0041F7D5 |INC ESI ; //EAX =0 ;EAX =HEX*5
0041F7D6 |LEA EBP, DWORD PTR DS:[EBX+EAX*2->; EBP <== 01 |<==03 这个计算是把十六进制转化为ASCII值,因为EAX=0||第二次计算的时候
0041F7DA |XOR EBX, EBX ; //就是把后一位的hex+前一位值*A-30
0041F7DC |MOV BL, BYTE PTR DS:[ESI-1] ; BL <== DS:[0012F515]=31 ('1')
0041F7DF \JMP SHORT Revival.0041F7A8
0041F7E1 MOV EAX, EBP ; EAX <==EBP (经过上面计算的值) ||(78901) =13435|||(56)=38
0041F7E3 CMP EDI, 2D
0041F7E6 JNZ SHORT Revival.0041F7EF
0041F7E8 NEG EAX
0041F7EA POP EBP
0041F7EB POP EDI
0041F7EC POP ESI
0041F7ED POP EBX
0041F7EE RETN
-----------------
这一段要分析一下: 下面要的四个关键值的计算
1.第一次用试验码的第三位,第四位进行如下计算:后一位值+前一位值*A 例如:(01)==>1+0*A=01
2.第二次用试验码的第六位,第七位进行相同计算:后一位值+前一位值*A 例如:(34)==>4+3*A=22
3.第三次用试验码的最后五位进行如下计算:前一位值*A+后一位值 ,然后把前面的值*A+后一位的值
例如(78901)==>1+(0+(9+(8+7*a)*a)*a)*a=13435
4.第四次用试验码的第九位,第十位进行如下计算:前一位值*A+后一位值 例如:(56)==>6+5*A=38
|