chenx221/Reverse
1
0
Fork 0
Code Pull Requests Activity

solved new crackme

Browse Source
This commit is contained in:
Chenx221 2024-10-15 11:12:41 +08:00
parent 41fa9ac455
commit 7f51505b5a
Signed by: chenx221
GPG Key ID: D7A9EC07024C3021
9 changed files with 265 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
bugcrack_me1_by_genaytyk/Bugged.exe Normal file
View File

Binary file not shown.

BIN
bugcrack_me1_by_genaytyk/Bugged_Patched.exe Normal file
View File

Binary file not shown.

58
bugcrack_me1_by_genaytyk/Genaytyk.nfo Normal file
View File

@ -0,0 +1,58 @@
ｱｱｱｱｱｱｱｱｱｱｱｱｱｱｱｱｱﾛｱｱｱｱｱｱｱｱｱｱｱｱﾛ ｱﾛ ｱｱｱｱﾛ ｱ ｱｱｱｱﾛ ｱｱｱﾛ ｱｱﾛﾛ
ｱｱｲｲｲｲｲｲｲｲｲｲｲｲｲｲｲｱﾛｲｲｲｲｲｲｲｲｲｲｲｱﾛ ｱ ｱｱﾛ ｱ ｱｲｲｲｱﾛ ｱｲｲｱﾛﾛ ｱｱｲｲｱﾛｱｲｲｱﾛ
ｱｲｲｲｲｲｱｱｱｱｱｱｱｱｱｱｲｱｱﾛｲｲｲｱｱｱｱｱｱｱｱｱﾛﾛﾛ ｱｲｱﾛ ｱ ｱ ｱｱｱｲｲｱﾛｱｱｲｲｱﾛﾛ ｱ ﾛｱｲｲｱｲｲｱｱﾛ
ｱｲｲｲｱｱﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛｱｱｱﾛｲｲｲｱﾛﾛﾛﾛﾛﾛﾛﾛﾛｱﾛﾛ ｱｲｱﾛ ｱｱｱｱｱﾛｲｱｱｱｲｲｲｱﾛ ﾛｱｲｲｲｱﾛﾛﾛ
ｱｲｲｲｱﾛﾛ ｱｱｱｱｱﾛﾛﾛﾛﾛｲｲｲｱｱｱｱｱﾛ ｱｲｲｲｱﾛ ｱｲｱﾛ ｱ ｱｲｲｲｱﾛｲｲｲｲｲｲｱﾛﾛｱｱｱｱｱｱｱﾛﾛｲｲｱﾛ ｱ
ｱｲｲｲｱﾛ ｱｱｱｲｲｲｱｱﾛ ｱｲｲｲｲｲｲｲｱﾛ ｱｲｲｲｱﾛﾛ ｱｲｱﾛ ｱｲｲｲｱｱﾛｲｲｲｲｲｱﾛｲｲｲｲｲｲｲｲｱﾛｲｲｱﾛ
ｱｲｲｲｱﾛｱ ｱｱｲｲｲｲｲｱﾛ ｱｲｱｱｱｱｱｱｱﾛ ｱｲｲｲｲｱﾛ ｱｲｱﾛ ｱ ｱｱｲｲｲｲｱﾛｲｲｲｲｱﾛﾛｱｱｲｲｱｱｱｱｱﾛｱｱｱﾛｱﾛ
ｱｲｲｲｱﾛ ﾛｱｲｲｲｲｲｱﾛ ｱｲｱﾛﾛﾛﾛﾛﾛﾛ ｱｲｲｲｲｱﾛﾛ ｱｲｱﾛ ｱｲｱｱｲｲｱﾛｲｲｲｲｱﾛﾛﾛｱｲｲｱﾛﾛﾛﾛﾛﾛﾛﾛﾛｲｱﾛ
ｱｱｲｲｱﾛ ﾛｱｲｲｲｲｱﾛ ｱｲｱﾛ ｱｲｱｱｲｱｱﾛ ｱｲｱﾛ ｱｱｲｱﾛﾛｱｲｱﾛｲｲｲｲｱﾛ ｱｲｲｱﾛ ｱｱﾛｱｲｲｱﾛ
ﾛｱｲｲｱｱｱｱｱ ｱｱｲｲｲｱﾛ ｱｲｱﾛ ｱｲｱｱｲｲｱﾛ ｱｲｱﾛ ｱｲｱｱｱｱｱｲｲｱﾛｲｲｲｱﾛ ｱｲｲｱﾛ ｱｲｱｲｲｱﾛ
ｱｱｲｲｲｲｲｱｱｱｱｲｲｲｱﾛｱｱｱｲｱｱｱｱｱｱｱｱﾛｱｲｱﾛｱｲｲｱﾛｱｲｱﾛ ｱｱｲｲｲｲｲｲｲｲｱﾛｲｲｲｱﾛ ｱｲｲｱﾛｱ ﾛｱｲｲｱﾛ
ﾛｱｱｱｲｲｲｲｲｲｲｲｱｱｱﾛｱｲｲｲｲｲｲｱｲｲｲｱﾛｱｲｱﾛｱｲｲｱｱｱｲｱﾛ ｱｱｲｱｱｱｱｲｲｲｲｱﾛｲｲｲｱﾛ ｱｲｲｱﾛ ｱｲｲｲｱｱﾛﾛ
ﾛﾛｱｱｱｱｱｱｱｱｱﾛﾛﾛﾛｱｱｱｱｱｱｱｱｱｱｱｱﾛｱｲｱﾛﾛｱｲｲｲｲｲｱﾛ ｱｲｲｱﾛﾛｱｲｲｲｲｱﾛｱｱｱｱﾛ ｱｲｲｱﾛ ｱｲｱｱｲｲｱﾛ
ﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛ ﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛｱｱｱﾛ ﾛｱｱｱｱｱｱﾛｱｱｱｱｱﾛ ｱｱｱｱｱｱﾛﾛﾛﾛﾛﾛ ｱｱｱｱﾛ ｱｱｲｱﾛｱｲｱﾛ
ｱ ｱ ﾛﾛﾛﾛﾛ ﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛ ﾛﾛﾛﾛﾛﾛﾛ ﾛﾛﾛﾛﾛ ｱｱｱﾛﾛｱﾛﾛ
ｱ ｱ ｱ ｱ ｱ ｱ ｱ ﾛﾛﾛ ﾛﾛ
ｱ ｱ ｱ ｱ ｱ ｱ ｱ ｱ
ｱ ﾉﾋﾋﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾋﾍﾍﾍﾍﾍﾍﾍﾍﾋﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾋﾋﾋﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾋﾍﾍﾋﾍﾍﾍﾍﾍﾍﾍﾍﾋﾍﾍﾋﾍﾍﾍﾍﾍﾍﾍﾍﾍｻ
ﾌﾊﾎﾍﾍﾍﾍﾋﾍﾍﾍﾍﾍﾍｼGenaytykﾈﾍﾍﾍﾍﾍﾍﾋﾍﾍﾍﾍﾎﾊｹﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄｺCrack-meｺﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄｺ
ｺ ｺ ｺ"Be anonymous or die."ｺ ｺ ｺ ﾈﾍﾍﾊﾍﾍﾍﾎﾎﾍﾍﾍﾊﾍﾍｼ ｺ
ﾌﾍｼ ﾌﾍﾍｻwww.zo-web.fr.stﾉﾍﾍｹ ﾈﾍｹﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾁﾁﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄｺ
ｱ ｱ ﾌﾍｻ ﾈﾍﾍﾊﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾊﾍﾍｼ ﾉﾍｹﾄﾄﾄﾄﾄﾄﾄﾄﾂﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾂﾄﾄﾄﾄﾄﾄﾄﾄｺ
ｺ ｺ ﾂﾚﾄﾄﾂｴﾚｳ ﾄﾄｿ ﾀﾂｿﾂ ﾚﾄﾂﾄﾙﾚｿﾚｿﾂﾄｿ ｺ ｺﾍﾍﾍﾍﾍﾍﾍﾍｳBugged crack-me 1ｳﾍﾍﾍﾍﾍﾍﾍﾍｺ
. ｱ ﾌﾍｼﾚﾙﾀｿ ｳﾚﾙﾀﾂｿ ｳ ｳ ﾀｿｳ ｳ ｳﾙﾀｳｳﾚｴ ﾈﾍｹﾄﾄﾄﾄﾄﾄﾄﾄﾁﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾁﾄﾄﾄﾄﾄﾄﾄﾄｺ
ｱ ｺﾄﾄﾁﾄﾄﾁﾄﾄﾁﾄﾄﾅﾄﾄﾁﾄﾄﾁﾄﾄﾁﾄﾂﾁﾄﾄﾁﾄﾄﾁﾄﾄﾁﾄﾄﾁｺ ｺ
ｺﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍｳCrack listｳﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍｺDescription: Crack this crack-me ｺ
ｱ ｺﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾁﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾁﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄｺﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄ(see instructions.txt) ｺ
ｱ ｺ ｺ ｺ
ｱ ｺ -The font creator program ｺProtection:Hidden bug,CheckSum. ｺ
ｺ -Icon workshop ｺﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄ ｺ
ｱ ｺ -IDA (incomplete) ｺ ｺ
ｺ -Perfect keylogger ｺ ﾂ ｺ
ｱｱｺ -Winzip 7.0 ｺNoteｳNothing. ;-) ｺ
ｱ ｺ -Quick Heal 6.07 ｺﾄﾄﾄﾄﾙ ｺ
ｺ -Phasma3 ｺ ｺ
ｺ -PSXMC 3.04 ｺ ｺ
ｱ ｱ ｺ -Cyclone 2002 b ｺ ｺ
ｺ ｺ ｺ
ｱ ｺ ｺ ｺ
ｺ ｺ ｺ
ｱ ｺ ｺ ｺ
ｺ ｺ ｺ
ｺ ｺ ｺ
ｱ ｺ ｺ ｺ
ﾌﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾋﾍﾍﾍﾍﾍﾋﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍｹﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍｼ
ｺ ｺThanxｺ ｺ ｱ ｱ
ｱ ｱ ｺ ﾈﾍﾍﾍﾍﾍｼ ｺ ｱ ｱ ｱ ｱ
ｺTc FFFｳwww.forumdutc.free.fr ｺ ｱ ｱ ｱ ｱ ｱ
ｱ ｺShmeitCorpｳwww.shmeitcorp.cjb.net ｺ ｱ ｱ ｱ ｱ ｱ
ｱ ｺShadowslord ｺ ｱ ｱ ｱ ｱ
ｺAnd other people... ｺ ｱ ｱ ｱ
ｱ ﾈﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍﾍｼ ｱ ｱｱ
ｱ ｱ ｱ
ｱ ｱ ｱ ｱ ｱ ｱ ｱ ｱ ｱ ｱ
ｱ ｱ ｱ ｱ ｱ ｱ ｱ
ｱ ｱ ｱ
ｱ ｱ ｱ ｱ ｱ ｱ ｱ ｱ ｱ ｱ
ｱ ｱ ｱ ｱ ｱ ｱ ｱ ｱ

39
bugcrack_me1_by_genaytyk/Instructions.txt Normal file
View File

@ -0,0 +1,39 @@
***********Bugged crack-me 1 by Genaytyk***********
---------------------------English-------------------------------
Modify the program to kick the bug and see the good messagebox.
Forbiden!!!!:
-To see the "Bad CheckSum" message, you must avoid it.
-To kick the "Bad CheckSum" message.
-To rebuild the messagebox, you must only defated the bug.
-To make a loader. Oops i'm an idiot, you cannot make a loader, the checksum check the memory ;-).
Send solutions to genaytyk@hotmail.com
Purpose: Don't use a disassembler, use a debugger and be careful with breakpoints.
Note: This is my first crack-me. Don't be hangry. ;-)
------------------------French-------------------------------
Modifiez le programme pour virer le bug et qu'il affiche le bon message.
Interdit!!!!:
-De voir le message "Bad CheckSum", vous devez l'éviter.
-De virer le message "Bad CheckSum".
-De reconstruire la messagebox, vous devez seulement virer le bug.
-De créer un loader. Oops j'suis con, vous pouvez pas créer un loader, le checksum verifie la mémoire ;-).
Envoyez vos solutions à genaytyk@hotmail.com
Conseil: N'utilisez pas un désassembleur, utilisez plutôt un débugger et soyez prudent avec les breakpoints.
Note: C'est mon premier crack-me, soyez pas méchant. ;-)
[--Genaytyk--]
"Be anonymous or die"

1
bugcrack_me1_by_genaytyk/other/check.bin Normal file
View File

@ -0,0 +1 @@
D¬ô´uü¼ôšuD³3ü«<ü´Ì!sss€„€ƒ€‚€…3sC3seC3ss›ˆˆˆš;ˆˆˆ

BIN
bugcrack_me1_by_genaytyk/other/check_dec.bin Normal file
View File

Binary file not shown.

BIN
bugcrack_me1_by_genaytyk/other/check_dec_fix.bin Normal file
View File

Binary file not shown.

1
bugcrack_me1_by_genaytyk/other/check_fix.bin Normal file
View File

@ -0,0 +1 @@
D¬ô´uü¼ôšuD³3ü«<ü´Ì!sss€„€ƒãããã3sC3seC3ss›ˆˆˆš;ˆˆˆ

166
bugcrack_me1_by_genaytyk/solve.md Normal file
View File

@ -0,0 +1,166 @@
过检测，修bug
先晒方法：
```
*文件偏移
8DD: 80->E3
8DE: 82->E3
8DF: 80->E3
8E0: 85->E3
```
细节：
EP进来先跳第一个检测
```assembly
00401007 | E9 03010000 | jmp bugged.40110F |
```
这里会对401000~4010F8代码进行求和校验
```assembly
0040110F | 60 | pushad |
00401110 | 33DB | xor ebx,ebx |
00401112 | B8 00104000 | mov eax,<bugged.OptionalHeader.AddressOfEn |
00401117 | 90 | nop |
00401118 | 90 | nop |
00401119 | 90 | nop |
0040111A | 90 | nop |
0040111B | 90 | nop |
0040111C | 90 | nop |
0040111D | 90 | nop |
0040111E | 0318 | add ebx,dword ptr ds:[eax] |
00401120 | 83C3 04 | add ebx,4 |
00401123 | 83C0 04 | add eax,4 |
00401126 | 3D F8104000 | cmp eax,bugged.4010F8 |
0040112B | 75 EA | jne bugged.401117 | 循环0x3E次，对EP开头这段进行求和校验
0040112D | 3B1D FA304000 | cmp ebx,dword ptr ds:[4030FA] | 004030FA:"煼愚"
00401133 | 0F84 D3FEFFFF | je bugged.40100C |
00401139 | 6A 30 | push 30 |
0040113B | 68 1C214000 | push bugged.40211C | 40211C:"Bad checksum!!"
00401140 | 68 2B214000 | push bugged.40212B | 40212B:"A virus or a cracker ;-) has corrupted the program, please reinstall it."
00401145 | 6A 00 | push 0 |
00401147 | E8 DCFEFFFF | call <JMP.&_MessageBoxA@16> |
0040114C | E9 CEFEFFFF | jmp bugged.40101F |
```
校验无误后会一路跳：
```
0040100D | EB 7E | jmp bugged.40108D |
```
这段好像没啥用：
```
0040108D | 60 | pushad |
0040108E | 40 | inc eax |
0040108F | 48 | dec eax |
00401090 | 33C9 | xor ecx,ecx | ecx:EntryPoint
00401092 | 83E9 02 | sub ecx,2 | ecx:EntryPoint
00401095 | 41 | inc ecx | ecx:EntryPoint
00401096 | 41 | inc ecx | ecx:EntryPoint
00401097 | 8BD9 | mov ebx,ecx | ecx:EntryPoint
00401099 | 85DB | test ebx,ebx |
0040109B | 75 82 | jne bugged.40101F |
0040109D | 61 | popad |
0040109E | EB 37 | jmp bugged.4010D7 |
```
接下来是释放最后的检查代码：
```
004010D7 | 60 | pushad |
004010D8 | B8 8D104000 | mov eax,bugged.40108D |
004010DD | BB C0304000 | mov ebx,4030C0 |
004010E2 | 33C9 | xor ecx,ecx | ecx:EntryPoint
004010E4 | 8A13 | mov dl,byte ptr ds:[ebx] |
004010E6 | 80C2 02 | add dl,2 |
004010E9 | 80F2 75 | xor dl,75 |
004010EC | 8810 | mov byte ptr ds:[eax],dl |
004010EE | 40 | inc eax |
004010EF | 43 | inc ebx |
004010F0 | 41 | inc ecx | ecx:EntryPoint
004010F1 | 83F9 3A | cmp ecx,3A | ecx:EntryPoint, 3A:':'
004010F4 | 75 EE | jne bugged.4010E4 | 循环0x3A次，释放新的检查代码到上个检查
004010F6 | 61 | popad |
004010F7 | EB 94 | jmp bugged.40108D |
```
可以看出从4030C0位置开始3A大小内容是被加密的（再后面好像是前面的校验值，不过用不上）
```
13 44 AC F4 B4 75 FC BC F4 9A 75 11 44 B3 33 FC
AB 3C FC B4 CC 21 73 73 73 80 84 80 83 80 82 80
85 12 1D 33 1B 73 43 33 73 1B 65 43 33 73 1D 73
9B 11 88 88 88 9A 3B 88 88 88
```
经过解密`+0x2，xor 0x75`，可以得到：
```
60 33 DB 83 C3 02 8B CB 83 E9 02 66 33 C0 40 8B
D8 4B 8B C3 BB 56 00 00 00 F7 F3 F7 F0 [F7 F1 F7 ←
F2] 61 6A 40 68 00 30 40 00 68 12 30 40 00 6A 00
E8 66 FF FF FF E9 48 FF FF FF
```
文件先摆着，反正等会儿也要执行这块代码
这是解密的代码
```assembly
0040108D | 60 | pushad |
0040108E | 33DB | xor ebx,ebx |
00401090 | 83C3 02 | add ebx,2 |
00401093 | 8BCB | mov ecx,ebx | ecx:EntryPoint
00401095 | 83E9 02 | sub ecx,2 | ecx:EntryPoint
00401098 | 66:33C0 | xor ax,ax |
0040109B | 40 | inc eax |
0040109C | 8BD8 | mov ebx,eax |
0040109E | 4B | dec ebx |
0040109F | 8BC3 | mov eax,ebx |
004010A1 | BB 56000000 | mov ebx,56 | 56:'V'
004010A6 | F7F3 | div ebx |
004010A8 | F7F0 | div eax |
004010AA | F7F1 | div ecx | <--
004010AC | F7F2 | div edx | <--
004010AE | 61 | popad |
004010AF | 6A 40 | push 40 |
004010B1 | 68 00304000 | push bugged.403000 | 403000:"Congratulations!!"
004010B6 | 68 12304000 | push 403012 | 403012:"Bug anihilated/destroyed/defated. :p. Coded a little in Masm32 and more in hex editor."
004010BB | 6A 00 | push 0 |
004010BD | E8 66FFFFFF | call <JMP.&_MessageBoxA@16> |
004010C2 | E9 48FFFFFF | jmp bugged.40100F |
```
其中`004010AA`、`004010AC`会出现问题（/0），NOP掉
`F7 F1 F7 F2`这块换成`90 90 90 90` (也就是上边解密的二进制内容[]指出部分)
更换后重新加密回去`xor 0x75, -0x2`，最后可得到
```
13 44 AC F4 B4 75 FC BC F4 9A 75 11 44 B3 33 FC
AB 3C FC B4 CC 21 73 73 73 80 84 80 83 [E3 E3 E3
E3] 12 1D 33 1B 73 43 33 73 1B 65 43 33 73 1D 73
9B 11 88 88 88 9A 3B 88 88 88
```
用你的hex编辑器打开exe文件，转到文件偏移`0x8C0`处
```
8DD: 80->E3
8DE: 82->E3
8DF: 80->E3
8E0: 85->E3
```
(可选) 有时候好像过不去这个文件校验？直接Patch成`jmp bugged.40100C`
```
00401133 | 0F84 D3FEFFFF | je bugged.40100C |
```