x64dbg - 第三十二章 | 反匯編練習(二十一)
目標程式
檔案下載：ReverseMe(1).exe
解壓密碼：morosedog
任務目標
- 移除
Nag視窗
分析程式
- 執行
ReverseMe(1).exe - 點擊
Check - 彈出
You need to remove the nag try to do it in a two byte patch. Regards!(你需要刪除嘮叨嘗試在兩個字節的補丁中執行此操作。 問候！) - 點擊
確定 - 彈出
Remove the nag from the ReverseMe. It can be donw in a two bytes patch. But every other solution is fine. This ReverseMe is part of a tutorial. Enjoy!(從ReverseMe中移除嘮叨。 它可以是兩個字節的補丁。 但其他所有解決方案都很好。 這個ReverseMe是教程的一部分。 請享受！)
檢驗顯示是使用MASM32 / TASM32編寫。
額外補充
一般正常的入口點如下
1
2004CC7E8 < | 55 | push ebp |
004CC7E9 | 8BEC | mov ebp,esp |-
1
2
3
4
5a b a⊕b
1 0 = 1
1 1 = 0
0 0 = 0
0 1 = 1
搜尋思路
- 使用搜尋字串找關鍵字。
修改思路
- 跳過
Nag
實際分析
開啟
ReverseMe(1).exe於反匯編視窗點選右鍵選擇
搜尋(S)->目前模組->字串引用(S)搜尋輸入Regis1
2
3
4
5位址 反組譯 字串
004000D9 add dword ptr ds:[4000C],eax L"4"
004012B1 push reverseme(1).40317D "TutorialNag"
004012B6 push reverseme(1).403134 "You need to remove the nag\r\nTry to do it in a two byte patch. \r\nRegards!"
004012F7 push dword ptr ds:[403134] "You need to remove the nag\r\nTry to do it in a two byte patch. \r\nRegards!"004012B6、004012F7設定中斷點F9執行程式彈出
Nag視窗You need to remove the nag try to do it in a two byte patch. Regards!點擊
確定彈出
Remove the nag from the ReverseMe. It can be donw in a two bytes patch. But every other solution is fine. This ReverseMe is part of a tutorial. Enjoy!點擊
X關閉程序結束
始終沒有斷點在設定德中斷點
在此可以確認這些是用來欺騙的代碼
Ctrl + F2重新啟動(S)F8一步一步過，並持續觀察1
2
3
4
5
600401288 < | 6A 00 | push 0 |
0040128A | E8 EFFFFFFF | call <JMP.&GetModuleHandleA> |
0040128F | A3 30314000 | mov dword ptr ds:[403130],eax |
00401294 | BF 11104000 | mov edi,<reverseme(1).sub_401011> | 401011:"j"
00401299 | E8 71000000 | call <reverseme(1).sub_40130F> |
0040129E | E8 6EFDFFFF | call <reverseme(1).sub_401011> |執行到
0040129E | E8 6EFDFFFF | call <reverseme(1).sub_401011> |彈出Nag可以發現有兩個
Call，針對這兩個Call進行分析call <reverseme(1).sub_40130F>call <reverseme(1).sub_401011>
Ctrl + F2重新啟動(S)F8一步一步過到00401299 | E8 71000000 | call <reverseme(1).sub_40130F> |F7步入斷點在
0040130F < | B8 00104000 | mov eax,reverseme(1).401000 |向下觀察
1
2
3
4
5
60040130F < | B8 00104000 | mov eax,reverseme(1).401000 |
00401314 | 8030 5A | xor byte ptr ds:[eax],5A |
00401317 | 40 | inc eax |
00401318 | 3D 18124000 | cmp eax,<JMP.&BeginPaint> |
0040131D | 7C F5 | jl reverseme(1).401314 |
0040131F | C3 | ret |mov eax,reverseme(1).401000- 將
eax塞入00401000
- 將
xor byte ptr ds:[eax],5Aeax進行xor,5A
inc eaxeax加一
cmp eax,<JMP.&BeginPaint>- 比較
eax是否與<JMP.&BeginPaint>相同
- 比較
jl reverseme(1).401314- 不成立跳轉回
401314(迴圈)
- 不成立跳轉回
根據上方的分析會將
00401000~00401217這區塊做xor,5A處理。以下是
xor前和後的紀錄1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468// XOR之前的代碼(解密前)
00401000 | E2 5A | loop reverseme(1).40105C |
00401002 | 6A 1A | push 1A |
00401004 | 5A | pop edx | edx:"j"
00401005 | DA6A E9 | fisubr st(0),dword ptr ds:[edx-17] |
00401008 | 1A67 72 | sbb ah,byte ptr ds:[edi+72] |
0040100B | 6B1A 5A | imul ebx,dword ptr ds:[edx],5A | edx:"j"
0040100E | 26:AF | scasd |
00401010 | 1A69 9A | sbb ch,byte ptr ds:[ecx-66] |
00401013 | 3C 9D | cmp al,9D |
00401015 | 5D | pop ebp |
00401016 | 305A D9 | xor byte ptr ds:[edx-27],bl | edx-27:"%0 @"
00401019 | 9D | popfd |
0040101A | 58 | pop eax |
0040101B | 9D | popfd |
0040101C | 5D | pop ebp |
0040101D | 3227 | xor ah,byte ptr ds:[edi] |
0040101F | 6A 1A | push 1A |
00401021 | D99D 5E9C5D5A | fstp dword ptr ss:[ebp+5A5D9C5E],st(0) |
00401027 | 1D 9D5D326E | sbb eax,6E325D9D |
0040102C | 6A 1A | push 1A |
0040102E | D99D 5E9C5D5A | fstp dword ptr ss:[ebp+5A5D9C5E],st(0) |
00401034 | 1D 3C9D5D30 | sbb eax,305D9D3C |
00401039 | 5A | pop edx | edx:"j"
0040103A | D99D 589D5DB2 | fstp dword ptr ss:[ebp-4DA262A8],st(0) |
00401040 | 6A 58 | push 58 |
00401042 | 5A | pop edx | edx:"j"
00401043 | D99D 5E9C5D5A | fstp dword ptr ss:[ebp+5A5D9C5E],st(0) |
00401049 | 1D 3C9D5DB1 | sbb eax,B15D9D3C |
0040104E | 1E | push ds |
0040104F | D9B5 7EA58DB2 | fnstenv m28 ptr ss:[ebp-4D725A82] |
00401055 | 9D | popfd |
00401056 | 58 | pop eax |
00401057 | 5A | pop edx | edx:"j"
00401058 | 5A | pop edx | edx:"j"
00401059 | B2 3E | mov dl,3E | 3E:'>'
0040105B | 58 | pop eax |
0040105C | 5A | pop edx | edx:"j"
0040105D | 5A | pop edx | edx:"j"
0040105E | B1 4F | mov cl,4F | 4F:'O'
00401060 | 8C02 | mov word ptr ds:[edx],es | edx:"j"
00401062 | AA | stosb |
00401063 | D209 | ror byte ptr ds:[ecx],cl |
00401065 | 1F | pop ds |
00401066 | 48 | dec eax |
00401067 | 53 | push ebx |
00401068 | 1843 D9 | sbb byte ptr ds:[ebx-27],al |
0040106B | 9D | popfd |
0040106C | 4B | dec ebx |
0040106D | 3C 9D | cmp al,9D |
0040106F | 5D | pop ebp |
00401070 | 3050 D9 | xor byte ptr ds:[eax-27],dl |
00401073 | 9D | popfd |
00401074 | 58 | pop eax |
00401075 | 9D | popfd |
00401076 | 5D | pop ebp |
00401077 | A5 | movsd |
00401078 | 6F | outsd |
00401079 | 6E | outsb |
0040107A | 6BD9 9D | imul ebx,ecx,FFFFFF9D |
0040107D | 5E | pop esi |
0040107E | 3C 9D | cmp al,9D |
00401080 | 5D | pop ebp |
00401081 | 1A5A D9 | sbb bl,byte ptr ds:[edx-27] | edx-27:"%0 @"
00401084 | 9D | popfd |
00401085 | 58 | pop eax |
00401086 | 3C 9D | cmp al,9D |
00401088 | 5D | pop ebp |
00401089 | 305A D9 | xor byte ptr ds:[edx-27],bl | edx-27:"%0 @"
0040108C | 9D | popfd |
0040108D | 58 | pop eax |
0040108E | 9D | popfd |
0040108F | 5D | pop ebp |
00401090 | A5 | movsd |
00401091 | 6F | outsd |
00401092 | 6A 6B | push 6B |
00401094 | D99D 5E3C9D5D | fstp dword ptr ss:[ebp+5D9D3C5E],st(0) |
0040109A | 1A5A D9 | sbb bl,byte ptr ds:[edx-27] | edx-27:"%0 @"
0040109D | 9D | popfd |
0040109E | 58 | pop eax |
0040109F | 9D | popfd |
004010A0 | 5D | pop ebp |
004010A1 | B2 CA | mov dl,CA |
004010A3 | 5A | pop edx | edx:"j"
004010A4 | 5A | pop edx | edx:"j"
004010A5 | D99D 5E9C5D5A | fstp dword ptr ss:[ebp+5A5D9C5E],st(0) |
004010AB | 1D 3C9D5DB1 | sbb eax,B15D9D3C |
004010B0 | 76 D9 | jbe reverseme(1).40108B |
004010B2 | B5 4F | mov ch,4F | 4F:'O'
004010B4 | A5 | movsd |
004010B5 | 8D0F | lea ecx,dword ptr ds:[edi] |
004010B7 | D1B6 D99EEA9D | shl dword ptr ds:[esi-62156127],1 |
004010BD | 1F | pop ds |
004010BE | 8A6A 5A | mov ch,byte ptr ds:[edx+5A] |
004010C1 | 5A | pop edx | edx:"j"
004010C2 | 5A | pop edx | edx:"j"
004010C3 | 9D | popfd |
004010C4 | 1F | pop ds |
004010C5 | 8E59 5A | mov ds,word ptr ds:[ecx+5A] |
004010C8 | 5A | pop edx | edx:"j"
004010C9 | 5A | pop edx | edx:"j"
004010CA | 9D | popfd |
004010CB | 1F | pop ds |
004010CC | 82C1 4B | add cl,4B |
004010CF | 1A5A 9D | sbb bl,byte ptr ds:[edx-63] | edx-63:"%( @"
004010D2 | 1F | pop ds |
004010D3 | 865A 5A | xchg byte ptr ds:[edx+5A],bl |
004010D6 | 5A | pop edx | edx:"j"
004010D7 | 5A | pop edx | edx:"j"
004010D8 | 9D | popfd |
004010D9 | 1F | pop ds |
004010DA | BA 5A5A5A5A | mov edx,5A5A5A5A | edx:"j"
004010DF | A5 | movsd |
004010E0 | 6F | outsd |
004010E1 | 6A 6B | push 6B |
004010E3 | 1A5A D5 | sbb bl,byte ptr ds:[edx-2B] | edx-2B:" @"
004010E6 | 1F | pop ds |
004010E7 | BE 9D1FAA5C | mov esi,5CAA1F9D |
004010EC | 5A | pop edx | edx:"j"
004010ED | 5A | pop edx | edx:"j"
004010EE | 5A | pop edx | edx:"j"
004010EF | 9D | popfd |
004010F0 | 1F | pop ds |
004010F1 | AE | scasb |
004010F2 | 5A | pop edx | edx:"j"
004010F3 | 5A | pop edx | edx:"j"
004010F4 | 5A | pop edx | edx:"j"
004010F5 | 5A | pop edx | edx:"j"
004010F6 | 9D | popfd |
004010F7 | 1F | pop ds |
004010F8 | A2 5A6A1A5A | mov byte ptr ds:[5A1A6A5A],al |
004010FD | 305B A5 | xor byte ptr ds:[ebx-5B],bl |
00401100 | 2F | das |
00401101 | BE B21D5B5A | mov esi,5A5B1DB2 |
00401106 | 5A | pop edx | edx:"j"
00401107 | D31F | rcr dword ptr ds:[edi],cl |
00401109 | B2 D3 | mov dl,D3 |
0040110B | 1F | pop ds |
0040110C | A6 | cmpsb |
0040110D | 325A 25 | xor bl,byte ptr ds:[edx+25] |
00401110 | 5A | pop edx | edx:"j"
00401111 | 5A | pop edx | edx:"j"
00401112 | 305A B2 | xor byte ptr ds:[edx-4E],bl | edx-4E:"@"
00401115 | 75 5B | jne reverseme(1).401172 |
00401117 | 5A | pop edx | edx:"j"
00401118 | 5A | pop edx | edx:"j"
00401119 | D31F | rcr dword ptr ds:[edi],cl |
0040111B | B6 D7 | mov dh,D7 |
0040111D | 1F | pop ds |
0040111E | 8A0A | mov cl,byte ptr ds:[edx] | edx:"j"
00401120 | B2 61 | mov dl,61 | 61:'a'
00401122 | 5B | pop ebx |
00401123 | 5A | pop edx | edx:"j"
00401124 | 5A | pop edx | edx:"j"
00401125 | 305A A5 | xor byte ptr ds:[edx-5B],bl | edx-5B:" @"
00401128 | 2F | das |
00401129 | 52 | push edx | edx:"j"
0040112A | 305A 30 | xor byte ptr ds:[edx+30],bl | edx+30:"1@"
0040112D | 5A | pop edx | edx:"j"
0040112E | 32D8 | xor bl,al |
00401130 | 5A | pop edx | edx:"j"
00401131 | 5A | pop edx | edx:"j"
00401132 | 5A | pop edx | edx:"j"
00401133 | 3276 5B | xor dh,byte ptr ds:[esi+5B] |
00401136 | 5A | pop edx | edx:"j"
00401137 | 5A | pop edx | edx:"j"
00401138 | 325A 5A | xor bl,byte ptr ds:[edx+5A] |
0040113B | 5A | pop edx | edx:"j"
0040113C | DA32 | fidiv st(0),dword ptr ds:[edx] | edx:"j"
0040113E | 5A | pop edx | edx:"j"
0040113F | 5A | pop edx | edx:"j"
00401140 | 5A | pop edx | edx:"j"
00401141 | DA32 | fidiv st(0),dword ptr ds:[edx] | edx:"j"
00401143 | 5A | pop edx | edx:"j"
00401144 | 5A | pop edx | edx:"j"
00401145 | 92 | xchg edx,eax | edx:"j"
00401146 | 5A | pop edx | edx:"j"
00401147 | 3248 6A | xor cl,byte ptr ds:[eax+6A] |
0040114A | 1A5A 32 | sbb bl,byte ptr ds:[edx+32] |
0040114D | 5A | pop edx | edx:"j"
0040114E | 6A 1A | push 1A |
00401150 | 5A | pop edx | edx:"j"
00401151 | 3052 B2 | xor byte ptr ds:[edx-4E],dl | edx-4E:"@"
00401154 | 9C | pushfd |
00401155 | 5A | pop edx | edx:"j"
00401156 | 5A | pop edx | edx:"j"
00401157 | 5A | pop edx | edx:"j"
00401158 | D31F | rcr dword ptr ds:[edi],cl |
0040115A | EA 305BA52F EAB2 | jmp far B2EA:2FA55B30 |
00401161 | 5B | pop ebx |
00401162 | 5B | pop ebx |
00401163 | 5A | pop edx | edx:"j"
00401164 | 5A | pop edx | edx:"j"
00401165 | A5 | movsd |
00401166 | 2F | das |
00401167 | EA B25F5B5A 5A30 | jmp far 305A:5A5B5FB2 |
0040116E | 5A | pop edx | edx:"j"
0040116F | 305A 30 | xor byte ptr ds:[edx+30],bl | edx+30:"1@"
00401172 | 5A | pop edx | edx:"j"
00401173 | D7 | xlat |
00401174 | 1F | pop ds |
00401175 | EE | out dx,al |
00401176 | 0AB2 9C5A5A5A | or dh,byte ptr ds:[edx+5A5A5A9C] |
0040117C | 51 | push ecx |
0040117D | 9A 2E4ED71F EE0A | call far AEE:1FD74E2E |
00401184 | B2 B9 | mov dl,B9 |
00401186 | 5A | pop edx | edx:"j"
00401187 | 5A | pop edx | edx:"j"
00401188 | 5A | pop edx | edx:"j"
00401189 | D7 | xlat |
0040118A | 1F | pop ds |
0040118B | EE | out dx,al |
0040118C | 0AB2 C25A5A5A | or dh,byte ptr ds:[edx+5A5A5AC2] |
00401192 | B1 83 | mov cl,83 |
00401194 | D11F | rcr dword ptr ds:[edi],1 |
00401196 | E6 93 | out 93,al |
00401198 | 98 | cwde |
00401199 | 4A | dec edx | edx:"j"
0040119A | 5A | pop edx | edx:"j"
0040119B | 0FD1B6 D99EF6D9 | psrlw mm6,qword ptr ds:[esi-26096127] |
004011A2 | 27 | daa |
004011A3 | 56 | push esi |
004011A4 | 58 | pop eax |
004011A5 | 2F | das |
004011A6 | 53 | push ebx |
004011A7 | 305A B2 | xor byte ptr ds:[edx-4E],bl | edx-4E:"@"
004011AA | F65A 5A | neg byte ptr ds:[edx+5A] |
004011AD | 5A | pop edx | edx:"j"
004011AE | B1 06 | mov cl,6 |
004011B0 | D927 | fldenv m28 ptr ds:[edi] |
004011B2 | 56 | push esi |
004011B3 | 55 | push ebp |
004011B4 | 2F | das |
004011B5 | 1BD7 | sbb edx,edi | edx:"j"
004011B7 | 1F | pop ds |
004011B8 | E6 0A | out A,al |
004011BA | A5 | movsd |
004011BB | 2F | das |
004011BC | 52 | push edx | edx:"j"
004011BD | B2 0C | mov dl,C | C:'\f'
004011BF | 5A | pop edx | edx:"j"
004011C0 | 5A | pop edx | edx:"j"
004011C1 | 5A | pop edx | edx:"j"
004011C2 | D31F | rcr dword ptr ds:[edi],cl |
004011C4 | A6 | cmpsb |
004011C5 | D7 | xlat |
004011C6 | 1F | pop ds |
004011C7 | F60A A5 | test byte ptr ds:[edx],A5 | edx:"j"
004011CA | 2F | das |
004011CB | 52 | push edx | edx:"j"
004011CC | B2 31 | mov dl,31 | 31:'1'
004011CE | 5A | pop edx | edx:"j"
004011CF | 5A | pop edx | edx:"j"
004011D0 | 5A | pop edx | edx:"j"
004011D1 | 324F 7A | xor cl,byte ptr ds:[edi+7A] |
004011D4 | 5A | pop edx | edx:"j"
004011D5 | 5A | pop edx | edx:"j"
004011D6 | D7 | xlat |
004011D7 | 1F | pop ds |
004011D8 | F60A 30 | test byte ptr ds:[edx],30 | edx:"j"
004011DB | A5 | movsd |
004011DC | 32D3 | xor dl,bl |
004011DE | 6A 1A | push 1A |
004011E0 | 5A | pop edx | edx:"j"
004011E1 | A5 | movsd |
004011E2 | 2F | das |
004011E3 | A6 | cmpsb |
004011E4 | B2 1D | mov dl,1D |
004011E6 | 5A | pop edx | edx:"j"
004011E7 | 5A | pop edx | edx:"j"
004011E8 | 5A | pop edx | edx:"j"
004011E9 | D7 | xlat |
004011EA | 1F | pop ds |
004011EB | E6 0A | out A,al |
004011ED | A5 | movsd |
004011EE | 2F | das |
004011EF | 52 | push edx | edx:"j"
004011F0 | B2 1B | mov dl,1B |
004011F2 | 5A | pop edx | edx:"j"
004011F3 | 5A | pop edx | edx:"j"
004011F4 | 5A | pop edx | edx:"j"
004011F5 | B1 4F | mov cl,4F | 4F:'O'
004011F7 | A5 | movsd |
004011F8 | 2F | das |
004011F9 | 4E | dec esi |
004011FA | A5 | movsd |
004011FB | 2F | das |
004011FC | 4A | dec edx | edx:"j"
004011FD | A5 | movsd |
004011FE | 2F | das |
004011FF | 56 | push esi |
00401200 | A5 | movsd |
00401201 | 2F | das |
00401202 | 52 | push edx | edx:"j"
00401203 | B2 46 | mov dl,46 | 46:'F'
00401205 | 5A | pop edx | edx:"j"
00401206 | 5A | pop edx | edx:"j"
00401207 | 5A | pop edx | edx:"j"
00401208 | 93 | xchg ebx,eax |
00401209 | 98 | cwde |
0040120A | 4A | dec edx | edx:"j"
0040120B | 5A | pop edx | edx:"j"
0040120C | 699A 93984A5A 0AB23A5 | imul ebx,dword ptr ds:[edx+5A4A9893],5A3 |
00401216 | 5A | pop edx | edx:"j"
00401217 | 5A | pop edx | edx:"j"
// XOR過後(解密後)
00401000 | B8 00304000 | mov eax,reverseme(1).403000 | eax:sub_401218
00401005 | 8030 B3 | xor byte ptr ds:[eax],B3 | eax:sub_401218
00401008 | 40 | inc eax | eax:sub_401218
00401009 | 3D 28314000 | cmp eax,reverseme(1).403128 | eax:sub_401218
0040100E | 7C F5 | jl reverseme(1).401005 |
00401010 | 40 | inc eax | eax:sub_401218
00401011 < | 33C0 | xor eax,eax | eax:sub_401218
00401013 | 66:C707 6A00 | mov word ptr ds:[edi],6A | edi:sub_401011, 6A:'j'
00401018 | 83C7 02 | add edi,2 | edi:sub_401011
0040101B | C707 687D3040 | mov dword ptr ds:[edi],40307D68 | edi:sub_401011
00401021 | 83C7 04 | add edi,4 | edi:sub_401011
00401024 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
00401027 | 47 | inc edi | edi:sub_401011
00401028 | C707 68343040 | mov dword ptr ds:[edi],40303468 | edi:sub_401011
0040102E | 83C7 04 | add edi,4 | edi:sub_401011
00401031 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
00401034 | 47 | inc edi | edi:sub_401011
00401035 | 66:C707 6A00 | mov word ptr ds:[edi],6A | edi:sub_401011, 6A:'j'
0040103A | 83C7 02 | add edi,2 | edi:sub_401011
0040103D | C707 E8300200 | mov dword ptr ds:[edi],230E8 | edi:sub_401011, 230E8:L"lydbg.exe"
00401043 | 83C7 04 | add edi,4 | edi:sub_401011
00401046 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
00401049 | 47 | inc edi | edi:sub_401011
0040104A | 66:C707 EB44 | mov word ptr ds:[edi],44EB | edi:sub_401011
0040104F | 83EF 24 | sub edi,24 | edi:sub_401011
00401052 | FFD7 | call edi | edi:sub_401011
00401054 | E8 C7020000 | call <reverseme(1).sub_401320> |
00401059 | E8 64020000 | call reverseme(1).4012C2 |
0040105E | EB 15 | jmp reverseme(1).401075 |
00401060 | D6 | salc |
00401061 | 58 | pop eax | eax:sub_401218
00401062 | F0 | ??? |
00401063 | 8853 45 | mov byte ptr ds:[ebx+45],dl |
00401066 | 1209 | adc cl,byte ptr ds:[ecx] |
00401068 | 42 | inc edx | edx:"j"
00401069 | 1983 C71166C7 | sbb dword ptr ds:[ebx-3899EE39],eax | eax:sub_401218
0040106F | 07 | pop es |
00401070 | 6A 0A | push A |
00401072 | 83C7 02 | add edi,2 | edi:sub_401011
00401075 | C707 FF353431 | mov dword ptr ds:[edi],313435FF | edi:sub_401011
0040107B | 83C7 04 | add edi,4 | edi:sub_401011
0040107E | 66:C707 4000 | mov word ptr ds:[edi],40 | edi:sub_401011, 40:'@'
00401083 | 83C7 02 | add edi,2 | edi:sub_401011
00401086 | 66:C707 6A00 | mov word ptr ds:[edi],6A | edi:sub_401011, 6A:'j'
0040108B | 83C7 02 | add edi,2 | edi:sub_401011
0040108E | C707 FF353031 | mov dword ptr ds:[edi],313035FF | edi:sub_401011
00401094 | 83C7 04 | add edi,4 | edi:sub_401011
00401097 | 66:C707 4000 | mov word ptr ds:[edi],40 | edi:sub_401011, 40:'@'
0040109C | 83C7 02 | add edi,2 | edi:sub_401011
0040109F | C707 E8900000 | mov dword ptr ds:[edi],90E8 | edi:sub_401011
004010A5 | 83C7 04 | add edi,4 | edi:sub_401011
004010A8 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
004010AB | 47 | inc edi | edi:sub_401011
004010AC | 66:C707 EB2C | mov word ptr ds:[edi],2CEB | edi:sub_401011
004010B1 | 83EF 15 | sub edi,15 | edi:sub_401011
004010B4 | FFD7 | call edi | edi:sub_401011
004010B6 | 55 | push ebp |
004010B7 | 8BEC | mov ebp,esp |
004010B9 | 83C4 B0 | add esp,FFFFFFB0 |
004010BC | C745 D0 30000000 | mov dword ptr ss:[ebp-30],30 | 30:'0'
004010C3 | C745 D4 03000000 | mov dword ptr ss:[ebp-2C],3 |
004010CA | C745 D8 9B114000 | mov dword ptr ss:[ebp-28],reverseme(1).4 |
004010D1 | C745 DC 00000000 | mov dword ptr ss:[ebp-24],0 |
004010D8 | C745 E0 00000000 | mov dword ptr ss:[ebp-20],0 |
004010DF | FF35 30314000 | push dword ptr ds:[403130] |
004010E5 | 8F45 E4 | pop dword ptr ss:[ebp-1C] |
004010E8 | C745 F0 06000000 | mov dword ptr ss:[ebp-10],6 |
004010EF | C745 F4 00000000 | mov dword ptr ss:[ebp-C],0 | [ebp-C]:sub_401291+D
004010F6 | C745 F8 00304000 | mov dword ptr ss:[ebp-8],reverseme(1).40 |
004010FD | 6A 01 | push 1 |
004010FF | FF75 E4 | push dword ptr ss:[ebp-1C] |
00401102 | E8 47010000 | call <JMP.&LoadIconA> |
00401107 | 8945 E8 | mov dword ptr ss:[ebp-18],eax | eax:sub_401218
0040110A | 8945 FC | mov dword ptr ss:[ebp-4],eax | eax:sub_401218
0040110D | 68 007F0000 | push 7F00 |
00401112 | 6A 00 | push 0 |
00401114 | E8 2F010000 | call <JMP.&LoadCursorA> |
00401119 | 8945 EC | mov dword ptr ss:[ebp-14],eax | eax:sub_401218
0040111C | 8D45 D0 | lea eax,dword ptr ss:[ebp-30] | eax:sub_401218
0040111F | 50 | push eax | eax:sub_401218
00401120 | E8 3B010000 | call <JMP.&RegisterClassExA> |
00401125 | 6A 00 | push 0 |
00401127 | FF75 08 | push dword ptr ss:[ebp+8] |
0040112A | 6A 00 | push 0 |
0040112C | 6A 00 | push 0 |
0040112E | 68 82000000 | push 82 |
00401133 | 68 2C010000 | push 12C |
00401138 | 68 00000080 | push 80000000 |
0040113D | 68 00000080 | push 80000000 |
00401142 | 68 0000C800 | push C80000 |
00401147 | 68 12304000 | push reverseme(1).403012 |
0040114C | 68 00304000 | push reverseme(1).403000 |
00401151 | 6A 08 | push 8 |
00401153 | E8 C6000000 | call <JMP.&CreateWindowExA> |
00401158 | 8945 B0 | mov dword ptr ss:[ebp-50],eax | eax:sub_401218
0040115B | 6A 01 | push 1 |
0040115D | FF75 B0 | push dword ptr ss:[ebp-50] |
00401160 | E8 01010000 | call <JMP.&ShowWindow> |
00401165 | FF75 B0 | push dword ptr ss:[ebp-50] |
00401168 | E8 05010000 | call <JMP.&UpdateWindow> |
0040116D | 6A 00 | push 0 |
0040116F | 6A 00 | push 0 |
00401171 | 6A 00 | push 0 |
00401173 | 8D45 B4 | lea eax,dword ptr ss:[ebp-4C] | eax:sub_401218
00401176 | 50 | push eax | eax:sub_401218
00401177 | E8 C6000000 | call <JMP.&GetMessageA> |
0040117C | 0BC0 | or eax,eax | eax:sub_401218
0040117E | 74 14 | je reverseme(1).401194 |
00401180 | 8D45 B4 | lea eax,dword ptr ss:[ebp-4C] | eax:sub_401218
00401183 | 50 | push eax | eax:sub_401218
00401184 | E8 E3000000 | call <JMP.&TranslateMessage> |
00401189 | 8D45 B4 | lea eax,dword ptr ss:[ebp-4C] | eax:sub_401218
0040118C | 50 | push eax | eax:sub_401218
0040118D | E8 98000000 | call <JMP.&DispatchMessageA> |
00401192 | EB D9 | jmp reverseme(1).40116D |
00401194 | 8B45 BC | mov eax,dword ptr ss:[ebp-44] | eax:sub_401218
00401197 | C9 | leave |
00401198 | C2 1000 | ret 10 |
0040119B | 55 | push ebp |
0040119C | 8BEC | mov ebp,esp |
0040119E | 83C4 AC | add esp,FFFFFFAC |
004011A1 | 837D 0C 02 | cmp dword ptr ss:[ebp+C],2 |
004011A5 | 75 09 | jne reverseme(1).4011B0 |
004011A7 | 6A 00 | push 0 |
004011A9 | E8 AC000000 | call <JMP.&PostQuitMessage> |
004011AE | EB 5C | jmp reverseme(1).40120C |
004011B0 | 837D 0C 0F | cmp dword ptr ss:[ebp+C],F |
004011B4 | 75 41 | jne reverseme(1).4011F7 |
004011B6 | 8D45 BC | lea eax,dword ptr ss:[ebp-44] | eax:sub_401218
004011B9 | 50 | push eax | eax:sub_401218
004011BA | FF75 08 | push dword ptr ss:[ebp+8] |
004011BD | E8 56000000 | call <JMP.&BeginPaint> |
004011C2 | 8945 FC | mov dword ptr ss:[ebp-4],eax | eax:sub_401218
004011C5 | 8D45 AC | lea eax,dword ptr ss:[ebp-54] | eax:sub_401218
004011C8 | 50 | push eax | eax:sub_401218
004011C9 | FF75 08 | push dword ptr ss:[ebp+8] |
004011CC | E8 6B000000 | call <JMP.&GetClientRect> |
004011D1 | 68 15200000 | push 2015 |
004011D6 | 8D45 AC | lea eax,dword ptr ss:[ebp-54] | eax:sub_401218
004011D9 | 50 | push eax | eax:sub_401218
004011DA | 6A FF | push FFFFFFFF |
004011DC | 68 89304000 | push reverseme(1).403089 |
004011E1 | FF75 FC | push dword ptr ss:[ebp-4] |
004011E4 | E8 47000000 | call <JMP.&DrawTextA> |
004011E9 | 8D45 BC | lea eax,dword ptr ss:[ebp-44] | eax:sub_401218
004011EC | 50 | push eax | eax:sub_401218
004011ED | FF75 08 | push dword ptr ss:[ebp+8] |
004011F0 | E8 41000000 | call <JMP.&EndPaint> |
004011F5 | EB 15 | jmp reverseme(1).40120C |
004011F7 | FF75 14 | push dword ptr ss:[ebp+14] |
004011FA | FF75 10 | push dword ptr ss:[ebp+10] |
004011FD | FF75 0C | push dword ptr ss:[ebp+C] |
00401200 | FF75 08 | push dword ptr ss:[ebp+8] |
00401203 | E8 1C000000 | call <JMP.&NtdllDefWindowProc_A> |
00401208 | C9 | leave |
00401209 | C2 1000 | ret 10 |
0040120C | 33C0 | xor eax,eax | eax:sub_401218
0040120E | C9 | leave |
0040120F | C2 1000 | ret 10 |
00401212 | 50 | push eax | eax:sub_401218
00401213 | E8 60000000 | call <JMP.&ExitProcess> |在此可以知道在做解密的動作
- 使用
5A解密
- 使用
尚未彈出
Nag視窗
Ctrl + F2重新啟動(S)F8一步一步過到0040129E | E8 6EFDFFFF | call <reverseme(1).sub_401011> |F7步入斷點在
00401011 < | 33C0 | xor eax,eax | eax:sub_401218向下觀察
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
2300401011 < | 33C0 | xor eax,eax | eax:sub_401218
00401013 | 66:C707 6A00 | mov word ptr ds:[edi],6A | edi:sub_401011, 6A:'j'
00401018 | 83C7 02 | add edi,2 | edi:sub_401011
0040101B | C707 687D3040 | mov dword ptr ds:[edi],40307D68 | edi:sub_401011
00401021 | 83C7 04 | add edi,4 | edi:sub_401011
00401024 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
00401027 | 47 | inc edi | edi:sub_401011
00401028 | C707 68343040 | mov dword ptr ds:[edi],40303468 | edi:sub_401011
0040102E | 83C7 04 | add edi,4 | edi:sub_401011
00401031 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
00401034 | 47 | inc edi | edi:sub_401011
00401035 | 66:C707 6A00 | mov word ptr ds:[edi],6A | edi:sub_401011, 6A:'j'
0040103A | 83C7 02 | add edi,2 | edi:sub_401011
0040103D | C707 E8300200 | mov dword ptr ds:[edi],230E8 | edi:sub_401011, 230E8:L"lydbg.exe"
00401043 | 83C7 04 | add edi,4 | edi:sub_401011
00401046 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
00401049 | 47 | inc edi | edi:sub_401011
0040104A | 66:C707 EB44 | mov word ptr ds:[edi],44EB | edi:sub_401011
0040104F | 83EF 24 | sub edi,24 | edi:sub_401011
00401052 | FFD7 | call edi | edi:sub_401011
00401054 | E8 C7020000 | call <reverseme(1).sub_401320> |
00401059 | E8 64020000 | call reverseme(1).4012C2 |
0040105E | EB 15 | jmp reverseme(1).401075 |看到很多類似
mov word ptr ds:[edi],6A- 這些基本上都是在做解密的動作(塞值)
當步過到
00401052 | FFD7 | call edi |彈出
Nag視窗在此可以知道
call edi彈出Nag視窗請特別留意
mov word ptr ds:[edi],6A
Ctrl + F2重新啟動(S)F8一步一步過到0040129E | E8 6EFDFFFF | call <reverseme(1).sub_401011> |F7步入斷點在
00401011 < | 33C0 | xor eax,eax | eax:sub_401218F8一步一步過到0040129E | E8 6EFDFFFF | call <reverseme(1).sub_401011> |F7步入斷點在
00401000 | B8 00304000 | mov eax,reverseme(1).403000 |向下觀察
1
2
3
4
5
6
7
8
9
10
11
1200401000 | B8 00304000 | mov eax,reverseme(1).403000 |
00401005 | 8030 B3 | xor byte ptr ds:[eax],B3 |
00401008 | 40 | inc eax |
00401009 | 3D 28314000 | cmp eax,reverseme(1).403128 |
0040100E | 7C F5 | jl reverseme(1).401005 |
00401010 | 40 | inc eax |
00401011 < | 6A 00 | push 0 |
00401013 | 68 7D304000 | push reverseme(1).40307D |
00401018 | 68 34304000 | push reverseme(1).403034 |
0040101D | 6A 00 | push 0 |
0040101F | E8 30020000 | call <JMP.&MessageBoxA> |
00401024 | EB 44 | jmp reverseme(1).40106A |步過
00401000~00401009這段迴圈(這邊在解密)向下觀察
1
2
3
4
5
6
7
8
9
10
1100401000 | B8 00304000 | mov eax,reverseme(1).403000 | 403000:"ReverseMeTutorial"
00401005 | 8030 B3 | xor byte ptr ds:[eax],B3 |
00401008 | 40 | inc eax |
00401009 | 3D 28314000 | cmp eax,reverseme(1).403128 |
0040100E | 7C F5 | jl reverseme(1).401005 |
00401010 | 40 | inc eax |
00401011 < | 6A 00 | push 0 |
00401013 | 68 7D304000 | push reverseme(1).40307D | 40307D:"TutorialNag"
00401018 | 68 34304000 | push reverseme(1).403034 | 403034:"You need to remove the nag\r\nTry to do it in a two byte patch. \r\nRegards!"
0040101D | 6A 00 | push 0 |
0040101F | E8 30020000 | call <JMP.&MessageBoxA> |00401018 | 68 34304000 | push reverseme(1).403034 | 403034:"You need to remove the nag\r\nTry to do it in a two byte patch. \r\nRegards!"為nag訊息調用了
MessageBoxA0040101D | 6A 00 | push 0 |是該函數的第一個參數
(要建立的消息框的所有者窗口的句柄。如果此參數為NULL，則消息框沒有所有者窗口。)
註：函數：MessageBoxA
註：根據x64dbg - 第十五章 | 反匯編練習(四) 下教學，可以利用push 1的方式阻止彈出視窗。
0040101D總共被加解密了兩次- 第一次被使用
5A解密 - 第二次被使用
6A解密 (6A=6A 00)
- 第一次被使用
根據分析(第二次)
- 將
mov word ptr ds:[edi], 0x6A改為mov word ptr ds:[edi], 0x016A
- 將
此時去走會發現已經不會彈出
Nag視窗但是打補丁後，再次分析會得到
push 5B的結果，並不是我們預期的push 01- 雖然都成功阻止彈出
Nag，但是並不是很好的結果
- 雖然都成功阻止彈出
根據分析(第一次)
- 將
mov word ptr ds:[edi], 0x6A改為mov word ptr ds:[edi], 0x5B6A - 再次打補丁，成功得到
push 1
- 將
註：以上參考了
x64dbg
x64dbg’s documentation!
CSDN billvsme的专栏 的 OllyDbg 使用笔记 （十八）
