Like Share Discussion Bookmark Smile

J.J. Huang   2019-09-06   x64dbg   瀏覽次數:

x64dbg - 第三十二章 | 反匯編練習(二十一)

目標程式

檔案下載:ReverseMe(1).exe
解壓密碼:morosedog


任務目標

  • 移除Nag視窗

分析程式

  • 執行ReverseMe(1).exe
  • 點擊Check
  • 彈出You need to remove the nag try to do it in a two byte patch. Regards! (你需要刪除嘮叨嘗試在兩個字節的補丁中執行此操作。 問候!)
  • 點擊確定
  • 彈出Remove the nag from the ReverseMe. It can be donw in a two bytes patch. But every other solution is fine. This ReverseMe is part of a tutorial. Enjoy! (從ReverseMe中移除嘮叨。 它可以是兩個字節的補丁。 但其他所有解決方案都很好。 這個ReverseMe是教程的一部分。 請享受!)

檢驗顯示是使用MASM32 / TASM32編寫。


額外補充

  • 一般正常的入口點如下

    1
    2
    004CC7E8 < | 55                    | push ebp                                 |
    004CC7E9 | 8BEC | mov ebp,esp |
  • XOR

    1
    2
    3
    4
    5
    a b a⊕b
    1 0 = 1
    1 1 = 0
    0 0 = 0
    0 1 = 1

搜尋思路

  • 使用搜尋字串找關鍵字。

修改思路

  • 跳過Nag

實際分析

  • 開啟ReverseMe(1).exe

  • 於反匯編視窗點選右鍵選擇搜尋(S)->目前模組->字串引用(S)

  • 搜尋輸入Regis

    1
    2
    3
    4
    5
    位址       反組譯                          字串                                                                            
    004000D9 add dword ptr ds:[4000C],eax L"4"
    004012B1 push reverseme(1).40317D "TutorialNag"
    004012B6 push reverseme(1).403134 "You need to remove the nag\r\nTry to do it in a two byte patch. \r\nRegards!"
    004012F7 push dword ptr ds:[403134] "You need to remove the nag\r\nTry to do it in a two byte patch. \r\nRegards!"
  • 004012B6004012F7設定中斷點

  • F9執行程式

  • 彈出Nag視窗You need to remove the nag try to do it in a two byte patch. Regards!

  • 點擊確定

  • 彈出Remove the nag from the ReverseMe. It can be donw in a two bytes patch. But every other solution is fine. This ReverseMe is part of a tutorial. Enjoy!

  • 點擊X關閉

  • 程序結束

  • 始終沒有斷點在設定德中斷點

  • 在此可以確認這些是用來欺騙的代碼


  • Ctrl + F2重新啟動(S)

  • F8一步一步過,並持續觀察

    1
    2
    3
    4
    5
    6
    00401288 < | 6A 00                 | push 0                                   |
    0040128A | E8 EFFFFFFF | call <JMP.&GetModuleHandleA> |
    0040128F | A3 30314000 | mov dword ptr ds:[403130],eax |
    00401294 | BF 11104000 | mov edi,<reverseme(1).sub_401011> | 401011:"j"
    00401299 | E8 71000000 | call <reverseme(1).sub_40130F> |
    0040129E | E8 6EFDFFFF | call <reverseme(1).sub_401011> |
  • 執行到0040129E | E8 6EFDFFFF | call <reverseme(1).sub_401011> |彈出Nag

  • 可以發現有兩個Call,針對這兩個Call進行分析

    • call <reverseme(1).sub_40130F>
    • call <reverseme(1).sub_401011>
  • Ctrl + F2重新啟動(S)

  • F8一步一步過到00401299 | E8 71000000 | call <reverseme(1).sub_40130F> |

  • F7步入

  • 斷點在0040130F < | B8 00104000 | mov eax,reverseme(1).401000 |

  • 向下觀察

    1
    2
    3
    4
    5
    6
    0040130F < | B8 00104000           | mov eax,reverseme(1).401000              |
    00401314 | 8030 5A | xor byte ptr ds:[eax],5A |
    00401317 | 40 | inc eax |
    00401318 | 3D 18124000 | cmp eax,<JMP.&BeginPaint> |
    0040131D | 7C F5 | jl reverseme(1).401314 |
    0040131F | C3 | ret |
  • mov eax,reverseme(1).401000

    • eax塞入00401000
  • xor byte ptr ds:[eax],5A

    • eax進行xor, 5A
  • inc eax

    • eax加一
  • cmp eax,<JMP.&BeginPaint>

    • 比較eax是否與<JMP.&BeginPaint>相同
  • jl reverseme(1).401314

    • 不成立跳轉回401314 (迴圈)
  • 根據上方的分析會將00401000 ~ 00401217 這區塊做xor,5A處理。

  • 以下是xor前和後的紀錄

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    96
    97
    98
    99
    100
    101
    102
    103
    104
    105
    106
    107
    108
    109
    110
    111
    112
    113
    114
    115
    116
    117
    118
    119
    120
    121
    122
    123
    124
    125
    126
    127
    128
    129
    130
    131
    132
    133
    134
    135
    136
    137
    138
    139
    140
    141
    142
    143
    144
    145
    146
    147
    148
    149
    150
    151
    152
    153
    154
    155
    156
    157
    158
    159
    160
    161
    162
    163
    164
    165
    166
    167
    168
    169
    170
    171
    172
    173
    174
    175
    176
    177
    178
    179
    180
    181
    182
    183
    184
    185
    186
    187
    188
    189
    190
    191
    192
    193
    194
    195
    196
    197
    198
    199
    200
    201
    202
    203
    204
    205
    206
    207
    208
    209
    210
    211
    212
    213
    214
    215
    216
    217
    218
    219
    220
    221
    222
    223
    224
    225
    226
    227
    228
    229
    230
    231
    232
    233
    234
    235
    236
    237
    238
    239
    240
    241
    242
    243
    244
    245
    246
    247
    248
    249
    250
    251
    252
    253
    254
    255
    256
    257
    258
    259
    260
    261
    262
    263
    264
    265
    266
    267
    268
    269
    270
    271
    272
    273
    274
    275
    276
    277
    278
    279
    280
    281
    282
    283
    284
    285
    286
    287
    288
    289
    290
    291
    292
    293
    294
    295
    296
    297
    298
    299
    300
    301
    302
    303
    304
    305
    306
    307
    308
    309
    310
    311
    312
    313
    314
    315
    316
    317
    318
    319
    320
    321
    322
    323
    324
    325
    326
    327
    328
    329
    330
    331
    332
    333
    334
    335
    336
    337
    338
    339
    340
    341
    342
    343
    344
    345
    346
    347
    348
    349
    350
    351
    352
    353
    354
    355
    356
    357
    358
    359
    360
    361
    362
    363
    364
    365
    366
    367
    368
    369
    370
    371
    372
    373
    374
    375
    376
    377
    378
    379
    380
    381
    382
    383
    384
    385
    386
    387
    388
    389
    390
    391
    392
    393
    394
    395
    396
    397
    398
    399
    400
    401
    402
    403
    404
    405
    406
    407
    408
    409
    410
    411
    412
    413
    414
    415
    416
    417
    418
    419
    420
    421
    422
    423
    424
    425
    426
    427
    428
    429
    430
    431
    432
    433
    434
    435
    436
    437
    438
    439
    440
    441
    442
    443
    444
    445
    446
    447
    448
    449
    450
    451
    452
    453
    454
    455
    456
    457
    458
    459
    460
    461
    462
    463
    464
    465
    466
    467
    468
    // XOR之前的代碼(解密前)
    00401000 | E2 5A | loop reverseme(1).40105C |
    00401002 | 6A 1A | push 1A |
    00401004 | 5A | pop edx | edx:"j"
    00401005 | DA6A E9 | fisubr st(0),dword ptr ds:[edx-17] |
    00401008 | 1A67 72 | sbb ah,byte ptr ds:[edi+72] |
    0040100B | 6B1A 5A | imul ebx,dword ptr ds:[edx],5A | edx:"j"
    0040100E | 26:AF | scasd |
    00401010 | 1A69 9A | sbb ch,byte ptr ds:[ecx-66] |
    00401013 | 3C 9D | cmp al,9D |
    00401015 | 5D | pop ebp |
    00401016 | 305A D9 | xor byte ptr ds:[edx-27],bl | edx-27:"%0 @"
    00401019 | 9D | popfd |
    0040101A | 58 | pop eax |
    0040101B | 9D | popfd |
    0040101C | 5D | pop ebp |
    0040101D | 3227 | xor ah,byte ptr ds:[edi] |
    0040101F | 6A 1A | push 1A |
    00401021 | D99D 5E9C5D5A | fstp dword ptr ss:[ebp+5A5D9C5E],st(0) |
    00401027 | 1D 9D5D326E | sbb eax,6E325D9D |
    0040102C | 6A 1A | push 1A |
    0040102E | D99D 5E9C5D5A | fstp dword ptr ss:[ebp+5A5D9C5E],st(0) |
    00401034 | 1D 3C9D5D30 | sbb eax,305D9D3C |
    00401039 | 5A | pop edx | edx:"j"
    0040103A | D99D 589D5DB2 | fstp dword ptr ss:[ebp-4DA262A8],st(0) |
    00401040 | 6A 58 | push 58 |
    00401042 | 5A | pop edx | edx:"j"
    00401043 | D99D 5E9C5D5A | fstp dword ptr ss:[ebp+5A5D9C5E],st(0) |
    00401049 | 1D 3C9D5DB1 | sbb eax,B15D9D3C |
    0040104E | 1E | push ds |
    0040104F | D9B5 7EA58DB2 | fnstenv m28 ptr ss:[ebp-4D725A82] |
    00401055 | 9D | popfd |
    00401056 | 58 | pop eax |
    00401057 | 5A | pop edx | edx:"j"
    00401058 | 5A | pop edx | edx:"j"
    00401059 | B2 3E | mov dl,3E | 3E:'>'
    0040105B | 58 | pop eax |
    0040105C | 5A | pop edx | edx:"j"
    0040105D | 5A | pop edx | edx:"j"
    0040105E | B1 4F | mov cl,4F | 4F:'O'
    00401060 | 8C02 | mov word ptr ds:[edx],es | edx:"j"
    00401062 | AA | stosb |
    00401063 | D209 | ror byte ptr ds:[ecx],cl |
    00401065 | 1F | pop ds |
    00401066 | 48 | dec eax |
    00401067 | 53 | push ebx |
    00401068 | 1843 D9 | sbb byte ptr ds:[ebx-27],al |
    0040106B | 9D | popfd |
    0040106C | 4B | dec ebx |
    0040106D | 3C 9D | cmp al,9D |
    0040106F | 5D | pop ebp |
    00401070 | 3050 D9 | xor byte ptr ds:[eax-27],dl |
    00401073 | 9D | popfd |
    00401074 | 58 | pop eax |
    00401075 | 9D | popfd |
    00401076 | 5D | pop ebp |
    00401077 | A5 | movsd |
    00401078 | 6F | outsd |
    00401079 | 6E | outsb |
    0040107A | 6BD9 9D | imul ebx,ecx,FFFFFF9D |
    0040107D | 5E | pop esi |
    0040107E | 3C 9D | cmp al,9D |
    00401080 | 5D | pop ebp |
    00401081 | 1A5A D9 | sbb bl,byte ptr ds:[edx-27] | edx-27:"%0 @"
    00401084 | 9D | popfd |
    00401085 | 58 | pop eax |
    00401086 | 3C 9D | cmp al,9D |
    00401088 | 5D | pop ebp |
    00401089 | 305A D9 | xor byte ptr ds:[edx-27],bl | edx-27:"%0 @"
    0040108C | 9D | popfd |
    0040108D | 58 | pop eax |
    0040108E | 9D | popfd |
    0040108F | 5D | pop ebp |
    00401090 | A5 | movsd |
    00401091 | 6F | outsd |
    00401092 | 6A 6B | push 6B |
    00401094 | D99D 5E3C9D5D | fstp dword ptr ss:[ebp+5D9D3C5E],st(0) |
    0040109A | 1A5A D9 | sbb bl,byte ptr ds:[edx-27] | edx-27:"%0 @"
    0040109D | 9D | popfd |
    0040109E | 58 | pop eax |
    0040109F | 9D | popfd |
    004010A0 | 5D | pop ebp |
    004010A1 | B2 CA | mov dl,CA |
    004010A3 | 5A | pop edx | edx:"j"
    004010A4 | 5A | pop edx | edx:"j"
    004010A5 | D99D 5E9C5D5A | fstp dword ptr ss:[ebp+5A5D9C5E],st(0) |
    004010AB | 1D 3C9D5DB1 | sbb eax,B15D9D3C |
    004010B0 | 76 D9 | jbe reverseme(1).40108B |
    004010B2 | B5 4F | mov ch,4F | 4F:'O'
    004010B4 | A5 | movsd |
    004010B5 | 8D0F | lea ecx,dword ptr ds:[edi] |
    004010B7 | D1B6 D99EEA9D | shl dword ptr ds:[esi-62156127],1 |
    004010BD | 1F | pop ds |
    004010BE | 8A6A 5A | mov ch,byte ptr ds:[edx+5A] |
    004010C1 | 5A | pop edx | edx:"j"
    004010C2 | 5A | pop edx | edx:"j"
    004010C3 | 9D | popfd |
    004010C4 | 1F | pop ds |
    004010C5 | 8E59 5A | mov ds,word ptr ds:[ecx+5A] |
    004010C8 | 5A | pop edx | edx:"j"
    004010C9 | 5A | pop edx | edx:"j"
    004010CA | 9D | popfd |
    004010CB | 1F | pop ds |
    004010CC | 82C1 4B | add cl,4B |
    004010CF | 1A5A 9D | sbb bl,byte ptr ds:[edx-63] | edx-63:"%( @"
    004010D2 | 1F | pop ds |
    004010D3 | 865A 5A | xchg byte ptr ds:[edx+5A],bl |
    004010D6 | 5A | pop edx | edx:"j"
    004010D7 | 5A | pop edx | edx:"j"
    004010D8 | 9D | popfd |
    004010D9 | 1F | pop ds |
    004010DA | BA 5A5A5A5A | mov edx,5A5A5A5A | edx:"j"
    004010DF | A5 | movsd |
    004010E0 | 6F | outsd |
    004010E1 | 6A 6B | push 6B |
    004010E3 | 1A5A D5 | sbb bl,byte ptr ds:[edx-2B] | edx-2B:" @"
    004010E6 | 1F | pop ds |
    004010E7 | BE 9D1FAA5C | mov esi,5CAA1F9D |
    004010EC | 5A | pop edx | edx:"j"
    004010ED | 5A | pop edx | edx:"j"
    004010EE | 5A | pop edx | edx:"j"
    004010EF | 9D | popfd |
    004010F0 | 1F | pop ds |
    004010F1 | AE | scasb |
    004010F2 | 5A | pop edx | edx:"j"
    004010F3 | 5A | pop edx | edx:"j"
    004010F4 | 5A | pop edx | edx:"j"
    004010F5 | 5A | pop edx | edx:"j"
    004010F6 | 9D | popfd |
    004010F7 | 1F | pop ds |
    004010F8 | A2 5A6A1A5A | mov byte ptr ds:[5A1A6A5A],al |
    004010FD | 305B A5 | xor byte ptr ds:[ebx-5B],bl |
    00401100 | 2F | das |
    00401101 | BE B21D5B5A | mov esi,5A5B1DB2 |
    00401106 | 5A | pop edx | edx:"j"
    00401107 | D31F | rcr dword ptr ds:[edi],cl |
    00401109 | B2 D3 | mov dl,D3 |
    0040110B | 1F | pop ds |
    0040110C | A6 | cmpsb |
    0040110D | 325A 25 | xor bl,byte ptr ds:[edx+25] |
    00401110 | 5A | pop edx | edx:"j"
    00401111 | 5A | pop edx | edx:"j"
    00401112 | 305A B2 | xor byte ptr ds:[edx-4E],bl | edx-4E:"@"
    00401115 | 75 5B | jne reverseme(1).401172 |
    00401117 | 5A | pop edx | edx:"j"
    00401118 | 5A | pop edx | edx:"j"
    00401119 | D31F | rcr dword ptr ds:[edi],cl |
    0040111B | B6 D7 | mov dh,D7 |
    0040111D | 1F | pop ds |
    0040111E | 8A0A | mov cl,byte ptr ds:[edx] | edx:"j"
    00401120 | B2 61 | mov dl,61 | 61:'a'
    00401122 | 5B | pop ebx |
    00401123 | 5A | pop edx | edx:"j"
    00401124 | 5A | pop edx | edx:"j"
    00401125 | 305A A5 | xor byte ptr ds:[edx-5B],bl | edx-5B:" @"
    00401128 | 2F | das |
    00401129 | 52 | push edx | edx:"j"
    0040112A | 305A 30 | xor byte ptr ds:[edx+30],bl | edx+30:"1@"
    0040112D | 5A | pop edx | edx:"j"
    0040112E | 32D8 | xor bl,al |
    00401130 | 5A | pop edx | edx:"j"
    00401131 | 5A | pop edx | edx:"j"
    00401132 | 5A | pop edx | edx:"j"
    00401133 | 3276 5B | xor dh,byte ptr ds:[esi+5B] |
    00401136 | 5A | pop edx | edx:"j"
    00401137 | 5A | pop edx | edx:"j"
    00401138 | 325A 5A | xor bl,byte ptr ds:[edx+5A] |
    0040113B | 5A | pop edx | edx:"j"
    0040113C | DA32 | fidiv st(0),dword ptr ds:[edx] | edx:"j"
    0040113E | 5A | pop edx | edx:"j"
    0040113F | 5A | pop edx | edx:"j"
    00401140 | 5A | pop edx | edx:"j"
    00401141 | DA32 | fidiv st(0),dword ptr ds:[edx] | edx:"j"
    00401143 | 5A | pop edx | edx:"j"
    00401144 | 5A | pop edx | edx:"j"
    00401145 | 92 | xchg edx,eax | edx:"j"
    00401146 | 5A | pop edx | edx:"j"
    00401147 | 3248 6A | xor cl,byte ptr ds:[eax+6A] |
    0040114A | 1A5A 32 | sbb bl,byte ptr ds:[edx+32] |
    0040114D | 5A | pop edx | edx:"j"
    0040114E | 6A 1A | push 1A |
    00401150 | 5A | pop edx | edx:"j"
    00401151 | 3052 B2 | xor byte ptr ds:[edx-4E],dl | edx-4E:"@"
    00401154 | 9C | pushfd |
    00401155 | 5A | pop edx | edx:"j"
    00401156 | 5A | pop edx | edx:"j"
    00401157 | 5A | pop edx | edx:"j"
    00401158 | D31F | rcr dword ptr ds:[edi],cl |
    0040115A | EA 305BA52F EAB2 | jmp far B2EA:2FA55B30 |
    00401161 | 5B | pop ebx |
    00401162 | 5B | pop ebx |
    00401163 | 5A | pop edx | edx:"j"
    00401164 | 5A | pop edx | edx:"j"
    00401165 | A5 | movsd |
    00401166 | 2F | das |
    00401167 | EA B25F5B5A 5A30 | jmp far 305A:5A5B5FB2 |
    0040116E | 5A | pop edx | edx:"j"
    0040116F | 305A 30 | xor byte ptr ds:[edx+30],bl | edx+30:"1@"
    00401172 | 5A | pop edx | edx:"j"
    00401173 | D7 | xlat |
    00401174 | 1F | pop ds |
    00401175 | EE | out dx,al |
    00401176 | 0AB2 9C5A5A5A | or dh,byte ptr ds:[edx+5A5A5A9C] |
    0040117C | 51 | push ecx |
    0040117D | 9A 2E4ED71F EE0A | call far AEE:1FD74E2E |
    00401184 | B2 B9 | mov dl,B9 |
    00401186 | 5A | pop edx | edx:"j"
    00401187 | 5A | pop edx | edx:"j"
    00401188 | 5A | pop edx | edx:"j"
    00401189 | D7 | xlat |
    0040118A | 1F | pop ds |
    0040118B | EE | out dx,al |
    0040118C | 0AB2 C25A5A5A | or dh,byte ptr ds:[edx+5A5A5AC2] |
    00401192 | B1 83 | mov cl,83 |
    00401194 | D11F | rcr dword ptr ds:[edi],1 |
    00401196 | E6 93 | out 93,al |
    00401198 | 98 | cwde |
    00401199 | 4A | dec edx | edx:"j"
    0040119A | 5A | pop edx | edx:"j"
    0040119B | 0FD1B6 D99EF6D9 | psrlw mm6,qword ptr ds:[esi-26096127] |
    004011A2 | 27 | daa |
    004011A3 | 56 | push esi |
    004011A4 | 58 | pop eax |
    004011A5 | 2F | das |
    004011A6 | 53 | push ebx |
    004011A7 | 305A B2 | xor byte ptr ds:[edx-4E],bl | edx-4E:"@"
    004011AA | F65A 5A | neg byte ptr ds:[edx+5A] |
    004011AD | 5A | pop edx | edx:"j"
    004011AE | B1 06 | mov cl,6 |
    004011B0 | D927 | fldenv m28 ptr ds:[edi] |
    004011B2 | 56 | push esi |
    004011B3 | 55 | push ebp |
    004011B4 | 2F | das |
    004011B5 | 1BD7 | sbb edx,edi | edx:"j"
    004011B7 | 1F | pop ds |
    004011B8 | E6 0A | out A,al |
    004011BA | A5 | movsd |
    004011BB | 2F | das |
    004011BC | 52 | push edx | edx:"j"
    004011BD | B2 0C | mov dl,C | C:'\f'
    004011BF | 5A | pop edx | edx:"j"
    004011C0 | 5A | pop edx | edx:"j"
    004011C1 | 5A | pop edx | edx:"j"
    004011C2 | D31F | rcr dword ptr ds:[edi],cl |
    004011C4 | A6 | cmpsb |
    004011C5 | D7 | xlat |
    004011C6 | 1F | pop ds |
    004011C7 | F60A A5 | test byte ptr ds:[edx],A5 | edx:"j"
    004011CA | 2F | das |
    004011CB | 52 | push edx | edx:"j"
    004011CC | B2 31 | mov dl,31 | 31:'1'
    004011CE | 5A | pop edx | edx:"j"
    004011CF | 5A | pop edx | edx:"j"
    004011D0 | 5A | pop edx | edx:"j"
    004011D1 | 324F 7A | xor cl,byte ptr ds:[edi+7A] |
    004011D4 | 5A | pop edx | edx:"j"
    004011D5 | 5A | pop edx | edx:"j"
    004011D6 | D7 | xlat |
    004011D7 | 1F | pop ds |
    004011D8 | F60A 30 | test byte ptr ds:[edx],30 | edx:"j"
    004011DB | A5 | movsd |
    004011DC | 32D3 | xor dl,bl |
    004011DE | 6A 1A | push 1A |
    004011E0 | 5A | pop edx | edx:"j"
    004011E1 | A5 | movsd |
    004011E2 | 2F | das |
    004011E3 | A6 | cmpsb |
    004011E4 | B2 1D | mov dl,1D |
    004011E6 | 5A | pop edx | edx:"j"
    004011E7 | 5A | pop edx | edx:"j"
    004011E8 | 5A | pop edx | edx:"j"
    004011E9 | D7 | xlat |
    004011EA | 1F | pop ds |
    004011EB | E6 0A | out A,al |
    004011ED | A5 | movsd |
    004011EE | 2F | das |
    004011EF | 52 | push edx | edx:"j"
    004011F0 | B2 1B | mov dl,1B |
    004011F2 | 5A | pop edx | edx:"j"
    004011F3 | 5A | pop edx | edx:"j"
    004011F4 | 5A | pop edx | edx:"j"
    004011F5 | B1 4F | mov cl,4F | 4F:'O'
    004011F7 | A5 | movsd |
    004011F8 | 2F | das |
    004011F9 | 4E | dec esi |
    004011FA | A5 | movsd |
    004011FB | 2F | das |
    004011FC | 4A | dec edx | edx:"j"
    004011FD | A5 | movsd |
    004011FE | 2F | das |
    004011FF | 56 | push esi |
    00401200 | A5 | movsd |
    00401201 | 2F | das |
    00401202 | 52 | push edx | edx:"j"
    00401203 | B2 46 | mov dl,46 | 46:'F'
    00401205 | 5A | pop edx | edx:"j"
    00401206 | 5A | pop edx | edx:"j"
    00401207 | 5A | pop edx | edx:"j"
    00401208 | 93 | xchg ebx,eax |
    00401209 | 98 | cwde |
    0040120A | 4A | dec edx | edx:"j"
    0040120B | 5A | pop edx | edx:"j"
    0040120C | 699A 93984A5A 0AB23A5 | imul ebx,dword ptr ds:[edx+5A4A9893],5A3 |
    00401216 | 5A | pop edx | edx:"j"
    00401217 | 5A | pop edx | edx:"j"

    // XOR過後(解密後)
    00401000 | B8 00304000 | mov eax,reverseme(1).403000 | eax:sub_401218
    00401005 | 8030 B3 | xor byte ptr ds:[eax],B3 | eax:sub_401218
    00401008 | 40 | inc eax | eax:sub_401218
    00401009 | 3D 28314000 | cmp eax,reverseme(1).403128 | eax:sub_401218
    0040100E | 7C F5 | jl reverseme(1).401005 |
    00401010 | 40 | inc eax | eax:sub_401218
    00401011 < | 33C0 | xor eax,eax | eax:sub_401218
    00401013 | 66:C707 6A00 | mov word ptr ds:[edi],6A | edi:sub_401011, 6A:'j'
    00401018 | 83C7 02 | add edi,2 | edi:sub_401011
    0040101B | C707 687D3040 | mov dword ptr ds:[edi],40307D68 | edi:sub_401011
    00401021 | 83C7 04 | add edi,4 | edi:sub_401011
    00401024 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
    00401027 | 47 | inc edi | edi:sub_401011
    00401028 | C707 68343040 | mov dword ptr ds:[edi],40303468 | edi:sub_401011
    0040102E | 83C7 04 | add edi,4 | edi:sub_401011
    00401031 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
    00401034 | 47 | inc edi | edi:sub_401011
    00401035 | 66:C707 6A00 | mov word ptr ds:[edi],6A | edi:sub_401011, 6A:'j'
    0040103A | 83C7 02 | add edi,2 | edi:sub_401011
    0040103D | C707 E8300200 | mov dword ptr ds:[edi],230E8 | edi:sub_401011, 230E8:L"lydbg.exe"
    00401043 | 83C7 04 | add edi,4 | edi:sub_401011
    00401046 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
    00401049 | 47 | inc edi | edi:sub_401011
    0040104A | 66:C707 EB44 | mov word ptr ds:[edi],44EB | edi:sub_401011
    0040104F | 83EF 24 | sub edi,24 | edi:sub_401011
    00401052 | FFD7 | call edi | edi:sub_401011
    00401054 | E8 C7020000 | call <reverseme(1).sub_401320> |
    00401059 | E8 64020000 | call reverseme(1).4012C2 |
    0040105E | EB 15 | jmp reverseme(1).401075 |
    00401060 | D6 | salc |
    00401061 | 58 | pop eax | eax:sub_401218
    00401062 | F0 | ??? |
    00401063 | 8853 45 | mov byte ptr ds:[ebx+45],dl |
    00401066 | 1209 | adc cl,byte ptr ds:[ecx] |
    00401068 | 42 | inc edx | edx:"j"
    00401069 | 1983 C71166C7 | sbb dword ptr ds:[ebx-3899EE39],eax | eax:sub_401218
    0040106F | 07 | pop es |
    00401070 | 6A 0A | push A |
    00401072 | 83C7 02 | add edi,2 | edi:sub_401011
    00401075 | C707 FF353431 | mov dword ptr ds:[edi],313435FF | edi:sub_401011
    0040107B | 83C7 04 | add edi,4 | edi:sub_401011
    0040107E | 66:C707 4000 | mov word ptr ds:[edi],40 | edi:sub_401011, 40:'@'
    00401083 | 83C7 02 | add edi,2 | edi:sub_401011
    00401086 | 66:C707 6A00 | mov word ptr ds:[edi],6A | edi:sub_401011, 6A:'j'
    0040108B | 83C7 02 | add edi,2 | edi:sub_401011
    0040108E | C707 FF353031 | mov dword ptr ds:[edi],313035FF | edi:sub_401011
    00401094 | 83C7 04 | add edi,4 | edi:sub_401011
    00401097 | 66:C707 4000 | mov word ptr ds:[edi],40 | edi:sub_401011, 40:'@'
    0040109C | 83C7 02 | add edi,2 | edi:sub_401011
    0040109F | C707 E8900000 | mov dword ptr ds:[edi],90E8 | edi:sub_401011
    004010A5 | 83C7 04 | add edi,4 | edi:sub_401011
    004010A8 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
    004010AB | 47 | inc edi | edi:sub_401011
    004010AC | 66:C707 EB2C | mov word ptr ds:[edi],2CEB | edi:sub_401011
    004010B1 | 83EF 15 | sub edi,15 | edi:sub_401011
    004010B4 | FFD7 | call edi | edi:sub_401011
    004010B6 | 55 | push ebp |
    004010B7 | 8BEC | mov ebp,esp |
    004010B9 | 83C4 B0 | add esp,FFFFFFB0 |
    004010BC | C745 D0 30000000 | mov dword ptr ss:[ebp-30],30 | 30:'0'
    004010C3 | C745 D4 03000000 | mov dword ptr ss:[ebp-2C],3 |
    004010CA | C745 D8 9B114000 | mov dword ptr ss:[ebp-28],reverseme(1).4 |
    004010D1 | C745 DC 00000000 | mov dword ptr ss:[ebp-24],0 |
    004010D8 | C745 E0 00000000 | mov dword ptr ss:[ebp-20],0 |
    004010DF | FF35 30314000 | push dword ptr ds:[403130] |
    004010E5 | 8F45 E4 | pop dword ptr ss:[ebp-1C] |
    004010E8 | C745 F0 06000000 | mov dword ptr ss:[ebp-10],6 |
    004010EF | C745 F4 00000000 | mov dword ptr ss:[ebp-C],0 | [ebp-C]:sub_401291+D
    004010F6 | C745 F8 00304000 | mov dword ptr ss:[ebp-8],reverseme(1).40 |
    004010FD | 6A 01 | push 1 |
    004010FF | FF75 E4 | push dword ptr ss:[ebp-1C] |
    00401102 | E8 47010000 | call <JMP.&LoadIconA> |
    00401107 | 8945 E8 | mov dword ptr ss:[ebp-18],eax | eax:sub_401218
    0040110A | 8945 FC | mov dword ptr ss:[ebp-4],eax | eax:sub_401218
    0040110D | 68 007F0000 | push 7F00 |
    00401112 | 6A 00 | push 0 |
    00401114 | E8 2F010000 | call <JMP.&LoadCursorA> |
    00401119 | 8945 EC | mov dword ptr ss:[ebp-14],eax | eax:sub_401218
    0040111C | 8D45 D0 | lea eax,dword ptr ss:[ebp-30] | eax:sub_401218
    0040111F | 50 | push eax | eax:sub_401218
    00401120 | E8 3B010000 | call <JMP.&RegisterClassExA> |
    00401125 | 6A 00 | push 0 |
    00401127 | FF75 08 | push dword ptr ss:[ebp+8] |
    0040112A | 6A 00 | push 0 |
    0040112C | 6A 00 | push 0 |
    0040112E | 68 82000000 | push 82 |
    00401133 | 68 2C010000 | push 12C |
    00401138 | 68 00000080 | push 80000000 |
    0040113D | 68 00000080 | push 80000000 |
    00401142 | 68 0000C800 | push C80000 |
    00401147 | 68 12304000 | push reverseme(1).403012 |
    0040114C | 68 00304000 | push reverseme(1).403000 |
    00401151 | 6A 08 | push 8 |
    00401153 | E8 C6000000 | call <JMP.&CreateWindowExA> |
    00401158 | 8945 B0 | mov dword ptr ss:[ebp-50],eax | eax:sub_401218
    0040115B | 6A 01 | push 1 |
    0040115D | FF75 B0 | push dword ptr ss:[ebp-50] |
    00401160 | E8 01010000 | call <JMP.&ShowWindow> |
    00401165 | FF75 B0 | push dword ptr ss:[ebp-50] |
    00401168 | E8 05010000 | call <JMP.&UpdateWindow> |
    0040116D | 6A 00 | push 0 |
    0040116F | 6A 00 | push 0 |
    00401171 | 6A 00 | push 0 |
    00401173 | 8D45 B4 | lea eax,dword ptr ss:[ebp-4C] | eax:sub_401218
    00401176 | 50 | push eax | eax:sub_401218
    00401177 | E8 C6000000 | call <JMP.&GetMessageA> |
    0040117C | 0BC0 | or eax,eax | eax:sub_401218
    0040117E | 74 14 | je reverseme(1).401194 |
    00401180 | 8D45 B4 | lea eax,dword ptr ss:[ebp-4C] | eax:sub_401218
    00401183 | 50 | push eax | eax:sub_401218
    00401184 | E8 E3000000 | call <JMP.&TranslateMessage> |
    00401189 | 8D45 B4 | lea eax,dword ptr ss:[ebp-4C] | eax:sub_401218
    0040118C | 50 | push eax | eax:sub_401218
    0040118D | E8 98000000 | call <JMP.&DispatchMessageA> |
    00401192 | EB D9 | jmp reverseme(1).40116D |
    00401194 | 8B45 BC | mov eax,dword ptr ss:[ebp-44] | eax:sub_401218
    00401197 | C9 | leave |
    00401198 | C2 1000 | ret 10 |
    0040119B | 55 | push ebp |
    0040119C | 8BEC | mov ebp,esp |
    0040119E | 83C4 AC | add esp,FFFFFFAC |
    004011A1 | 837D 0C 02 | cmp dword ptr ss:[ebp+C],2 |
    004011A5 | 75 09 | jne reverseme(1).4011B0 |
    004011A7 | 6A 00 | push 0 |
    004011A9 | E8 AC000000 | call <JMP.&PostQuitMessage> |
    004011AE | EB 5C | jmp reverseme(1).40120C |
    004011B0 | 837D 0C 0F | cmp dword ptr ss:[ebp+C],F |
    004011B4 | 75 41 | jne reverseme(1).4011F7 |
    004011B6 | 8D45 BC | lea eax,dword ptr ss:[ebp-44] | eax:sub_401218
    004011B9 | 50 | push eax | eax:sub_401218
    004011BA | FF75 08 | push dword ptr ss:[ebp+8] |
    004011BD | E8 56000000 | call <JMP.&BeginPaint> |
    004011C2 | 8945 FC | mov dword ptr ss:[ebp-4],eax | eax:sub_401218
    004011C5 | 8D45 AC | lea eax,dword ptr ss:[ebp-54] | eax:sub_401218
    004011C8 | 50 | push eax | eax:sub_401218
    004011C9 | FF75 08 | push dword ptr ss:[ebp+8] |
    004011CC | E8 6B000000 | call <JMP.&GetClientRect> |
    004011D1 | 68 15200000 | push 2015 |
    004011D6 | 8D45 AC | lea eax,dword ptr ss:[ebp-54] | eax:sub_401218
    004011D9 | 50 | push eax | eax:sub_401218
    004011DA | 6A FF | push FFFFFFFF |
    004011DC | 68 89304000 | push reverseme(1).403089 |
    004011E1 | FF75 FC | push dword ptr ss:[ebp-4] |
    004011E4 | E8 47000000 | call <JMP.&DrawTextA> |
    004011E9 | 8D45 BC | lea eax,dword ptr ss:[ebp-44] | eax:sub_401218
    004011EC | 50 | push eax | eax:sub_401218
    004011ED | FF75 08 | push dword ptr ss:[ebp+8] |
    004011F0 | E8 41000000 | call <JMP.&EndPaint> |
    004011F5 | EB 15 | jmp reverseme(1).40120C |
    004011F7 | FF75 14 | push dword ptr ss:[ebp+14] |
    004011FA | FF75 10 | push dword ptr ss:[ebp+10] |
    004011FD | FF75 0C | push dword ptr ss:[ebp+C] |
    00401200 | FF75 08 | push dword ptr ss:[ebp+8] |
    00401203 | E8 1C000000 | call <JMP.&NtdllDefWindowProc_A> |
    00401208 | C9 | leave |
    00401209 | C2 1000 | ret 10 |
    0040120C | 33C0 | xor eax,eax | eax:sub_401218
    0040120E | C9 | leave |
    0040120F | C2 1000 | ret 10 |
    00401212 | 50 | push eax | eax:sub_401218
    00401213 | E8 60000000 | call <JMP.&ExitProcess> |
  • 在此可以知道在做解密的動作

    • 使用5A解密
  • 尚未彈出Nag視窗


  • Ctrl + F2重新啟動(S)

  • F8一步一步過到0040129E | E8 6EFDFFFF | call <reverseme(1).sub_401011> |

  • F7步入

  • 斷點在00401011 < | 33C0 | xor eax,eax | eax:sub_401218

  • 向下觀察

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    00401011 < | 33C0                  | xor eax,eax                              | eax:sub_401218
    00401013 | 66:C707 6A00 | mov word ptr ds:[edi],6A | edi:sub_401011, 6A:'j'
    00401018 | 83C7 02 | add edi,2 | edi:sub_401011
    0040101B | C707 687D3040 | mov dword ptr ds:[edi],40307D68 | edi:sub_401011
    00401021 | 83C7 04 | add edi,4 | edi:sub_401011
    00401024 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
    00401027 | 47 | inc edi | edi:sub_401011
    00401028 | C707 68343040 | mov dword ptr ds:[edi],40303468 | edi:sub_401011
    0040102E | 83C7 04 | add edi,4 | edi:sub_401011
    00401031 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
    00401034 | 47 | inc edi | edi:sub_401011
    00401035 | 66:C707 6A00 | mov word ptr ds:[edi],6A | edi:sub_401011, 6A:'j'
    0040103A | 83C7 02 | add edi,2 | edi:sub_401011
    0040103D | C707 E8300200 | mov dword ptr ds:[edi],230E8 | edi:sub_401011, 230E8:L"lydbg.exe"
    00401043 | 83C7 04 | add edi,4 | edi:sub_401011
    00401046 | C607 00 | mov byte ptr ds:[edi],0 | edi:sub_401011
    00401049 | 47 | inc edi | edi:sub_401011
    0040104A | 66:C707 EB44 | mov word ptr ds:[edi],44EB | edi:sub_401011
    0040104F | 83EF 24 | sub edi,24 | edi:sub_401011
    00401052 | FFD7 | call edi | edi:sub_401011
    00401054 | E8 C7020000 | call <reverseme(1).sub_401320> |
    00401059 | E8 64020000 | call reverseme(1).4012C2 |
    0040105E | EB 15 | jmp reverseme(1).401075 |
  • 看到很多類似mov word ptr ds:[edi],6A

    • 這些基本上都是在做解密的動作(塞值)
  • 當步過到00401052 | FFD7 | call edi |

  • 彈出Nag視窗

  • 在此可以知道call edi彈出Nag視窗

  • 請特別留意mov word ptr ds:[edi],6A


  • Ctrl + F2重新啟動(S)

  • F8一步一步過到0040129E | E8 6EFDFFFF | call <reverseme(1).sub_401011> |

  • F7步入

  • 斷點在00401011 < | 33C0 | xor eax,eax | eax:sub_401218

  • F8一步一步過到0040129E | E8 6EFDFFFF | call <reverseme(1).sub_401011> |

  • F7步入

  • 斷點在00401000 | B8 00304000 | mov eax,reverseme(1).403000 |

  • 向下觀察

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    00401000   | B8 00304000           | mov eax,reverseme(1).403000              |
    00401005 | 8030 B3 | xor byte ptr ds:[eax],B3 |
    00401008 | 40 | inc eax |
    00401009 | 3D 28314000 | cmp eax,reverseme(1).403128 |
    0040100E | 7C F5 | jl reverseme(1).401005 |
    00401010 | 40 | inc eax |
    00401011 < | 6A 00 | push 0 |
    00401013 | 68 7D304000 | push reverseme(1).40307D |
    00401018 | 68 34304000 | push reverseme(1).403034 |
    0040101D | 6A 00 | push 0 |
    0040101F | E8 30020000 | call <JMP.&MessageBoxA> |
    00401024 | EB 44 | jmp reverseme(1).40106A |
  • 步過00401000 ~ 00401009 這段迴圈(這邊在解密)

  • 向下觀察

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    00401000   | B8 00304000           | mov eax,reverseme(1).403000              | 403000:"ReverseMeTutorial"
    00401005 | 8030 B3 | xor byte ptr ds:[eax],B3 |
    00401008 | 40 | inc eax |
    00401009 | 3D 28314000 | cmp eax,reverseme(1).403128 |
    0040100E | 7C F5 | jl reverseme(1).401005 |
    00401010 | 40 | inc eax |
    00401011 < | 6A 00 | push 0 |
    00401013 | 68 7D304000 | push reverseme(1).40307D | 40307D:"TutorialNag"
    00401018 | 68 34304000 | push reverseme(1).403034 | 403034:"You need to remove the nag\r\nTry to do it in a two byte patch. \r\nRegards!"
    0040101D | 6A 00 | push 0 |
    0040101F | E8 30020000 | call <JMP.&MessageBoxA> |
  • 00401018 | 68 34304000 | push reverseme(1).403034 | 403034:"You need to remove the nag\r\nTry to do it in a two byte patch. \r\nRegards!"nag訊息

  • 調用了MessageBoxA

  • 0040101D | 6A 00 | push 0 |是該函數的第一個參數
    (要建立的消息框的所有者窗口的句柄。如果此參數為NULL,則消息框沒有所有者窗口。)

註:函數:MessageBoxA
註:根據x64dbg - 第十五章 | 反匯編練習(四) 下教學,可以利用push 1的方式阻止彈出視窗。


  • 0040101D總共被加解密了兩次

    • 第一次被使用5A解密
    • 第二次被使用6A解密 (6A = 6A 00)
  • 根據分析(第二次)

    • mov word ptr ds:[edi], 0x6A 改為 mov word ptr ds:[edi], 0x016A
  • 此時去走會發現已經不會彈出Nag視窗

  • 但是打補丁後,再次分析會得到push 5B的結果,並不是我們預期的push 01

    • 雖然都成功阻止彈出Nag,但是並不是很好的結果
  • 根據分析(第一次)

    • mov word ptr ds:[edi], 0x6A 改為 mov word ptr ds:[edi], 0x5B6A
    • 再次打補丁,成功得到push 1

註:以上參考了
x64dbg
x64dbg’s documentation!
CSDN billvsme的专栏OllyDbg 使用笔记 (十八)