【3.A.S.T】网络安全爱好者 - Powered by Discuz! Board

标题: AD Popup Killer 2.1 解析 [打印本页]

作者: s37su37 时间: 2009-1-24 17:31 标题: AD Popup Killer 2.1 解析

AD Popup Killer 2.1 解析
软件名称： AD Popup Killer 2.1
软件大小： 156KB
加壳方式： N/A
保护方式：注册码
编写语言： Microsoft Visual C++ 6.0
使用工具： OD
操作平台：盗版XP
软件介绍：保护IE不受广告捆扰!
作者声明：只是感兴趣，体验一下kanxue文章书写器，没有其他目的。失误之处敬请诸位大侠赐教!
详细过程：程序无壳，OD载入，使用字符串搜索：
0040B990 .  64:A1 0000000>mov    eax, dword ptr fs:[0]          ;  搜索字符串来到这里
0040B996 .  6A FF       push -1
0040B998 .  68 C8F94000 push 0040F9C8
0040B99D .  50          push eax
0040B99E .  64:8925 00000>mov    dword ptr fs:[0], esp
0040B9A5 .  83EC 08    sub    esp, 8
0040B9A8 .  56          push esi
0040B9A9 .  57          push edi
0040B9AA .  8BF1       mov    esi, ecx
0040B9AC .  6A 01       push 1
0040B9AE .  E8 DF280000 call <jmp.&MFC42.#6334_CWnd::UpdateDa>
0040B9B3 .  8B86 E4000000 mov    eax, dword ptr [esi+E4]       ;  试炼码入EAX，ASCII "9999999999"
0040B9B9 .  8DBE E4000000 lea    edi, dword ptr [esi+E4]
0040B9BF .  8B48 F8    mov    ecx, dword ptr [eax-8]          ;  计算试炼码长度 ds:[00383EA0]=0000000A
0040B9C2 .  85C9       test ecx, ecx
0040B9C4 .  75 24       jnz    short 0040B9EA                ;  注册码长度大于零合法，跳！
0040B9C6 .  6A 00       push 0
0040B9C8 .  68 AC624100 push 004162AC                      ;  AD Popup Killer
0040B9CD .  68 186A4100 push 00416A18                      ;  Please input the SN of AD Popup Killer.
0040B9D2 .  8BCE       mov    ecx, esi
0040B9D4 .  E8 31290000 call <jmp.&MFC42.#4224_CWnd::MessageB>
0040B9D9 .  8B4C24 10    mov    ecx, dword ptr [esp+10]
0040B9DD .  64:890D 00000>mov    dword ptr fs:[0], ecx
0040B9E4 .  5F          pop    edi
0040B9E5 .  5E          pop    esi
0040B9E6 .  83C4 14    add    esp, 14
0040B9E9 .  C3          retn
0040B9EA >  8B8E E0000000 mov    ecx, dword ptr [esi+E0]       ;  用户名入ECX，ASCII "KuNgBiM"
0040B9F0 .  8B41 F8    mov    eax, dword ptr [ecx-8]          ;  计算用户名长度 ds:[00383E50]=00000007
0040B9F3 .  85C0       test eax, eax
0040B9F5 .  75 24       jnz    short 0040BA1B                ;  用户名长度大于零合法，跳！
0040B9F7 .  6A 00       push 0
0040B9F9 .  68 AC624100 push 004162AC                      ;  AD Popup Killer
0040B9FE .  68 006A4100 push 00416A00                      ;  Please input your name.
0040BA03 .  8BCE       mov    ecx, esi
0040BA05 .  E8 00290000 call <jmp.&MFC42.#4224_CWnd::MessageB>
0040BA0A .  8B4C24 10    mov    ecx, dword ptr [esp+10]
0040BA0E .  64:890D 00000>mov    dword ptr fs:[0], ecx
0040BA15 .  5F          pop    edi
0040BA16 .  5E          pop    esi
0040BA17 .  83C4 14    add    esp, 14
0040BA1A .  C3          retn
0040BA1B >  8D4C24 08    lea    ecx, dword ptr [esp+8]
0040BA1F .  E8 06270000 call <jmp.&MFC42.#540_CString::CStrin>
0040BA24 .  68 7C604100 push 0041607C                      ;  bsoft
0040BA29 .  8D4C24 0C    lea    ecx, dword ptr [esp+C]
0040BA2D .  C74424 1C 000>mov    dword ptr [esp+1C], 0
0040BA35 .  E8 06CFFFFF call 00408940
0040BA3A .  51          push ecx
0040BA3B .  8BCC       mov    ecx, esp
0040BA3D .  896424 10    mov    dword ptr [esp+10], esp
0040BA41 .  57          push edi
0040BA42 .  E8 B5270000 call <jmp.&MFC42.#535_CString::CStrin>
0040BA47 .  E8 54090000 call 0040C3A0                      ;  算法CALL，跟进！
0040BA4C .  83C4 04    add    esp, 4
0040BA4F .  85C0       test eax, eax
0040BA51 .  74 61       je    short 0040BAB4
0040BA53 .  8B3F       mov    edi, dword ptr [edi]          ;  写入试炼码
0040BA55 .  8D4C24 08    lea    ecx, dword ptr [esp+8]
0040BA59 .  57          push edi
0040BA5A .  68 C0604100 push 004160C0                      ;  passw
0040BA5F .  68 6C604100 push 0041606C                      ;  registe
0040BA64 .  E8 57D2FFFF call 00408CC0
0040BA69 .  8B86 E0000000 mov    eax, dword ptr [esi+E0]       ;  写入用户名
0040BA6F .  8D4C24 08    lea    ecx, dword ptr [esp+8]
0040BA73 .  50          push eax
0040BA74 .  68 74604100 push 00416074                      ;  user
0040BA79 .  68 6C604100 push 0041606C                      ;  registe
0040BA7E .  E8 3DD2FFFF call 00408CC0
0040BA83 .  6A 01       push 1
0040BA85 .  68 B8604100 push 004160B8                      ;  breg
0040BA8A .  68 6C604100 push 0041606C                      ;  registe
0040BA8F .  8D4C24 14    lea    ecx, dword ptr [esp+14]
0040BA93 .  E8 D8D1FFFF call 00408C70
0040BA98 .  6A 00       push 0
0040BA9A .  68 AC624100 push 004162AC                      ;  AD Popup Killer
0040BA9F .  68 E8694100 push 004169E8                      ;  Register Successfully!
0040BAA4 .  8BCE       mov    ecx, esi
0040BAA6 .  E8 5F280000 call <jmp.&MFC42.#4224_CWnd::MessageB>
0040BAAB .  8BCE       mov    ecx, esi
0040BAAD .  E8 3A250000 call <jmp.&MFC42.#4853_CDialog::OnOK>
0040BAB2 .  EB 13       jmp    short 0040BAC7
0040BAB4 >  6A 00       push 0
0040BAB6 .  68 AC624100 push 004162AC                      ;  AD Popup Killer
0040BABB .  68 C4694100 push 004169C4                      ;  Please make sure your SN is valid.
0040BAC0 .  8BCE       mov    ecx, esi
0040BAC2 .  E8 43280000 call <jmp.&MFC42.#4224_CWnd::MessageB>
0040BAC7 >  8D4C24 08    lea    ecx, dword ptr [esp+8]
0040BACB .  C74424 18 FFF>mov    dword ptr [esp+18], -1
0040BAD3 .  E8 46260000 call <jmp.&MFC42.#800_CString::~CStri>
0040BAD8 .  8B4C24 10    mov    ecx, dword ptr [esp+10]
0040BADC .  5F          pop    edi
0040BADD .  64:890D 00000>mov    dword ptr fs:[0], ecx
0040BAE4 .  5E          pop    esi
0040BAE5 .  83C4 14    add    esp, 14
0040BAE8 .  C3          retn

跟进0040BA47:

0040C3A0  /$  6A FF       push -1                            ;  跟进到这里
0040C3A2  |.  68 E0FA4000 push 0040FAE0                      ;  SE 处理程序安装
0040C3A7  |.  64:A1 0000000>mov    eax, dword ptr fs:[0]
0040C3AD  |.  50          push eax
0040C3AE  |.  64:8925 00000>mov    dword ptr fs:[0], esp
0040C3B5  |.  83EC 0C    sub    esp, 0C
0040C3B8  |.  53          push ebx
0040C3B9  |.  55          push ebp
0040C3BA  |.  56          push esi
0040C3BB  |.  57          push edi
0040C3BC  |.  8D4424 10    lea    eax, dword ptr [esp+10]
0040C3C0  |.  6A 08       push 8
0040C3C2  |.  50          push eax
0040C3C3  |.  8D4C24 34    lea    ecx, dword ptr [esp+34]
0040C3C7  |.  C74424 2C 000>mov    dword ptr [esp+2C], 0
0040C3CF  |.  E8 2A1F0000 call <jmp.&MFC42.#4129_CString::Left>
0040C3D4  |.  8B7424 10    mov    esi, dword ptr [esp+10]
0040C3D8  |.  8D4C24 14    lea    ecx, dword ptr [esp+14]
0040C3DC  |.  33C0       xor    eax, eax
0040C3DE  |.  2BF1       sub    esi, ecx
0040C3E0  |>  8D4C04 14    /lea    ecx, dword ptr [esp+eax+14]
0040C3E4  |.  40          |inc    eax                            ;  计算下一位
0040C3E5  |.  83F8 08    |cmp    eax, 8                         ;  是否计算了8位？
0040C3E8  |.  8A140E       |mov    dl, byte ptr [esi+ecx]
0040C3EB  |.  8811       |mov    byte ptr [ecx], dl             ;  试炼码变换
;  dl=39 ('9')
;  堆栈 ds:[0012F0C0]=7C ('|')

;  dl=39 ('9')
;  堆栈 ds:[0012F0C1]=60 ('`')

;  dl=39 ('9')
;  堆栈 ds:[0012F0C2]=41 ('A')

;  dl=39 ('9')
;  堆栈 ds:[0012F0C3]=00

;  dl=39 ('9')
;  堆栈 ds:[0012F0C4]=AE ('?)

;  dl=39 ('9')
;  堆栈 ds:[0012F0C5]=43 ('C')

;  dl=39 ('9')
;  堆栈 ds:[0012F0C6]=D3 ('?)

;  dl=39 ('9')
;  堆栈 ds:[0012F0C7]=73 ('s')
0040C3ED  |.^ 7C F1       \jl    short 0040C3E0
0040C3EF  |.  0FBE7424 15 movsx esi, byte ptr [esp+15]
0040C3F4  |.  0FBE6C24 14 movsx ebp, byte ptr [esp+14]
0040C3F9  |.  0FBE7C24 18 movsx edi, byte ptr [esp+18]
0040C3FE  |.  8D0C2E       lea    ecx, dword ptr [esi+ebp]
0040C401  |.  B8 56555555 mov    eax, 55555556                   ;  地址=72

0040C406  |.  03CF       add    ecx, edi                      ;  EDI加ECX，edi=39,ecx=72
0040C408  |.  F7E9       imul ecx                            ;  相加后的值送入ECX，ecx=AB
0040C40A  |.  0FBE5C24 16 movsx ebx, byte ptr [esp+16]
0040C40F  |.  8BC2       mov    eax, edx                      ;  EDX送给EAX，edx=39,eax=72
0040C411  |.  C1E8 1F    shr    eax, 1F                         ;  EAX逻辑右移1F
0040C414  |.  03D0       add    edx, eax                      ;  EAX加EDX
0040C416  |.  3BDA       cmp    ebx, edx
0040C418  |.  0F85 8E000000 jnz    0040C4AC
0040C41E  |.  0FBE4C24 17 movsx ecx, byte ptr [esp+17]          ;  取出ECX值，ecx=AB
0040C423  |.  8D043B       lea    eax, dword ptr [ebx+edi]       ;  地址=72
0040C426  |.  99          cdq                                     ;  把EAX中的字的符号扩展到EDX中去
0040C427  |.  2BC2       sub    eax, edx                      ;  EDX减EAX，edx=00,eax=72
0040C429  |.  D1F8       sar    eax, 1                         ;  EAX算术右移1
0040C42B  |.  3BC8       cmp    ecx, eax
0040C42D  |.  75 7D       jnz    short 0040C4AC
0040C42F  |.  8A5C24 19    mov    bl, byte ptr [esp+19]          ;  bl=39 ('9')
0040C433  |.  8D042E       lea    eax, dword ptr [esi+ebp]       ;  地址=72
0040C436  |.  99          cdq                                     ;  把EAX中的字的符号扩展到EDX中去
0040C437  |.  2BC2       sub    eax, edx                      ;  EDX减EAX，edx=00,eax=72
0040C439  |.  0FBED3       movsx edx, bl                         ;  BL先符号扩展,再传送EDX
0040C43C  |.  D1F8       sar    eax, 1                         ;  EAX算术右移1
0040C43E  |.  3BD0       cmp    edx, eax
0040C440  |.  75 6A       jnz    short 0040C4AC
0040C442  |.  8A4C24 1B    mov    cl, byte ptr [esp+1B]          ;  cl=39 ('9')
0040C446  |.  0FBEC1       movsx eax, cl                         ;  CL先符号扩展,再传送EAX
0040C449  |.  03C6       add    eax, esi                      ;  ESI加EAX，esi=39,eax=39
0040C44B  |.  99          cdq                                     ;  把EAX中的字的符号扩展到EDX中去
0040C44C  |.  2BC2       sub    eax, edx                      ;  EDX减EAX，edx=00,eax=72
0040C44E  |.  0FBE5424 1A movsx edx, byte ptr [esp+1A]
0040C453  |.  D1F8       sar    eax, 1                         ;  EAX算术右移1,eax=72
0040C455  |.  3BD0       cmp    edx, eax
0040C457  |.  75 53       jnz    short 0040C4AC
0040C459  |.  8A4424 15    mov    al, byte ptr [esp+15]          ;  al=39 ('9')
0040C45D  |.  8A5424 14    mov    dl, byte ptr [esp+14]          ;  dl=39 ('9')
0040C461  |.  3AD0       cmp    dl, al                         ;  al与dl值不能相等
0040C463  |.  74 47       je    short 0040C4AC                ;  这里不能跳！爆破点A
0040C465  |.  8A5424 18    mov    dl, byte ptr [esp+18]
0040C469  |.  8A4424 16    mov    al, byte ptr [esp+16]
0040C46D  |.  3AC2       cmp    al, dl                         ;  dl与al值不能相等
0040C46F  |.  74 3B       je    short 0040C4AC                ;  再次比较，这里不能跳！爆破点B
0040C471  |.  3AD9       cmp    bl, cl                         ;  cl与bl值不能相等
0040C473  |.  74 37       je    short 0040C4AC                ;  再次比较，这里不能跳！爆破点C
0040C475  |.  8D4C24 10    lea    ecx, dword ptr [esp+10]
0040C479  |.  C64424 24 00  mov    byte ptr [esp+24], 0
0040C47E  |.  E8 9B1C0000 call <jmp.&MFC42.#800_CString::~CStri>
0040C483  |.  8D4C24 2C    lea    ecx, dword ptr [esp+2C]
0040C487  |.  C74424 24 FFF>mov    dword ptr [esp+24], -1
0040C48F  |.  E8 8A1C0000 call <jmp.&MFC42.#800_CString::~CStri>
0040C494  |.  5F          pop    edi
0040C495  |.  5E          pop    esi
0040C496  |.  5D          pop    ebp
0040C497  |.  B8 01000000 mov    eax, 1
0040C49C  |.  5B          pop    ebx
0040C49D  |.  8B4C24 0C    mov    ecx, dword ptr [esp+C]
0040C4A1  |.  64:890D 00000>mov    dword ptr fs:[0], ecx
0040C4A8  |.  83C4 18    add    esp, 18
0040C4AB  |.  C3          retn
附件下载：http://www.unpack.cn/viewthread.php?tid=10042

欢迎光临【3.A.S.T】网络安全爱好者 (http://3ast.com/)