Gelismis ozelliklere sahip bir hesap makinesi.

Acilista Register menusu geliyor. “amois”, “1907” -> [bpx hmemcpy] -> biraz takip

0167:00406151 LEA EAX,[EBP-10]
0167:00406154 MOV ECX,00438938
0167:00406159 PUSH EAX
0167:0040615A CALL 00407611                        <- ??
0167:0040615F PUSH DWORD PTR [EBX]
0167:00406161 AND DWORD PTR [EBP-04],00
0167:00406165 PUSH DWORD PTR [EBP-10]
0167:00406168 CALL 0040D654                        <- ??
0167:0040616D POP ECX
0167:0040616E TEST EAX,EAX
0167:00406170 POP ECX
0167:00406171 JNZ 004061C4                         <- Kotu cocuk
...
0167:004061C4 PUSH 300
0167:004061C6 PUSH 000000CB
0167:004061CB MOV ECX,ESI
0167:004061CD CALL 00405F07                        <- Hata

Hataya neden olan 4061CD’deki cagriya 406171’den geldik. Hemen ustteki cagrinin incelenmesi gerekiyor.

[bpx 406168] -> [F8]

...
0167:0040D663 PUSH DWORD PTR [EBP+0C]              <- ??
0167:0040D666 PUSH DWORD PTR [EBP+08]              <- ??
0167:0040D669 CALL 0040BA70                        <- ??

40D669’daki cagri oncesi 2 deger push ediliyor. [d ebp+0c] ve [d ebp+08] ile bir sonuc alamiyoruz gibi gozukuyor.

[d ebp+0c] ->

016F:0067F6B4 F0 42 8A 00 EC FC 67 00-90 C5 42 00 01 00 00 00 .B....g...B.....

Peki, [d 008A42F0] ->

016F:008A42F0 31 39 30 37 00 30 36 00-00 00 00 00 00 00 00 00 1907.06.........

Evet, [ebp+0c] bizim sallama seriali gosteriyorsa -> [ebp+08] ...

Keygen algoritmasina da bir goz atalim. 406168’deki cagrinin hemen ustundeki cagriyi inceleyelim. [bpx 40615A] -> [F8]

0167:00407640 MOV EAX,[EBP+0C]                    <- “amois”
0167:00407643 PUSH 01
0167:00407645 MOV ECX,[EAX-08]                    <- ecx = 5, serial uzunlugu
0167:00407648 MOV EAX,EDI                         <- edi = 7 ve azaliyor
0167:0040764A CDQ
0167:0040764B IDIV ECX                            <- eax’i ecx’e bol
0167:0040764D LEA EAX,[EBP-18]
0167:00407650 LEA ECX,[EBP+0C]
0167:00407653 PUSH EDX                            <- kalan burada = 2
0167:00407654 PUSH EAX
0167:00407655 CALL 0041E3AE                       <- “amois” deki 2.inci harf
0167:0040765A MOV ESI,[EAX]                       <- “o” , (saymaya 0’dan basla)
0167:0040765C MOV EAX,[EBP+0C]
0167:0040765F PUSH 01
0167:00407661 LEA ECX,[EBP+0C]
0167:00407664 MOV EAX,[EAX-08]
0167:00407667 MOV BYTE PTR [EBP-04],03
0167:0040766B DEC EAX
0167:0040766C PUSH EAX
0167:0040766D LEA EAX,[EBP-14]
0167:00407670 PUSH EAX
0167:00407671 CALL 0041E3AE                       <- “amois” in son harfi “s”
0167:00407676 MOV EAX,[EAX]
0167:00407678 PUSH 0A
0167:0040767A MOVSX ECX,BYTE PTR [ESI]            <- “o”
0167:0040767D MOVSX EAX,BYTE PTR [EAX]            <- “s”
0167:00407680 LEA EAX,[EDI*2+EAX]                 <- eax = edi * 2 + eax
0167:00407683 ADD EAX,ECX                         <- eax = eax + ecx
0167:00407685 POP ECX                             <- ecx = 0Ah
0167:00407686 CDQ
0167:00407687 IDIV ECX                            <- eax = eax / ecx
0167:00407689 LEA ECX,[EBP-14]
0167:0040768C MOV EBX,EDX                         <- kalan ebx’e
0167:0040768E CALL 00423912
0167:00407693 LEA ECX,[EBP-18]
0167:00407696 MOV BYTE PTR [EBP-04],02
0167:0040769A CALL 00423912
0167:0040769F ADD BL,30                           <- ascii’ye cevirmek icin
0167:004076A2 LEA EAX,[EBP-10]
0167:004076A5 PUSH EBX
0167:004076A6 PUSH EAX
0167:004076A7 LEA EAX,[EBP-1C]
0167:004076AA PUSH EAX
0167:004076AB CALL 0041E1F2
0167:004076B0 PUSH EAX
0167:004076B1 LEA ECX,[EBP-10]
0167:004076B4 MOV BYTE PTR [EBP-04],04
0167:004076B8 CALL 004239FF
0167:004076BD LEA ECX,[EBP-1C]
0167:004076C0 MOV BYTE PTR [EBP-04],02
0167:004076C4 CALL 00423912
0167:004076C9 DEC EDI                             <- edi = 7 6 5 4 3 2 1 0
0167:004076CA JNS 00407640

407640 ile 4076CA arasinda bir dongu var. Yan tarafta biraz aciklamaya calistim. Oncelikle bu dongu edi=7 iken baslayip, 0’dan kucuk olana kadar toplam 8 kez donuyor. Yani, girdigimiz username’den bagimsiz. 407671’de, username’in son harfi bulunuyor ve bu 40767D’de eax’e her seferinde sabit olarak ataniyor. 40767A’da ecx’e atanan harflerin algoritmasi ise su sekilde. Username’in uzunlugu edi’ye bolunup kalan degere gore, Username’deki konumu bulunuyor. Yani MOD alma islemi. Burada edi degerimiz 7 ile 0 arasinda degisiyor.

Edi = 7 -> 7 Mod 5 -> 2 -> “amois”
Edi = 6 -> 6 Mod 5 -> 1 -> “amois”
Edi = 5 -> 5 Mod 5 -> 0 -> “amois”
Edi = 4 -> 4 Mod 5 -> 4 -> “amois”
Edi = 3 -> 3 Mod 5 -> 3 -> “amois”
Edi = 2 -> 2 Mod 5 -> 2 -> “amois”
Edi = 1 -> 1 Mod 5 -> 1 -> “amois”
Edi = 0 -> 0 Mod 5 -> 0 -> “amois”

Artik 40767A’da ecx’e nasil deger atandigini cozduk. Daha sonra da 407680’den itibaren ufak bir rutin daha var. Asagidaki Excel tablosunu incelerseniz, daha iyi anlayacaksiniz.


ecx     ascii ecx     edi     edi*2+eax     eax+ecx     mod 10
o         111         7         125         240             0
m         109         6         121         236             6
a         97          5         107         222             2
s         115         4         123         238             8
i         105         3         111         226             6
o         111         2         115         ?               ?
m         109         1         111         ?               ?
a         97          0         97          ?               ?
 

KeyGen algoritmasini asagidaki VB koduna cevirdim.

isim = "amois"                                        ; username
isim_uz = Len(isim)                                   ; username uzunlugu
eax = Asc(Right$(isim, 1))                            ; son harfi
For edi = 7 To 0 Step -1                              ; sayac olarak edi
sira_no = edi Mod isim_uz                             ; MOD alma islemi
ecx = Asc(Mid(isim, sira_no + 1, 1))                  ; username’deki yeri
serial_bas = Str$((ecx + (edi * 2 + eax)) Mod 10)     ; 407680’deki islemler
serial = serial + serial_bas                          ; serial olustur
Next edi                                              ; donguye devam et
MsgBox (serial)                                       ; seriali goster



Ayni algoritmayi ASM kodu olarak da soyle cevirdim.


.data
isim db "amois",0                                     ; username
isim_uz dd 0h                                         ; kullanacagimiz degiskenler
sayac dd 0h
son_harf db 04h dup (?)
deg_harf db 04h dup (?)
sira_no dd 0h
serial db 08h dup(?)

.code

start:

invoke StrLen, addr isim                              ; username uzunlugunu bul
mov isim_uz, eax                                      ; sakla
invoke szRight, addr isim, addr son_harf, 1           ; son harfi bul

mov sayac, 07h                                        ; sayaci ayarla

@dongu:
cmp sayac, 0ffffffffh                                 ; sayac -1 oldu mu ?
je @yaz                                               ; seriali goster
mov eax, sayac
mov ecx, isim_uz
cdq
idiv ecx                                              ; MOD alma islemi
mov sira_no, edx                                      ; kalan deger sira_no’da
invoke szMid, addr isim, addr deg_harf, sira_no, 1    ; yerini bul
mov eax, dword ptr [son_harf]                         ; son harf eax’de
mov ecx, dword ptr [deg_harf]                         ; degisen harfler ecx’de
mov ebx, sayac ; sayac ebx’de
lea eax, [ebx*2+eax]                                  ; 407680 deki islemler
add eax, ecx                                          ;
mov ecx, 0ah                                          ;
cdq                                                   ;
idiv ecx                                              ; edx’de kalan deger
add edx, 030h                                         ; buna 30h ekleyerek
lea esi, serial                                       ; ascii’ye cevirdik
sub esi, sayac
mov byte ptr [esi+7], dl                              ; bu degeri sakla
dec sayac                                             ; sayaci 1 azalt
jmp @dongu                                            ; donguye devam

@yaz:
invoke MessageBox, 0, addr serial, addr isim, 0

 

Bir programı kullanarak para kazanıyorsanız, programı satın alın.