3275391 1109228 2009-05-01T06:10:48Z http://seyool.springnote.com/pages/3275391 2009-05-01T02:42:57Z <p>&nbsp;</p> <p>집에와서 jz님이 만드신 크랙미를 살펴보았습니다.</p> <p>제 언팩미 1탄을 상세하게 풀어주셔서 고마운 마음에 답례(?)를 하기 위해서 열심히 IDA를 돌렸지요. ^^</p> <p>순전히 저의 추측으로만 분석을 한것이어서 정답이 아닐수도 있어서 염려가 됩니다.</p> <p>&nbsp;</p> <p>안티 디버깅은 2가지 정도 찾았는데 못찾은것이 더 있을 가능성도 있습니다.</p> <p>안티디버깅 이후에 비로소 사용자 키값을 처리하는 루틴과 키값을 암호화후 비교하는 루틴이 있습니다.</p> <p>살펴볼 루틴은 다음과 같습니다.</p> <p>&nbsp;</p> <ul> <li>Explorer.exe의 프로세스와 jz_crackme.exe프로세스내 ntdll.dll의 코드섹션을 비교하여서 틀린 부분이&nbsp;있으면 안티디버깅 루틴 수행</li> <li>Trap Flag를 설정후 SEH핸들러가 실행되는지 확인하여 안티디버깅 루틴 수행</li> <li>시간측정 루틴(입력시간 초과 방지용)</li> <li>입력된 패스워드를 암호화하는 함수</li> </ul> <p>&nbsp;</p> <p>안티 디버깅 루틴은 프로그램을 종료시키는 단순한 방식이 아닌, 정답이 제대로 안나오게 방해하는 역활을</p> <p>수행하는것 같습니다. 덕분에 badfood를 밤새 많이 먹었네요 ;;</p> <p>일단 안티디버깅 루틴부터 살펴보겠습니다.</p> <p>&nbsp;</p> <h4>1. explorer::ntdll.dll과 &nbsp;jz_crackme::ntdll.dll의 코드섹션 비교하는 안티디버깅 분석</h4> <p>&nbsp;</p> <h6>explorer.exe PID검색 루틴</h6> <p>.text:004010E7 loc_4010E7: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: _main+CEj</p> <p>.text:004010E7 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lea &nbsp; &nbsp; edx, [ebp+dwProcessId]</p> <p>.text:004010ED &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;edx</p> <p>.text:004010EE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;offset aExplorer_exe ; "explorer.exe"</p> <p>.text:004010F3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp; &nbsp;maybe_GetPidByProcessName</p> <p>.text:004010F8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp, 8</p> <p>.text:004010FB &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; test &nbsp; &nbsp;eax, eax</p> <p>.text:004010FD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jnz &nbsp; &nbsp; short loc_401104</p> <p>.text:004010FF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; loc_4011D1</p> <p><br /> maybe_GetPidByProcessName 내부를 살펴보면 TlHelp32 함수를 이용하여 전달된 함수명으로 Pid를 구하고 있습니다.</p> <p>&nbsp;</p> <p>&nbsp;</p> <h6>explorer.exe의 ntdll 코드섹션을 읽어 오는 루틴</h6> <p>&nbsp;</p> <p>.text:00401104 loc_401104: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: _main+FDj</p> <p>.text:00401104 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+Size]</p> <p>.text:0040110A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;eax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; dwSize</p> <p>.text:0040110B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+lpMem]</p> <p>.text:00401111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;ecx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; lpBuffer</p> <p>.text:00401112 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+maybe_Ntdll_CodeSectionAddress]</p> <p>.text:00401118 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;edx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; lpAddress</p> <p>.text:00401119 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+dwProcessId]</p> <p>.text:0040111F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;eax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; dwProcessId</p> <p>.text:00401120 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp; &nbsp;maybe_ReadMemoryFromPid</p> <p>.text:00401125 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp, 10h</p> <p>.text:00401128 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; test &nbsp; &nbsp;eax, eax</p> <p>.text:0040112A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jnz &nbsp; &nbsp; short loc_401131</p> <p>.text:0040112C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; loc_4011D1</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>maybe_ReadMemoryFromPid 의 내부는 전달된 Pid를 OpenProcess하여 메모리를 읽어서 리턴하는 함수입니다.</p> <p>&nbsp;</p> <h6>for문을 돌면서 explorer::ntdll의 코드섹션과 jz_crackme.exe::ntdll의 코드섹션과 비교하는 루틴</h6> <p>&nbsp;</p> <p>.text:00401154 loc_401154: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: _main+150j</p> <p>.text:00401154 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+maybe_for_i_value], 0</p> <p>.text:0040115E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; short loc_40116F</p> <p>.text:00401160 ; ---------------------------------------------------------------------------</p> <p>.text:00401160</p> <p>.text:00401160 loc_401160: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: _main:loc_4011CFj</p> <p>.text:00401160 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+maybe_for_i_value]</p> <p>.text:00401166 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; ecx, 1</p> <p>.text:00401169 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+maybe_for_i_value], ecx</p> <p>.text:0040116F</p> <p>.text:0040116F loc_40116F: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: _main+15Ej</p> <p>.text:0040116F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+maybe_for_i_value]</p> <p>.text:00401175 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; edx, [ebp+Size]</p> <p>.text:0040117B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jge &nbsp; &nbsp; short loc_4011D1</p> <p>.text:0040117D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+lpMem]</p> <p>.text:00401183 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; eax, [ebp+maybe_for_i_value]</p> <p>.text:00401189 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; ecx, ecx</p> <p>.text:0040118B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; cl, [eax]</p> <p>.text:0040118D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+var_524]</p> <p>.text:00401193 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; edx, [ebp+maybe_for_i_value]</p> <p>.text:00401199 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; eax, eax</p> <p>.text:0040119B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; al, [edx]</p> <p>.text:0040119D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; ecx, eax</p> <p>.text:0040119F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_4011CF</p> <p>.text:004011A1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, maybe_DebuggerFuckRandomValue</p> <p>.text:004011A7 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; ecx, 900Dh</p> <p>.text:004011AD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; maybe_DebuggerFuckRandomValue, ecx</p> <p>.text:004011B3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+var_524]</p> <p>.text:004011B9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; edx, [ebp+maybe_for_i_value]</p> <p>.text:004011BF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+lpMem]</p> <p>.text:004011C5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; eax, [ebp+maybe_for_i_value]</p> <p>.text:004011CB &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; cl, [eax]</p> <p>.text:004011CD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [edx], cl</p> <p>.text:004011CF</p> <p>.text:004011CF loc_4011CF: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: _main+19Fj</p> <p>.text:004011CF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; short loc_401160</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>maybe_DebuggerFuckRandomValue는 틀린 부분이 발견될때마다 900dh 값을 더해주는 것을 볼 수 있습니다.</p> <p>maybe_DebuggerFuckRandomValue는 정답비교시 방해하는 역활을 하는 값으로 0 값을 유지해야만 합니다.</p> <p>&nbsp;</p> <h4>Trap Flag를 설정후 SEH핸들러가 실행되는지 확인하여 안티디버깅 루틴 수행</h4> <p>&nbsp;</p> <p><br /></p> <p>.text:00401203 loc_401203: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: _main+1F2j</p> <p>.text:00401203 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;offset seh_DebuggerNotFoundContinueExecution ; 디버거 체크</p> <p>.text:00401208 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;large dword ptr fs:0</p> <p>.text:0040120F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; large fs:0, esp</p> <p>.text:00401216 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pushf</p> <p>.text:00401217 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;edx</p> <p>.text:00401218 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; or &nbsp; &nbsp; &nbsp;[esp+584h+var_580], 100h ; eflag pushf후 trap 플래그를 설정하여 디버거 탐지</p> <p>.text:00401220 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;ebx</p> <p>.text:00401221 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ebx, [esp+588h+var_580]</p> <p>.text:00401225 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;ebx</p> <p>.text:00401226 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; popf</p> <p>.text:00401227 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; inc &nbsp; &nbsp; edx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; 예외 발생하고 준비된 핸들러가 실행되어야만 함</p> <p>.text:00401227 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; 디버거가 캐치하여 실행하면 badfood -_-</p> <p>.text:00401228 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; inc &nbsp; &nbsp; edx</p> <p>.text:00401229 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; ebx</p> <p>.text:0040122A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; edx</p> <p>.text:0040122B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp, 4</p> <p>.text:0040122E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; large dword ptr fs:0</p> <p>.text:00401235 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp, 4</p> <p>.text:00401238 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; inc &nbsp; &nbsp; maybe_IsDebuggerFound</p> <p>.text:0040123E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rdtsc</p> <p>.text:00401240 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; maybe_DebuggerFuckRandomValue, eax</p> <p>.text:00401246 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; short loc_401268</p> <p>.text:00401248 ; ---------------------------------------------------------------------------</p> <p>.text:00401248</p> <p>.text:00401248 seh_DebuggerNotFoundContinueExecution: &nbsp;; DATA XREF: _main:loc_401203o</p> <p>.text:00401248 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [esp-4+envp]</p> <p>.text:0040124C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; dword ptr [edx+0B8h], offset seh_RunNextFunction</p> <p>.text:00401256 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; eax, eax</p> <p>.text:00401258 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; retn</p> <p>.text:00401259 ; ---------------------------------------------------------------------------</p> <p>.text:00401259</p> <p>.text:00401259 seh_RunNextFunction: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; DATA XREF: _main+24Co</p> <p>.text:00401259 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; ebx</p> <p>.text:0040125A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; edx</p> <p>.text:0040125B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp, 4</p> <p>.text:0040125E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; large dword ptr fs:0</p> <p>.text:00401265 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp, 4</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>seh_DebuggerNotFoundContinueExecution() 예외함수를 SEH Handler로 등록시키고 eflags값의 trap 비트를 설정하여 예외가 발생하게 하고 있습니다.</p> <p>디버거가 예외를 무시하게 되면 maybe_IsDebuggerFound와&nbsp;maybe_DebuggerFuckRandomValue값이 설정되고 결국에는 badfood를 맛보게 될 것이지요.</p> <p>정상적으로 실행이 되면 예외핸들러를 타게 되고 사용자 암호를 물어보는 메인 코드가 실행되게 됩니다</p> <p>&nbsp;</p> <h4>입력된 패스워드를 암호화하는 함수</h4> <p>&nbsp;</p> <h6>정답 확인하는 루틴</h6> <p>&nbsp;</p> <p>.text:00401354 loc_401354: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: _main+31Aj</p> <p>.text:00401354 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, maybe_DebuggerFuckRandomValue</p> <p>.text:0040135A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; maybe_1st_Copied_DebuggerFuckRandomValue, ecx</p> <p>.text:00401360 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+maybe_UserInputedPasswordStrLen]</p> <p>.text:00401366 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;edx</p> <p>.text:00401367 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lea &nbsp; &nbsp; eax, [ebp+maybe_UserInputedPasswordBuffer]</p> <p>.text:0040136D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;eax</p> <p>.text:0040136E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp; &nbsp;maybe_Encryption</p> <p>.text:00401373 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp, 8</p> <p>.text:00401376 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+maybe_EncryptedResultValue], eax</p> <p>.text:0040137C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, maybe_1st_Copied_DebuggerFuckRandomValue</p> <p>.text:00401382 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; maybe_2nd_Copied_DebuggerFuckRandomValue, ecx</p> <p>.text:00401388 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+maybe_EncryptedResultValue]</p> <p>.text:0040138E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; edx, maybe_IsDebuggerFound</p> <p>.text:00401394 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+maybe_EncryptedResultValue], edx</p> <p>.text:0040139A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, maybe_2nd_Copied_DebuggerFuckRandomValue</p> <p>.text:0040139F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; maybe_3rd_Copied_DebuggerFuckRandomValue, eax</p> <p>.text:004013A4 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+maybe_EncryptedResultValue]</p> <p>.text:004013AA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; ecx, maybe_3rd_Copied_DebuggerFuckRandomValue</p> <p>.text:004013B0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+maybe_EncryptedResultValue], ecx</p> <p>.text:004013B6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; [ebp+maybe_EncryptedResultValue], 0AF006DC3h</p> <p>.text:004013C0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_4013D1</p> <p>.text:004013C2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;offset aWrong &nbsp; ; "wrong!\n"</p> <p>.text:004013C7 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp; &nbsp;maybe_printf</p> <p>.text:004013CC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp, 4</p> <p>.text:004013CF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; short loc_4013E5</p> <p>.text:004013D1 ; ---------------------------------------------------------------------------</p> <p>.text:004013D1</p> <p>.text:004013D1 loc_4013D1: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: _main+3C0j</p> <p>.text:004013D1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lea &nbsp; &nbsp; edx, [ebp+maybe_UserInputedPasswordBuffer]</p> <p>.text:004013D7 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;edx</p> <p>.text:004013D8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;offset aDFS@gmail_comNF ; "정답! %s@gmail.com으로 메일을 보내서 인"...</p> <p>.text:004013DD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp; &nbsp;maybe_printf</p> <p>.text:004013E2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp, 8</p> <p>.text:004013E5</p> <p>.text:004013E5 loc_4013E5: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: _main+3CFj</p> <p>.text:004013E5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;offset aPause &nbsp; ; "pause"</p> <p>.text:004013EA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp; &nbsp;sub_401DB6</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>maybe_Encryption 함수가 사용자가 입력한 내용과 길이를 가지고 어떤값을 만들고 리턴해주는 함수입니다.</p> <p>maybe_Encryption함수의 리턴값을 가지고 maybe_DebuggerFuckRandomValue와 xor 연산을 2번 시켜주고 있습니다.</p> <p>리턴값은 결국 0AF006DC3h 값이 되어야 함을&nbsp;004013B6 주소에 알 수가 있습니다.</p> <p>그러면 maybe_Encryption함수의 내부를 살펴보겠습니다.</p> <p>&nbsp;</p> <h6>maybe_Encryption() 함수의 내부</h6> <p>&nbsp;</p> <p>maybe_Encryption을 처음보고 해쉬값의 원래 데이터를 찾는게 아닌가 하고&nbsp;좌절했습니다만, 곧 차근 차근 따라 가보니 힌트가 나오는것을 알 수 있었습니다.</p> <p>일단 분석을 방해하는 코드를 빨간색으로 색칠후 따라가보겠습니다.</p> <p>&nbsp;</p> <p><img class="attachment" title="방해코드.PNG" src="/pages/3275391/attachments/1495661" alt="방해코드.PNG" /></p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>.text:00401420 maybe_Encryption proc near &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; CODE XREF: _main+36Ep</p> <p>.text:00401420</p> <p>.text:00401420 var_8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = byte ptr -8</p> <p>.text:00401420 var_4 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = dword ptr -4</p> <p>.text:00401420 InputBuffer &nbsp; &nbsp; = dword ptr &nbsp;8</p> <p>.text:00401420 InputLen &nbsp; &nbsp; &nbsp; &nbsp;= dword ptr &nbsp;0Ch</p> <p>.text:00401420</p> <p>.text:00401420 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;ebp</p> <p>.text:00401421 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ebp, esp</p> <p>.text:00401423 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub &nbsp; &nbsp; esp, 8</p> <p>.text:00401426 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;ebx</p> <p>.text:00401427 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;esi</p> <p>.text:00401428 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;edi</p> <p>.text:00401429 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], 0FEBAF001h</p> <p>.text:00401430 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+InputBuffer]</p> <p>.text:00401433 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; ecx, byte ptr [eax]</p> <p>.text:00401436 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; ecx, 74h</p> <p>.text:00401439 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_40144E</p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:0040143B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+InputBuffer]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:0040143E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, byte ptr [edx+2]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:00401442 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+var_4]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:00401445 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; ecx, eax</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:00401447 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], ecx</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:0040144A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rol &nbsp; &nbsp; [ebp+var_4], 4</span></p> <p>.text:0040144E</p> <p>.text:0040144E loc_40144E: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: maybe_Encryption+19j</p> <p>.text:0040144E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rol &nbsp; &nbsp; [ebp+var_4], 8</p> <p>.text:00401452 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; [ebp+InputLen], 7</p> <p>.text:00401456 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_401467</p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:00401458 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+InputBuffer]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:0040145B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, byte ptr [edx+5]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:0040145F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+var_4]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:00401462 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; ecx, eax</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:00401464 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], ecx</span></p> <p>&nbsp;</p> <p>&nbsp;</p> <p>00401436 를 보시면 InputBuffer는&nbsp;00000074('t')로 시작되는 것을 알 수 있습니다. 또&nbsp;00401452에서는 문자열 길이가 7이어야 된다는&nbsp;것을 알 수 있습니다.</p> <p>그러면 InputBuffer는 t _ _ _ _ _ _ 이 되겠군요.&nbsp;var_4 값은&nbsp;FEBAF001 로 설정되고요</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>.text:00401467 loc_401467: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: maybe_Encryption+36j</p> <p>.text:00401467 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rol &nbsp; &nbsp; [ebp+var_4], 4</p> <p>.text:0040146B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+InputBuffer]</p> <p>.text:0040146E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, byte ptr [edx]</p> <p>.text:00401471 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+InputBuffer]</p> <p>.text:00401474 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; edx, byte ptr [ecx+4]</p> <p>.text:00401478 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub &nbsp; &nbsp; eax, edx</p> <p>.text:0040147A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; eax, 2</p> <p>.text:0040147D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_401490</p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:0040147F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+InputBuffer]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:00401482 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; ecx, byte ptr [eax+6]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:00401486 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+var_4]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:00401489 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; edx, ecx</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:0040148B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], edx</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:0040148E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; short loc_40149F</span></p> <p>.text:00401490 ; ---------------------------------------------------------------------------</p> <p>.text:00401490</p> <p>.text:00401490 loc_401490: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: maybe_Encryption+5Dj</p> <p>.text:00401490 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+InputBuffer]</p> <p>.text:00401493 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; ecx, byte ptr [eax+4]</p> <p>.text:00401497 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+var_4]</p> <p>.text:0040149A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; edx, ecx</p> <p>.text:0040149C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], edx</p> <p>.text:0040149F</p> <p>.text:0040149F loc_40149F: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: maybe_Encryption+6Ej</p> <p>.text:0040149F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+InputBuffer]</p> <p>.text:004014A2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; ecx, byte ptr [eax+4]</p> <p>.text:004014A6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+InputBuffer]</p> <p>.text:004014A9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, byte ptr [edx+1]</p> <p>.text:004014AD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub &nbsp; &nbsp; ecx, eax</p> <p>.text:004014AF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; ecx, 0Ah</p> <p>.text:004014B2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_4014BA</p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:004014B4 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rol &nbsp; &nbsp; [ebp+var_4], 10h</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:004014B8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; short loc_4014CD</span></p> <p>&nbsp;</p> <p>00401467 ~&nbsp;0040147D 루틴을 분석해 보면,&nbsp;</p> <p>var_4 =&nbsp;BAF001FE 가 되고, InputBuffer[0]와 InputBuffer[4]의 차가 2가 된다는 것을 알 수 있습니다.</p> <p>그러므로 InputBuffer는&nbsp;&nbsp;t _ _ _ r&nbsp;_ _ 가 됩니다.</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>00401490 ~&nbsp;004014B2 를 해석 하면,</p> <p>var_4 =&nbsp;AF001F99 가 되고, InputBuffer[4]와 &nbsp;InputBuffer[1]의 차가 0ah가 된다는 것을 알 수 있습니다.</p> <p>그러므로 InputBuffer&nbsp;t h _ _ r&nbsp;_ _ 가 됩니다.</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>.text:004014BA loc_4014BA: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: maybe_Encryption+92j</p> <p>.text:004014BA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+InputBuffer]</p> <p>.text:004014BD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; edx, byte ptr [ecx+2]</p> <p>.text:004014C1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+var_4]</p> <p>.text:004014C4 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; eax, edx</p> <p>.text:004014C6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], eax</p> <p>.text:004014C9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rol &nbsp; &nbsp; [ebp+var_4], 8</p> <p>.text:004014CD</p> <p>.text:004014CD loc_4014CD: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: maybe_Encryption+98j</p> <p>.text:004014CD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+InputBuffer]</p> <p>.text:004014D0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; edx, byte ptr [ecx+1]</p> <p>.text:004014D4 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+InputBuffer]</p> <p>.text:004014D7 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; ecx, byte ptr [eax+2]</p> <p>.text:004014DB &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub &nbsp; &nbsp; edx, ecx</p> <p>.text:004014DD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; edx, 35h</p> <p>.text:004014E0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_4014F3</p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:004014E2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+InputBuffer]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:004014E5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, byte ptr [edx+5]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:004014E9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+var_4]</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:004014EC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; ecx, eax</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:004014EE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], ecx</span></p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:004014F1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; short loc_4014F7</span></p> <p>&nbsp;</p> <p>004014BA ~&nbsp;004014E0 을 분석해 보면,</p> <p>var_4 =&nbsp;AF001F99 &nbsp;^ arg0[2] 가 되고, InputBuffer[1]과 InputBuffer[2]의 차가 35h 가 되며 이는 곳 숫자 '3' 인것을 알 수 있습니다.</p> <p>그러므로 InputBuffer 는&nbsp;t h 3 _ r&nbsp;_ _ 가 됩니다.</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>이제 마지막 남은 루틴을 분석할 차례입니다. 빨간 부분이 얼마&nbsp;남아있있지 않군요&nbsp;ㅎㅎ</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>.text:004014F3 loc_4014F3: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: maybe_Encryption+C0j</p> <p>.text:004014F3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rol &nbsp; &nbsp; [ebp+var_4], 10h</p> <p>.text:004014F7</p> <p>.text:004014F7 loc_4014F7: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: maybe_Encryption+D1j</p> <p>.text:004014F7 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+InputBuffer]</p> <p>.text:004014FA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, byte ptr [edx]</p> <p>.text:004014FD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+InputBuffer]</p> <p>.text:00401500 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; edx, byte ptr [ecx+3]</p> <p>.text:00401504 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub &nbsp; &nbsp; eax, edx</p> <p>.text:00401506 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_8], al</p> <p>.text:00401509 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, [ebp+var_8]</p> <p>.text:0040150D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+var_4]</p> <p>.text:00401510 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; ecx, eax &nbsp; &nbsp; &nbsp; &nbsp;; var4 = AAAF001F</p> <p>.text:00401510 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;; var8 = 't' - arg0[3]</p> <p>.text:00401512 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], ecx</p> <p>.text:00401515 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+InputBuffer]</p> <p>.text:00401518 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, byte ptr [edx+4]</p> <p>.text:0040151C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+var_4]</p> <p>.text:0040151F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; ecx, eax</p> <p>.text:00401521 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], ecx</p> <p>.text:00401524 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rol &nbsp; &nbsp; [ebp+var_4], 8</p> <p>.text:00401528 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+InputBuffer]</p> <p>.text:0040152B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, byte ptr [edx+5]</p> <p>.text:0040152F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; eax, 69h</p> <p>.text:00401532 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_40153B</p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:00401534 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], 0F001F001h</span></p> <p>.text:0040153B</p> <p>.text:0040153B loc_40153B: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: maybe_Encryption+112j</p> <p>.text:0040153B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+InputBuffer]</p> <p>.text:0040153E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; edx, byte ptr [ecx+5]</p> <p>.text:00401542 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+var_4]</p> <p>.text:00401545 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; eax, edx</p> <p>.text:00401547 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], eax</p> <p>.text:0040154A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+InputBuffer]</p> <p>.text:0040154D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; edx, byte ptr [ecx+6]</p> <p>.text:00401551 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; edx, 6Eh</p> <p>.text:00401554 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_40155D</p> <p><span class="Apple-style-span" style="color: rgb(255, 1, 3);">.text:00401556 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], 0BADDF00Dh</span></p> <p>.text:0040155D</p> <p>.text:0040155D loc_40155D: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: maybe_Encryption+134j</p> <p>.text:0040155D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+var_4]</p> <p>.text:00401560 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; edi</p> <p>.text:00401561 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; esi</p> <p>.text:00401562 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; ebx</p> <p>.text:00401563 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; esp, ebp</p> <p>.text:00401565 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; ebp</p> <p>.text:00401566 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; retn</p> <p>.text:00401566 maybe_Encryption endp</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>004014F3 ~&nbsp;00401524 까지는 InputBuffer[3]값과 InputBuffer[4]값을 가지고 var_4를 변화시킵니다.</p> <p>&nbsp;</p> <p>여기서 부터는 var_4값을 따라가는 것을 포기했습니다. InputBuffer[3]값을 알 수 없었기 때문에 머리가 안돌아가 더라구요;;</p> <p>0040152B ~&nbsp;00401532 을 보시면, InputBuffer[5]값이 'i'(69h)와 같은 지 비교하는 것을 알 수 있기 떄문에,</p> <p>InputBuffer는&nbsp;t h 3 _ r i&nbsp;_ 가 됩니다.</p> <p>&nbsp;</p> <p>0040154A&nbsp;~&nbsp;00401554를 해석해 보면, InputBuffer[6]이 'n'(6eh)가 되는 것을 알 수 있습니다.</p> <p>그러므로 InputBuffer는&nbsp;t h 3 _ r i n 이 됩니다.</p> <p>함수의 끝은&nbsp;현재까지 변화된 var_4를 리턴하게 됩니다. 그러나 저는 var_4를 분석을 중간에 포기했기때문에 th3_rin 값만 알 수 있었습니다.</p> <p>&nbsp;</p> <p>여기서 선택할 수 있습니다. bruteforce 입력을 하여서 남은 1자리의 문자를 맞출 수 있기도 합니다. 실제로 성질 급한 저는 그렇게도 해보았습니다.</p> <p>그러나 'wrong'만 나오더라구요. 나중에 알고 보니 안티디버깅 루틴중 ntdll의 code section비교 루틴이 있는데, 제 컴퓨터에서는 디버거가</p> <p>없어도 코드 섹션 비교가 동일하지&nbsp;않게 나오는 지 정상적인 상태에서도 답을 알아 낼 수 가 없었습니다. OTL</p> <p>그래서 엄청나게 많은 badfood를 맛보았습니다.</p> <p>결국 올리를 붙여서 값을 추적할 수 밖에 없었습니다.</p> <p>&nbsp;</p> <p>앞서 설명드린 내용중에 다음과 같이 Encryption함수가 리턴하는 값을 비교하는 루틴을 아래와 같이 보여 드렸습니다.</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>.text:00401360 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+maybe_UserInputedPasswordStrLen]</p> <p>.text:00401366 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;edx</p> <p>.text:00401367 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lea &nbsp; &nbsp; eax, [ebp+maybe_UserInputedPasswordBuffer]</p> <p>.text:0040136D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;eax</p> <p>.text:0040136E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp; &nbsp;maybe_Encryption</p> <p>.text:00401373 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp, 8</p> <p>.text:00401376 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+maybe_EncryptedResultValue], eax</p> <p>... 생략 ...</p> <p>.text:004013B6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; [ebp+maybe_EncryptedResultValue], 0AF006DC3h</p> <p>.text:004013C0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_4013D1</p> <p>... 생략 ...</p> <p>.text:004013D8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;offset aDFS@gmail_comNF ; "정답! %s@gmail.com으로 메일을 보내서 인"...</p> <p>.text:004013DD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp; &nbsp;maybe_printf</p> <p>.text:004013E2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp, 8</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>여기서&nbsp;00401373에 브레이크포인트를 걸고 'th3_rin'값을 입력하였을때 결과를 확인하여 보았습니다.</p> <p>AF0078C3 값이 리턴됩니다. 이번에는 'th3arin'값을 입력하여 보았습니다.&nbsp;AF007EC3 값이 나옵니다. '_'문자와 'a'문자를</p> <p>다르게 입력하여도&nbsp;AF00??C3h 값이 유지되는것을 볼 수 있었습니다. 여기서 위에서 포기한 var_4 변경 루틴을</p> <p>조금더 살펴 보겠습니다.</p> <p>&nbsp;</p> <p>살펴볼 부분은 다음과 같습니다.</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>.text:004014F7 loc_4014F7: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; CODE XREF: maybe_Encryption+D1j</p> <p>.text:004014F7 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+InputBuffer]</p> <p>.text:004014FA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, byte ptr [edx]</p> <p>.text:004014FD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+InputBuffer]</p> <p>.text:00401500 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; edx, byte ptr [ecx+3]</p> <p><span class="Apple-style-span" style="background-color: rgb(255, 204, 102);">.text:00401504 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub &nbsp; &nbsp; eax, edx</span></p> <p>.text:00401506 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_8], al</p> <p>.text:00401509 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, [ebp+var_8]</p> <p>.text:0040150D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+var_4]</p> <p><span class="Apple-style-span" style="background-color: rgb(174, 255, 102);">.text:00401510 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; ecx, eax</span></p> <p>.text:00401512 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], ecx</p> <p>.text:00401515 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+InputBuffer]</p> <p>.text:00401518 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, byte ptr [edx+4]</p> <p>.text:0040151C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+var_4]</p> <p><span class="Apple-style-span" style="background-color: rgb(255, 247, 0);">.text:0040151F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; ecx, eax</span></p> <p>.text:00401521 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], ecx</p> <p>.text:00401524 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rol &nbsp; &nbsp; [ebp+var_4], 8</p> <p>.text:00401528 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+InputBuffer]</p> <p>.text:0040152B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; eax, byte ptr [edx+5]</p> <p>.text:0040152F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; eax, 69h</p> <p>.text:00401532 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_40153B</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>입력값을 'th3_rin'을 입력하고&nbsp;0040151F에 브레이크포인트를 걸고 eax값과 var_4를 확인해 보았습니다.</p> <p>eax =&nbsp;00000072 ('r') &nbsp;InputBuffer[4]&nbsp;문자</p> <p>ecx =&nbsp;AAAF000A</p> <p>이 되며, var4에는 eax xor ecx한&nbsp;값&nbsp;AAAF0078이 들어가게 됩니다. 그리고 이 값을 8bit 왼쪽으로 로테이트 쉬프트 시키면</p> <p>AF0078AA값 됩니다. AA값은 maybe_Encryption함수가 리턴할 즈음에 C3값으로 바뀝니다. 그래서 리턴되는 값은</p> <p>AF0078C3 이 됩니다.&nbsp;AF0078C3 값은&nbsp;AF00??C3 패턴과 유사합니다. 즉 InputBuffer[3]값에 따라서 ??가 정해지고, ??값은</p> <p>6d가 되어야 비교문(0AF00<strong style="">6D</strong>C3h와 비교)을 통과할 수 있는 것입니다.&nbsp;</p> <p>&nbsp;</p> <p>다시&nbsp;0040151F 을 살펴보겠습니다. xor ecx, eax('r')=00000072&nbsp;을 했을 때, 결과값이&nbsp;6d가 되는 값을 찾으면 되겠습니다.</p> <p>&nbsp;</p> <p>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ??&nbsp;&nbsp;= 0001 1111 -&gt; 1f</p> <p>xor) &nbsp; &nbsp; 72&nbsp;&nbsp;= 0111 0010 -&gt; 72</p> <p>----------------------------</p> <p>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;6d &nbsp;= 0110 1101</p> <p>&nbsp;</p> <p>이렇게 계산 해보니, 1f&nbsp;가 나옵니다. 그러면 ecx값은 AAAF000A(th3_rin 입력시의 값)이 아닌&nbsp;AAAF00<strong style="">1F</strong>(올바른 값입력시)이 되어야만</p> <p>한다는 것을 알 수 있습니다. 그러면 과연 InputBuffer[3]에 어떤값을 넣어야 var4의 값이&nbsp;AAAF001F값이 나올까요..?</p> <p>답을 찾기 위해&nbsp;이번에는&nbsp;조금 더 윗부분을 조사해 보겠습니다.</p> <p>&nbsp;</p> <p>00401510 을 보시면 var_4 값을 가지고 eax값이 xor연산을 하는 부분이 있습니다. 이번에는 여기에 브레이크포인트를 걸고 살펴 보겠습니다.</p> <p>마찬가지로 입력값은 'th3_rin'&nbsp;입니다.</p> <p>eax =&nbsp;00000015</p> <p>ecx =&nbsp;AAAF001F</p> <p>&nbsp;</p> <p>여기서 xor연산을 하게 되면 ecx는&nbsp;AAAF000A로 바뀌게 됩니다. 그러나 위에서 살펴보았듯이&nbsp;우리가 원하는 값은&nbsp;AAAF001F가 되어야만</p> <p>합니다.&nbsp;AAAF001F =&nbsp;AAAF001F xor&nbsp;eax 의 연산에서 eax가 0이 되면 자기 자신값&nbsp;AAAF001F이 나올수 있습니다.</p> <p>&nbsp;</p> <p>그렇다면 이번에는 eax값을 0이 되도록 하는 부분을 살펴보겠습니다.</p> <p>00401504 을 보시면 eax(InputBuffer[3])에서 edx(InputBuffer[0] = 74('t'))을 빼주는 것을 볼 수 있습니다. 여기서 eax가 0이 되려면</p> <p>edx와 동일한 값 74('t')이면 되겠습니다. 즉 InputBuffer[3]은 74('t')라는 것을 알 수 있겠습니다.</p> <p>&nbsp;</p> <p>종합해보면 InputBuffer는 't h 3 t r i n'이 되어야 maybe_Encryption함수가 올바른 리턴값&nbsp;0AF006DC3h을 리턴하는 것을 알 수 있습니다.</p> <p>&nbsp;</p> <p>최종적으로 확인해 보겠습니다.</p> <p>&nbsp;</p> <p><img class="attachment" title="최종.PNG" src="/pages/3275391/attachments/1496029" alt="최종.PNG" /></p> <p>&nbsp;</p> <p>이제 제대로 맞게 풀었는지 여쭤봐야겠습니다.&nbsp;</p> <p><br /></p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> by http://seyool.myid.net/ http://seyool.myid.net/ 191