?? setuphttp1212.txt
字號:
軟件名稱：Small HTTP server 1.212 sethttp.exe 40.5KB
下載地點(diǎn)：http://www.computerinfo.com.cn
發(fā) 信 人: 井 風(fēng)
時 間: 2001-02-23
破解工具：Trw20001.22
解題難度：[專 業(yè)] [學(xué) 士] [碩 士] [博 士]
********
前 言：
很小巧的WEB服務(wù)器，占用資源很小，支持CGI 1.1、 SSI、PHP。
過 程:
1、注冊窗口填入： 注冊名稱：abcdef 注冊碼：ABCD12345678；
2、用“井風(fēng)跟蹤”法找到出錯的CALL，此程序?yàn)椋?0403C31 CALL 004027BB。
詳細(xì)方法請閱讀“井風(fēng)”之WINZIP8.0破解教學(xué)篇；
3、分析代碼：
代碼段之一
0015F:00403C1C PUSH DWORD 83
015F:00403C21 PUSH DWORD [0040FB3C]
015F:00403C27 CALL 004048E4
015F:00403C2C PUSH DWORD 0040FC50
015F:00403C31 CALL 004027BB <---（過程2、）找出，執(zhí)行此CALL則出錯，追入此CALL
015F:00403C36 ADD ESP,BYTE +04 < 到代碼段之二，由后向前分析
015F:00403C39 TEST EAX,EAX <
015F:00403C3B JZ 00403C57
代碼段之二
015F:00402808 CMP EDX,EDX
015F:0040280A JZ 00402813
015F:0040280C MOV ESP,[004011AA]
015F:00402812 RET
015F:00402813 MOV [0040FB14],EDX
015F:00402819 CMP BYTE [EBP+FFFFF800],00 <===檢查有否輸入NAME
015F:00402820 JZ NEAR 00402978 <===NAME為空則出錯
015F:00402826 PUSH BYTE +10
015F:00402828 LEA EBX,[EBP+FFFFF8F0]
015F:0040282E PUSH EBX
015F:0040282F PUSH BYTE +79
015F:00402831 PUSH DWORD [0040FB3C]
015F:00402837 CALL 004048E4
015F:0040283C PUSH EBX
015F:0040283D CALL 00401E0C
015F:00402842 MOV [EBP+FFFFF7FC],EAX
015F:00402848 ADD ESP,BYTE +04
015F:0040284B MOV EDI,[EBP+FFFFF7F8]
015F:00402851 MOV ESI,0040261D
015F:00402856 CLD
015F:00402857 LODSB
015F:00402858 SCASB
015F:00402859 JNZ 0040285F
015F:0040285B OR AL,AL
015F:0040285D JNZ 00402857
015F:0040285F MOV AL,[EDI-01]
015F:00402862 SUB AL,[ESI-01]
015F:00402865 MOVSX EAX,AL
015F:00402868 MOV EDX,EAX
015F:0040286A TEST EDX,EDX
015F:0040286C JNZ 00402899
015F:0040286E CMP DWORD [EBP+FFFFF7FC],BYTE +16
015F:00402875 JA 0040287E
015F:00402877 PUSH DWORD 00402633
015F:0040287C JMP SHORT 0040288C
015F:0040287E CMP DWORD [EBP+FFFFF7FC],BYTE +1C
015F:00402885 JNA 004028E2
015F:00402887 PUSH DWORD 0040264D
015F:0040288C PUSH BYTE +79
015F:0040288E PUSH DWORD [0040FB3C]
015F:00402894 CALL 00404918
015F:00402899 ADD BYTE [EBP+FFFFF8F1],CF <===將注冊碼的第二位加上CF
015F:004028A0 ADD BYTE [EBP+FFFFF8F3],CA <===將注冊碼的第四位加上CA
015F:004028A7 LEA EBX,[EBP+FFFFF800]
015F:004028AD LEA EAX,[EBP+FFFFF8F0]
015F:004028B3 PUSH EAX
015F:004028B4 CALL 00401E0C <===將變化過的注冊碼計(jì)算產(chǎn)生EAX值，記為[**]
015F:004028B9 MOV [EBP+FFFFF7FC],EAX <===形成[EBP+FFFFF7FC]的值
015F:004028BF ADD BYTE [EBP+FFFFF8F1],31 <===還原注冊碼第二位值
015F:004028C6 ADD BYTE [EBP+FFFFF8F3],36 <===還原注冊碼第四位值
015F:004028CD PUSH EBX
015F:004028CE CALL 00402DB1
015F:004028D3 ADD ESP,BYTE +08
015F:004028D6 CMP [EBP+FFFFF7FC],EAX <===比較兩次計(jì)算的結(jié)果，[EBP+FFFFF7FC]為根據(jù)變化后
上面這行記為：[^-^] 的注冊碼計(jì)算結(jié)果，EAX根據(jù)注冊名稱計(jì)算結(jié)果。
下命令：D EAX 見E475CA=（14972362）十進(jìn)制
015F:004028DC JNZ NEAR 00402978 <===不相等則跳轉(zhuǎn)執(zhí)行***，出錯
015F:004028E2 MOV EAX,0040EE28
015F:004028E7 MOV EBX,EAX
015F:004028E9 SUB EBX,004092A8
015F:004028EF PUSH EBX
015F:004028F0 PUSH DWORD 53494745
015F:004028F5 PUSH DWORD 524E5528
015F:004028FA PUSH DWORD 004092A8
015F:004028FF CALL 00401E30
015F:00402904 MOV [EBP+FFFFF7E8],EAX
015F:0040290A ADD ESP,BYTE +10
015F:0040290D TEST EAX,EAX
015F:0040290F JZ 00402915
015F:00402911 MOV BYTE [EAX-01],00
015F:00402915 PUSH EBX
015F:00402916 PUSH DWORD 53494745
015F:0040291B PUSH DWORD 524E550A
015F:00402920 PUSH DWORD 004092A8
015F:00402925 CALL 00401E30
015F:0040292A MOV [EBP+FFFFF7E8],EAX
015F:00402930 ADD ESP,BYTE +10
015F:00402933 TEST EAX,EAX
015F:00402935 JZ 00402962
015F:00402937 MOV ECX,EAX
015F:00402939 INC ECX
015F:0040293A MOV EDI,ECX
015F:0040293C MOV ESI,0040267D
015F:00402941 CLD
015F:00402942 LODSB
015F:00402943 STOSB
015F:00402944 OR AL,AL
015F:00402946 JNZ 00402942
015F:00402948 MOV ECX,[EBP+FFFFF7E8]
015F:0040294E ADD ECX,BYTE +0F
015F:00402951 LEA EDX,[EBP+FFFFF800]
015F:00402957 MOV EDI,ECX
015F:00402959 MOV ESI,EDX
015F:0040295B CLD
015F:0040295C LODSB
015F:0040295D STOSB
015F:0040295E OR AL,AL
015F:00402960 JNZ 0040295C
015F:00402962 MOV EAX,[0040FC40]
015F:00402967 MOV [0040EE28],EAX
015F:0040296C MOV DWORD [0040EE2C],0FFFFFFF
015F:00402976 JMP SHORT 004029DB
015F:00402978 MOV DWORD [EBP+FFFFF7FC],00100000
015F:00402982 PUSH BYTE +14
015F:00402984 PUSH DWORD 0040268C
015F:00402989 PUSH DWORD 0040269E
015F:0040298E PUSH BYTE +00
015F:00402990 CALL 00404930 <===執(zhí)行此行出錯，記為[***]，向上分析
015F:00402995 CMP EAX,BYTE +07
015F:00402998 JNZ 004029DB
015F:0040299A CMP DWORD [EBP+FFFFF7FC],BYTE +00
015F:004029A1 JZ NEAR 00402C6D
015F:004029A7 MOV ESI,004027BB
代碼段之三
015F:00401E0C PUSH EBP <===追入**CALL，來到此行
015F:00401E0D MOV EBP,ESP
015F:00401E0F PUSH EBX
015F:00401E10 MOV EBX,[EBP+08]
015F:00401E13 XOR ECX,ECX <===將ECX清零
015F:00401E15 JMP SHORT 00401E1E
015F:00401E17 LEA EAX,[ECX+ECX*4] < 這段程序?qū)嶋H上是將十進(jìn)制數(shù)轉(zhuǎn)成十六進(jìn)制數(shù)，
015F:00401E1A LEA ECX,[EDX+EAX*2] <很經(jīng)典的算法！
015F:00401E1D INC EBX <
015F:00401E1E MOVSX EAX,BYTE [EBX] <
015F:00401E21 LEA EDX,[EAX-30] <---這句和B句的作用為檢查最后一位，如不為數(shù)字則結(jié)束
015F:00401E24 CMP EDX,BYTE +09 <---記為[B]
015F:00401E27 JNA 00401E17 <
015F:00401E29 MOV EAX,ECX <===將得出結(jié)果傳給EAX，以產(chǎn)生后面[EBP+FFFFF7FC]值
015F:00401E2B MOV EBX,[EBP-04]
015F:00401E2E LEAVE
015F:00401E2F RET
·
·
·
小 結(jié)：
弄清楚了代碼段之三的功能后，我們就知道如何得出注冊碼了。
因?yàn)榻?jīng)變化過的注冊碼的計(jì)算過程實(shí)際上是將一個十進(jìn)制數(shù)轉(zhuǎn)化為十六進(jìn)制數(shù)。所以得出：變化過
的注冊碼的十六進(jìn)制形式與[^-^]處根據(jù)注冊名產(chǎn)生的EAX值相同，即E475CA=（14972362）。
現(xiàn)在已經(jīng)知道了變化過的注冊碼應(yīng)為14972362，由[**]前面幾行代碼可知道：變化過程只是將你輸
入的注冊碼的第二、四位分別加上了CF、CA。所以只要將14972362中的4和7的ASCII值分別減去CF、CA
（34-CF=65為e、37-CA=6D為m）即為正確注冊碼：1e9m2362
NAME：abcdef CODE：1e9m2362
后 記：
有疑問請與我聯(lián)系：hz.cy@163.net?? 快捷鍵說明
復(fù)制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -