Помогите с CrackMe/Vb6

Discussion in 'Реверсинг' started by cryptX, 13 May 2011.

  1. cryptX

    cryptX Elder - Старейшина

    Joined:
    2 Sep 2008
    Messages:
    51
    Likes Received:
    1
    Reputations:
    1
    Здраствуйте!
    Помогите пожайлуста понять алгоритм работы этой crackme,знаю что используется криптовка ключа,но не могу понять тип хеша.(md5,aes ?)

    И потом как можно справится с такой зашитой (патчить ? ) ?

    Если не трудно описать в двух словах как работает алгоритм проверки.

    Вот хеш ключа такой: D4031626A48386A6AF14EF8A5B2129D7DCCE17DEC5D0F0141274F0C45AF4FDAB2E121EAAEB1A89B1AB7069C148AD8255D901

    вес: 40kb
    линк: http://www.sendspace.com/file/41eyk0
     
  2. TR0J@N

    TR0J@N Elder - Старейшина

    Joined:
    30 Mar 2007
    Messages:
    105
    Likes Received:
    58
    Reputations:
    13
    Форма чтобы орентироваться в именах
    Code:
    Begin VB.Form FTestRijndael
      Caption = "Unlock me, bro."
      ScaleMode = 1
      AutoRedraw = False
      FontTransparent = True
      'Icon = n/a
      LinkTopic = "Form1"
      ClientLeft = 60
      ClientTop = 345
      ClientWidth = 5505
      ClientHeight = 1470
      StartUpPosition = 3 'Windows Default
      Begin TextBox license
        Left = 1320
        Top = 120
        Width = 4155
        Height = 315
        Text = "registrationkey"
        TabIndex = 1
      End
      Begin CommandButton cmdTest2
        Caption = "Unlock Application"
        Left = 0
        Top = 480
        Width = 1935
        Height = 255
        TabIndex = 0
      End
      Begin Label Label1
        Caption = "Encryption copyright: ""Copyright 2001 Phil Fresle"""
        Left = 0
        Top = 1200
        Width = 5535
        Height = 255
        TabIndex = 4
      End
      Begin Label result
        Left = 0
        Top = 840
        Width = 5415
        Height = 255
        TabIndex = 3
      End
      Begin Label Label2
        Caption = "Key"
        Left = 0
        Top = 180
        Width = 1215
        Height = 255
        TabIndex = 2
      End
    End
    Код кнопки проверки:
    Code:
    Private Sub cmdTest2_Click() '402CC0
      Dim var_18 As Me
      loc_00402CE5: var_8 = &H401108
      loc_00402D3A: call MSVBVM60.DLL.__vbaNew(004018F4h, arg_8, esi, ebx)
      loc_00402D4B: Set var_18 = MSVBVM60.DLL.__vbaNew(004018F4h, arg_8, esi, ebx)
      loc_00402D66: var_34 = license.Text
      loc_00402D8C: call MSVBVM60.DLL.__vbaStr2Vec(var_6C, var_34, var_34, arg_8, 00402330h, 000000A0h, arg_8)
      loc_00402D9A: call MSVBVM60.DLL.__vbaAryMove(var_28, var_6C)
      loc_00402DBA: var_2C = "D4031626A48386A6AF14EF8A5B2129D7DCCE17DEC5D0F0141274F0C45AF4FDAB2E121EAAEB1A89B1AB7069C148AD8255D901BE46D19EDBBC1A2E2D3298C6A710"
      loc_00402DCA: var_1C = Len(var_2C)
      loc_00402DCF: Len(var_2C) = Len(var_2C) - var_2C
      loc_00402DD1: sar eax, 01h
      loc_00402DD3: Len(var_2C) = Len(var_2C) - 00000001h
      loc_00402DEC: call ReDim(00000080h, 00000001h, var_24, 00000011h, 00000001h, Len(var_2C), ebx)
                    If 00000001h > 0 Then GoTo loc_00402ED0
      loc_00402E0E: var_40 = 2
      loc_00402E14: var_74 = var_2C
      loc_00402E21: var_94 = "&H"
      loc_00402E2B: var_9C = 8
      loc_00402E35: var_7C = &H4008
      loc_00402E3C: var_58 = Mid$(var_2C, 1, 2)
      loc_00402E52: 00000001h = 00000001h - 2
      loc_00402E5C: sar edi, 01h
      loc_00402E5E: 00000001h = 00000001h - Me.%x1 = GetIDsOfNames(%x2) 'Ignore this
                    If 00000001h < 0 Then GoTo loc_00402E74
      loc_00402E64: Err.Raise
      loc_00402E6A: GoTo loc_00402E74
      loc_00402E6C: Err.Raise
      loc_00402E74: 
      loc_00402E83: var_68 = "&H" & 8
      loc_00402E8A: Var_Ret_1 = CByte(var_68)
      loc_00402EBC: 00000002h = 00000002h + 00000001h
      loc_00402ECB: GoTo loc_00402DFF
      loc_00402ED0: 
      loc_00402EE5: call Me.LoadProp(var_24, var_28, var_B0)
      loc_00402F0B: call MSVBVM60.DLL.__vbaAryMove(var_20, var_B0, Me.LoadProp(var_24, var_28, var_B0), var_18, 00402210h, 00000030h)
      loc_00402F2D: var_74 = var_20
      loc_00402F30: var_7C = &H2011
      loc_00402F3A: call MSVBVM60.DLL.__vbaStrVarCopy(var_7C, arg_8)
      loc_00402F45: var_34 = MSVBVM60.DLL.__vbaStrVarCopy(var_7C, arg_8)
      loc_00402F4D: Unknown_VTable_Call[edi+54h]
      loc_00402F7F: GoTo loc_00402FB7
      loc_00402FB0: call MSVBVM60.DLL.__vbaAryDestruct(00000000h, var_6C, var_68, 00402FF1h, Unknown_VTable_Call[edi+54h], MSVBVM60.DLL.__vbaAryMove(var_20, var_B0, Me.LoadProp(var_24, var_28, var_B0), var_18, 00402210h, 00000030h), 00402720h, Unknown_VTable_Call[edi+54h], MSVBVM60.DLL.__vbaAryMove(var_20, var_B0, Me.LoadProp(var_24, var_28, var_B0), var_18, 00402210h, 00000030h))
      loc_00402FB6: Exit Sub
      loc_00402FB7: 
      loc_00402FC7: call MSVBVM60.DLL.__vbaAryDestruct(ebx, var_B0)
      loc_00402FD7: call MSVBVM60.DLL.__vbaAryDestruct(ebx, var_20)
      loc_00402FDE: call MSVBVM60.DLL.__vbaAryDestruct(ebx, var_24)
      loc_00402FE5: call MSVBVM60.DLL.__vbaAryDestruct(ebx, var_28)
      loc_00402FF0: Exit Sub
      loc_0040300D: Exit Sub
    End Sub
    
     
    1 person likes this.
  3. s0l_ir0n

    s0l_ir0n Active Member

    Joined:
    14 Mar 2009
    Messages:
    399
    Likes Received:
    144
    Reputations:
    18
    аес, он самый
    [​IMG]

    Это не хэш ключа, а Round Key, если я не ошибаюсь.

    Вот тут все подробно расписано, но к сожалению на английском:
    http://www.quadibloc.com/crypto/co040401.htm
     
    #3 s0l_ir0n, 16 Jun 2011
    Last edited: 16 Jun 2011
    1 person likes this.