WINZIP8.0PASSWORD追蹤部分認識 (7千字)
WINZIP8.0PASSWORD追蹤部分認識
1.加密加壓一個ABC.ZIP
2.解壓ABC.ZIP，輸入PASSWORD
3.BPX HMEMCPY 確認PASSWORD
4.按F12 進入無模組提醒領空
5.U 20001EC6
6.BPX 20001EC6
7.F5攔截成功如下
:20001EC6 A1CC4D0620 mov eax,
dword ptr [20064DCC]--passwod
:20001ECB 56
push esi
:20001ECC 50
push eax
:20001ECD E83EFDFFFF call 20001C10----計算1
:20001ED2 8B4D08
mov ecx, dword ptr [ebp+08]
:20001ED5 83C404
add esp, 00000004
:20001ED8 33F6
xor esi, esi
:20001EDA 8B11
mov edx, dword ptr [ecx]
:20001EDC 8955F4
mov dword ptr [ebp-0C], edx
:20001EDF 8B4104
mov eax, dword ptr [ecx+04]
:20001EE2 8945F8
mov dword ptr [ebp-08], eax
:20001EE5 8B4908
mov ecx, dword ptr [ecx+08]
:20001EE8 894DFC
mov dword ptr [ebp-04], ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:20001F0E(C)
|
:20001EEB E890FCFFFF call 20001B80---計算2
:20001EF0 8A5435F4 mov
dl, byte ptr [ebp+esi-0C]
:20001EF4 32D0
xor dl, al
:20001EF6 8AC2
mov al, dl
:20001EF8 885435F4 mov
byte ptr [ebp+esi-0C], dl
:20001EFC 25FF000000 and eax,
000000FF
:20001F01 50
push eax
:20001F02 E899FCFFFF call 20001BA0----計算3
:20001F07 83C404
add esp, 00000004
:20001F0A 46
inc esi
:20001F0B 83FE0C cmp
esi,0000000C--oc=12,
( the encryption header=12
bytes )
:20001F0E 7CDB
jl 20001EEB--計算2. 計算3 迴圈12計算
:20001F10 8B15240F0320 mov edx, dword
ptr [20030F24]
:20001F16 660FB645FF movzx ax,
byte ptr [ebp-01]--計算結果
:20001F1B F6422002 test
[edx+20], 02
:20001F1F 7414
je 20001F35
:20001F35 8B156A170820 mov edx, dword
ptr [2008176A]--crc32
:20001F3B C1EA18
shr edx, 18
:20001F3E 663BC2
cmp ax, dx
:20001F41 7407
je 20001F4A
計算1--可能是PAUL文章如下部分：
process_keys(key):
key0_{1-l} <-- 0x12345678
key1_{1-l} <-- 0x23456789
key2_{1-l} <-- 0x34567890
loop for i <-- 1 to l
update_keys_{i-l}(key_{i})
end loop
end process_keys
:20001C10 55
push ebp
:20001C11 8BEC
mov ebp, esp
:20001C13 56
push esi
:20001C14 8B7508
mov esi, dword ptr [ebp+08]--password
:20001C17 C7058840032078563412 mov dword ptr [20034088], 12345678
:20001C21 C7058C40032089674523 mov dword ptr [2003408C], 23456789
:20001C2B C7059040032090785634 mov dword ptr [20034090], 34567890
:20001C35 8A06
mov al, byte ptr [esi]--password
:20001C37 84C0
test al, al
:20001C39 7416
je 20001C51
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:20001C4F(C)
|
:20001C3B 25FF000000 and eax,
000000FF
:20001C40 50
push eax
:20001C41 E85AFFFFFF call 20001BA0
-----計算1.1
:20001C46 8A4601
mov al, byte ptr [esi+01]--next password
:20001C49 83C404
add esp, 00000004
:20001C4C 46
inc esi---password長度+1
:20001C4D 84C0
test al, al
:20001C4F 75EA
jne 20001C3B --password長度=0 NO JUMP
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:20001C39(C)
:20001C51 5E
pop esi
:20001C52 5D
pop ebp
:20001C53 C3
ret
計算1.1
* Referenced by a CALL at Addresses:
|:20001C41 , :20001CB7 , :20001D0B , :20001D44 , :20001D78
|:20001DEE , :20001F02 , :20001F93 , :20008ACC
|
:20001BA0 55
push ebp
:20001BA1 8BEC
mov ebp, esp
:20001BA3 8B1588400320 mov edx, dword
ptr [20034088]-12345678
:20001BA9 8B4508
mov eax, dword ptr [ebp+08]- password
:20001BAC 8BCA
mov ecx, edx
:20001BAE 56
push esi
:20001BAF 33C8
xor ecx, eax
:20001BB1 81E1FF000000 and ecx, 000000FF
:20001BB7 C1EA08
shr edx, 08
:20001BBA 8B0C8D04110320 mov ecx, dword ptr
[4*ecx+20031104]
:20001BC1 33CA
xor ecx, edx
:20001BC3 8B158C400320 mov edx, dword
ptr [2003408C]-23456789
:20001BC9 890D88400320 mov dword ptr
[20034088], ecx
:20001BCF 81E1FF000000 and ecx, 000000FF
:20001BD5 03CA
add ecx, edx
:20001BD7 8B1590400320 mov edx, dword
ptr [20034090]-3456790
:20001BDD 69C905840808 imul ecx, 08088405
:20001BE3 41
inc ecx
:20001BE4 8BF2
mov esi, edx
:20001BE6 890D8C400320 mov dword ptr
[2003408C], ecx
:20001BEC 81E6FF000000 and esi, 000000FF
:20001BF2 C1E918
shr ecx, 18
:20001BF5 33CE
xor ecx, esi
:20001BF7 5E
pop esi
:20001BF8 C1EA08
shr edx, 08
:20001BFB 8B0C8D04110320 mov ecx, dword ptr
[4*ecx+20031104]
:20001C02 33CA
xor ecx, edx
:20001C04 890D90400320 mov dword ptr
[20034090], ecx --[20034090]
結果存放地址
:20001C0A 5D
pop ebp
:20001C0B C3
ret
計算2
:20001B80 8B0D90400320 mov ecx, dword
ptr [20034090]
:20001B86 83C902
or ecx, 00000002
:20001B89 8BC1
mov eax, ecx
:20001B8B 83F001
xor eax, 00000001
:20001B8E 0FAFC1
imul eax, ecx
:20001B91 25FFFF0000 and eax,
0000FFFF
:20001B96 C1E808
shr eax, 08
:20001B99 C3
ret
計算3
:20001BA0 55
push ebp
:20001BA1 8BEC
mov ebp, esp
:20001BA3 8B1588400320 mov edx, dword
ptr [20034088]
:20001BA9 8B4508
mov eax, dword ptr [ebp+08]
:20001BAC 8BCA
mov ecx, edx
:20001BAE 56
push esi
:20001BAF 33C8
xor ecx, eax
:20001BB1 81E1FF000000 and ecx, 000000FF
:20001BB7 C1EA08
shr edx, 08
:20001BBA 8B0C8D04110320 mov ecx, dword ptr
[4*ecx+20031104]
:20001BC1 33CA
xor ecx, edx
:20001BC3 8B158C400320 mov edx, dword
ptr [2003408C]
:20001BC9 890D88400320 mov dword ptr
[20034088], ecx
:20001BCF 81E1FF000000 and ecx, 000000FF
:20001BD5 03CA
add ecx, edx
:20001BD7 8B1590400320 mov edx, dword
ptr [20034090]
:20001BDD 69C905840808 imul ecx, 08088405
:20001BE3 41
inc ecx
:20001BE4 8BF2
mov esi, edx
:20001BE6 890D8C400320 mov dword ptr
[2003408C], ecx
:20001BEC 81E6FF000000 and esi, 000000FF
:20001BF2 C1E918
shr ecx, 18
:20001BF5 33CE
xor ecx, esi
:20001BF7 5E
pop esi
:20001BF8 C1EA08
shr edx, 08
:20001BFB 8B0C8D04110320 mov ecx, dword ptr
[4*ecx+20031104]
:20001C02 33CA
xor ecx, edx
:20001C04 890D90400320 mov dword ptr
[20034090], ecx--好象最終結果是解密解壓的key
:20001C0A 5D
pop ebp
:20001C0B C3
ret
KINGSUN
版權所有
相關文章
- SQL追蹤和事件追蹤2012-12-31SQL事件
- 配置查詢與執行緒追蹤函式 | 全方位認識 sys 系統庫2018-11-06執行緒函式
- 日誌追蹤2023-12-04
- 程式碼追蹤2024-11-01
- Centos7系統路由追蹤安裝使用教程。2024-01-07CentOS路由
- 安全知識圖譜 | 按圖索“跡” 追蹤溯源2021-12-07
- OpenTelemetry分散式追蹤2024-09-11分散式
- 基於知識圖譜的APT組織追蹤治理2020-01-08APT
- 基於 OpenCv 和 Python 的手指識別及追蹤2018-12-16OpenCVPython
- Acrobat Reader 5.0的反跟蹤程式碼部分 (5千字)2001-08-14BAT
- 微服務追蹤SQL(支援Isto管控下的gorm查詢追蹤)2022-07-01微服務SQLGoORM
- 城市生活復原追蹤：部分城市常住人口返城率資料2020-03-02
- 如何追蹤laravel動態2021-09-10Laravel
- 如何追蹤Java動態2021-09-16Java
- 如何追蹤vue動態2021-09-16Vue
- 如何追蹤Go動態2021-09-13Go
- 追蹤解析 Disruptor 原始碼2019-01-19原始碼
- Debug追蹤eclipse2020-12-07Eclipse
- 路由追蹤命令詳解2016-11-02路由
- oracle追蹤誤操作DDL2015-03-12Oracle
- go的鏈路追蹤2024-10-12Go
- python ubuntu dlib 人臉識別11-物體追蹤2020-04-02PythonUbuntu
- 取代cookie的網站追蹤技術：“帆布指紋識別”初探2014-07-30Cookie網站
- 取代cookie的網站追蹤技術：”帆布指紋識別”初探2014-07-29Cookie網站
- 搭建資料追蹤系統2019-03-02
- 使用 CSS 追蹤使用者2019-02-28CSS
- 如何追蹤Python動態2021-09-16Python
- 如何追蹤laravel動態<二>2021-09-13Laravel
- 追蹤解析 ThreadPoolExecutor 原始碼2019-01-19thread原始碼
- Tockler for Mac時間追蹤工具2020-12-27Mac
- Spring Cloud 鏈路追蹤2020-10-05SpringCloud
- 網路安全追蹤利器IpTicker2017-11-12
- DataGuard環境程式資訊追蹤2016-06-14
- 使用dbms_system 追蹤sql2012-03-23SQL
- skywalking鏈路追蹤2024-08-04
- 如何跟蹤ASProtect外殼加密過的程式？ (7千字)2001-04-13加密
- 微服務追蹤SQL上報至Jaeger(支援Istio管控下的gorm查詢追蹤)2022-07-01微服務SQLGoORM
- VR先驅研製眼球追蹤 未來VR頭顯將實現眼球追蹤2016-09-06VR