160 crackme training for novice crackers

1. Demolition

2. Find Algorithm

One: Blasting procedure
This program is a VB program, and I have not been exposed to programs other than C++ before. When the program is loading, neither BP MessageBoxA nor MessageBoxW can break the pop-up window.
Temporarily look at the VB program of “Encryption and Decryption III” and learn that the dialog box function of VB is: rtcMsgBox. There are VB function breakpoints in the OD plug-in, click to clear the rtcMsgBox breakpoint. Then enter the account tqdn password 1234 and click the control OK to let the program run.

After the program ran, it was broken in the dynamic link library of MSVBVM50. This should be the scope of the rtcMsgBox function. Just press F8 to get out of this function, a message box will pop up and display “You Get Wrong Try Again” as you go down, it should be an error message.
After stepping out of the function, return to the following.

Looking up at the current EIP, the nearest one is a JMP instruction. Clicking on this instruction on the OD directly skips the function that displays the error message. Then look up again. Are there any jump instructions.

. Looking up and found a reliable jumping point:
. 0040258B je XAfkayas_.004025E5; If SI is equal to 0 then jump to the wrong display
. Try to modify the JE here to nop. Then run the program~~ Successful blasting!

2: Find out the algorithm
. First of all, if you want to find an algorithm, you should clear the breakpoint at the blasting point first, and run here.

The jump of JE is controlled by TEST SI, SI, so we should find the instruction to assign SI there.

Looking up from TEST SI, SI, the return value of the vbaStrCmp string comparison function is given to ESI in a very close place. We clear the breakpoint at vbaStrCmp, and run OD to see what the comparison is. You can see in the observation stack that the function directly compares the password 1234 I entered with the KEY value calculated by the program in plain text.

Let’s look up the disassembly code

The first parameter of vbaStrCmp is given by the return value of vbaStrMove. Observe the disassembly

Did not see the instruction of PUSH parameter in vbaStrMove. Let’s clear the breakpoint here and go in to see what the implementation of vbaStrMove looks like.

By explaining the disassembly, we can know that vbaStrMove does not use the stack to pass parameters but uses two registers EDX and ECX. Combined with disassembly, EDX is given by the return value of vbaStrCat. ECX comes from ebp-0x20.

The two parameters of vbaStrCat are directly pushing a string “AKA-” and pushing an ECX, which points to a string “390240”. The KEY bit “AKA-390240” obtained by clearing the breakpoint at the blasting point at the beginning is very close to the algorithm. Our next step is to find out where ECX comes from. but failed. I am not familiar with VB, and the results given by the function here make me inexplicable.

So I decided to clear the breakpoint in the function header of the blasting point again, and then follow the process step by step. And pay attention to the return value and outgoing parameters of the function (lea EXX, ebp-XX, in this case, consider the outgoing parameter, check the current address directly in the hexadecimal window, and what is modified after the function is completed data!)

The string is 390240, which passed the first failed trace. Then you can know that this place is where the integer string is calculated. For KEY, you only need to splice an “AKA-” before the string.

This algorithm is very simple, just like 001, only the first byte of the account is taken. However, this account is calculated by taking the account length. Therefore, the KEY calculated by an account can only get the correct result when the first letter and the account length are equal!