160 - 37 CyberBlade.1

环境
Windows xp sp3

工具
1.exeinfo PE
2.ollydbg

查壳
OD载入是VB程序。

测试

OD载入直接搜字符串。
这个是当输入为空时会弹出消息框告诉你要输入9个字符。

0040E005   > \8B4D E4       mov ecx,dword ptr ss:[ebp-0x1C]
0040E008   .  51            push ecx
0040E009   .  68 4C344000   push CyberBla.0040344C
0040E00E   .  FF15 28114100 call dword ptr ds:[<&MSVBVM50.__vbaStrCm>;  MSVBVM50.__vbaStrCmp
0040E014   .  8BF0          mov esi,eax
0040E016   .  8D4D E4       lea ecx,dword ptr ss:[ebp-0x1C]
0040E019   .  F7DE          neg esi
0040E01B   .  1BF6          sbb esi,esi
0040E01D   .  46            inc esi
0040E01E   .  F7DE          neg esi
0040E020   .  FF15 8C114100 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>;  MSVBVM50.__vbaFreeStr
0040E026   .  8D4D E0       lea ecx,dword ptr ss:[ebp-0x20]
0040E029   .  FF15 90114100 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>;  MSVBVM50.__vbaFreeObj
0040E02F   .  66:3BF7       cmp si,di
0040E032   .  74 7D         je XCyberBla.0040E0B1
0040E034   .  BF 0A000000   mov edi,0xA
0040E039   .  BB 04000280   mov ebx,0x80020004
0040E03E   .  897D A0       mov dword ptr ss:[ebp-0x60],edi
0040E041   .  897D B0       mov dword ptr ss:[ebp-0x50],edi
0040E044   .  8B3D 78114100 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>;  MSVBVM50.__vbaVarDup
0040E04A   .  BE 08000000   mov esi,0x8
0040E04F   .  8D55 80       lea edx,dword ptr ss:[ebp-0x80]
0040E052   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
0040E055   .  895D A8       mov dword ptr ss:[ebp-0x58],ebx
0040E058   .  895D B8       mov dword ptr ss:[ebp-0x48],ebx
0040E05B   .  C745 88 EC344>mov dword ptr ss:[ebp-0x78],CyberBla.004>;  UNICODE "Error"
0040E062   .  8975 80       mov dword ptr ss:[ebp-0x80],esi
0040E065   .  FFD7          call edi                                 ;  <&MSVBVM50.__vbaVarDup>
0040E067   .  8D55 90       lea edx,dword ptr ss:[ebp-0x70]
0040E06A   .  8D4D D0       lea ecx,dword ptr ss:[ebp-0x30]
0040E06D   .  C745 98 94344>mov dword ptr ss:[ebp-0x68],CyberBla.004>;  UNICODE "You have to enter an 9 number key first."
0040E074   .  8975 90       mov dword ptr ss:[ebp-0x70],esi
0040E077   .  FFD7          call edi
0040E079   .  8D55 A0       lea edx,dword ptr ss:[ebp-0x60]
0040E07C   .  8D45 B0       lea eax,dword ptr ss:[ebp-0x50]
0040E07F   .  52            push edx
0040E080   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
0040E083   .  50            push eax
0040E084   .  51            push ecx
0040E085   .  8D55 D0       lea edx,dword ptr ss:[ebp-0x30]
0040E088   .  6A 40         push 0x40
0040E08A   .  52            push edx
0040E08B   .  FF15 04114100 call dword ptr ds:[<&MSVBVM50.#595>]     ;  MSVBVM50.rtcMsgBox

这里比较

0040E0EB   .  51            push ecx                                 ;  输入的serial存进来
0040E0EC   .  FF15 5C114100 call dword ptr ds:[<&MSVBVM50.__vbaR8Str>;  MSVBVM50.__vbaR8Str
0040E0F2   .  DB43 4C       fild dword ptr ds:[ebx+0x4C]             ;  这里会有一个值
0040E0F5   .  DD9D 38FFFFFF fstp qword ptr ss:[ebp-0xC8]
0040E0FB   .  DCA5 38FFFFFF fsub qword ptr ss:[ebp-0xC8]             ;  输入的serial与上面的值相减
0040E101   .  DFE0          fstsw ax
0040E103   .  A8 0D         test al,0xD
0040E105   .  0F85 EB030000 jnz CyberBla.0040E4F6
0040E10B   .  FF15 14114100 call dword ptr ds:[<&MSVBVM50.__vbaFpR8>>;  MSVBVM50.__vbaFpR8
0040E111   .  DC1D 08104000 fcomp qword ptr ds:[0x401008]            ;  将上面的结果与0比较
0040E117   .  DFE0          fstsw ax                                 ;  相等的话下面的跳转不实现，弹出正确消息框框
0040E119   .  F6C4 40       test ah,0x40
0040E11C   .  74 05         je XCyberBla.0040E123
0040E11E   .  BF 01000000   mov edi,0x1
0040E123   >  8D4D E4       lea ecx,dword ptr ss:[ebp-0x1C]
0040E126   .  FF15 8C114100 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>;  MSVBVM50.__vbaFreeStr
0040E12C   .  8D4D E0       lea ecx,dword ptr ss:[ebp-0x20]
0040E12F   .  FF15 90114100 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>;  MSVBVM50.__vbaFreeObj
0040E135   .  F7DF          neg edi
0040E137   .  66:85FF       test di,di
0040E13A   .  0F84 2C010000 je CyberBla.0040E26C
0040E140   .  BB 04000280   mov ebx,0x80020004
0040E145   .  BF 0A000000   mov edi,0xA
0040E14A   .  BE 08000000   mov esi,0x8
0040E14F   .  8D55 80       lea edx,dword ptr ss:[ebp-0x80]
0040E152   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
0040E155   .  895D A8       mov dword ptr ss:[ebp-0x58],ebx
0040E158   .  897D A0       mov dword ptr ss:[ebp-0x60],edi
0040E15B   .  895D B8       mov dword ptr ss:[ebp-0x48],ebx
0040E15E   .  897D B0       mov dword ptr ss:[ebp-0x50],edi
0040E161   .  C745 88 5C354>mov dword ptr ss:[ebp-0x78],CyberBla.004>;  UNICODE "Correct password"
0040E168   .  8975 80       mov dword ptr ss:[ebp-0x80],esi
0040E16B   .  FF15 78114100 call dword ptr ds:[<&MSVBVM50.__vbaVarDu>;  MSVBVM50.__vbaVarDup
0040E171   .  8D55 90       lea edx,dword ptr ss:[ebp-0x70]
0040E174   .  8D4D D0       lea ecx,dword ptr ss:[ebp-0x30]
0040E177   .  C745 98 FC344>mov dword ptr ss:[ebp-0x68],CyberBla.004>;  UNICODE "Not bad, you have found the correct password."
0040E17E   .  8975 90       mov dword ptr ss:[ebp-0x70],esi
0040E181   .  FF15 78114100 call dword ptr ds:[<&MSVBVM50.__vbaVarDu>;  MSVBVM50.__vbaVarDup
0040E187   .  8D55 A0       lea edx,dword ptr ss:[ebp-0x60]
0040E18A   .  8D45 B0       lea eax,dword ptr ss:[ebp-0x50]
0040E18D   .  52            push edx
0040E18E   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
0040E191   .  50            push eax
0040E192   .  51            push ecx
0040E193   .  8D55 D0       lea edx,dword ptr ss:[ebp-0x30]
0040E196   .  6A 40         push 0x40
0040E198   .  52            push edx
0040E199   .  FF15 04114100 call dword ptr ds:[<&MSVBVM50.#595>]     ;  MSVBVM50.rtcMsgBox