ollydbg using notes (16)

ollydbg using notes (16)

Reference

Book: "Encryption and decryption"

Video: Small Turtle decryption Series video

Example program: HTTP://PAN.BAIDU.COM/S/1QWDJYIW

Resource Hacker:http://www.angusj.com/resourcehacker/reshack_cn_3.6.0.exe

After this program runs, there is a nag window that can be staffed from this nag window, using resource hacker this software to find the Nag's hinstance

Picture 1

Picture 2

You can know that the Nag window has a hinstance of 100 (decimal), loads the program into OD, and searches for push 0x64

Picture 3

Then all push 0x64 up and down breakpoints. Run the program and find the call that generated the Nag window. Delete other breakpoints. Observing the code in front of this call, you can send JE short 0040672E can skip this, and decide that this JE jump does not jump is the 00431650

Picture 4

Under Call 00431650, click the breakpoint, rerun the program, go to call 00431650, view the code

00431650/$ 81EC D0000000 sub ESP, 0d000431656 |.  8d4424-Lea eax, DWORD ptr [esp]0043165a |.  ebx0043165b Push |.  ESI0043165C Push |.  EDI0043165D Push |. -Push eax;  /phandle0043165e |. 19000200 Push 20019; |  Access = key_read00431663 |. 6A Push 0; |  Reserved = 000431665 |. f8b34400 Push 0044b3f8; |  subkey = "Software\gamani\gifmoviegear\2.0" 0043166A |.  01000080 push 80000001; |hkey = hkey_current_user0043166f |.  83CB FF or EBX, FFFFFFFF; |00431672 |. FF15 04804400 call DWORD ptr [<&ADVAPI32. regopenkey>;  \regopenkeyexa00431678 |.  85C0 test eax, eax0043167a |.  0f85 C2000000 jnz 0043174200431680 |. 8D4C24 Lea ECX, DWORD ptr [esp+10]00431684 |. 8b35 08804400 mov esi, DWORD ptr [<&ADVAPI32.  regqu>; ADVAPI32.  regqueryvalueexa0043168a |.  8d5424 Lea edx, DWORD ptr [esp+14]0043168e |. ECX push;  /pbufsize0043168f |. Push edx; |  Buffer00431690 |.  eax; |pvaluetype00431691 |. -Push eax; |  Reserved00431692 |.  8b4424 1C mov eax, DWORD ptr [esp+1c]; |00431696 |.  BF 64000000 mov edi, |0043169b |. 98d44400 Push 0044d498; |  ValueName = "RegName3" 004316a0 |.  eax; |HKEY004316A1 |.  897C24-mov DWORD ptr [esp+28], EDI; |004316A5 |. FFD6 call ESI;  \regqueryvalueexa004316a7 |. 85C0 test eax, eax004316a9 |.  0f85 93000000 jnz 00431742004316AF |.  8D4C24 Lea ECX, DWORD ptr [ESP+10]004316B3 |.  8d5424. Lea edx, DWORD ptr [Esp+78]004316b7 |. ECX push;  /pbufsize004316b8 |. Push edx; |  buffer004316b9 |.  eax; |pvaluetype004316ba |. -Push eax; |  RESERVED004316BB |.  8b4424 1C mov eax, DWORD ptr [esp+1c]; |004316BF |. a4d44400 Push 0044d4a4; |  ValueName = "RegCode3" 004316c4 |.  eax; |hkey004316c5 |.  897C24-mov DWORD ptr [esp+28], EDI; |004316C9 |. FFD6 call ESI;  \REGQUERYVALUEEXA004316CB |.  85C0 test eax, EAX004316CD |.  JNZ Short 00431742004316CF |. 8D4C24 78    Lea ECX, DWORD ptr [ESP+78]004316D3 |.  8d5424 Lea edx, DWORD ptr [Esp+14]004316d7 |.  Wuyi Push Ecx004316d8 |.  Push Edx004316d9 |.  E8 b2feffff Call 00431590004316DE |.  83C4 add ESP, 8004316E1 |.  85C0 test eax, Eax004316e3 |.  5D JE Short 00431742004316E5 |.  8b9424 E00000>mov edx, DWORD ptr [Esp+e0]004316ec |.  BB 01000000 mov ebx, 1004316F1 |.  85D2 test edx, EDX004316F3 |.  Je Short 00431716004316f5 |.  8D7C24 Lea EDI, DWORD ptr [ESP+14]004316F9 |.  83c9 FF or ECX, FFFFFFFF004316FC |.  33c0 xor eax, EAX004316FE |.  F2:ae repne scas byte ptr es:[edi]00431700 |.  F7d1 not ecx00431702 |.  2bf9 Sub edi, ecx00431704 |.  8BC1 mov eax, ecx00431706 |.  8BF7 mov esi, edi00431708 |.  8BFA mov edi, edx0043170a |.    C1e9 02   shr ecx, 20043170D |.  F3:a5 Rep movs dword ptr Es:[edi], DWORD p>0043170f |.  8BC8 mov ecx, eax00431711 |.  83E1 Geneva and ECX, 300431714 |. F3:a4 Rep movs byte ptr es:[edi], byte ptr>00431716 |> 8b9424 E40000>mov edx, DWORD ptr [Esp+e4  ]0043171d |.  85D2 test edx, edx0043171f |.  Je Short 0043174200431721 |.  8D7C24-Lea EDI, DWORD ptr [esp+78]00431725 |.  83c9 FF or ECX, FFFFFFFF00431728 |.  33c0 xor eax, EAX0043172A |.  F2:ae repne scas byte ptr es:[edi]0043172c |.  F7d1 not ecx0043172e |.  2bf9 Sub edi, ecx00431730 |.  8BC1 mov eax, ecx00431732 |.  8BF7 mov esi, edi00431734 |.  8BFA mov edi, edx00431736 |.  c1e9 ecx shr, 200431739 |.  F3:a5 Rep movs dword ptr Es:[edi], DWORD p>0043173b |. 8BC8 mov ecx, eax0043173d |.  83E1 Geneva and ECX, 300431740 |. F3:a4 Rep movs byte ptr es:[edi], byte ptr>00431742 |> 8b4c24 0C mov ecx, DWORD ptr [esp+c]004  31746 |. ECX push;  /hkey00431747 |. FF15 00804400 call DWORD ptr [<&ADVAPI32. regcloseke>;            \regclosekey0043174d 5F pop edi0043174e 8BC3 mov eax, ebx00431750 5E  Pop esi00431751 5B pop ebx00431752 81c4 D0000000 add esp, 0d000431758 \. C3 RETN

You can see that this function is used to read the name and key in the registry to determine if name and key are correct by using call 00431590来.

We can at the end of the function mov eax, EBX changed to mov al,1 to crack (can not be changed to MOV eax,1 because mov eax,1 occupy 5 bytes, after the change will overwrite the code behind)

ollydbg using notes (16)