| Question: [original] ollydbg entry series (2)-string reference Author: ccdebuger Time: 2006-02-14,13: 34 Chain: http://bbs.pediy.com/showthread.php? T = 21308 Reference: Thanks to the feedback from chuxuezhe: Http://bbs.pediy.com/showthread.php? S = & threadid = 24703. After checking, we found that it was a writeArticleYou have used the modified ultra string reference plug-in to search for strings. The modified plug-in automatically adds the stringsCodeIt is followed by a comment, and all the letters are in lower case. As a result, the case score in the comment is unclear and confusing when the original article is written. This time I modified some of the articles, all of them were operated using the OD built-in function, and several images were recreated. Because of my own mistakes, I am sorry for the confusion in reading!
Ollydbg entry series (2)-string reference
Author: ccdebuger In the previous article, we started to crack the attack. Today's goalProgramIt is CFF crackme #3 in the crackmes.cjb.net image package attached to the first version of "encryption and decryption", which adopts the username/serial number protection method. The original version has an UPX shell. At the beginning, no shell is involved in cracking. We are mainly familiar with the general method of using ollydbg to crack. I will take off the shell for analysis. The attachment is a file after shelling and can be used directly. Let's first talk about the general software cracking process: Do not use ollydbg to debug a software first, and run it first. It is best to take a look at the help documentation to familiarize yourself with the use of the software, let's look at the registration method. If the serial number method is used, you can take a false one and try it to see how it works. It also leaves some useful clues for us to crack it. If the registration code is not entered, consider whether to read the registry or key file (generally referred to as Keyfile, that is, the program reads the content of a file to determine whether to register ), other tools can be used for analysis. If none of these are, the original program is only a trial version with incomplete functions. To register it as the official version, you must complete the code by yourself. A little out of question, huh, huh. After obtaining some basic information about the program, we also need to use the shell check tool to check whether the program has been shelled. If there is no shell, let's see what compiler the program is compiled, such as Vc, Delphi, and VB. Such shell checking tools include peid and Fi. If there is shell, we should try to take off the shell and then use ollydbg for debugging. In special cases, we can also debug with shell. Enter the subject below:
This crackme has already lost both the user name and registration code, saving us the trouble of getting started. We are at the "register now !" Click the button to bring up a dialog box:
Now, we will display "Wrong serial, try again!" In this error dialog box today !" . Start ollydbg, select the menu File> open the crackme3.exe file, and we will stop here:
In the Disassembly window, right-click a menu and choose search> all reference text strings and click:
Of course, it is more convenient to use the above super string reference + plug-in. However, our goal is to be familiar with some ollydbg operations. I will try to use the built-in functions of ollydbg with less plug-ins. Now, in another dialog box, right-click it, select the "Search Text" menu item, and enter "Wrong serial, try again !" The start WORD "wrong" (note that the search content is case-sensitive) to find one:
Right-click the string we found, and click "follow in the Disassembly window" in the menu. We are here:
See. To see if there are other references, you can right-click the menu to find references-> immediate count. A dialog box is displayed:
Double-click the two addresses marked above, and we will go to the corresponding location: 00366f79 |. Ba 8c0000400 mov edX, crackme3.0044450c; ASCII "Wrong serial, try again! "
In the Disassembly window, scroll up to see the following: 00366f2c |. 8b45 FC mov eax, dword ptr ss: [EBP-4]
Note that I have marked two key points on the above annotations. Some may ask, how do you know the two are the key points? In fact, it is very simple. I decided to jump to the command corresponding to the string "Wrong serial, try again. If you choose "debug option"> "CPU tag", "show Jump path" and the two "show Gray path if the jump is not implemented" and "show the path to jump to the selected command "if selected, you will see the jump from where to where the error string is:
We set a breakpoint at the address 0020.f2c by pressing the F2 key. Now we press the F9 key and the program is running. In the above edit box, enter it casually, for example, ccdebuger. The edit box below is still the original "754-gfx-ier-954". Let's click the "register now !" Button, oh, ollydbg jumped out and paused at our breakpoint. Let's take a look at the information window. You should have found the content you just entered? It is shown as follows: Stack SS: [0012f9ac] = 00d44db4, (ASCII "ccdebuger ")
The above memory address 00d44db4 is the content we just entered. Here I am ccdebuger. You can choose stack SS: [0012f9ac] = 00d44db4, (ASCII "ccdebuger"), right click, select "value following in the data window" in the pop-up menu, and you will see the content you just entered in the data window below. While eax = 00000009 refers to the length of the input content. For example, the ccdebuger I entered is 9 characters long. As shown in:
00366f2c |. 8b45 FC mov eax, dword ptr ss: [EBP-4]; send the content we entered to eax, I here is "ccdebuger" When we press the F8 key to go to the "00366f34 |. E8 f32bfcff call crackme3.00403b2c" sentence, we press the F7 key to enter the call. When we enter, the cursor stops at this sentence:
00403b2c/$53 push EBX according to the above analysis, we know that the user name must be "registered user ". Press the F9 key to run the program. The error dialog box is displayed. Click OK. Enter "registered user" in the first edit box and click "register now!" again !" Button, blocked by ollydbg. We have already analyzed the call at the address 00366f34. This time, we don't have to press F7 to follow up and press F8 to pass the call. Press the F8 key to go to the second key code: 00366f49 |. 8b45 FC mov eax, dword ptr ss: [EBP-4]; get the entered Registration Code Please note that the call crackme3.00403b2c at address 0020.f51 is the same as the call crackme3.00403b2c at address 0020.f34 analyzed above? This indicates that the user name and registration code are detected using the same subroutine. We have analyzed the subprogram call above. We can easily draw a conclusion from the execution until now, this call is to compare the entered registration code with the "GFX-754-IER-954" after the instruction at 0020.f4c address, equal to OK. Now we have enough information. Now, choose> breakpoint> open the breakpoint window (you can also press Alt + B or click the "B" icon on the toolbar to open the breakpoint window ):
Why is this step not to delete the breakpoint? This is mainly for the sake of insurance. In case of analysis errors, we need to proceed with the analysis. If the breakpoint is deleted, we need to repeat the work. Disable it first. If it turns out that our analysis is correct, it is not too late to delete it. Now we disable the breakpoint and press F9 in ollydbg to run the program. Enter the analyzed content:
-------------------------------------------------------------------------------- |
Uploaded attachment
| Cffo-3.rar (, 0, 16467 downloads) |
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
