问题描述
KEY_NUM[32]:00000000000000020000000400000006000000080000000A0000000C0000000ESARN_KEY[72]:40232425262A2B210232425262A2B214002425262A2B214023025262A2B214023240262A2B214023242502A2B21402324252602B2140232425262A02140232425262A2B0DUMMY_NUM[64]:0000FB000000D20000007A000000A300000010000000C900000064000000810000009D000000BE0000005E00000006000000250000004700000038000000E200parity_d：10000000hparity_x：1000000h加密函数.text:0804B91Aloc_804B91A:;CODEXREF:encoder_flag+BCj.text:0804B91A8B0Emovecx,[esi].text:0804B91C89CAmovedx,ecx.text:0804B91E89C8moveax,ecx.text:0804B920C1FA10saredx,10h.text:0804B923C1F811sareax,11h.text:0804B92683E001andeax,1.text:0804B92983E201andedx,1.text:0804B92C01C2addedx,eax.text:0804B92E89C8moveax,ecx.text:0804B930C1F812sareax,12h.text:0804B93383E001andeax,1.text:0804B93601C2addedx,eax.text:0804B93889C8moveax,ecx.text:0804B93AC1F813sareax,13h.text:0804B93D83E001andeax,1.text:0804B94001C2addedx,eax.text:0804B94289C8moveax,ecx.text:0804B944C1F814sareax,14h.text:0804B94783E001andeax,1.text:0804B94A01C2addedx,eax.text:0804B94C89C8moveax,ecx.text:0804B94EC1F815sareax,15h.text:0804B95183E001andeax,1.text:0804B95401C2addedx,eax.text:0804B95689C8moveax,ecx.text:0804B958C1F816sareax,16h.text:0804B95B83E001andeax,1.text:0804B95E01C2addedx,eax.text:0804B96089C8moveax,ecx.text:0804B962C1F817sareax,17h.text:0804B96583E001andeax,1.text:0804B96801C2addedx,eax.text:0804B96A83E201andedx,1.text:0804B96D7408jzshortloc_804B977.text:0804B96F;38:*(_DWORD*)a1|=parity_d;.text:0804B96F0B0D48D20508orecx,parity_d.text:0804B975890Emov[esi],ecx.text:0804B977;39:if(!v2).text:0804B977.text:0804B977loc_804B977:;CODEXREF:encoder_flag+119j.text:0804B97785DBtestebx,ebx.text:0804B9797505jnzshortloc_804B980.text:0804B97B;40:v2=7;.text:0804B97BBB07000000movebx,7.text:0804B980;41:returnv2;.text:0804B980.text:0804B980loc_804B980:;CODEXREF:encoder_flag+125j.text:0804B9808D65F8leaesp,[ebp-8].text:0804B98389D8moveax,ebx.text:0804B9855Bpopebx.text:0804B9865Epopesi.text:0804B9875Dpopebp.text:0804B988C3retn.text:0804B988encoder_flagendp
解决方案
解决方案二：
解密函数publicdecoder_flag.text:0804B98Cdecoder_flagprocnear.text:0804B98C.text:0804B98Carg_0=dwordptr8.text:0804B98C.text:0804B98C55pushebp.text:0804B98D89E5movebp,esp.text:0804B98F56pushesi.text:0804B99053pushebx.text:0804B9918B7508movesi,[ebp+arg_0].text:0804B9948B1Emovebx,[esi].text:0804B99689D8moveax,ebx.text:0804B998D1F8sareax,1.text:0804B99A89DAmovedx,ebx.text:0804B99C83E001andeax,1.text:0804B99F83E201andedx,1.text:0804B9A201C2addedx,eax.text:0804B9A489D8moveax,ebx.text:0804B9A6C1F802sareax,2.text:0804B9A983E001andeax,1.text:0804B9AC01C2addedx,eax.text:0804B9AE89D8moveax,ebx.text:0804B9B0C1F803sareax,3.text:0804B9B383E001andeax,1.text:0804B9B601C2addedx,eax.text:0804B9B889D8moveax,ebx.text:0804B9BAC1F804sareax,4.text:0804B9BD83E001andeax,1.text:0804B9C001C2addedx,eax.text:0804B9C289D8moveax,ebx.text:0804B9C4C1F805sareax,5.text:0804B9C783E001andeax,1.text:0804B9CA01C2addedx,eax.text:0804B9CC89D8moveax,ebx.text:0804B9CEC1F806sareax,6.text:0804B9D183E001andeax,1.text:0804B9D401C2addedx,eax.text:0804B9D689D8moveax,ebx.text:0804B9D8C1F807sareax,7.text:0804B9DB83E001andeax,1.text:0804B9DE01C2addedx,eax.text:0804B9E089D8moveax,ebx.text:0804B9E2C1F808sareax,8.text:0804B9E583E001andeax,1.text:0804B9E801C2addedx,eax.text:0804B9EA89D8moveax,ebx.text:0804B9ECC1F818sareax,18h.text:0804B9EF83E201andedx,1.text:0804B9F283E001andeax,1.text:0804B9F539C2cmpedx,eax.text:0804B9F7755Djnzshortloc_804BA56.text:0804B9F989DAmovedx,ebx.text:0804B9FB89D8moveax,ebx.text:0804B9FDC1FA10saredx,10h.text:0804BA00C1F811sareax,11h.text:0804BA0383E001andeax,1.text:0804BA0683E201andedx,1.text:0804BA0901C2addedx,eax.text:0804BA0B89D8moveax,ebx.text:0804BA0DC1F812sareax,12h.text:0804BA1083E001andeax,1.text:0804BA1301C2addedx,eax.text:0804BA1589D8moveax,ebx.text:0804BA17C1F813sareax,13h.text:0804BA1A83E001andeax,1.text:0804BA1D01C2addedx,eax.text:0804BA1F89D8moveax,ebx.text:0804BA21C1F814sareax,14h.text:0804BA2483E001andeax,1.text:0804BA2701C2addedx,eax.text:0804BA2989D8moveax,ebx.text:0804BA2BC1F815sareax,15h.text:0804BA2E83E001andeax,1.text:0804BA3101C2addedx,eax.text:0804BA3389D8moveax,ebx.text:0804BA35C1F816sareax,16h.text:0804BA3883E001andeax,1.text:0804BA3B01C2addedx,eax.text:0804BA3D89D8moveax,ebx.text:0804BA3FC1F817sareax,17h.text:0804BA4283E001andeax,1.text:0804BA4501C2addedx,eax.text:0804BA4789D8moveax,ebx.text:0804BA49C1F81Csareax,1Ch.text:0804BA4C83E201andedx,1.text:0804BA4F83E001andeax,1.text:0804BA5239C2cmpedx,eax.text:0804BA54740Ajzshortloc_804BA60.text:0804BA56.text:0804BA56loc_804BA56:;CODEXREF:decoder_flag+6Bj.text:0804BA56B8FFFFFFFFmoveax,0FFFFFFFFh.text:0804BA5BEB25jmpshortloc_804BA82.text:0804BA5B;---------------------------------------------------------------------------.text:0804BA5D8D7600align10h.text:0804BA60.text:0804BA60loc_804BA60:;CODEXREF:decoder_flag+C8j.text:0804BA6089D9movecx,ebx.text:0804BA62C1F919sarecx,19h.text:0804BA6583E107andecx,7.text:0804BA680FBE84C900D20508movsxeax,SARN_KEY[ecx+ecx*8].text:0804BA7031C3xorebx,eax.text:0804BA720FB7C3movzxeax,bx.text:0804BA7585C9testecx,ecx.text:0804BA778906mov[esi],eax.text:0804BA797505jnzshortloc_804BA80.text:0804BA7BB907000000movecx,7.text:0804BA80.text:0804BA80loc_804BA80:;CODEXREF:decoder_flag+EDj.text:0804BA8089C8moveax,ecx.text:0804BA82.text:0804BA82loc_804BA82:;CODEXREF:decoder_flag+CFj.text:0804BA825Bpopebx.text:0804BA835Epopesi.text:0804BA845Dpopebp.text:0804BA85C3retn.text:0804BA85decoder_flagendp
解决方案三：
以上汇编，IDAF5代码signedint__cdecldecoder_flag(signedint*a1){signedintv1;//ebx@1signedintresult;//eax@3intv3;//ecx@4v1=*a1;if(((((*(_WORD*)a1>>8)&1)+((*a1>>7)&1)+((*a1>>6)&1)+((*a1>>5)&1)+((*a1>>4)&1)+((*a1>>3)&1)+((*a1>>2)&1)+((*a1>>1)&1)+(*a1&1))&1)==((*a1>>24)&1)&&((((v1>>23)&1)+((v1>>22)&1)+((v1>>21)&1)+((v1>>20)&1)+((v1>>19)&1)+((v1>>18)&1)+((v1>>17)&1)+((v1>>16)&1))&1)==((v1>>28)&1)){v3=(v1>>25)&7;*a1=(unsigned__int16)(SARN_KEY[9*v3]^(unsigned__int16)v1);if(!v3)v3=7;result=v3;}else{result=-1;}returnresult;}int__cdeclencoder_flag(inta1){unsignedintv1;//eax@1intv2;//ebx@1intv3;//ecx@1intv4;//eax@1intv5;//eax@1intv6;//ecx@1time_tseed;//[sp+18h][bp-Ch]@1v1=time(&seed);srand(v1);v2=rand()%8;v3=rand()%16;v4=*(_DWORD*)a1^SARN_KEY[9*v2];*(_DWORD*)a1=v4;v5=*(_DWORD*)&KEY_NUM[4*v2]|v4;*(_DWORD*)a1=v5;v6=*(_DWORD*)&DUMMY_NUM[4*v3]|v5;*(_DWORD*)a1=v6;if(((BYTE1(v6)&1)+((v6>>7)&1)+((v6>>6)&1)+((v6>>5)&1)+((v6>>4)&1)+((v6>>3)&1)+((v6>>2)&1)+((v6>>1)&1)+(v6&1))&1)*(_DWORD*)a1=parity_x|v6;if((((*(_DWORD*)a1>>23)&1)+((*(_DWORD*)a1>>22)&1)+((*(_DWORD*)a1>>21)&1)+((*(_DWORD*)a1>>20)&1)+((*(_DWORD*)a1>>19)&1)+((*(_DWORD*)a1>>18)&1)+((*(_DWORD*)a1>>17)&1)+((*(_DWORD*)a1>>16)&1))&1)*(_DWORD*)a1|=parity_d;if(!v2)v2=7;returnv2;}
解决方案四：
下面是我写的C#还原的代码privatestaticint[]KEY_NUM=newint[]{0x0,0x2000000,0x4000000,0x6000000,0x8000000,0xA000000,0xC000000,0xE000000};privatestaticint[]SARN_KEY=newint[]{0x25242340,0x26252423,0x2A262524,0x2B2A2625,0x212B2A26,0x40212B2A,0x2340212B,0x24234021};privatestaticint[]DUMMY_NUM=newint[]{0xFB0000,0xD20000,0x7A0000,0xA30000,0x100000,0xC90000,0x640000,0x810000,0x9D0000,0xBE0000,0x5E0000,0x060000,0x250000,0x470000,0x380000,0xE20000};publicstaticintencoder_flag(refintinput){intparity_d=268435456;//二进制1000000000000000000000000000010000000hintparity_x=16777216;//二进制10000000000000000000000001000000hRandomrnd=newRandom((int)DateTime.Now.Ticks);intrndKey=rnd.Next(999)%8;intrndDKey=rnd.Next(999)%16;input=input^SARN_KEY[rndKey];input=KEY_NUM[rndKey]|input;input=DUMMY_NUM[rndDKey]|input;if(((((sbyte)input&1)+((input>>7)&1)+((input>>6)&1)+((input>>5)&1)+((input>>4)&1)+((input>>3)&1)+((input>>2)&1)+((input>>1)&1)+(input&1))&1)==1)input=parity_x|input;if(((((input>>23)&1)+((input>>22)&1)+((input>>21)&1)+((input>>20)&1)+((input>>19)&1)+((input>>18)&1)+((input>>17)&1)+((input>>16)&1))&1)==1)input|=parity_d;if(rndKey==0)rndKey=7;returnrndKey;}publicstaticintdecoder_flag(refintinput){intresult=0;intv1=input;if(((((input>>8)&1)+((input>>7)&1)+((input>>6)&1)+((input>>5)&1)+((input>>4)&1)+((input>>3)&1)+((input>>2)&1)+((input>>1)&1)+(input&1))&1)==((input>>24)&1)&&((((input>>23)&1)+((input>>22)&1)+((input>>21)&1)+((input>>20)&1)+((input>>19)&1)+((input>>18)&1)+((input>>17)&1)+((input>>16)&1))&1)==((input>>28)&1)){intkey=(v1>>25)&7;input=(SARN_KEY[key]^v1);result=key;if(result==0)result=7;}else{result=-1;}returnresult;}staticvoidMain(string[]args){Randomrnd=newRandom((int)DateTime.Now.Ticks);intrndDKey=rnd.Next(9999)%65000+1;Console.WriteLine(rndDKey);intkey=encoder_flag(refrndDKey);Console.WriteLine(rndDKey);Console.WriteLine(key);intkey2=decoder_flag(refrndDKey);Console.WriteLine(rndDKey);Console.WriteLine(key);//正确的情况下，key==key2}