Cracker Handbook 1.0 part 136 pot

- Tiền tố của Serial có thể là "fgc-" hoặc "fgf-"

0041C668 | 68 7C144F00 PUSH FLASHGET.004F147C ; _ ASCII "fgc-" 0041C66D | 8BCB MOV ECX,EBX

0041C66F | E8 CED70700 CALL FLASHGET.00499E42 ; ret 0 nếu bằng 0041C674 | 85C0 TEST EAX,EAX

0041C676 | 75 06 JNZ SHORT FLASHGET.0041C67E

0041C678 | 897C24 10 MOV DWORD PTR SS:[ESP+10],EDI

0041C67C | EB 18 JMP SHORT FLASHGET.0041C696

0041C67E |> 68 74144F00 PUSH FLASHGET.004F1474 ; _ ASCII "fgf-" 0041C683 | 8BCB MOV ECX,EBX

0041C685 | E8 B8D70700 CALL FLASHGET.00499E42 ; ret 0 nếu bằng 0041C68A | 85C0 TEST EAX,EAX

0041C68C | 0F85 A7000000 JNZ FLASHGET.0041C739

0041C692 | 894424 10 MOV DWORD PTR SS:[ESP+10],EAX

0041C696 |> 6A 2C PUSH 2C

- Quá trình kiểm tra chuỗi Serial

.WHILE (TRUE)

xor edi,edi

mov eax,DWORD PTR [chuỗi Serial đã được bỏ đi tiền tố "fgf-" và "fgc-"]

_SWITCH (EDI)

_ CASE (1)

movsx esi, kt thứ 3 (trong eax)

movsx edx, kt4

movsx ecx, kt2 add esi, ecx

movsx ex ,kt1 add esi, eax _ CASE (0) mov cl, kt3

mov dl, kt2

xor ecx, edx movsx edx, kt4 and ecx, 7F

imul ecx, edx movsx eax, kt1 add ecx, eax mov esi, ecx _ ENDswitch .IF ("fgc-")

movsx ecx, "i"

.ENDIF

.IF (edi !=2)

mov ecx, byte PTR [edi+ str] ; str trỏ đến chuỗi "kevin " .ENDIF

mov eax, esi

Lấy eax chia cho ecx ,được phần dư trong edx

_ SWITCH (EDI)

_ CASE (0)

test edx, edx

jnz @exit 1 ; _ invalid serial

_ CASE (1)

cmp edx, 8

jnz @exit 1

_ ENDswitch

inc edi

cmp edi, 2

jge @exit2 ; regular serial

.ENDWHILE

0041C69F | 8BE8 MOV EBP,EAX

0041C6A1 | 33F6 XOR ESI,ESI

0041C6A3 | 83C5 04 ADD EBP,4

0041C6A6 | 33FF XOR EDI,EDI

0041C6A8 |> 8B45 00 /MOV EAX,DWORD PTR SS:[EBP]

0041C6AB | 8BCF |MOV ECX,EDI

0041C6AD | 83C5 04 |ADD EBP,4

0041C6B0 | 83E9 00 |SUB ECX,0 ; _ Switch (cases 0 1)

0041C6B3 | 894424 1C |MOV DWORD PTR SS:[ESP+1C],EAX ; _ đưa 4 kt vào Stack

0041C6B7 | 74 1C |JE SHORT FLASHGET.0041C6D5

0041C6B9 | 49 |DEC ECX

0041C6BA | 75 33 |JNZ SHORT FLASHGET.0041C6EF

; Kt thứ 3 & 4 (trong Stack)đưa vào ESI,EDX

0041C6BC | 0FBE7424 1E |MOVSX ESI,BYTE PTR SS:[ESP+1E] ; Case 1 of switch 0041C6B0

0041C6C1 | 0FBE5424 1F |MOVSX EDX,BYTE PTR SS:[ESP+1F]

0041C6C6 | 0FBECC |MOVSX ECX,AH ; kt thứ 2

0041C6C9 | 23F1 |AND ESI,ECX ; AND kt 3 & 2==> KQ trong ESI

0041C6CB | 0FAFF2 |IMUL ESI,EDX ; _ sau đó nhân với kt 4

0041C6CE | 0FBEC0 |MOVSX EAX,AL ; _ kt 1

0041C6D1 | 03F0 |ADD ESI,EAX ; ADD esi với kt 1

0041C6D3 | EB 1A |JMP SHORT FLASHGET.0041C6EF

; kt 3

0041C6D5 |> 8A4C24 1E |MOV CL,BYTE PTR SS:[ESP+1E] ; _ Case 0 of switch 0041C6B0

0041C6D9 | 8AD4 |MOV DL,AH ; _ kt 2

0041C6DB | 33CA |XOR ECX,EDX ; XOR kt 3 và 2==> KQ trong ECX

0041C6DD | 0FBE5424 1F |MOVSX EDX,BYTE PTR SS:[ESP+1F] ; kt 4 0041C6E2 | 83E1 7F |AND ECX,7F

0041C6E5 | 0FAFCA |IMUL ECX,EDX ; nhân với kt 4

0041C6E8 | 0FBEC0 |MOVSX EAX,AL ; kt 1

0041C6EB | 03C8 |ADD ECX,EAX ; cộng với kt 1

0041C6ED | 8BF1 |MOV ESI,ECX

; IF "fgf-" thì [esp+10] bên dưới chứa 0, nếu "fgc-" thì là 1

0041C6EF |> 8B4424 10 |MOV EAX,DWORD PTR SS:[ESP+10] ; Default case of switch 0041C6B0

0041C6F3 | 85C0 |TEST EAX,EAX

0041C6F5 | 74 0C |JE SHORT FLASHGET.0041C703

0041C6F7 | 0FBE0D 43F64E0>|MOVSX ECX,BYTE PTR DS:[4EF643] ; "i" 0041C6FE | 83FF 02 |CMP EDI,2

0041C701 | 74 07 |JE SHORT FLASHGET.0041C70A

0041C703 |> 0FBE8F 40F64E0>|MOVSX ECX,BYTE PTR DS:[EDI+4EF640] ; trỏ đến chuỗi "kevin "

; lấy KQ tính trên 4 kt chia cho ecx

0041C70A |> 8BC6 |MOV EAX,ESI

0041C70C | 33D2 |XOR EDX,EDX

0041C70E | F7F1 |DIV ECX

0041C710 | 8BC7 |MOV EAX,EDI

; switch này để xử lý tuỳ thuộc nó là kt thư mấy

0041C712 | 83E8 00 |SUB EAX,0 ; Switch (cases 0 1)

0041C715 | 74 0A |JE SHORT FLASHGET.0041C721

0041C717 | 48 |DEC EAX

0041C718 | 75 0B |JNZ SHORT FLASHGET.0041C725

0041C71A | 83FA 08 |CMP EDX,8 ; _ Case 1 of switch 0041C712 0041C71D | 75 11 |JNZ SHORT FLASHGET.0041C730

0041C71F | EB 04 |JMP SHORT FLASHGET.0041C725

0041C721 |> 85D2 |TEST EDX,EDX ; _ Case 0 of switch 0041C712 0041C723 | 75 0B |JNZ SHORT FLASHGET.0041C730

0041C725 |> 47 |INC EDI ; Default case of switch 0041C712

0041C726 | 83FF 02 |CMP EDI,2

0041C729 | 7D 23 |JGE SHORT FLASHGET.0041C74E ; _ nhảy đến @exit 2 0041C72B |.^E9 78FFFFFF \JMP FLASHGET.0041C6A8

; @EXIT 1:

0041C730 |> 6A FF PUSH -1

0041C732 | 8BCB MOV ECX,EBX

0041C734 | E8 BC220800 CALL FLASHGET.0049E9F5

0041C739 |> 5F POP EDI

0041C73A | 5E POP ESI

0041C73B | 5D POP EBP

0041C73C | 33C0 XOR EAX,EAX

0041C73E | 5B POP EBX

0041C73F | 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20]

0041C743 | 64:890D 000000>MOV DWORD PTR FS:[0],ECX

0041C74A | 83C4 2C ADD ESP,2C

0041C74D | C3 RETN

; _ @EXIT 2:

0041C74E |> 6A FF PUSH -1 ; Ở đây khi serial hợp lệ

0041C750 | 8BCB MOV ECX,EBX

0041C752 | E8 9E220800 CALL FLASHGET.0049E9F5