Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
004010CF |. 83F9 00004010D2 |.^ 75 F4004010D4 |. 8BD8004010D6 |. B9 54010000004010DB |> 8033 11004010DE |. 83E9 01004010E1 |. 43004010E2 |. 83F9 00004010E5 |.^ 75 F4004010E7 |. 58004010E8 \. C3|CMP ECX,0\JNZ SHORT unpackme.004010C8MOV EBX,EAXMOV ECX,154XOR BYTE PTR DS:[EBX],11SUB ECX,1INC EBXCMP ECX,0JNZ SHORT unpackme.004010DBPOP EAXRETKao sto vidimo u EBX se smesta adresa 00401007 i 7F bajtova od te adresese xoruje sa 7h, posle cega se ponovo xoruje 154h bajtova od adrese004010F5 sa 11h. Posto nema potrebe da prolazimo kroz sve ove loopovepritisnucemo CTRL + F9 sto ce izvrsiti ovaj CALL i vratice nas na sledecuadresu posle izvrsenja RET komande:004010B5 |. 50 PUSH EAX ; unpackme.004010F5004010B6 |. E8 7EFFFFFFCALL unpackme.00401039004010BB |. 58POP EAX004010BC \. C3RETKao sto vidimo ovo nas je odvelo do druge CALL komande u gornjem CALLu.Sada cemo sa F7 uci i u ovaj drugi CALL:00401007 . /EB 27 JMP SHORT unpackme.0040103000401009 . |43 72 43 20 6> ASCII "CrC <strong>of</strong> this file"00401019 . |20 68 61 73 2> ASCII " has been modifi"00401029 . |65 64 20 21 2> ASCII "ed !!!",000401030 > \EB 07 JMP SHORT unpackme.0040103900401032 . 45 72 72 6F 7> ASCII "Error:",000401039 $ 50 PUSH EAX ; unpackme.004010F50040103A . 8BD8MOV EBX,EAX0040103C . B9 54010000MOV ECX,15400401041 . BA 00000000 MOV EDX,000401046 > 0313 ADD EDX,DWORD PTR DS:[EBX]00401048 . 83E9 01 SUB ECX,10040104B . 43INC EBX0040104C . 83F9 00CMP ECX,00040104F .^ 75 F5JNZ SHORT unpackme.0040104600401051 . B8 4A124000 MOV EAX,unpackme.0040124A00401056 . BE 80124000 MOV ESI,unpackme.004012800040105B . 50PUSH EAX0040105C . 56PUSH ESI0040105D . E8 28000000CALL unpackme.0040108A00401062 . 81FA B08DEB31 CMP EDX,31EB8DB000401068 . 74 19 JE SHORT unpackme.004010830040106A . 6A 30 PUSH 300040106C . 68 32104000PUSH 00401032 "Error:"00401071 . 68 09104000 PUSH 00401009 "CrC <strong>of</strong> this file has been modified !!!"00401076 . 6A 00 PUSH 000401078 . E8 E5010000 CALL unpackme.004012620040107D . 50PUSH EAX0040107E . E8 F1010000CALL unpackme.0040127400401083 > E9 96010000 JMP unpackme.0040121E00401088 . 58 POP EAX00401089 . C3 RETOvo je malo duzi CALL ali sam ga ja podelio na celine kako bi ste vi lakseshvatili sta se ovde desava. Analizu cemo raditi po obelezenim bojama.Zeleni deo predstavlja samo poruke koje ce se prikazati ako smo modifikovaliovaj fajl, a posto ovo nismo uradili o ovome necemo brinuti.Narandzasti deo predstavlja kod za racunanje “CRCa” dela koda koji pocinjena adresi 004010F5 a dugacak je 154h i predstavlja glavni deo koda. Ni ovonam nije bitno posto nismo modifikovali ovaj deo koda nego se bavimo samo<strong>The</strong> Art <strong>of</strong> Cracking by Ap0x Page 147 <strong>of</strong> 165