bruteaspro10.asm

作者通过asprotect这个软件破解了RSA-1024的密码保护,一个非常有意思的例子

.586                                             
.MODEL FLAT,STDCALL
; ------------------------------------------------------
; Poorly coded brute forcer for Asprotect 1.0/1.11
;				by Amenesia//TKM!
; ------------------------------------------------------

include BruteAspro10.inc


.DATA

;..User friendly :).........................
solution  db "Seed =",0 
notf      db "- Nop -",0
hexstring db "0123456789ABCDEF",0
result    db "00000000",0

;..Brute-forcer............................
CurrentSeed dd 00000000h
MinSeed     dd 0398BBB73h
MaxSeed     dd 0FFFFFFFFh

;..N........................................
HighMod     dd 0EB1D4EADh


.CODE
;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

BruteForcer:

 mov eax, [MinSeed]
 
BruteForcer_loop:
 push eax
 mov [CurrentSeed], eax
 call RandInt
 or eax, 0C0000000h
 push eax
 call RandInt
 or eax, 0C0000000h
 pop ebx
 mul ebx
 sub edx, [HighMod]
 cmp edx, 2
 jbe SeedF
 pop eax
 inc eax
 cmp eax, [MaxSeed]
 je  SeedNotF
 jmp BruteForcer_loop
 
 
 SeedF:
 pop eax
 mov edi, (offset result+7)
Hex2ascii:
 mov ebx, eax
 and ebx, 0Fh
 mov  bl, [offset hexstring + ebx]
 mov  [edi], bl
 sub  edi, 1
 shr  eax, 4
 cmp  eax, 0
 jne  Hex2ascii
  
 call MessageBoxA,0,offset result,offset solution,0
 ret
 
SeedNotF:  
 call MessageBoxA,0,offset notf,offset solution,0
 ret

rand		proc near	
		mov	ecx, [CurrentSeed]
		imul	ecx, 343FDh
		add	    ecx, 269EC3h
		mov	[CurrentSeed], ecx
		mov	eax, ecx
		shr	eax, 10h
		and	eax, 7FFFh
		retn
rand		endp 
  
 RandInt		proc near	

		mov	edi, 60
		mov	ecx, [CurrentSeed]		
highbyte:	
		imul	ecx, 343FDh
		add	    ecx, 269EC3h
		dec edi
		jnz highbyte
		mov	[CurrentSeed], ecx	
			
		xor	esi, esi
		mov	edi, 4
build_int:				
		call	rand
		shl	esi, 8
		add	esi, eax
		dec	edi
		jnz	build_int
		mov	eax, esi
		retn
RandInt		endp

end BruteForcer
ends