bruteaspro111c.asm

作者通过asprotect这个软件破解了RSA-1024的密码保护,一个非常有意思的例子

.586                                             
.MODEL FLAT,STDCALL
; ------------------------------------------------------
; Poorly coded brute forcer for Asprotect 1.11c
;					by Amenesia//TKM!
; ------------------------------------------------------

include BruteAspro111c.inc


.DATA

;..User friendly :).........................
solution  db "_rand() =",0 
notf      db "- Nop -",0
hexstring db "0123456789ABCDEF",0
result    db "00000000",0

;..Brute-forcer............................
CurrentSeed dd 00000000h

MinSeed     dd  00000000h
MaxSeed     dd  00007FFFh

;..N........................................
Mod_p1 dd 0C7D6E57Ah
Mod_p2 dd 00D1C3A97h
Mod_p3 dd 052618FB4h
Mod_p4 dd 097A6E4D1h



.CODE
;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
BruteForcer:

 mov eax, [MinSeed]
 
BruteForcer_loop:
 push eax
 mov [CurrentSeed], eax
 call RandInt
 mov ebx, eax
 or  eax, 0C0000000h
 
 mov ebp, eax
 mov edx, [Mod_p1]
 mov eax, [Mod_p2]
 cmp ebp, edx
 jb nextseed  

 div ebp
 mov esi, eax
 mov edi, edx

big_mul:
 mov eax, ebx
 mul esi
 mov ecx, edx
 add edx, eax
 adc ecx, 0
 
 cmp edi, ecx
 jb too_big
 ja sub_big

 cmp [Mod_p3], edx
 jb too_big
 ja sub_big
 
 cmp [Mod_p4], eax
 jb too_big
 jae sub_big 
 
too_big:
 dec esi
 ;add edi, ebp
 ;jmp big_mul
 sub ecx, ebp
 
sub_big:
 push [Mod_p4]
 push [Mod_p3] 
 sub [Mod_p4], eax
 sbb [Mod_p3], edx
 sbb edi, ecx
 mov eax, [Mod_p3]
 mov edx, edi 
 pop [Mod_p3]
 pop [Mod_p4] 
 div ebp
 mov ebp, edx
 mov edi ,eax
 mul ebx
 cmp edx, ebp
 jb nocarry
 dec edi
 
nocarry:
 or edi, 0C0000000h
 and esi, 0FFFFFFFEh
 and edi, 0FFFFFFFEh 
 cmp esi, edi
 je  SeedF
 
nextseed:
 pop eax
 inc eax
 cmp eax,[MaxSeed ]
 je SeedNotF
 jmp BruteForcer_loop
 
 
SeedF:
 pop eax
 call RandInt 
 mov edi, (offset result+7)
 
Hex2ascii:
 mov ebx, eax
 and ebx, 0Fh
 mov  bl, [offset hexstring + ebx]
 mov  [edi], bl
 sub  edi, 1
 shr  eax, 4
 cmp  eax, 0
 jne  Hex2ascii
  
 call MessageBoxA,0,offset result,offset solution ,0
 ret
 
SeedNotF:  
 call MessageBoxA,0,offset notf ,offset solution,0
 ret

rand		proc near	
		mov	eax, [CurrentSeed]
		and	eax, 7FFFh
		retn
rand	endp 
  
 RandInt		proc near	

			
		xor	esi, esi
		mov	edi, 4
build_int:				
		call rand
		shl	esi, 8
		add	esi, eax
		dec	edi
		jnz	build_int
		mov	eax, esi
		retn
RandInt		endp
 
end BruteForcer
ends