View Full Version : Genetic Algorithms? Debugger Attack? - Brute force exercise part II
)| Originally posted by _Servil_ My first idea was to let it run in loop for all 64k of acceptable variationz with SEHandler treatement but the result was unusable, also I didn't know how to tell kernel to reuse the Handler after it was triggered. Even if I knew, this is not the way to go since the random jumps are jumpping wherever it wants etc etc. |
). Maybe, more apposite to call it "GuessMe"? 
.WHILE ebx != 07FFFFFFFh ; Test all positive integers
; DECRYPT LOOP
; ================
; Fitness Test
; ================
cld
mov ecx, SizeOfDecrypt
mov esi, offset BeginDecrypt ; start of Decrypt block
xor eax, eax
@@:
test ecx, ecx
jz @BruteNext
dec ecx
lodsb ; check each byte
; check <mov r32,
sub al, 10111000b ; mask for opcode MOV in bits 3-7
cmp eax, 011b ; 3 ; selects for eax, ebx, ecx, edx in bits 0-2
jg @B
; check imm32> address
cmp word ptr [esi+1], 4011h ; xx 11 40 00
jnz @B
cmp byte ptr [esi+3], 0
jnz @B
; -----------------------
; Solution Found
; -----------------------
invoke wsprintf, ADDR buffer1, ADDR StringFmt, ebx
invoke SendMessage, hList, LB_ADDSTRING, 0, offset buffer1
invoke SendMessage, hList, LB_SETITEMDATA, eax, esi
invoke UpdateWindow, hWnd
@BruteNext:
inc ebx ; increment serial nummber
;-----------------
.ENDW
jmp ExitOK
; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴
BeginDecrypt:
dd 8C47A73Fh
...
| right now I was experimenting with using a custom debugger of my own that tries each combo |
(At thread startup, I do a GetThreadContext and get the value of the DS, ES, GS segments, and keep them so I can restore them during an exception). So now I could do anything, after an exception it just keeps truckin' Just your run of the mill debugger.
Very nice nikolatesla (Gauss?), you've been able to execute the code in a protected debug environment. It'll be interesting to see how it works in other cases. It's nice to see some debugger code. You could maybe tie the bruteforcer.cpp and the debugger engine together in memory with linked lists for example so you could code the bruteforcer algo a la plugin for different situations. It may not be as applicable to this crackme, because as was said this is more of a Guess-me in the final analysis. If you had a more defined algorithm to work with, a more genetic approach might be able to be used. After the first little filter algorithm of the crackme you've already got a finite population of answers to start with, including the correct one, and you need to test them all for the second decryption part. If you hit the right fitness test then yes, I think you could use the GA idea to isolate the correct s/n. But then you still have to test the answer in some form which means a visual inspection/trial, or run it through nt20's debugger. With so many protections using such code to "protect" themselves, the more experience you have with such code the better..and then you may be able to code good unpackers, etc, as well