ܲ ܲ ߲߲ ߲ ۲ݰ ݲ ޲ ܲ ۲ܲ ܲ ߲ܲ ߲ ߲ ߲۲ ۲ ޲ݲ۲ ۲ ޲ݲ޲ ܲ۲ ߲ܲ ߲ܲ ߲ ܱ۱ ܲ ܲ ߲ܲ ߲ ܲܲ ܲܲ۲޲ ޲ ޲ ݰ ݱ޲ ߲ ߲ ܲ ߲ ߲ ߲ ۲߲ܲ۲۱ ܲ ۲ܲ ܲ۲ ۲۲ܲ۲߲۲۲ ܲ ۲ ߲۲ ۲۲ ߲۲߲ ۲ ߲ ۲߲ ۲ ۲ ܲ޲ ۲ ۲ coax!cph ۲ ۲ݲ ݲ ۲ ۲ ۲ ۲ ۲ ۲ ۲ ۲ ۲ ۲۲۲ ۲ ۲ ۲ ۲۲ ܲܲܲTEAM-53.TUTORiALS.PACK.NUMBER.SiXTEEN.#16 ߲ : CrackMe_0026 by HappyTown : lord_Phoenix :: Intro :: 㦥 祣 ᠫ, , ஢ , 室 訢. 16 53 , ⮢ ⠪ भ, 訫 =) ࠧ ᪠, ᠫ 㦥 ᫥ ॢ 窱, ⮥ ६ 㦥 - , ⠩ - =) :: Tools :: 窱 ᯮ ᪨ 㬥⮢: - IDA - MS VisualC ( ᠭ ) - ⥪ Miracl :: Reversing :: 窱 , "⪭" : .text:004011CF mov ebx, ds:GetDlgItemTextA .text:004011D5 add esp, 8 .text:004011D8 stosb .text:004011D9 lea eax, [esp+3A0h+szName] .text:004011E0 push 65h ; nMaxCount .text:004011E2 push eax ; lpString .text:004011E3 push 3E8h ; nIDDlgItem .text:004011E8 push esi ; hDlg .text:004011E9 call ebx ; GetDlgItemTextA .text:004011EB lea edi, [esp+3A0h+szName] .text:004011F2 or ecx, 0FFFFFFFFh .text:004011F5 xor eax, eax .text:004011F7 repne scasb .text:004011F9 not ecx .text:004011FB dec ecx .text:004011FC cmp ecx, 3 .text:004011FF jb bad_boy .text:00401205 lea edi, [esp+3A0h+szName] .text:0040120C or ecx, 0FFFFFFFFh .text:0040120F repne scasb .text:00401211 not ecx .text:00401213 dec ecx .text:00401214 cmp ecx, 18h .text:00401217 ja bad_boy .text:0040121D lea ecx, [esp+3A0h+szSerial] .text:00401221 push 65h ; nMaxCount .text:00401223 push ecx ; lpString .text:00401224 push 3E9h ; nIDDlgItem .text:00401229 push esi ; hDlg .text:0040122A call ebx ; GetDlgItemTextA .text:0040122C lea edx, [esp+3A0h+szSerial] .text:00401230 push 2Dh ; int .text:00401232 push edx ; char * .text:00401233 call _strchr .text:00401238 add esp, 8 .text:0040123B test eax, eax .text:0040123D jz bad_boy [...] ᮡ᭮ 窱 砥 ஢ . >=3 <=24. ஢ઠ ଠ ਠ. [0..9][A..F] ᥡ "-". ᫨ ୮ - 窱 "-" ६ ( szFirstPart) , "-", (szSecondPart). ᫥ ᥣ ⮣ ᭮ 窱. ࠧ 砥, HappyTown ᯮ짮 Miracl. 㭪樨 ⮩ 祭 ஢ - ᨣ (  :p). ⮤ ਤ㬠 bLack-eye ᪮쪮 . ᪠砢 ࠪ, ᬮॢ - ᠬ. ⮤ ⠪: 1. ਬ ⨭ , 䮪㥬 - mov dword ptr [eax+ecx*4+20h], XXh 2. 饬 ࠪ MR_IN(XXd) - ᮡ᭮ 楤. ਬ 00401B20: .text:00401B48 mov dword ptr [eax+ecx*4+20h], 17h 饬 ࠪ ப MR_IN(23). : flash mirvar(_MIPD_ int iv) { /* initialize big/flash number */ flash x; int align; char *ptr; #ifdef MR_OS_THREADS miracl *mr_mip=get_mip(); #endif if (mr_mip->ERNUM) return NULL; MR_IN(23); if (!(mr_mip->active)) { mr_berror(_MIPP_ MR_ERR_NO_MIRSYS); MR_OUT return NULL; } 00401B20 - mirvar. 祭 䨪樨 饬 - ᥡ ᤥ ⠡ "㭪 - ⠭ MR_IN". ᮢ ;) .. ᪮쪮 ᥫ ( 㦥 뫮 २뢠), 樠: a == 2982h b == 3408h p == AEBF94CEE3E707h n == AEBF94D5C6AA71h xG == 7A3E808599A525h xQ == 9F70A02013BC9Bh .text:0040143C mov eax, [esp+3B0h+p] .text:00401440 mov ecx, [esp+3B0h+b] .text:00401444 mov edx, [esp+3B0h+a] .text:00401448 push 0 .text:0040144A push eax ; p .text:0040144B push ecx ; b .text:0040144C push edx ; a .text:0040144D call _ecurve_init ; ecurve_init(a,b,p,0) 뤥প 㬥樨 ࠪ: 9.3.7 ecurve_init Function: void ecurve_init(A,B,p,type) big A,B,p; int type; Module: mrcurve.c Description: Initialises the internal parameters of the current active GF(p) elliptic curve. The curve is assumed to be of the form y^2 =x^3 + Ax + B mod p, the so-called Weierstrass model. This routine can be called subsequently with the parameters of a different curve. Parameters: Three big numbers A, B and p. The type parameter must be either MR_PROJECTIVE or MR_AFFINE, and specifies whether projective or affine co-ordinates should be used internally. Normally the former is faster. Return value: None Restrictions: None. Allocated memory will be freed when the current instance of MIRACL is terminated by a call to mirexit. Only one elliptic curve, GF(p) or GF(2^m) may be active within a single MIRACL instance. 窱 ᯮ ਢ y^2 =x^3 + Ax + B mod p (ࠬ ), 㦥 ᭮. ᮧ 窨-⨯: .text:00401452 call _epoint_init .text:00401457 mov [esp+3C0h+point1], eax .text:0040145B call _epoint_init .text:00401460 mov [esp+3C0h+point2], eax .text:00401464 call _epoint_init .text:00401469 mov [esp+3C0h+point3], eax Point1 - G: .text:0040146D mov eax, [esp+3C0h+point1] .text:00401471 push eax ; point1 .text:00401472 mov eax, [esp+3C4h+xG] .text:00401476 push 0 ; 0 - 騩 .text:00401478 push eax ; xG .text:00401479 push eax ; xG .text:0040147A call _epoint_set G ࠭ 窱 ⠪ 뢠 ᦠ⮬ - ⮥ ⮫쪮 窨 騩 न. न 祭 : _____________________ / 3 y= + \/ (x + A*x + B) mod p - 襭 - ⮣ 㦥 騩 . Point3 - Q: .text:0040147F mov ecx, [esp+3D0h+point3] .text:00401483 mov eax, [esp+3D0h+xQ] .text:00401487 push ecx ; point3 .text:00401488 push 0 ; 0 .text:0040148A push eax ; xQ .text:0040148B push eax ; xQ .text:0040148C call _epoint_set ᦠ.. ᫨ ⨬ ⭮ - ⠩ ᠭ epoint_set 㬥樨 ࠪ. 2 ᫠ ( r s) - ⠫ 祭ﬨ 襣 ਠ - szFirstPart szSecondPart: .text:00401494 lea edx, [esp+3A0h+szFirstPart] .text:0040149B push edx .text:0040149C push ebp ; r .text:0040149D call _cinstr .text:004014A2 lea eax, [esp+3A8h+szSecondPart] .text:004014A9 push eax .text:004014AA push edi ; s .text:004014AB call _cinstr ࠢ: .text:004014B0 push esi ; n .text:004014B1 push ebp ; r .text:004014B2 call _compare .text:004014B7 add esp, 18h .text:004014BA cmp eax, 0FFFFFFFFh .text:004014BD jnz bad_boy .text:004014C3 push esi ; n .text:004014C4 push edi ; s .text:004014C5 call _compare .text:004014CA add esp, 8 .text:004014CD cmp eax, 0FFFFFFFFh .text:004014D0 jnz bad_boy ஢ઠ - rIOBASE = 16; a = mirvar(0x2982); b = mirvar(0x3408); p = mirvar(0); n = mirvar(0); xG = mirvar(0); d = mirvar(0); k = mirvar(0); r = mirvar(0); s = mirvar(0); h = mirvar(0); cinstr(p, "AEBF94CEE3E707"); cinstr(n, "AEBF94D5C6AA71"); cinstr(xG, "7A3E808599A525"); cinstr(d, "9D3F1E3CDDA5E5"); ecurve_init(a, b, p, MR_AFFINE); epoint_set(xG, xG, 0, G); /* generating random k */ irand(GetTickCount()); do { bigrand(n, k); } while(egcd(k, n, s) != 1); /* k*G */ ecurve_mult(k, G, G); /* r = (k*G).x */ epoint_get(G, r, r); /* k^(-1) mod n */ xgcd(k, n, k, k, k); /* e=SHA-1(Name) */ shs_init(&sh); i = 0; while (name[i] != 0) { shs_process(&sh, name[i]); i++; } shs_hash(&sh, digest); bytes_to_big(20, digest, e); /* s = (k^(-1))(e+dr) mod n */ mad(d, r, e, n, n, s); mad(k, s, s, n, n, s); /* serial -> %r-%s */ cotstr(r, serial); strcat(serial, "-"); cotstr(s, second_part); strcat(serial, second_part); SetDlgItemText(hwnd, IDC_SERIAL,serial); epoint_free(G); mirkill(a); mirkill(b); mirkill(p); mirkill(n); mirkill(xG); mirkill(d); mirkill(k); mirkill(r); mirkill(s); mirkill(e); mirexit(); :: Outro :: : lord_Phoenix 5E8E6D04BD3E16-35E830763335BD 諨 ⮩ .. 뫮 ᭮, ࠢ .. ᫨ - 訢! #cryptographie @ irc.street-creed.com !!