逆向[00]--一个最简单的crackme分析与破解

首先看代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
import Foundation

struct Software {
let name: String
let key:Key
func keySwap(key: Key) -> String {
let k = Key()
let authKey = String(k.key.reversed())
return authKey
}

struct Key {
let key = "KD-9KOE36LXJ-K1N2D4EI-CX"
let isWrongKey = true

}

}


var k = Software.Key()
print("insert name")
var s = Software(name: String(readLine()!), key: k)
print("provide your key")
if s.keySwap(key: k)==String(readLine()!) {
print("Success")
} else {
print("wrong key")
}


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
0000000100003ab0         push       rbp
0000000100003ab1 mov rbp, rsp
0000000100003ab4 push r15
0000000100003ab6 push r14
0000000100003ab8 push r13
0000000100003aba push r12
0000000100003abc push rbx
0000000100003abd sub rsp, 0x18
0000000100003ac1 movabs r12, 0xe100000000000000
0000000100003acb movabs rax, 0xd000000000000018
0000000100003ad5 mov qword [_$s7crackme1kAA8SoftwareV3KeyVvp], rax ; _$s7crackme1kAA8SoftwareV3KeyVvp
0000000100003adc lea r13, qword [0x100003f30] ; 0x100003f30
0000000100003ae3 movabs rax, 0x8000000000000000
0000000100003aed or r13, rax
0000000100003af0 mov qword [qword_100008088], r13 ; qword_100008088
0000000100003af7 mov byte [byte_100008090], 0x1 ; byte_100008090
0000000100003afe lea rdi, qword [_$ss23_ContiguousArrayStorageCyypGMD] ; argument #1 for method ___swift_instantiateConcreteTypeFromMangledName, _$ss23_ContiguousArrayStorageCyypGMD
0000000100003b05 call ___swift_instantiateConcreteTypeFromMangledName ; ___swift_instantiateConcreteTypeFromMangledName
0000000100003b0a mov r14, rax
0000000100003b0d mov esi, 0x40
0000000100003b12 mov edx, 0x7
0000000100003b17 mov rdi, rax
0000000100003b1a call imp___stubs__swift_allocObject ; swift_allocObject
0000000100003b1f mov rbx, rax
0000000100003b22 movaps xmm0, xmmword [0x100003f30] ; 0x100003f30
0000000100003b29 movups xmmword [rax+0x10], xmm0
0000000100003b2d mov r15, qword [_$sSSN_100004000] ; _$sSSN_100004000
0000000100003b34 mov qword [rax+0x38], r15
0000000100003b38 movabs rax, 0x6e20747265736e69
0000000100003b42 mov qword [rbx+0x20], rax
0000000100003b46 movabs rax, 0xeb00000000656d61
0000000100003b50 mov qword [rbx+0x28], rax
0000000100003b54 mov esi, 0x20
0000000100003b59 mov ecx, 0xa
0000000100003b5e mov rdi, rbx
0000000100003b61 mov rdx, r12
0000000100003b64 mov r8, r12
0000000100003b67 call imp___stubs__$ss5print_9separator10terminatoryypd_S2StF ; Swift.print(_: Any..., separator: Swift.String, terminator: Swift.String) -> ()
0000000100003b6c mov rdi, rbx ; argument "instance" for method imp___stubs__swift_release
0000000100003b6f call imp___stubs__swift_release ; swift_release
0000000100003b74 mov edi, 0x1
0000000100003b79 call imp___stubs__$ss8readLine16strippingNewlineSSSgSb_tF ; Swift.readLine(strippingNewline: Swift.Bool) -> Swift.String?
0000000100003b7e test rdx, rdx
0000000100003b81 je loc_100003daa

0000000100003b87 mov qword [rbp+var_38], rax
0000000100003b8b mov qword [rbp+var_30], rdx
0000000100003b8f mov rdx, qword [_$sSSs25LosslessStringConvertiblesWP_100004010] ; _$sSSs25LosslessStringConvertiblesWP_100004010
0000000100003b96 mov rcx, qword [_$sSSSTsWP_100004008] ; _$sSSSTsWP_100004008
0000000100003b9d lea rdi, qword [rbp+var_38]
0000000100003ba1 mov rsi, r15
0000000100003ba4 call imp___stubs__$sSSySSxcs25LosslessStringConvertibleRzSTRzSJ7ElementSTRtzlufC ; Swift.String.init<A where A: Swift.LosslessStringConvertible, A: Swift.Sequence, A.Element == Swift.Character>(A) -> Swift.String
0000000100003ba9 mov rcx, qword [_$s7crackme1kAA8SoftwareV3KeyVvp] ; _$s7crackme1kAA8SoftwareV3KeyVvp
0000000100003bb0 mov r12, r15
0000000100003bb3 mov r15, qword [qword_100008088] ; qword_100008088
0000000100003bba mov bl, byte [byte_100008090] ; byte_100008090
0000000100003bc0 mov qword [_$s7crackme1sAA8SoftwareVvp], rax ; _$s7crackme1sAA8SoftwareVvp
0000000100003bc7 mov qword [qword_1000080a0], rdx ; qword_1000080a0
0000000100003bce mov qword [qword_1000080a8], rcx ; qword_1000080a8
0000000100003bd5 mov qword [qword_1000080b0], r15 ; qword_1000080b0
0000000100003bdc mov byte [byte_1000080b8], bl ; byte_1000080b8
0000000100003be2 mov esi, 0x40
0000000100003be7 mov edx, 0x7
0000000100003bec mov qword [rbp+var_40], r14
0000000100003bf0 mov rdi, r14
0000000100003bf3 call imp___stubs__swift_allocObject ; swift_allocObject
0000000100003bf8 mov rbx, rax
0000000100003bfb movaps xmm0, xmmword [0x100003f30] ; 0x100003f30
0000000100003c02 movups xmmword [rax+0x10], xmm0
0000000100003c06 mov qword [rax+0x38], r12
0000000100003c0a movabs r14, 0xd000000000000018
0000000100003c14 lea rax, qword [r14-8]
0000000100003c18 mov qword [rbx+0x20], rax
0000000100003c1c lea rax, qword [aKd9koe36lxjk1n] ; "KD-9KOE36LXJ-K1N2D4EI-CX"
0000000100003c23 movabs rcx, 0x8000000000000000
0000000100003c2d or rax, rcx
0000000100003c30 mov qword [rbx+0x28], rax
0000000100003c34 mov rdi, r15
0000000100003c37 call imp___stubs__swift_bridgeObjectRetain ; swift_bridgeObjectRetain
0000000100003c3c mov esi, 0x20
0000000100003c41 mov ecx, 0xa
0000000100003c46 mov rdi, rbx
0000000100003c49 movabs rdx, 0xe100000000000000
0000000100003c53 mov r8, rdx
0000000100003c56 call imp___stubs__$ss5print_9separator10terminatoryypd_S2StF ; Swift.print(_: Any..., separator: Swift.String, terminator: Swift.String) -> ()
0000000100003c5b mov rdi, rbx ; argument "instance" for method imp___stubs__swift_release
0000000100003c5e call imp___stubs__swift_release ; swift_release
0000000100003c63 mov qword [rbp+var_38], r14
0000000100003c67 mov qword [rbp+var_30], r13
0000000100003c6b lea rdi, qword [_$ss18ReversedCollectionVySSGMD] ; argument #1 for method ___swift_instantiateConcreteTypeFromMangledName, _$ss18ReversedCollectionVySSGMD
0000000100003c72 call ___swift_instantiateConcreteTypeFromMangledName ; ___swift_instantiateConcreteTypeFromMangledName
0000000100003c77 mov rbx, rax
0000000100003c7a call _$ss18ReversedCollectionVySSGAByxGSTsWl ; lazy protocol witness table accessor for type Swift.ReversedCollection<Swift.String> and conformance Swift.ReversedCollection<A> : Swift.Sequence in Swift
0000000100003c7f lea rdi, qword [rbp+var_38]
0000000100003c83 mov rsi, rbx
0000000100003c86 mov rdx, rax
0000000100003c89 call imp___stubs__$sSSySSxcSTRzSJ7ElementRtzlufC ; Swift.String.init<A where A: Swift.Sequence, A.Element == Swift.Character>(A) -> Swift.String
0000000100003c8e mov r13, rax
0000000100003c91 mov r15, rdx
0000000100003c94 mov edi, 0x1
0000000100003c99 call imp___stubs__$ss8readLine16strippingNewlineSSSgSb_tF ; Swift.readLine(strippingNewline: Swift.Bool) -> Swift.String?
0000000100003c9e test rdx, rdx
0000000100003ca1 je loc_100003dac

0000000100003ca7 mov qword [rbp+var_38], rax
0000000100003cab mov qword [rbp+var_30], rdx
0000000100003caf mov rsi, qword [_$sSSN_100004000] ; _$sSSN_100004000
0000000100003cb6 mov rdx, qword [_$sSSs25LosslessStringConvertiblesWP_100004010] ; _$sSSs25LosslessStringConvertiblesWP_100004010
0000000100003cbd mov rcx, qword [_$sSSSTsWP_100004008] ; _$sSSSTsWP_100004008
0000000100003cc4 lea rdi, qword [rbp+var_38]
0000000100003cc8 call imp___stubs__$sSSySSxcs25LosslessStringConvertibleRzSTRzSJ7ElementSTRtzlufC ; Swift.String.init<A where A: Swift.LosslessStringConvertible, A: Swift.Sequence, A.Element == Swift.Character>(A) -> Swift.String
0000000100003ccd mov r12, rdx
0000000100003cd0 cmp r13, rax
0000000100003cd3 jne loc_100003ce0

0000000100003cd5 mov r14b, 0x1
0000000100003cd8 mov rbx, r15
0000000100003cdb cmp r15, r12
0000000100003cde je loc_100003cfa

loc_100003ce0:
0000000100003ce0 mov rdi, r13 ; CODE XREF=_main+547
0000000100003ce3 mov rsi, r15
0000000100003ce6 mov rdx, rax
0000000100003ce9 mov rcx, r12
0000000100003cec xor r8d, r8d
0000000100003cef call imp___stubs__$ss27_stringCompareWithSmolCheck__9expectingSbs11_StringGutsV_ADs01_G16ComparisonResultOtF ; Swift._stringCompareWithSmolCheck(_: Swift._StringGuts, _: Swift._StringGuts, expecting: Swift._StringComparisonResult) -> Swift.Bool
0000000100003cf4 mov r14d, eax
0000000100003cf7 mov rbx, r12

loc_100003cfa:
0000000100003cfa mov rdi, r15 ; CODE XREF=_main+558
0000000100003cfd call imp___stubs__swift_bridgeObjectRelease ; swift_bridgeObjectRelease
0000000100003d02 mov rdi, rbx
0000000100003d05 call imp___stubs__swift_bridgeObjectRelease ; swift_bridgeObjectRelease
0000000100003d0a mov esi, 0x40
0000000100003d0f mov edx, 0x7
0000000100003d14 mov rdi, qword [rbp+var_40]
0000000100003d18 call imp___stubs__swift_allocObject ; swift_allocObject
0000000100003d1d mov rbx, rax
0000000100003d20 movaps xmm0, xmmword [0x100003f30] ; 0x100003f30
0000000100003d27 movups xmmword [rax+0x10], xmm0
0000000100003d2b mov rax, qword [_$sSSN_100004000] ; _$sSSN_100004000
0000000100003d32 mov qword [rbx+0x38], rax
0000000100003d36 test r14b, 0x1
0000000100003d3a movabs rax, 0x73736563637553
0000000100003d44 movabs rcx, 0x656b20676e6f7277
0000000100003d4e cmovne rcx, rax
0000000100003d52 movabs rax, 0xe700000000000000
0000000100003d5c movabs rdx, 0xe900000000000079
0000000100003d66 cmovne rdx, rax
0000000100003d6a mov qword [rbx+0x20], rcx
0000000100003d6e mov qword [rbx+0x28], rdx
0000000100003d72 mov esi, 0x20
0000000100003d77 mov ecx, 0xa
0000000100003d7c mov rdi, rbx
0000000100003d7f movabs rdx, 0xe100000000000000
0000000100003d89 mov r8, rdx
0000000100003d8c call imp___stubs__$ss5print_9separator10terminatoryypd_S2StF ; Swift.print(_: Any..., separator: Swift.String, terminator: Swift.String) -> ()
0000000100003d91 mov rdi, rbx ; argument "instance" for method imp___stubs__swift_release
0000000100003d94 call imp___stubs__swift_release ; swift_release
0000000100003d99 xor eax, eax
0000000100003d9b add rsp, 0x18
0000000100003d9f pop rbx
0000000100003da0 pop r12
0000000100003da2 pop r13
0000000100003da4 pop r14
0000000100003da6 pop r15
0000000100003da8 pop rbp
0000000100003da9 ret
; endp

loc_100003daa:
0000000100003daa ud2 ; CODE XREF=_main+209
; endp

loc_100003dac: