MD5加密算法的识别
Posted
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了MD5加密算法的识别相关的知识，希望对你有一定的参考价值。
通过MD5加密算法原理的介绍，会了解到MD5在加密的过程中，有几个固定的流程(特征)，在逆向分析的过程中通过这些特征可以识别出当前使用的是MD5的加密算法，从而更高效的分析还原算法。
整理下MD5加密的几个特征：
1. 处理的数据是512位为1组，补位数据的填充方式
2. 4个初始常数 A=0X67452301L，B=0XEFCDAB89L，C=0X98BADCFEL，D=0X10325476L (4个初始常数的值为主要特征)
3. 4轮Hash运算 (每轮的移位次数及运算的常量为主要特征)
第一轮
a=FF(a,b,c,d,M0,7,0xd76aa478)
b=FF(d,a,b,c,M1,12,0xe8c7b756)
c=FF(c,d,a,b,M2,17,0x242070db)
d=FF(b,c,d,a,M3,22,0xc1bdceee)
a=FF(a,b,c,d,M4,7,0xf57c0faf)
b=FF(d,a,b,c,M5,12,0x4787c62a)
c=FF(c,d,a,b,M6,17,0xa8304613)
d=FF(b,c,d,a,M7,22,0xfd469501)
a=FF(a,b,c,d,M8,7,0x698098d8)
b=FF(d,a,b,c,M9,12,0x8b44f7af)
c=FF(c,d,a,b,M10,17,0xffff5bb1)
d=FF(b,c,d,a,M11,22,0x895cd7be)
a=FF(a,b,c,d,M12,7,0x6b901122)
b=FF(d,a,b,c,M13,12,0xfd987193)
c=FF(c,d,a,b,M14,17,0xa679438e)
d=FF(b,c,d,a,M15,22,0x49b40821)
第二轮
a=GG(a,b,c,d,M1,5,0xf61e2562)
b=GG(d,a,b,c,M6,9,0xc040b340)
c=GG(c,d,a,b,M11,14,0x265e5a51)
d=GG(b,c,d,a,M0,20,0xe9b6c7aa)
a=GG(a,b,c,d,M5,5,0xd62f105d)
b=GG(d,a,b,c,M10,9,0x02441453)
c=GG(c,d,a,b,M15,14,0xd8a1e681)
d=GG(b,c,d,a,M4,20,0xe7d3fbc8)
a=GG(a,b,c,d,M9,5,0x21e1cde6)
b=GG(d,a,b,c,M14,9,0xc33707d6)
c=GG(c,d,a,b,M3,14,0xf4d50d87)
d=GG(b,c,d,a,M8,20,0x455a14ed)
a=GG(a,b,c,d,M13,5,0xa9e3e905)
b=GG(d,a,b,c,M2,9,0xfcefa3f8)
c=GG(c,d,a,b,M7,14,0x676f02d9)
d=GG(b,c,d,a,M12,20,0x8d2a4c8a)
第三轮
a=HH(a,b,c,d,M5,4,0xfffa3942)
b=HH(d,a,b,c,M8,11,0x8771f681)
c=HH(c,d,a,b,M11,16,0x6d9d6122)
d=HH(b,c,d,a,M14,23,0xfde5380c)
a=HH(a,b,c,d,M1,4,0xa4beea44)
b=HH(d,a,b,c,M4,11,0x4bdecfa9)
c=HH(c,d,a,b,M7,16,0xf6bb4b60)
d=HH(b,c,d,a,M10,23,0xbebfbc70)
a=HH(a,b,c,d,M13,4,0x289b7ec6)
b=HH(d,a,b,c,M0,11,0xeaa127fa)
c=HH(c,d,a,b,M3,16,0xd4ef3085)
d=HH(b,c,d,a,M6,23,0x04881d05)
a=HH(a,b,c,d,M9,4,0xd9d4d039)
b=HH(d,a,b,c,M12,11,0xe6db99e5)
c=HH(c,d,a,b,M15,16,0x1fa27cf8)
d=HH(b,c,d,a,M2,23,0xc4ac5665)
第四轮
a=II(a,b,c,d,M0,6,0xf4292244)
b=II(d,a,b,c,M7,10,0x432aff97)
c=II(c,d,a,b,M14,15,0xab9423a7)
d=II(b,c,d,a,M5,21,0xfc93a039)
a=II(a,b,c,d,M12,6,0x655b59c3)
b=II(d,a,b,c,M3,10,0x8f0ccc92)
c=II(c,d,a,b,M10,15,0xffeff47d)
d=II(b,c,d,a,M1,21,0x85845dd1)
a=II(a,b,c,d,M8,6,0x6fa87e4f)
b=II(d,a,b,c,M15,10,0xfe2ce6e0)
c=II(c,d,a,b,M6,15,0xa3014314)
d=II(b,c,d,a,M13,21,0x4e0811a1)
a=II(a,b,c,d,M4,6,0xf7537e82)
b=II(d,a,b,c,M11,10,0xbd3af235)
c=II(c,d,a,b,M2,15,0x2ad7d2bb)
d=II(b,c,d,a,M9,21,0xeb86d391)
当前也有很多MD5的算法变形，要还原这些变形的算法，首先就要找到所有变形的地方，然后修改标准算法，一般变形的几个地方：
1. 对数据补位填充的变形
2. 4个初始常数的变形
3. 4轮Hash运算的变形
下面为标准MD5在OD的特征：
初始4个常数：
004012B0 /$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 004012B4 |. 33C9 XOR ECX,ECX 004012B6 |. 8948 14 MOV DWORD PTR DS:[EAX+14],ECX 004012B9 |. 8948 10 MOV DWORD PTR DS:[EAX+10],ECX 004012BC |. C700 01234567 MOV DWORD PTR DS:[EAX],67452301 004012C2 |. C740 04 89ABC>MOV DWORD PTR DS:[EAX+4],EFCDAB89 004012C9 |. C740 08 FEDCB>MOV DWORD PTR DS:[EAX+8],98BADCFE 004012D0 |. C740 0C 76543>MOV DWORD PTR DS:[EAX+C],10325476 004012D7 \\. C3 RETN
Hash运算:
00401400 /$ 83EC 40 SUB ESP,40 00401403 |. 8B4C24 48 MOV ECX,DWORD PTR SS:[ESP+48] 00401407 |. 53 PUSH EBX 00401408 |. 55 PUSH EBP 00401409 |. 56 PUSH ESI 0040140A |. 8B7424 50 MOV ESI,DWORD PTR SS:[ESP+50] 0040140E |. 57 PUSH EDI 0040140F |. 6A 40 PUSH 40 00401411 |. 8D5424 14 LEA EDX,DWORD PTR SS:[ESP+14] 00401415 |. 8B06 MOV EAX,DWORD PTR DS:[ESI] 00401417 |. 8B7E 04 MOV EDI,DWORD PTR DS:[ESI+4] 0040141A |. 8B5E 08 MOV EBX,DWORD PTR DS:[ESI+8] 0040141D |. 8B6E 0C MOV EBP,DWORD PTR DS:[ESI+C] 00401420 |. 51 PUSH ECX 00401421 |. 52 PUSH EDX 00401422 |. 894424 60 MOV DWORD PTR SS:[ESP+60],EAX 00401426 |. E8 75090000 CALL MD5KeyGe.00401DA0 0040142B |. 8BC7 MOV EAX,EDI 0040142D |. 8B5424 60 MOV EDX,DWORD PTR SS:[ESP+60] 00401431 |. F7D0 NOT EAX 00401433 |. 8BCB MOV ECX,EBX 00401435 |. 23C5 AND EAX,EBP 00401437 |. 23CF AND ECX,EDI 00401439 |. 0BC1 OR EAX,ECX 0040143B |. 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+1C] 0040143F |. 03C1 ADD EAX,ECX 00401441 |. 8D8C02 78A46A>LEA ECX,DWORD PTR DS:[EDX+EAX+D76AA478] 00401448 |. 8BD7 MOV EDX,EDI 0040144A |. 8BC1 MOV EAX,ECX 0040144C |. C1E8 19 SHR EAX,19 0040144F |. C1E1 07 SHL ECX,7 00401452 |. 0BC1 OR EAX,ECX 00401454 |. 03C7 ADD EAX,EDI 00401456 |. 8BC8 MOV ECX,EAX 00401458 |. 23D0 AND EDX,EAX 0040145A |. F7D1 NOT ECX 0040145C |. 23CB AND ECX,EBX 0040145E |. 0BCA OR ECX,EDX 00401460 |. 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+20] 00401464 |. 03CA ADD ECX,EDX 00401466 |. 8D9429 56B7C7>LEA EDX,DWORD PTR DS:[ECX+EBP+E8C7B756] 0040146D |. 8BCA MOV ECX,EDX 0040146F |. C1E9 14 SHR ECX,14 00401472 |. C1E2 0C SHL EDX,0C 00401475 |. 0BCA OR ECX,EDX 00401477 |. 03C8 ADD ECX,EAX 00401479 |. 8BD1 MOV EDX,ECX 0040147B |. 8BE9 MOV EBP,ECX 0040147D |. F7D2 NOT EDX 0040147F |. 23D7 AND EDX,EDI 00401481 |. 23E8 AND EBP,EAX 00401483 |. 0BD5 OR EDX,EBP 00401485 |. 8B6C24 24 MOV EBP,DWORD PTR SS:[ESP+24] 00401489 |. 03D5 ADD EDX,EBP 0040148B |. 8BE9 MOV EBP,ECX 0040148D |. 8D9C13 DB7020>LEA EBX,DWORD PTR DS:[EBX+EDX+242070DB] 00401494 |. 8BD3 MOV EDX,EBX 00401496 |. C1EA 0F SHR EDX,0F 00401499 |. C1E3 11 SHL EBX,11 0040149C |. 0BD3 OR EDX,EBX 0040149E |. 03D1 ADD EDX,ECX 004014A0 |. 8BDA MOV EBX,EDX 004014A2 |. 23EA AND EBP,EDX 004014A4 |. F7D3 NOT EBX 004014A6 |. 23D8 AND EBX,EAX 004014A8 |. 0BDD OR EBX,EBP 004014AA |. 8B6C24 28 MOV EBP,DWORD PTR SS:[ESP+28] 004014AE |. 03DD ADD EBX,EBP 004014B0 |. 8D9C1F EECEBD>LEA EBX,DWORD PTR DS:[EDI+EBX+C1BDCEEE] 004014B7 |. 8BFB MOV EDI,EBX 004014B9 |. C1E7 16 SHL EDI,16 004014BC |. C1EB 0A SHR EBX,0A 004014BF |. 0BFB OR EDI,EBX 004014C1 |. 8BDA MOV EBX,EDX 004014C3 |. 03FA ADD EDI,EDX 004014C5 |. 897C24 60 MOV DWORD PTR SS:[ESP+60],EDI 004014C9 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 004014CD |. F7D7 NOT EDI 004014CF |. 23F9 AND EDI,ECX 004014D1 |. 23DD AND EBX,EBP 004014D3 |. 8B6C24 2C MOV EBP,DWORD PTR SS:[ESP+2C] 004014D7 |. 0BFB OR EDI,EBX 004014D9 |. 03FD ADD EDI,EBP 004014DB |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 004014DF |. 8BEB MOV EBP,EBX 004014E1 |. 8D8438 AF0F7C>LEA EAX,DWORD PTR DS:[EAX+EDI+F57C0FAF] 004014E8 |. 8BF8 MOV EDI,EAX 004014EA |. C1EF 19 SHR EDI,19 004014ED |. C1E0 07 SHL EAX,7 004014F0 |. 0BF8 OR EDI,EAX 004014F2 |. 03FB ADD EDI,EBX 004014F4 |. 8BC7 MOV EAX,EDI 004014F6 |. 23EF AND EBP,EDI 004014F8 |. F7D0 NOT EAX 004014FA |. 23C2 AND EAX,EDX 004014FC |. 0BC5 OR EAX,EBP 004014FE |. 8B6C24 30 MOV EBP,DWORD PTR SS:[ESP+30] 00401502 |. 03C5 ADD EAX,EBP 00401504 |. 8D8C01 2AC687>LEA ECX,DWORD PTR DS:[ECX+EAX+4787C62A] 0040150B |. 8BC1 MOV EAX,ECX 0040150D |. C1E8 14 SHR EAX,14 00401510 |. C1E1 0C SHL ECX,0C 00401513 |. 0BC1 OR EAX,ECX 00401515 |. 03C7 ADD EAX,EDI 00401517 |. 8BC8 MOV ECX,EAX 00401519 |. 8BE8 MOV EBP,EAX 0040151B |. F7D1 NOT ECX 0040151D |. 23CB AND ECX,EBX 0040151F |. 23EF AND EBP,EDI 00401521 |. 0BCD OR ECX,EBP 00401523 |. 8B6C24 34 MOV EBP,DWORD PTR SS:[ESP+34] 00401527 |. 03CD ADD ECX,EBP 00401529 |. 8BE8 MOV EBP,EAX 0040152B |. 8D940A 134630>LEA EDX,DWORD PTR DS:[EDX+ECX+A8304613] 00401532 |. 8BCA MOV ECX,EDX 00401534 |. C1E9 0F SHR ECX,0F 00401537 |. C1E2 11 SHL EDX,11 0040153A |. 0BCA OR ECX,EDX 0040153C |. 03C8 ADD ECX,EAX 0040153E |. 8BD1 MOV EDX,ECX 00401540 |. 23E9 AND EBP,ECX 00401542 |. F7D2 NOT EDX 00401544 |. 23D7 AND EDX,EDI 00401546 |. 0BD5 OR EDX,EBP 00401548 |. 8B6C24 38 MOV EBP,DWORD PTR SS:[ESP+38] 0040154C |. 03D5 ADD EDX,EBP 0040154E |. 8D9C13 019546>LEA EBX,DWORD PTR DS:[EBX+EDX+FD469501] 00401555 |. 8BD3 MOV EDX,EBX 00401557 |. C1E2 16 SHL EDX,16 0040155A |. C1EB 0A SHR EBX,0A 0040155D |. 0BD3 OR EDX,EBX 0040155F |. 8BD9 MOV EBX,ECX 00401561 |. 03D1 ADD EDX,ECX 00401563 |. 895424 60 MOV DWORD PTR SS:[ESP+60],EDX 00401567 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 0040156B |. F7D2 NOT EDX 0040156D |. 23D0 AND EDX,EAX 0040156F |. 23DD AND EBX,EBP 00401571 |. 8B6C24 3C MOV EBP,DWORD PTR SS:[ESP+3C] 00401575 |. 0BD3 OR EDX,EBX 00401577 |. 03D5 ADD EDX,EBP 00401579 |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 0040157D |. 8BEB MOV EBP,EBX 0040157F |. 8DBC17 D89880>LEA EDI,DWORD PTR DS:[EDI+EDX+698098D8] 00401586 |. 8BD7 MOV EDX,EDI 00401588 |. C1EA 19 SHR EDX,19 0040158B |. C1E7 07 SHL EDI,7 0040158E |. 0BD7 OR EDX,EDI 00401590 |. 03D3 ADD EDX,EBX 00401592 |. 8BFA MOV EDI,EDX 00401594 |. 23EA AND EBP,EDX 00401596 |. F7D7 NOT EDI 00401598 |. 23F9 AND EDI,ECX 0040159A |. 0BFD OR EDI,EBP 0040159C |. 8B6C24 40 MOV EBP,DWORD PTR SS:[ESP+40] 004015A0 |. 03FD ADD EDI,EBP 004015A2 |. 8D8438 AFF744>LEA EAX,DWORD PTR DS:[EAX+EDI+8B44F7AF] 004015A9 |. 8BF8 MOV EDI,EAX 004015AB |. C1EF 14 SHR EDI,14 004015AE |. C1E0 0C SHL EAX,0C 004015B1 |. 0BF8 OR EDI,EAX 004015B3 |. 03FA ADD EDI,EDX 004015B5 |. 8BC7 MOV EAX,EDI 004015B7 |. F7D0 NOT EAX 004015B9 |. 8BEF MOV EBP,EDI 004015BB |. 23C3 AND EAX,EBX 004015BD |. 23EA AND EBP,EDX 004015BF |. 0BC5 OR EAX,EBP 004015C1 |. 8B6C24 44 MOV EBP,DWORD PTR SS:[ESP+44] 004015C5 |. 03C5 ADD EAX,EBP 004015C7 |. 8BEF MOV EBP,EDI 004015C9 |. 8D8C01 B15BFF>LEA ECX,DWORD PTR DS:[ECX+EAX+FFFF5BB1] 004015D0 |. 8BC1 MOV EAX,ECX 004015D2 |. C1E8 0F SHR EAX,0F 004015D5 |. C1E1 11 SHL ECX,11 004015D8 |. 0BC1 OR EAX,ECX 004015DA |. 03C7 ADD EAX,EDI 004015DC |. 8BC8 MOV ECX,EAX 004015DE |. 23E8 AND EBP,EAX 004015E0 |. F7D1 NOT ECX 004015E2 |. 23CA AND ECX,EDX 004015E4 |. 0BCD OR ECX,EBP 004015E6 |. 8B6C24 48 MOV EBP,DWORD PTR SS:[ESP+48] 004015EA |. 03CD ADD ECX,EBP 004015EC |. 8D9C0B BED75C>LEA EBX,DWORD PTR DS:[EBX+ECX+895CD7BE] 004015F3 |. 8BCB MOV ECX,EBX 004015F5 |. C1E1 16 SHL ECX,16 004015F8 |. C1EB 0A SHR EBX,0A 004015FB |. 0BCB OR ECX,EBX 004015FD |. 8BD8 MOV EBX,EAX 004015FF |. 03C8 ADD ECX,EAX 00401601 |. 894C24 60 MOV DWORD PTR SS:[ESP+60],ECX 00401605 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 00401609 |. F7D1 NOT ECX 0040160B |. 23CF AND ECX,EDI 0040160D |. 23DD AND EBX,EBP 0040160F |. 8B6C24 4C MOV EBP,DWORD PTR SS:[ESP+4C] 00401613 |. 0BCB OR ECX,EBX 00401615 |. 03CD ADD ECX,EBP 00401617 |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 0040161B |. 8BEB MOV EBP,EBX 0040161D |. 8D940A 221190>LEA EDX,DWORD PTR DS:[EDX+ECX+6B901122] 00401624 |. 8BCA MOV ECX,EDX 00401626 |. C1E9 19 SHR ECX,19 00401629 |. C1E2 07 SHL EDX,7 0040162C |. 0BCA OR ECX,EDX 0040162E |. 03CB ADD ECX,EBX 00401630 |. 8BD1 MOV EDX,ECX 00401632 |. 23E9 AND EBP,ECX 00401634 |. F7D2 NOT EDX 00401636 |. 23D0 AND EDX,EAX 00401638 |. 0BD5 OR EDX,EBP 0040163A |. 8B6C24 50 MOV EBP,DWORD PTR SS:[ESP+50] 0040163E |. 03D5 ADD EDX,EBP 00401640 |. 8DBC17 937198>LEA EDI,DWORD PTR DS:[EDI+EDX+FD987193] 00401647 |. 8BD7 MOV EDX,EDI 00401649 |. C1EA 14 SHR EDX,14 0040164C |. C1E7 0C SHL EDI,0C 0040164F |. 0BD7 OR EDX,EDI 00401651 |. 03D1 ADD EDX,ECX 00401653 |. 8BEA MOV EBP,EDX 00401655 |. 8BFA MOV EDI,EDX 00401657 |. F7D5 NOT EBP 00401659 |. 23F9 AND EDI,ECX 0040165B |. 23DD AND EBX,EBP 0040165D |. 0BFB OR EDI,EBX 0040165F |. 8B5C24 54 MOV EBX,DWORD PTR SS:[ESP+54] 00401663 |. 03FB ADD EDI,EBX 00401665 |. 8BDA MOV EBX,EDX 00401667 |. 8D8438 8E4379>LEA EAX,DWORD PTR DS:[EAX+EDI+A679438E] 0040166E |. 8BF8 MOV EDI,EAX 00401670 |. C1EF 0F SHR EDI,0F 00401673 |. C1E0 11 SHL EAX,11 00401676 |. 0BF8 OR EDI,EAX 00401678 |. 03FA ADD EDI,EDX 0040167A |. 8BC7 MOV EAX,EDI 0040167C |. 23DF AND EBX,EDI 0040167E |. F7D0 NOT EAX 00401680 |. 894424 64 MOV DWORD PTR SS:[ESP+64],EAX 00401684 |. 23C1 AND EAX,ECX 00401686 |. 0BC3 OR EAX,EBX 00401688 |. 8B5C24 58 MOV EBX,DWORD PTR SS:[ESP+58] 0040168C |. 03C3 ADD EAX,EBX 0040168E |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 00401692 |. 8D9C03 2108B4>LEA EBX,DWORD PTR DS:[EBX+EAX+49B40821] 00401699 |. 8BC3 MOV EAX,EBX 0040169B |. C1E0 16 SHL EAX,16 0040169E |. C1EB 0A SHR EBX,0A 004016A1 |. 0BC3 OR EAX,EBX 004016A3 |. 8BDA MOV EBX,EDX 004016A5 |. 03C7 ADD EAX,EDI 004016A7 |. 894424 60 MOV DWORD PTR SS:[ESP+60],EAX 004016AB |. 23D8 AND EBX,EAX 004016AD |. 8BC7 MOV EAX,EDI 004016AF |. 23C5 AND EAX,EBP 004016B1 |. 8B6C24 20 MOV EBP,DWORD PTR SS:[ESP+20] 004016B5 |. 0BD8 OR EBX,EAX 004016B7 |. 03DD ADD EBX,EBP 004016B9 |. 8BEF MOV EBP,EDI 004016BB |. 8D8C19 62251E>LEA ECX,DWORD PTR DS:[ECX+EBX+F61E2562] 004016C2 |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 004016C6 |. 8BC1 MOV EAX,ECX 004016C8 |. C1E8 1B SHR EAX,1B 004016CB |. C1E1 05 SHL ECX,5 004016CE |. 0BC1 OR EAX,ECX 004016D0 |. 8B4C24 64 MOV ECX,DWORD PTR SS:[ESP+64] 004016D4 |. 03C3 ADD EAX,EBX 004016D6 |. 23CB AND ECX,EBX 004016D8 |. 23E8 AND EBP,EAX 004016DA |. 0BCD OR ECX,EBP 004016DC |. 8B6C24 34 MOV EBP,DWORD PTR SS:[ESP+34] 004016E0 |. 03CD ADD ECX,EBP 004016E2 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 004016E6 |. F7D3 NOT EBX 004016E8 |. 8D940A 40B340>LEA EDX,DWORD PTR DS:[EDX+ECX+C040B340] 004016EF |. 23D8 AND EBX,EAX 004016F1 |. 8BCA MOV ECX,EDX 004016F3 |. C1E9 17 SHR ECX,17 004016F6 |. C1E2 09 SHL EDX,9 004016F9 |. 0BCA OR ECX,EDX 004016FB |. 03C8 ADD ECX,EAX 004016FD |. 8BD1 MOV EDX,ECX 004016FF |. 23D5 AND EDX,EBP 00401701 |. 8B6C24 48 MOV EBP,DWORD PTR SS:[ESP+48] 00401705 |. 0BDA OR EBX,EDX 00401707 |. 03DD ADD EBX,EBP 00401709 |. 8DBC1F 515A5E>LEA EDI,DWORD PTR DS:[EDI+EBX+265E5A51] 00401710 |. 8BD7 MOV EDX,EDI 00401712 |. C1EA 12 SHR EDX,12 00401715 |. C1E7 0E SHL EDI,0E 00401718 |. 0BD7 OR EDX,EDI 0040171A |. 8BF8 MOV EDI,EAX 0040171C |. 03D1 ADD EDX,ECX 0040171E |. F7D7 NOT EDI 00401720 |. 8BDA MOV EBX,EDX 00401722 |. 23F9 AND EDI,ECX 00401724 |. 23D8 AND EBX,EAX 00401726 |. 0BFB OR EDI,EBX 00401728 |. 8B5C24 1C MOV EBX,DWORD PTR SS:[ESP+1C] 0040172C |. 03FB ADD EDI,EBX 0040172E |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 00401732 |. 8D9C3B AAC7B6>LEA EBX,DWORD PTR DS:[EBX+EDI+E9B6C7AA] 00401739 |. 8BFB MOV EDI,EBX 0040173B |. C1E7 14 SHL EDI,14 0040173E |. C1EB 0C SHR EBX,0C 00401741 |. 0BFB OR EDI,EBX 00401743 |. 8BD9 MOV EBX,ECX 00401745 |. 03FA ADD EDI,EDX 00401747 |. 897C24 60 MOV DWORD PTR SS:[ESP+60],EDI 0040174B |. 8BF9 MOV EDI,ECX 0040174D |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 00401751 |. F7D7 NOT EDI 00401753 |. 23FA AND EDI,EDX 00401755 |. 23DD AND EBX,EBP 00401757 |. 8B6C24 30 MOV EBP,DWORD PTR SS:[ESP+以上是关于MD5加密算法的识别的主要内容，如果未能解决你的问题，请参考以下文章