[MD5算法练习] MD5CrackMe算法分析

Posted 2020-07-18

【破文标题】[MD5算法练习] MD5CrackMe算法分析
【破文作者】静心学习
【作者邮箱】[email protected]
【作者主页】http://www.cnblogs.com/dacainiao/
【破解工具】OD
【破解平台】xp sp3
【软件名称】MD5CrackMe
【软件大小】72KB
【原版下载】http://pan.baidu.com/share/link?shareid=1620370201&uk=892352529
【保护方式】无壳
【软件简介】一个MD5算法练习的CrackMe
【破解声明】初学密码学，跟着看雪前辈们的脚步学习，错误之处敬请诸位前辈不吝赐教。
------------------------------------------------------------------------
【破解过程】程序VC编写，无壳，使用bp MessageBox断点，可以很快找到算法验证。

00402864 . 68 00010000 PUSH 0x100 ; /Count = 100 (256.)
00402869 . 51 PUSH ECX ; |Buffer
0040286A . 68 E8030000 PUSH 0x3E8 ; |ControlID = 3E8 (1000.)
0040286F . 56 PUSH ESI ; |hWnd
00402870 . FFD5 CALL NEAR EBP ; \\GetDlgItemTextA
00402872 . 8DBC24 0C0100>LEA EDI, DWORD PTR SS:[ESP+0x10C]
00402879 . 83C9 FF OR ECX, 0xFFFFFFFF
0040287C . 33C0 XOR EAX, EAX
0040287E . F2:AE REPNE SCAS BYTE PTR ES:[EDI]
00402880 . F7D1 NOT ECX
00402882 . 49 DEC ECX
00402883 . 83F9 01 CMP ECX, 0x1
00402886 . 73 1F JNB SHORT MD5Crack.004028A7
00402888 . 6A 40 PUSH 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0040288A . 68 A4D14000 PUSH MD5Crack.0040D1A4 ; |Title = "注册提示"
0040288F . 68 8CD14000 PUSH MD5Crack.0040D18C ; |Text = "用户名不能为空请输入!"
00402894 . 56 PUSH ESI ; |hOwner
00402895 . FF15 D4B04000 CALL NEAR DWORD PTR DS:[<&USER32.MessageBoxA>] ; \\MessageBoxA
0040289B . 5F POP EDI
0040289C . 5E POP ESI
0040289D . 33C0 XOR EAX, EAX
0040289F . 5D POP EBP
004028A0 . 81C4 00030000 ADD ESP, 0x300
004028A6 . C3 RETN
004028A7 > 8D5424 0C LEA EDX, DWORD PTR SS:[ESP+0xC]
004028AB . 68 00010000 PUSH 0x100
004028B0 . 52 PUSH EDX
004028B1 . 68 07040000 PUSH 0x407
004028B6 . 56 PUSH ESI
004028B7 . FFD5 CALL NEAR EBP ; user32.GetDlgItemTextA
004028B9 . 8D7C24 0C LEA EDI, DWORD PTR SS:[ESP+0xC]
004028BD . 83C9 FF OR ECX, 0xFFFFFFFF
004028C0 . 33C0 XOR EAX, EAX
004028C2 . F2:AE REPNE SCAS BYTE PTR ES:[EDI]
004028C4 . F7D1 NOT ECX
004028C6 . 49 DEC ECX
004028C7 . 83F9 01 CMP ECX, 0x1
004028CA . 73 1F JNB SHORT MD5Crack.004028EB
004028CC . 6A 40 PUSH 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
004028CE . 68 A4D14000 PUSH MD5Crack.0040D1A4 ; |Title = "注册提示"
004028D3 . 68 74D14000 PUSH MD5Crack.0040D174 ; |Text = "注册码不能为空请输入!"
004028D8 . 56 PUSH ESI ; |hOwner
004028D9 . FF15 D4B04000 CALL NEAR DWORD PTR DS:[<&USER32.MessageBoxA>] ; \\MessageBoxA
004028DF . 5F POP EDI
004028E0 . 5E POP ESI
004028E1 . 33C0 XOR EAX, EAX
004028E3 . 5D POP EBP
004028E4 . 81C4 00030000 ADD ESP, 0x300
004028EA . C3 RETN
004028EB > 8D8424 0C0200>LEA EAX, DWORD PTR SS:[ESP+0x20C]
004028F2 . 6A 00 PUSH 0x0
004028F4 . 8D8C24 100100>LEA ECX, DWORD PTR SS:[ESP+0x110]
004028FB . 50 PUSH EAX
004028FC . 51 PUSH ECX
004028FD . E8 FEFCFFFF CALL MD5Crack.00402600 ; //算法call
00402902 . 8D9424 180200>LEA EDX, DWORD PTR SS:[ESP+0x218] ; //32位MD5
00402909 . 8D4424 18 LEA EAX, DWORD PTR SS:[ESP+0x18] ; //注册码
0040290D . 52 PUSH EDX
0040290E . 50 PUSH EAX
0040290F . E8 CCFDFFFF CALL MD5Crack.004026E0
00402914 . 83C4 14 ADD ESP, 0x14
00402917 . 83F8 01 CMP EAX, 0x1 ; //返回值为1注册成功
0040291A . 6A 40 PUSH 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0040291C . 68 A4D14000 PUSH MD5Crack.0040D1A4 ; |Title = "注册提示"
00402921 . 75 18 JNZ SHORT MD5Crack.0040293B ; |
00402923 . 68 60D14000 PUSH MD5Crack.0040D160 ; |Text = "恭喜你，注册码正确!"
00402928 . 56 PUSH ESI ; |hOwner
00402929 . FF15 D4B04000 CALL NEAR DWORD PTR DS:[<&USER32.MessageBoxA>] ; \\MessageBoxA
0040292F . 5F POP EDI
00402930 . 5E POP ESI
00402931 . 33C0 XOR EAX, EAX
00402933 . 5D POP EBP
00402934 . 81C4 00030000 ADD ESP, 0x300
0040293A . C3 RETN
0040293B > 68 48D14000 PUSH MD5Crack.0040D148 ; |Text = "注册码错误，继续加油!"
00402940 . 56 PUSH ESI ; |hOwner
00402941 . FF15 D4B04000 CALL NEAR DWORD PTR DS:[<&USER32.MessageBoxA>] ; \\MessageBoxA
00402947 . 5F POP EDI
00402948 . 5E POP ESI
00402949 . 33C0 XOR EAX, EAX
0040294B . 5D POP EBP
0040294C . 81C4 00030000 ADD ESP, 0x300
00402952 . C3 RETN
00402953 > 8B0D 6C014100 MOV ECX, DWORD PTR DS:[0x41016C] ; MD5Crack.00400000; Case 110 (WM_INITDIALOG) of switch 0040280B
00402959 . 68 9A000000 PUSH 0x9A ; /RsrcName = 154.
0040295E . 51 PUSH ECX ; |hInst => 00400000
0040295F . FF15 D8B04000 CALL NEAR DWORD PTR DS:[<&USER32.LoadIconA>] ; \\LoadIconA
00402965 . 8B9424 100300>MOV EDX, DWORD PTR SS:[ESP+0x310]
0040296C . 50 PUSH EAX ; /lParam
0040296D . 6A 01 PUSH 0x1 ; |wParam = 0x1
0040296F . 68 80000000 PUSH 0x80 ; |Message = WM_SETICON
00402974 . 52 PUSH EDX ; |hWnd
00402975 . A3 68014100 MOV DWORD PTR DS:[0x410168], EAX ; |
0040297A . FF15 DCB04000 CALL NEAR DWORD PTR DS:[<&USER32.SendMessageA>] ; \\SendMessageA
00402980 . 5F POP EDI
00402981 . 5E POP ESI
00402982 . 33C0 XOR EAX, EAX
00402984 . 5D POP EBP
00402985 . 81C4 00030000 ADD ESP, 0x300
0040298B . C3 RETN

 

跟进算法CALL 00402600:

00402600 /$ 6A FF PUSH -0x1
00402602 |. 68 A8A14000 PUSH MD5Crack.0040A1A8 ; SE 处理程序安装
00402607 |. 64:A1 0000000>MOV EAX, DWORD PTR FS:[0]
0040260D |. 50 PUSH EAX
0040260E |. 64:8925 00000>MOV DWORD PTR FS:[0], ESP
00402615 |. 81EC 2C010000 SUB ESP, 0x12C
0040261B |. 53 PUSH EBX
0040261C |. 55 PUSH EBP
0040261D |. 56 PUSH ESI
0040261E |. 57 PUSH EDI
0040261F |. 8D8C24 DC0000>LEA ECX, DWORD PTR SS:[ESP+0xDC]
00402626 |. E8 15F2FFFF CALL MD5Crack.00401840 ; //MD5_Init
0040262B |. 8BAC24 540100>MOV EBP, DWORD PTR SS:[ESP+0x154]
00402632 |. 33C0 XOR EAX, EAX
00402634 |. 3BE8 CMP EBP, EAX
00402636 |. 898424 440100>MOV DWORD PTR SS:[ESP+0x144], EAX
0040263D |. 8DB424 DC0000>LEA ESI, DWORD PTR SS:[ESP+0xDC]
00402644 |. 74 04 JE SHORT MD5Crack.0040264A
00402646 |. 8B7424 10 MOV ESI, DWORD PTR SS:[ESP+0x10]
0040264A |> 884424 14 MOV BYTE PTR SS:[ESP+0x14], AL
0040264E |. B9 10000000 MOV ECX, 0x10
00402653 |. 33C0 XOR EAX, EAX
00402655 |. 8D7C24 15 LEA EDI, DWORD PTR SS:[ESP+0x15]
00402659 |. F3:AB REP STOS DWORD PTR ES:[EDI]
0040265B |. 8B06 MOV EAX, DWORD PTR DS:[ESI]
0040265D |. 8BCE MOV ECX, ESI
0040265F |. FF50 0C CALL NEAR DWORD PTR DS:[EAX+0xC] ; //MD5_Init
00402662 |. 8B9424 4C0100>MOV EDX, DWORD PTR SS:[ESP+0x14C]
00402669 |. 83C9 FF OR ECX, 0xFFFFFFFF
0040266C |. 8BFA MOV EDI, EDX
0040266E |. 33C0 XOR EAX, EAX
00402670 |. F2:AE REPNE SCAS BYTE PTR ES:[EDI]
00402672 |. 8B1E MOV EBX, DWORD PTR DS:[ESI]
00402674 |. F7D1 NOT ECX
00402676 |. 49 DEC ECX
00402677 |. 51 PUSH ECX
00402678 |. 52 PUSH EDX
00402679 |. 8BCE MOV ECX, ESI
0040267B |. FF53 04 CALL NEAR DWORD PTR DS:[EBX+0x4] ; //1. 用户名 2. 长度
0040267E |. 8B16 MOV EDX, DWORD PTR DS:[ESI]
00402680 |. 8D4424 14 LEA EAX, DWORD PTR SS:[ESP+0x14]
00402684 |. 50 PUSH EAX
00402685 |. 8BCE MOV ECX, ESI
00402687 |. FF52 08 CALL NEAR DWORD PTR DS:[EDX+0x8] ; //Buff
0040268A |. B9 20000000 MOV ECX, 0x20
0040268F |. 33C0 XOR EAX, EAX
00402691 |. 8D7C24 59 LEA EDI, DWORD PTR SS:[ESP+0x59]
00402695 |. C64424 58 00 MOV BYTE PTR SS:[ESP+0x58], 0x0
0040269A |. F3:AB REP STOS DWORD PTR ES:[EDI]
0040269C |. 5F POP EDI
0040269D |. 5E POP ESI
0040269E |. 85ED TEST EBP, EBP
004026A0 |. 5D POP EBP
004026A1 |. 5B POP EBX
004026A2 |. 75 14 JNZ SHORT MD5Crack.004026B8
004026A4 |. 8D4C24 48 LEA ECX, DWORD PTR SS:[ESP+0x48] ; //空Buff
004026A8 |. 8D5424 04 LEA EDX, DWORD PTR SS:[ESP+0x4] ; //新MD5
004026AC |. 51 PUSH ECX
004026AD |. 6A 10 PUSH 0x10
004026AF |. 52 PUSH EDX
004026B0 |. E8 DBFEFFFF CALL MD5Crack.00402590
004026B5 |. 83C4 0C ADD ESP, 0xC
004026B8 |> 8B8C24 400100>MOV ECX, DWORD PTR SS:[ESP+0x140]
004026BF |. 8D4424 48 LEA EAX, DWORD PTR SS:[ESP+0x48]
004026C3 |. 50 PUSH EAX ; /String2
004026C4 |. 51 PUSH ECX ; |String1
004026C5 |. FF15 00B04000 CALL NEAR DWORD PTR DS:[<&KERNEL32.lstrcpyA>] ; \\lstrcpyA
004026CB |. 8B8C24 2C0100>MOV ECX, DWORD PTR SS:[ESP+0x12C]
004026D2 |. 64:890D 00000>MOV DWORD PTR FS:[0], ECX
004026D9 |. 81C4 38010000 ADD ESP, 0x138
004026DF \\. C3 RETN

 

在算法call的子call 00402626中可以看到MD5_Init:

00401840 /$ 8BC1 MOV EAX, ECX
00401842 |. 33C9 XOR ECX, ECX
00401844 |. 8848 04 MOV BYTE PTR DS:[EAX+0x4], CL
00401847 |. C700 F0B04000 MOV DWORD PTR DS:[EAX], MD5Crack.0040B0F0
0040184D |. C740 08 01234>MOV DWORD PTR DS:[EAX+0x8], 0x67452301
00401854 |. C740 0C 89ABC>MOV DWORD PTR DS:[EAX+0xC], 0xEFCDAB89
0040185B |. C740 10 FEDCB>MOV DWORD PTR DS:[EAX+0x10], 0x98BADCFE
00401862 |. C740 14 76543>MOV DWORD PTR DS:[EAX+0x14], 0x10325476
00401869 |. 8948 18 MOV DWORD PTR DS:[EAX+0x18], ECX
0040186C |. 8948 1C MOV DWORD PTR DS:[EAX+0x1C], ECX
0040186F \\. C3 RETN

 

在算法call的子call 00402687 |. FF52 08 CALL NEAR DWORD PTR DS:[EDX+0x8] ; //MD5_Final
可以看到标准MD5：
00401BEB . FF52 10 CALL NEAR DWORD PTR DS:[EDX+0x10] ; //MD5_Final

00401C60 . 83EC 10 SUB ESP, 0x10
00401C63 . 53 PUSH EBX
00401C64 . 55 PUSH EBP
00401C65 . 56 PUSH ESI
00401C66 . 8BF1 MOV ESI, ECX
00401C68 . 57 PUSH EDI
00401C69 . 8B5E 14 MOV EBX, DWORD PTR DS:[ESI+0x14]
00401C6C . 8B56 10 MOV EDX, DWORD PTR DS:[ESI+0x10]
00401C6F . 8B7E 0C MOV EDI, DWORD PTR DS:[ESI+0xC]
00401C72 . 8B6E 08 MOV EBP, DWORD PTR DS:[ESI+0x8]
00401C75 . 8B46 20 MOV EAX, DWORD PTR DS:[ESI+0x20] ; //取出4个初始常量
00401C78 . 8BCB MOV ECX, EBX ; //计算数据位用户名
00401C7A . 33CA XOR ECX, EDX
00401C7C . 23CF AND ECX, EDI
00401C7E . 33CB XOR ECX, EBX
00401C80 . 03CD ADD ECX, EBP
00401C82 . 8BEA MOV EBP, EDX
00401C84 . 33EF XOR EBP, EDI
00401C86 . 8D8C01 78A46A>LEA ECX, DWORD PTR DS:[ECX+EAX+0xD76AA478]
00401C8D . 8BC1 MOV EAX, ECX
00401C8F . C1E8 19 SHR EAX, 0x19
00401C92 . C1E1 07 SHL ECX, 0x7
00401C95 . 0BC1 OR EAX, ECX
00401C97 . 8B4E 24 MOV ECX, DWORD PTR DS:[ESI+0x24]
00401C9A . 03C7 ADD EAX, EDI
00401C9C . 23E8 AND EBP, EAX
00401C9E . 33EA XOR EBP, EDX
00401CA0 . 03E9 ADD EBP, ECX
00401CA2 . 8D9C2B 56B7C7>LEA EBX, DWORD PTR DS:[EBX+EBP+0xE8C7B756]
00401CA9 . 8BEF MOV EBP, EDI
00401CAB . 8BCB MOV ECX, EBX
00401CAD . 33E8 XOR EBP, EAX
00401CAF . C1E9 14 SHR ECX, 0x14
00401CB2 . C1E3 0C SHL EBX, 0xC
00401CB5 . 0BCB OR ECX, EBX
00401CB7 . 8B5E 28 MOV EBX, DWORD PTR DS:[ESI+0x28]
00401CBA . 03C8 ADD ECX, EAX
00401CBC . 23E9 AND EBP, ECX
00401CBE . 33EF XOR EBP, EDI
00401CC0 . 03EB ADD EBP, EBX
00401CC2 . 8D9C2A DB7020>LEA EBX, DWORD PTR DS:[EDX+EBP+0x242070DB]
00401CC9 . 8BE9 MOV EBP, ECX
00401CCB . 8BD3 MOV EDX, EBX
00401CCD . 33E8 XOR EBP, EAX
00401CCF . C1EA 0F SHR EDX, 0xF
00401CD2 . C1E3 11 SHL EBX, 0x11
00401CD5 . 0BD3 OR EDX, EBX
00401CD7 . 8B5E 2C MOV EBX, DWORD PTR DS:[ESI+0x2C]
00401CDA . 03D1 ADD EDX, ECX
00401CDC . 23EA AND EBP, EDX
00401CDE . 33E8 XOR EBP, EAX
00401CE0 . 03EB ADD EBP, EBX
00401CE2 . 8D9C2F EECEBD>LEA EBX, DWORD PTR DS:[EDI+EBP+0xC1BDCEEE]
00401CE9 . 8BE9 MOV EBP, ECX
00401CEB . 8BFB MOV EDI, EBX
00401CED . 33EA XOR EBP, EDX
00401CEF . C1E7 16 SHL EDI, 0x16
00401CF2 . C1EB 0A SHR EBX, 0xA
00401CF5 . 0BFB OR EDI, EBX
00401CF7 . 8B5E 30 MOV EBX, DWORD PTR DS:[ESI+0x30]
00401CFA . 03FA ADD EDI, EDX
00401CFC . 23EF AND EBP, EDI
00401CFE . 33E9 XOR EBP, ECX
00401D00 . 03EB ADD EBP, EBX
00401D02 . 8D8428 AF0F7C>LEA EAX, DWORD PTR DS:[EAX+EBP+0xF57C0FAF]
00401D09 . 8BEA MOV EBP, EDX
00401D0B . 8BD8 MOV EBX, EAX
00401D0D . 33EF XOR EBP, EDI
00401D0F . C1EB 19 SHR EBX, 0x19
00401D12 . C1E0 07 SHL EAX, 0x7
00401D15 . 0BD8 OR EBX, EAX
00401D17 . 8B46 34 MOV EAX, DWORD PTR DS:[ESI+0x34]
00401D1A . 03DF ADD EBX, EDI
00401D1C . 23EB AND EBP, EBX
00401D1E . 33EA XOR EBP, EDX
00401D20 . 03E8 ADD EBP, EAX
00401D22 . 8D8C29 2AC687>LEA ECX, DWORD PTR DS:[ECX+EBP+0x4787C62A]
00401D29 . 8BC1 MOV EAX, ECX
00401D2B . C1E8 14 SHR EAX, 0x14
00401D2E . C1E1 0C SHL ECX, 0xC
00401D31 . 0BC1 OR EAX, ECX
00401D33 . 03C3 ADD EAX, EBX
00401D35 . 8B4E 38 MOV ECX, DWORD PTR DS:[ESI+0x38]
00401D38 . 8BEF MOV EBP, EDI
00401D3A . 33EB XOR EBP, EBX
00401D3C . 23E8 AND EBP, EAX
00401D3E . 33EF XOR EBP, EDI
00401D40 . 03E9 ADD EBP, ECX
00401D42 . 8D942A 134630>LEA EDX, DWORD PTR DS:[EDX+EBP+0xA8304613]
00401D49 . 8BE8 MOV EBP, EAX
00401D4B . 8BCA MOV ECX, EDX
00401D4D . 33EB XOR EBP, EBX
00401D4F . C1E9 0F SHR ECX, 0xF
00401D52 . C1E2 11 SHL EDX, 0x11
00401D55 . 0BCA OR ECX, EDX
00401D57 . 8B56 3C MOV EDX, DWORD PTR DS:[ESI+0x3C]
00401D5A . 03C8 ADD ECX, EAX
00401D5C . 23E9 AND EBP, ECX
00401D5E . 33EB XOR EBP, EBX
00401D60 . 03EA ADD EBP, EDX
00401D62 . 8DBC2F 019546>LEA EDI, DWORD PTR DS:[EDI+EBP+0xFD469501]
00401D69 . 8BE8 MOV EBP, EAX
00401D6B . 8BD7 MOV EDX, EDI
00401D6D . 33E9 XOR EBP, ECX
00401D6F . C1E2 16 SHL EDX, 0x16
00401D72 . C1EF 0A SHR EDI, 0xA
00401D75 . 0BD7 OR EDX, EDI
00401D77 . 8B7E 40 MOV EDI, DWORD PTR DS:[ESI+0x40]
00401D7A . 03D1 ADD EDX, ECX
00401D7C . 23EA AND EBP, EDX
00401D7E . 33E8 XOR EBP, EAX
00401D80 . 03EF ADD EBP, EDI
00401D82 . 8D9C2B D89880>LEA EBX, DWORD PTR DS:[EBX+EBP+0x698098D8]
00401D89 . 8BE9 MOV EBP, ECX
00401D8B . 8BFB MOV EDI, EBX
00401D8D . 33EA XOR EBP, EDX
00401D8F . C1EF 19 SHR EDI, 0x19
00401D92 . C1E3 07 SHL EBX, 0x7
00401D95 . 0BFB OR EDI, EBX
00401D97 . 8B5E 44 MOV EBX, DWORD PTR DS:[ESI+0x44]
00401D9A . 03FA ADD EDI, EDX
00401D9C . 23EF AND EBP, EDI
00401D9E . 33E9 XOR EBP, ECX
00401DA0 . 03EB ADD EBP, EBX
00401DA2 . 8D8428 AFF744>LEA EAX, DWORD PTR DS:[EAX+EBP+0x8B44F7AF]
00401DA9 . 8BEA MOV EBP, EDX
00401DAB . 8BD8 MOV EBX, EAX
00401DAD . 33EF XOR EBP, EDI
00401DAF . C1EB 14 SHR EBX, 0x14
00401DB2 . C1E0 0C SHL EAX, 0xC
00401DB5 . 0BD8 OR EBX, EAX
00401DB7 . 8B46 48 MOV EAX, DWORD PTR DS:[ESI+0x48]
00401DBA . 03DF ADD EBX, EDI
00401DBC . 23EB AND EBP, EBX
00401DBE . 33EA XOR EBP, EDX
00401DC0 . 03E8 ADD EBP, EAX
00401DC2 . 8D8C29 B15BFF>LEA ECX, DWORD PTR DS:[ECX+EBP+0xFFFF5BB1]
00401DC9 . 8BEB MOV EBP, EBX
00401DCB . 8BC1 MOV EAX, ECX
00401DCD . 33EF XOR EBP, EDI
00401DCF . C1E8 0F SHR EAX, 0xF
00401DD2 . C1E1 11 SHL ECX, 0x11
00401DD5 . 0BC1 OR EAX, ECX
00401DD7 . 8B4E 4C MOV ECX, DWORD PTR DS:[ESI+0x4C]
00401DDA . 03C3 ADD EAX, EBX
00401DDC . 23E8 AND EBP, EAX
00401DDE . 33EF XOR EBP, EDI
00401DE0 . 03E9 ADD EBP, ECX
00401DE2 . 8D942A BED75C>LEA EDX, DWORD PTR DS:[EDX+EBP+0x895CD7BE]
00401DE9 . 8BEB MOV EBP, EBX
00401DEB . 8BCA MOV ECX, EDX
00401DED . 33E8 XOR EBP, EAX
00401DEF . C1E1 16 SHL ECX, 0x16
00401DF2 . C1EA 0A SHR EDX, 0xA
00401DF5 . 0BCA OR ECX, EDX
00401DF7 . 8B56 50 MOV EDX, DWORD PTR DS:[ESI+0x50]
以上是关于[MD5算法练习] MD5CrackMe算法分析的主要内容，如果未能解决你的问题，请参考以下文章
 
 MD5算法
 MD5算法
 MD5加密算法详细分析_C实现
 MD5加密算法的识别
 JS加密算法练习
 MD5的学习与练习