语音界面 V2.0算法分析 -pc6资讯

您的位置：首页 → 精文荟萃 → 破解文章 → 语音界面 V2.0算法分析

语音界面 V2.0算法分析 时间：2004/10/15 0:57:00来源：本站整理作者：蓝点我要评论(0): 　破解者：HMILY[CCG][BCG]
下载地址： http://tongtian.net/cgi-bin/topic.cgi?forum=19&topic=767&show=0
下面的附件便是！
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004042ED(C)
|
:004042D9 56 push esi
:004042DA 8BCF mov ecx, edi
:004042DC E82F000000 call 00404310 ->注册码的计算，跟进去
:004042E1 83F8FE cmp eax, FFFFFFFE
:004042E4 741A je 00404300
:004042E6 3BC6 cmp eax, esi
:004042E8 7416 je 00404300
:004042EA 4E dec esi
:004042EB 85F6 test esi, esi
:004042ED 7FEA jg 004042D9
:004042EF 6A00 push 00000000
:004042F1 6A40 push 00000040

* Possible StringData Ref from Data Obj ->"注册码有误"
|
:004042F3 684C774000 push 0040774C

* Reference To: MFC42.Ordinal:04B0, Ord:04B0h
|
:004042F8 E873050000 Call 00404870
:004042FD 5F pop edi
:004042FE 5E pop esi
:004042FF C3 ret
=============================================================================================
上面还有，不重要！略………………

* Reference To: MFC42.Ordinal:0F21, Ord:0F21h
|
:00404392 E82F060000 Call 004049C6 ->计算从这里开始
:00404397 8B7C2468 mov edi, dword ptr [esp+68]
:0040439B 33DB xor ebx, ebx ->ebx清零，为计算做准备！
:0040439D 33C9 xor ecx, ecx ->同上
:0040439F 8D04BF lea eax, dword ptr [edi+4*edi] ->从trw中可看到edi=3;eax=3+3*4
:004043A2 8D0480 lea eax, dword ptr [eax+4*eax] ->eax=eax+eax*4
:004043A5 8D3480 lea esi, dword ptr [eax+4*eax] ->esi=eax+eax*4
:004043A8 C1E602 shl esi, 02 ->esi左移2;esi=esi<<2;

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404404(C)
|
:004043AB 0FBE440C50 movsx eax, byte ptr [esp+ecx+50] ->取机器码的第一位
:004043B0 03C6 add eax, esi ->eax=eax+esi
:004043B2 BD3E000000 mov ebp, 0000003E ->ebp=0x3E;
:004043B7 99 cdq ->edx清零
:004043B8 F7FD idiv ebp ->eax=eax/ebp,edx=eax%ebp
:004043BA 0FBE440C54 movsx eax, byte ptr [esp+ecx+54] ->取机器码第五位
:004043BF 03C6 add eax, esi ->eax=eax+esi
:004043C1 8A92E4704000 mov dl, byte ptr [edx+004070E4] ->eax求ebp得到的余数就是密码表中字符的位数
:004043C7 88540C30 mov byte ptr [esp+ecx+30], dl ->将取到的密码表中的字符保存
:004043CB 99 cdq
:004043CC F7FD idiv ebp | 算
:004043CE 8A82E4704000 mov al, byte ptr [edx+004070E4] | 法
:004043D4 88440C38 mov byte ptr [esp+ecx+38], al | 大
:004043D8 0FBE440C58 movsx eax, byte ptr [esp+ecx+58] | 都
:004043DD 03C6 add eax, esi | 相
:004043DF 99 cdq | 同
:004043E0 F7FD idiv ebp | 看
:004043E2 0FBE440C5C movsx eax, byte ptr [esp+ecx+5C] | 注
:004043E7 03C6 add eax, esi | 册
:004043E9 8A92E4704000 mov dl, byte ptr [edx+004070E4] | 机
:004043EF 88540C40 mov byte ptr [esp+ecx+40], dl | 源
:004043F3 99 cdq | 码
:004043F4 F7FD idiv ebp | 便知！
:004043F6 41 inc ecx ->ecx++;
:004043F7 83F904 cmp ecx, 00000004 ->比较ecx是否为4
:004043FA 8A82E4704000 mov al, byte ptr [edx+004070E4]
:00404400 88440C47 mov byte ptr [esp+ecx+47], al
:00404404 7CA5 jl 004043AB ->比如ecx<4则跳
=============================================================================================
* Reference To: MSVCRT.rand, Ord:02A6h
|
:00402758 FF15A8524000 Call dword ptr [004052A8]
:0040275E 8BD0 mov edx, eax
:00402760 83C9FF or ecx, FFFFFFFF
:00402763 0FAFD3 imul edx, ebx
:00402766 0FAFD7 imul edx, edi

* Possible StringData Ref from Data Obj ->"0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJ"
->"KLMNOPQRSTUVWXYZ" ->密码表
|
:00402769 BFE4704000 mov edi, 004070E4
:0040276E 33C0 xor eax, eax
:00402770 F2 repnz
:00402771 AE scasb
:00402772 F7D1 not ecx
:00402774 8BC2 mov eax, edx
:00402776 49 dec ecx
:00402777 33D2 xor edx, edx
:00402779 F7F1 div ecx
:0040277B 46 inc esi
:0040277C 83FE10 cmp esi, 00000010
:0040277F 8A82E4704000 mov al, byte ptr [edx+004070E4]
:00402785 88442EFF mov byte ptr [esi+ebp-01], al
:00402789 7CB2 jl 0040273D
:0040278B 8D4C2410 lea ecx, dword ptr [esp+10]
:0040278F 51 push ecx

* Possible StringData Ref from Data Obj ->"Software\Microsoft\BLUEReg"
|
:00402790 6820724000 push 00407220
:00402795 6802000080 push 80000002
==============================================================================================
以下为c++ builder 6.0的注册机源码！win98 SE、c++ builder 6.0下调试通过！
#include
#pragma hdrstop

#include "KeygenBox.h"
//---------------------------------------------------------------------------
#pragma package(smart_init)
#pragma resource "*.dfm"
TForm1 *Form1;
char key[]={'0','1','2','3','4','5','6','7','8','9','a','b',
'c','d','e','f','g','h','i','j','k','l','m','n',
'o','p','q','r','s','t','u','v','w','x','y','z',
'A','B','C','D','E','F','G','H','I','J','K','L',
'M','N','O','P','Q','R','S','T','U','V','W','X',
'Y','Z'};
String name,S1,S2,S3,S4;int a,b=1,ebp;
unsigned long esi,ea,eb,e1,e2,e3,e4;
char code1,code2,code3,code4;
//---------------------------------------------------------------------------
void __fastcall TForm1::OKBtnClick(TObject *Sender)
{
if(UEdit->Text=="") {Label2->Caption="未输入机器码！";return;}
if(UEdit->Text!="")
{
name=UEdit->Text;
a=UEdit->Text.Length();
if(a<16) {Label2->Caption="输入的机器码不正确";return;}
else
{
while(b<=4)
{
ea=3+3*4;
eb=ea+ea*4;
esi=(eb+eb*4)<<2;ebp=62;
e1=(name[b]+esi)%ebp;code1=key[e1];
b++;
CEdit->Text=CEdit->Text+code1;
}
S1=CEdit->Text;CEdit->Clear();
b=5;
while(b<=8)
{
ea=3+3*4;
eb=ea+ea*4;
esi=(eb+eb*4)<<2;ebp=62;
e2=(name[b]+esi)%ebp;code2=key[e2];
b++;
CEdit->Text=CEdit->Text+code2;
}
S2=CEdit->Text;CEdit->Clear();
b=9;
while(b<=12)
{
ea=3+3*4;
eb=ea+ea*4;
esi=(eb+eb*4)<<2;ebp=62;
e3=(name[b]+esi)%ebp;code3=key[e3];
b++;
CEdit->Text=CEdit->Text+code3;
}
S3=CEdit->Text;CEdit->Clear();
b=13;
while(b<=16)
{
ea=3+3*4;
eb=ea+ea*4;
esi=(eb+eb*4)<<2;ebp=62;
e4=(name[b]+esi)%ebp;code4=key[e4];
b++;
CEdit->Text=CEdit->Text+code4;
}
S4=CEdit->Text;CEdit->Clear();
CEdit->Text=CEdit->Text+S1+"-"+S2+"-"+S3+"-"+S4;
sndPlaySound(cuWavHandle,SND_MEMORY|SND_SYNC);
Label2->Caption="已经完成计算！";
}
}
}

文章评论

查看所有0条评论>>

热门文章 去除winrar注册框方法