您的位置：首页 → 精文荟萃 → 破解文章 → <<网站推广专家 V1.26>>专业版注册算法分析

<<网站推广专家 V1.26>>专业版注册算法分析

时间：2004/10/15 1:03:00来源：本站整理作者：蓝点我要评论(0)

　

目的：属技术交流，无其它目的，请不要任意散布或用用商业用途。初学破解,如有不对的地方欢迎批评指出。 工具：softice,w32Dasm,ollydbg,DeDe,Aspackdie1.3 试炼码： 机器码：A21401E1-282 用户名：lordor[BCG] 注册码：654321 来到这里： 00529D98  /.  55            PUSH EBP 00529D99  |.  8BEC          MOV EBP,ESP 00529D9B  |.  6A 00         PUSH 0 00529D9D  |.  6A 00         PUSH 0 00529D9F  |.  53            PUSH EBX 00529DA0  |.  8BD8          MOV EBX,EAX 00529DA2  |.  33C0          XOR EAX,EAX 00529DA4  |.  55            PUSH EBP 00529DA5  |.  68 D49E5200   PUSH unpacked.00529ED4 00529DAA  |.  64:FF30       PUSH DWORD PTR FS:[EAX] 00529DAD  |.  64:8920       MOV DWORD PTR FS:[EAX],ESP 00529DB0  |.  8D55 FC       LEA EDX,DWORD PTR SS:[EBP-4] 00529DB3  |.  8B83 E4020000 MOV EAX,DWORD PTR DS:[EBX+2E4] 00529DB9  |.  E8 9A85F0FF   CALL unpacked.00432358                   ;  取用户名unpa 00529DBE  |.  8B55 FC       MOV EDX,DWORD PTR SS:[EBP-4]             ;  用户名入edxDWOR 00529DC1  |.  B8 F0755800   MOV EAX,unpacked.005875F0 00529DC6  |.  E8 F19FEDFF   CALL unpacked.00403DBC 00529DCB  |.  8D55 F8       LEA EDX,DWORD PTR SS:[EBP-8] 00529DCE  |.  8B83 E8020000 MOV EAX,DWORD PTR DS:[EBX+2E8] 00529DD4  |.  E8 7F85F0FF   CALL unpacked.00432358                   ;  取注册码unpa 00529DD9  |.  8B55 F8       MOV EDX,DWORD PTR SS:[EBP-8]             ;  注册码入edxDWOR 00529DDC  |.  B8 F8755800   MOV EAX,unpacked.005875F8 00529DE1  |.  E8 D69FEDFF   CALL unpacked.00403DBC 00529DE6  |.  A1 2C985700   MOV EAX,DWORD PTR DS:[57982C] 00529DEB  |.  8B15 F0755800 MOV EDX,DWORD PTR DS:[5875F0]            ;  用户名入edxDWOR 00529DF1  |.  E8 C69FEDFF   CALL unpacked.00403DBC 00529DF6  |.  FF05 14765800 INC DWORD PTR DS:[587614] 00529DFC  |.  833D 14765800>CMP DWORD PTR DS:[587614],3 00529E03  |.  7E 0F         JLE SHORT unpacked.00529E14 00529E05  |.  C783 34020000>MOV DWORD PTR DS:[EBX+234],2 00529E0F  |.  E9 A5000000   JMP unpacked.00529EB9 00529E14  |>  A1 049C5700   MOV EAX,DWORD PTR DS:[579C04] 00529E19  |.  8B00          MOV EAX,DWORD PTR DS:[EAX] 00529E1B  |.  E8 982E0000   CALL unpacked.0052CCB8                   ;  关键call，F8进入 00529E20  |.  84C0          TEST AL,AL                               ;  成功标志AL,A 00529E22  |.  74 47         JE SHORT unpacked.00529E6B 00529E22  |. /74 47         JE SHORT unpacked.00529E6B 00529E24  |. |A1 949B5700   MOV EAX,DWORD PTR DS:[579B94] 00529E29  |. |C700 01000000 MOV DWORD PTR DS:[EAX],1 00529E2F  |. |A1 B0995700   MOV EAX,DWORD PTR DS:[5799B0] 00529E34  |. |C700 01000000 MOV DWORD PTR DS:[EAX],1 00529E3A  |. |8BC3          MOV EAX,EBX 00529E3C  |. |E8 83FEFFFF   CALL unpacked.00529CC4 00529E41  |. |A1 049C5700   MOV EAX,DWORD PTR DS:[579C04] 00529E46  |. |8B00          MOV EAX,DWORD PTR DS:[EAX] 00529E48  |. |8B80 08030000 MOV EAX,DWORD PTR DS:[EAX+308] 00529E4E  |. |33D2          XOR EDX,EDX 00529E50  |. |E8 FF8CF1FF   CALL unpacked.00442B54 00529E55  |. |A1 00765800   MOV EAX,DWORD PTR DS:[587600] 00529E5A  |. |E8 6DDEF2FF   CALL unpacked.00457CCC 00529E5F  |. |A1 E8755800   MOV EAX,DWORD PTR DS:[5875E8] 00529E64  |. |E8 DB38F2FF   CALL unpacked.0044D744 00529E69  |. |EB 4E         JMP SHORT unpacked.00529EB9 00529E6B  |> \A1 949B5700   MOV EAX,DWORD PTR DS:[579B94] 00529E70  |.  33D2          XOR EDX,EDX 00529E72  |.  8910          MOV DWORD PTR DS:[EAX],EDX ------------------------------------ 关键call: 0052CCB8  /$  55            PUSH EBP 0052CCB9  |.  8BEC          MOV EBP,ESP 0052CCBB  |.  B9 05000000   MOV ECX,5 0052CCC0  |>  6A 00         /PUSH 0 0052CCC2  |.  6A 00         |PUSH 0 0052CCC4  |.  49            |DEC ECX 0052CCC5  |.^ 75 F9         \JNZ SHORT unpacked.0052CCC0 0052CCC7  |.  53            PUSH EBX 0052CCC8  |.  56            PUSH ESI 0052CCC9  |.  57            PUSH EDI 0052CCCA  |.  33C0          XOR EAX,EAX 0052CCCC  |.  55            PUSH EBP 0052CCCD  |.  68 3BCF5200   PUSH unpacked.0052CF3B 0052CCD2  |.  64:FF30       PUSH DWORD PTR FS:[EAX] 0052CCD5  |.  64:8920       MOV DWORD PTR FS:[EAX],ESP 0052CCD8  |.  8D45 F0       LEA EAX,DWORD PTR SS:[EBP-10] 0052CCDB  |.  BA 54CF5200   MOV EDX,unpacked.0052CF54                ;  ASCII   "sef1sn8y3420dnu2ofps" 0052CCE0  |.  E8 1B71EDFF   CALL unpacked.00403E00 0052CCE5  |.  8D45 F4       LEA EAX,DWORD PTR SS:[EBP-C] 0052CCE8  |.  E8 7B70EDFF   CALL unpacked.00403D68 0052CCED  |.  8B15 309A5700 MOV EDX,DWORD PTR DS:[579A30]            ;  unpacked.005875F0 0052CCF3  |.  8B12          MOV EDX,DWORD PTR DS:[EDX]               ;  用户名入edxDWOR 0052CCF5  |.  8D45 EC       LEA EAX,DWORD PTR SS:[EBP-14] 0052CCF8  |.  8B0D 703C1301 MOV ECX,DWORD PTR DS:[1133C70]           ;  机器码入ecxDWOR 0052CCFE  |.  E8 3173EDFF   CALL unpacked.00404034                   ;  用户名＋机器码接起来，形成串A 0052CD03  |.  8B45 EC       MOV EAX,DWORD PTR SS:[EBP-14]            ;  A串入eax 0052CD06  |.  E8 DD72EDFF   CALL unpacked.00403FE8                   ;  串A的长度 0052CD0B  |.  A1 703C1301   MOV EAX,DWORD PTR DS:[1133C70]           ;  机器码入eax 0052CD10  |.  E8 D372EDFF   CALL unpacked.00403FE8                   ;  取机器码长度 0052CD15  |.  8BF0          MOV ESI,EAX 0052CD17  |.  85F6          TEST ESI,ESI 0052CD19  |.  0F8E B0000000 JLE unpacked.0052CDCF 0052CD1F  |.  BB 01000000   MOV EBX,1 0052CD24  |>  8D45 E8       /LEA EAX,DWORD PTR SS:[EBP-18] 0052CD27  |.  50            |PUSH EAX 0052CD28  |.  B9 01000000   |MOV ECX,1 0052CD2D  |.  8BD3          |MOV EDX,EBX 0052CD2F  |.  A1 703C1301   |MOV EAX,DWORD PTR DS:[1133C70]          ;  机器码入edx 0052CD34  |.  E8 B774EDFF   |CALL unpacked.004041F0                  ;  从机器码第ebx位开始取1位 004041F0 0052CD39  |.  8B45 E8       |MOV EAX,DWORD PTR SS:[EBP-18] 0052CD3C  |.  E8 6B74EDFF   |CALL unpacked.004041AC 0052CD41  |.  8BF8          |MOV EDI,EAX 0052CD43  |.  A1 309A5700   |MOV EAX,DWORD PTR DS:[579A30] 0052CD48  |.  8B00          |MOV EAX,DWORD PTR DS:[EAX]              ;  用户名入eax,DWO 0052CD4A  |.  E8 9972EDFF   |CALL unpacked.00403FE8                  ;  取长度L u 0052CD4F  |.  3BD8          |CMP EBX,EAX                             ;  与计数器比较X,EAX 0052CD51  |.  7F 23         |JG SHORT unpacked.0052CD76 0052CD53  |.  8D45 E4       |LEA EAX,DWORD PTR SS:[EBP-1C] 0052CD56  |.  50            |PUSH EAX 0052CD57  |.  A1 309A5700   |MOV EAX,DWORD PTR DS:[579A30] 0052CD5C  |.  8B00          |MOV EAX,DWORD PTR DS:[EAX]              ;  用户名入eax,DWO 0052CD5E  |.  B9 01000000   |MOV ECX,1 0052CD63  |.  8BD3          |MOV EDX,EBX 0052CD65  |.  E8 8674EDFF   |CALL unpacked.004041F0                  ;  从用户名第ebx位开始取1位 0052CD6A  |.  8B45 E4       |MOV EAX,DWORD PTR SS:[EBP-1C] 0052CD6D  |.  E8 3A74EDFF   |CALL unpacked.004041AC 0052CD72  |.  8BD0          |MOV EDX,EAX 0052CD74  |.  EB 1D         |JMP SHORT unpacked.0052CD93 0052CD76  |>  8D45 E0       |LEA EAX,DWORD PTR SS:[EBP-20] 0052CD79  |.  50            |PUSH EAX 0052CD7A  |.  B9 01000000   |MOV ECX,1 0052CD7F  |.  8BD3          |MOV EDX,EBX 0052CD81  |.  8B45 F0       |MOV EAX,DWORD PTR SS:[EBP-10] 0052CD84  |.  E8 6774EDFF   |CALL unpacked.004041F0 0052CD89  |.  8B45 E0       |MOV EAX,DWORD PTR SS:[EBP-20] 0052CD8C  |.  E8 1B74EDFF   |CALL unpacked.004041AC 0052CD91  |.  8BD0          |MOV EDX,EAX 0052CD93  |>  8A07          |MOV AL,BYTE PTR DS:[EDI]                ;  取得的一位机器入al 0052CD95  |.  8A12          |MOV DL,BYTE PTR DS:[EDX]                ;  取得的一位用户名dl 0052CD97  |.  3C 41         |CMP AL,41                               ;  机器码是否为字母A 0052CD99  |.  75 02         |JNZ SHORT unpacked.0052CD9D 0052CD9B  |.  B0 66         |MOV AL,66                               ;  如是字母A就用f代替al的值 0052CD9D  |>  8BF8          |MOV EDI,EAX 0052CD9F  |.  81E7 FF000000 |AND EDI,0FF 0052CDA5  |.  33C0          |XOR EAX,EAX 0052CDA7  |.  8AC2          |MOV AL,DL                               ;  一位用户名码入al 0052CDA9  |.  03F8          |ADD EDI,EAX                             ;  edi与eax相加，即1位机器码与1位用户名相加 0052CDAB  |.  03FB          |ADD EDI,EBX                             ;  再加计数器DI,EB 0052CDAD  |.  8D4D DC       |LEA ECX,DWORD PTR SS:[EBP-24] 0052CDB0  |.  BA 02000000   |MOV EDX,2 0052CDB5  |.  8BC7          |MOV EAX,EDI 0052CDB7  |.  E8 ECCDEDFF   |CALL unpacked.00409BA8                  ;  上面计算得到的数转换为字符. 0052CDBC  |.  8B55 DC       |MOV EDX,DWORD PTR SS:[EBP-24] 0052CDBF  |.  8D45 F8       |LEA EAX,DWORD PTR SS:[EBP-8] 0052CDC2  |.  E8 2972EDFF   |CALL unpacked.00403FF0                  ;  接起来形成串B 0052CDC7  |.  43            |INC EBX 0052CDC8  |.  4E            |DEC ESI 0052CDC9  |.^ 0F85 55FFFFFF \JNZ unpacked.0052CD24 0052CDCF  |> \8B45 F8       MOV EAX,DWORD PTR SS:[EBP-8] 0052CDD2  |.  E8 1172EDFF   CALL unpacked.00403FE8 0052CDD7  |.  8D45 FC       LEA EAX,DWORD PTR SS:[EBP-4] 0052CDDA  |.  8B55 F8       MOV EDX,DWORD PTR SS:[EBP-8] 0052CDDD  |.  E8 1E70EDFF   CALL unpacked.00403E00 0052CDE2  |.  8B45 FC       MOV EAX,DWORD PTR SS:[EBP-4] 0052CDE5  |.  E8 FE71EDFF   CALL unpacked.00403FE8 0052CDEA  |.  8BF0          MOV ESI,EAX 0052CDEC  |.  85F6          TEST ESI,ESI 0052CDEE  |.  0F8E F6000000 JLE unpacked.0052CEEA 0052CDF4  |.  BB 01000000   MOV EBX,1 0052CDF9  |>  8B45 FC       /MOV EAX,DWORD PTR SS:[EBP-4]            ;  串B入eaxX, 0052CDFC  |.  807C18 FF 41  |CMP BYTE PTR DS:[EAX+EBX-1],41          ;  是否为ABYT 0052CE01  |.  75 0D         |JNZ SHORT unpacked.0052CE10 0052CE03  |.  8D45 FC       |LEA EAX,DWORD PTR SS:[EBP-4] 0052CE06  |.  E8 AD73EDFF   |CALL unpacked.004041B8 0052CE0B  |.  C64418 FF 4D  |MOV BYTE PTR DS:[EAX+EBX-1],4D          ;  用M代替A 0052CE10  |>  8B45 FC       |MOV EAX,DWORD PTR SS:[EBP-4]            ;  串B入eaxX, 0052CE13  |.  807C18 FF 31  |CMP BYTE PTR DS:[EAX+EBX-1],31          ;  是否为1BYT 0052CE18  |.  75 0D         |JNZ SHORT unpacked.0052CE27 0052CE1A  |.  8D45 FC       |LEA EAX,DWORD PTR SS:[EBP-4] 0052CE1D  |.  E8 9673EDFF   |CALL unpacked.004041B8 0052CE22  |.  C64418 FF 4F  |MOV BYTE PTR DS:[EAX+EBX-1],4F 0052CE27  |>  8B45 FC       |MOV EAX,DWORD PTR SS:[EBP-4]            ;  串B入eaxX, 0052CE2A  |.  807C18 FF 32  |CMP BYTE PTR DS:[EAX+EBX-1],32          ;  是否为2BYT 0052CE2F  |.  75 0D         |JNZ SHORT unpacked.0052CE3E 0052CE31  |.  8D45 FC       |LEA EAX,DWORD PTR SS:[EBP-4] 0052CE34  |.  E8 7F73EDFF   |CALL unpacked.004041B8 0052CE39  |.  C64418 FF 33  |MOV BYTE PTR DS:[EAX+EBX-1],33 0052CE3E  |>  8B45 FC       |MOV EAX,DWORD PTR SS:[EBP-4]            ;  串B入eaxX, 0052CE41  |.  807C18 FF 72  |CMP BYTE PTR DS:[EAX+EBX-1],72          ;  是否为rBYT 0052CE46  |.  75 0D         |JNZ SHORT unpacked.0052CE55 0052CE48  |.  8D45 FC       |LEA EAX,DWORD PTR SS:[EBP-4] 0052CE4B  |.  E8 6873EDFF   |CALL unpacked.004041B8 0052CE50  |.  C64418 FF 37  |MOV BYTE PTR DS:[EAX+EBX-1],37 0052CE55  |>  8B45 FC       |MOV EAX,DWORD PTR SS:[EBP-4]            ;  串B入eaxX, 0052CE58  |.  807C18 FF 34  |CMP BYTE PTR DS:[EAX+EBX-1],34          ;  是否为4 0052CE5D  |.  75 0D         |JNZ SHORT unpacked.0052CE6C 0052CE5F  |.  8D45 FC       |LEA EAX,DWORD PTR SS:[EBP-4] 0052CE62  |.  E8 5173EDFF   |CALL unpacked.004041B8 0052CE67  |.  C64418 FF 4A  |MOV BYTE PTR DS:[EAX+EBX-1],4A 0052CE6C  |>  8B45 FC       |MOV EAX,DWORD PTR SS:[EBP-4]            ;  串B入eaxX, 0052CE6F  |.  807C18 FF 35  |CMP BYTE PTR DS:[EAX+EBX-1],35          ;  是否为5 0052CE74  |.  75 0D         |JNZ SHORT unpacked.0052CE83 0052CE76  |.  8D45 FC       |LEA EAX,DWORD PTR SS:[EBP-4] 0052CE79  |.  E8 3A73EDFF   |CALL unpacked.004041B8 0052CE7E  |.  C64418 FF 36  |MOV BYTE PTR DS:[EAX+EBX-1],36 0052CE83  |>  8B45 FC       |MOV EAX,DWORD PTR SS:[EBP-4]            ;  串B入eaxX, 0052CE86  |.  807C18 FF 38  |CMP BYTE PTR DS:[EAX+EBX-1],38          ;  是否为8 0052CE8B  |.  75 0D         |JNZ SHORT unpacked.0052CE9A 0052CE8D  |.  8D45 FC       |LEA EAX,DWORD PTR SS:[EBP-4] 0052CE90  |.  E8 2373EDFF   |CALL unpacked.004041B8 0052CE95  |.  C64418 FF 44  |MOV BYTE PTR DS:[EAX+EBX-1],44 0052CE9A  |>  8B45 FC       |MOV EAX,DWORD PTR SS:[EBP-4]            ;  串B入eaxX, 0052CE9D  |.  807C18 FF 30  |CMP BYTE PTR DS:[EAX+EBX-1],30          ;  是否为0 0052CEA2  |.  75 0D         |JNZ SHORT unpacked.0052CEB1 0052CEA4  |.  8D45 FC       |LEA EAX,DWORD PTR SS:[EBP-4] 0052CEA7  |.  E8 0C73EDFF   |CALL unpacked.004041B8 0052CEAC  |.  C64418 FF 4D  |MOV BYTE PTR DS:[EAX+EBX-1],4D 0052CEB1  |>  8B45 FC       |MOV EAX,DWORD PTR SS:[EBP-4]            ;  串B入eaxX, 0052CEB4  |.  807C18 FF 45  |CMP BYTE PTR DS:[EAX+EBX-1],45          ;  是否E B 0052CEB9  |.  75 0D         |JNZ SHORT unpacked.0052CEC8 0052CEBB  |.  8D45 FC       |LEA EAX,DWORD PTR SS:[EBP-4] 0052CEBE  |.  E8 F572EDFF   |CALL unpacked.004041B8 0052CEC3  |.  C64418 FF 44  |MOV BYTE PTR DS:[EAX+EBX-1],44 0052CEC8  |>  8D45 D8       |LEA EAX,DWORD PTR SS:[EBP-28] 0052CECB  |.  8B55 FC       |MOV EDX,DWORD PTR SS:[EBP-4]            ;  串B入edxX, 0052CECE  |.  8A541A FF     |MOV DL,BYTE PTR DS:[EDX+EBX-1]          ;  取1位串B入dl 0052CED2  |.  E8 3970EDFF   |CALL unpacked.00403F10 0052CED7  |.  8B55 D8       |MOV EDX,DWORD PTR SS:[EBP-28] 0052CEDA  |.  8D45 F4       |LEA EAX,DWORD PTR SS:[EBP-C] 0052CEDD  |.  E8 0E71EDFF   |CALL unpacked.00403FF0 0052CEE2  |.  43            |INC EBX 0052CEE3  |.  4E            |DEC ESI 0052CEE4  |.^ 0F85 0FFFFFFF \JNZ unpacked.0052CDF9 0052CEEA  |> \A1 C09A5700   MOV EAX,DWORD PTR DS:[579AC0] 0052CEEF  |.  8B00          MOV EAX,DWORD PTR DS:[EAX]               ;  注册码入eaxDWOR 0052CEF1  |.  8B55 F4       MOV EDX,DWORD PTR SS:[EBP-C]             ;  真码入edx 0052CEF4  |.  E8 FF71EDFF   CALL unpacked.004040F8                   ;  关键比较unpa 0052CEF9  |. /75 23         JNZ SHORT unpacked.0052CF1E              ;  不等则跳 ------------------------------------------- 总结　： 　　机器码与用户名运算产生串A，再到串A进行置换得串B，用串B与输入的注册码比较，如相等，则显示注册正确。 注册信息保存在： [HKEY_USERS\.DEFAULT\Software\Osb\Demo] "Name"="lordor[BCG]" "Pass"="D3M3M69CMJM9M77B79D3MM6D" 机器码：A21401E1-282 用户名：lordor[BCG] 注册码：D3M3M69CMJM9M77B79D3MM6D

　　　　
　　　　
　　　　　
　　　　
　　　　
　　　　　

相关阅读 Windows错误代码大全 Windows错误代码查询激活windows有什么用Mac QQ和Windows QQ聊天记录怎么合并 Mac QQ和Windows QQ聊天记录Windows 10自动更新怎么关闭 如何关闭Windows 10自动更新windows 10 rs4快速预览版17017下载错误问题Win10秋季创意者更新16291更新了什么 win10 16291更新内容windows10秋季创意者更新时间 windows10秋季创意者更新内容kb3150513补丁更新了什么 Windows 10补丁kb3150513是什么

文章评论

查看所有0条评论>>

发表评论

我来说两句...

提交评论