HappyTown第8个CrackMe算法分析及注册机
【文章标题】: HappyTown第8个CrackMe算法分析及注册机【文章作者】: dewar
【作者邮箱】: [email protected]
【软件名称】: HappyTown第8个CrackMe
【下载地址】: 自己搜索下载
【加壳方式】: 简单壳
【保护方式】: 注册码
【编写语言】: Borland Delphi
【使用工具】: OD
【操作平台】: WINXP
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
今天吃完晚饭没什么事做,顺便就把happytown的第8个CrackMe分析了一下,于是便有了下面的一些字.算是自己的学习笔记吧.没什么技术含量,高手勿笑,如果你不小心看完了本文还请指出其中的错误,也好让我多学一点东东.
感觉每做一个happytown的CrackMe都能学到一些东东,这里表示感谢~!
1.PEID查壳,"什么也没发现",看来有问题.于是手动脱之,壳很简单,这里就不啰嗦了.脱完之后不用修复,可直接运行,再用PEID查壳,深度扫描,发现是Borland Delphi 6.0 - 7.0写的程序.
2.OD载入脱壳后的文件.查找字符串参考,没什么有价值的发现;bp GetDlgItemTextA 和 bp GetWindowTextA下断,输入用户名和注册码后点Check均无反应;试了N种断点,还是没找到突破口;我狂晕,没办法看来只有请出"万能断点了",先取消原来所有的断点,点"插件"==>"ApiBreak"==>"Api断点"==>选"万能断点"==>勾上"万能断点"==>确定.然后输好相关信息后点Check,立马断在了下面的地方.
......
77D3353D F3:A5 REP MOVS DWORD PTR ES:, DWORD P> ;<==断在这里
77D3353F 8BC8 MOV ECX, EAX
77D33541 83E1 03 AND ECX, 3
77D33544 F3:A4 REP MOVS BYTE PTR ES:, BYTE PTR>
77D33546 E8 E3FBFFFF CALL 77D3312E
77D3354B 5F POP EDI
77D3354C 5E POP ESI
77D3354D 8BC3 MOV EAX, EBX
77D3354F 5B POP EBX
77D33550 5D POP EBP
77D33551 C2 1000 RETN 10
......
这里是系统领空,我的研究还没有深入到这一步,没有能力动它^_^,那就Alt+F9返回用户代码吧.
......
00437DD8|.8943 0C MOV DWORD PTR DS:, EAX ;<==返回在这里
00437DDB|>8B03 MOV EAX, DWORD PTR DS:
00437DDD|.83F8 0C CMP EAX, 0C
00437DE0|.75 1B JNZ SHORT 00437DFD
00437DE2|.8B53 08 MOV EDX, DWORD PTR DS:
00437DE5|.52 PUSH EDX ; /Arg1
00437DE6|.8B4B 04 MOV ECX, DWORD PTR DS: ; |
00437DE9|.8BD0 MOV EDX, EAX ; |
00437DEB|.8BC6 MOV EAX, ESI ; |
00437DED|.E8 56B7FFFF CALL 00433548 ; \CrackMe_.00433548
00437DF2|.EB 09 JMP SHORT 00437DFD
00437DF4|>8BD3 MOV EDX, EBX
00437DF6|.8BC6 MOV EAX, ESI
00437DF8|.E8 B3CFFFFF CALL 00434DB0
00437DFD|>5D POP EBP
00437DFE|.5F POP EDI
00437DFF|.5E POP ESI
00437E00|.5B POP EBX
00437E01\.C3 RETN
......
返回后先禁用刚才的断点.跟了一下,不是关键的地方,继续跟下去,让它一路返回.
......
0045538B|.8D55 FC LEA EDX, DWORD PTR SS:
0045538E|.8B87 04030000 MOV EAX, DWORD PTR DS:
00455394|.E8 0FE6FDFF CALL 004339A8 ;获得用户名
00455399|.BA 04000000 MOV EDX, 4 ;<==最后返回到这里
最后返回到00455399处,这时我们在堆栈中可发现自己输入的用户名,看来上一个函数应该是获得用户名的了.有眉目了^_^,继续跟吧.
0045539E|.8B45 FC MOV EAX, DWORD PTR SS: ;取得用户名长度
004553A1|.E8 CEFAFFFF CALL 00454E74 ;跟进去,发现是根据用户名长度设置标志,长度≤4就置0,否则置1
004553A6|.803B 00 CMP BYTE PTR DS:, 0 ;比较标志是否为0
004553A9|.0F84 AD050000 JE 0045595C ;是就跳向失败
004553AF|.BA 10000000 MOV EDX, 10 ;否则,继续
004553B4|.8B45 FC MOV EAX, DWORD PTR SS: ;同样是取用户名长度
004553B7|.E8 18FBFFFF CALL 00454ED4 ;跟进去,发现是根据用户名长度设置标志,长度≥16就置0,否则置1
004553BC|.803B 00 CMP BYTE PTR DS:, 0 ;比较标志位是否为0
004553BF|.0F84 97050000 JE 0045595C ;是就跳向失败
看来用户名长度只能在5~15之间才行.
004553C5|.8D55 F4 LEA EDX, DWORD PTR SS: ;否则,继续
004553C8|.8B87 0C030000 MOV EAX, DWORD PTR DS:
004553CE|.E8 D5E5FDFF CALL 004339A8 ;获得注册码
004553D3|.BA 0C000000 MOV EDX, 0C
004553D8|.8B45 F4 MOV EAX, DWORD PTR SS:
004553DB|.E8 54FBFFFF CALL 00454F34 ;根据输入的注册码的长度置标志,长度不是12就置0,否则置1
004553E0|.803B 00 CMP BYTE PTR DS:, 0 ;比较标志是否为0
004553E3|.0F84 73050000 JE 0045595C ;是就跳向失败
看来注册码长度只能是12位的.
004553E9|.8D45 F8 LEA EAX, DWORD PTR SS: ;不是就继续
004553EC|.50 PUSH EAX
004553ED|.B9 06000000 MOV ECX, 6
004553F2|.BA 01000000 MOV EDX, 1
004553F7|.8B06 MOV EAX, DWORD PTR DS: ;固定字符串
固定字符串为'ORACLE-BenQ-HP-IBM-SIEMENS-CISCO SYSTEMS-intel-Sun-DELL-SYBASE-Maxtor-lenovo',看来注册码的计算和它有关系^_^
004553F9|.E8 76EFFAFF CALL 00404374 ;从第1位起,共取6位,得'ORACLE'
004553FE|.8B45 F8 MOV EAX, DWORD PTR SS:
00455401 E8 AEF8FFFF CALL 00454CB4 ;取得字串的ASCII码之和,得A
00455406|.50 PUSH EAX
00455407|.8B45 FC MOV EAX, DWORD PTR SS:
0045540A|.E8 A5F8FFFF CALL 00454CB4 ;用户名的ASCII码之和,得B
0045540F|.5A POP EDX
00455410|.E8 47FAFFFF CALL 00454E5C ;B异或A,得C
00455415|.BA 0A000000 MOV EDX, 0A
0045541A|.E8 45FAFFFF CALL 00454E64 ;C除以10,取余数,得D
0045541F|.8D55 F0 LEA EDX, DWORD PTR SS:
00455422|.E8 F928FBFF CALL 00407D20 ;取D的ASCII码
00455427|.8D45 EC LEA EAX, DWORD PTR SS:
0045542A|.50 PUSH EAX
0045542B|.B9 01000000 MOV ECX, 1
00455430|.BA 01000000 MOV EDX, 1
00455435|.8B45 F4 MOV EAX, DWORD PTR SS: ;注册码
00455438|.E8 37EFFAFF CALL 00404374 ;取注册码第1位的ASCII码
0045543D|.8B55 F0 MOV EDX, DWORD PTR SS: ;D的ASCII码
00455440|.8B45 EC MOV EAX, DWORD PTR SS: ;注册码第1位的ASCII码
00455443|.E8 4CFBFFFF CALL 00454F94 ;比较两个ASCII码,相等标志置1,否则置0
00455448|.803B 00 CMP BYTE PTR DS:, 0 ;标志与0比较
0045544B 0F84 0B050000 JE 0045595C ;是0就跳向失败
第1位注册码就应该是余数D了,加油,马上就会知道真相了~~!!
00455451|.8D45 F8 LEA EAX, DWORD PTR SS: ;否则继续
00455454|.50 PUSH EAX
00455455|.B9 04000000 MOV ECX, 4
0045545A|.BA 08000000 MOV EDX, 8
0045545F|.8B06 MOV EAX, DWORD PTR DS: ;固定字符串
00455461|.E8 0EEFFAFF CALL 00404374 ;从第8位起,共取4位,得'BenQ'
00455466|.8B45 F8 MOV EAX, DWORD PTR SS:
00455469|.E8 46F8FFFF CALL 00454CB4 ;'BenQ'ASCII码之和
0045546E|.50 PUSH EAX
0045546F|.8B45 FC MOV EAX, DWORD PTR SS:
00455472|.E8 3DF8FFFF CALL 00454CB4 ;用户名ASCII码之和
00455477|.5A POP EDX
00455478|.E8 E3F9FFFF CALL 00454E60 ;相与
0045547D|.BA 0A000000 MOV EDX, 0A
00455482|.E8 DDF9FFFF CALL 00454E64 ;相与结果除以10,取余数
00455487|.8D55 F0 LEA EDX, DWORD PTR SS:
0045548A|.E8 9128FBFF CALL 00407D20 ;余数的ASCII码
第2位注册码,嘿嘿~~~~
0045548F|.8D45 EC LEA EAX, DWORD PTR SS:
00455492|.50 PUSH EAX
00455493|.B9 01000000 MOV ECX, 1
00455498|.BA 02000000 MOV EDX, 2
0045549D|.8B45 F4 MOV EAX, DWORD PTR SS:
004554A0|.E8 CFEEFAFF CALL 00404374 ;注册码第2位
004554A5|.8B55 F0 MOV EDX, DWORD PTR SS:
004554A8|.8B45 EC MOV EAX, DWORD PTR SS:
004554AB|.E8 E4FAFFFF CALL 00454F94 ;两数必须相等
004554B0|.803B 00 CMP BYTE PTR DS:, 0
004554B3 0F84 A3040000 JE 0045595C
004554B9|.8D45 F8 LEA EAX, DWORD PTR SS:
004554BC|.50 PUSH EAX
004554BD|.B9 02000000 MOV ECX, 2
004554C2|.BA 0D000000 MOV EDX, 0D
004554C7|.8B06 MOV EAX, DWORD PTR DS:
004554C9|.E8 A6EEFAFF CALL 00404374 ;取得字串'HP'
004554CE|.8B45 F8 MOV EAX, DWORD PTR SS:
004554D1|.E8 DEF7FFFF CALL 00454CB4 ;'HP'ASCII之和
004554D6|.50 PUSH EAX
004554D7|.8B45 FC MOV EAX, DWORD PTR SS:
004554DA|.E8 D5F7FFFF CALL 00454CB4 ;用户名ASCII码之和
004554DF|.5A POP EDX
004554E0|.E8 7BF9FFFF CALL 00454E60 ;相与
004554E5|.BA 0A000000 MOV EDX, 0A
004554EA|.E8 75F9FFFF CALL 00454E64 ;相与结果除以10,取余数
第3位了........看来注册码的计算都是如上所述,依葫芦画瓢,便可全部得出.只是除数有变化(10/7/9三种情况),逻辑运算有两种情况(异或、与）看下面的代码便知......
004554EF|.8D55 F0 LEA EDX, DWORD PTR SS:
004554F2|.E8 2928FBFF CALL 00407D20
004554F7|.8D45 EC LEA EAX, DWORD PTR SS:
004554FA|.50 PUSH EAX
004554FB|.B9 01000000 MOV ECX, 1
00455500|.BA 03000000 MOV EDX, 3
00455505|.8B45 F4 MOV EAX, DWORD PTR SS:
00455508|.E8 67EEFAFF CALL 00404374 ;注册码第3位
0045550D|.8B55 F0 MOV EDX, DWORD PTR SS:
00455510|.8B45 EC MOV EAX, DWORD PTR SS:
00455513|.E8 7CFAFFFF CALL 00454F94 ;两数必须相等
00455518|.803B 00 CMP BYTE PTR DS:, 0
0045551B 0F84 3B040000 JE 0045595C
00455521|.8D45 F8 LEA EAX, DWORD PTR SS:
00455524|.50 PUSH EAX
00455525|.B9 03000000 MOV ECX, 3
0045552A|.BA 10000000 MOV EDX, 10
0045552F|.8B06 MOV EAX, DWORD PTR DS:
00455531|.E8 3EEEFAFF CALL 00404374 ;'IBM'
00455536|.8B45 F8 MOV EAX, DWORD PTR SS:
00455539|.E8 76F7FFFF CALL 00454CB4
0045553E|.50 PUSH EAX
0045553F|.8B45 FC MOV EAX, DWORD PTR SS:
00455542|.E8 6DF7FFFF CALL 00454CB4
00455547|.5A POP EDX
00455548|.E8 0FF9FFFF CALL 00454E5C ;异或
0045554D|.BA 0A000000 MOV EDX, 0A ;/10
00455552|.E8 0DF9FFFF CALL 00454E64
00455557|.8D55 F0 LEA EDX, DWORD PTR SS:
0045555A|.E8 C127FBFF CALL 00407D20
0045555F|.8D45 EC LEA EAX, DWORD PTR SS:
00455562|.50 PUSH EAX
00455563|.B9 01000000 MOV ECX, 1
00455568|.BA 04000000 MOV EDX, 4
0045556D|.8B45 F4 MOV EAX, DWORD PTR SS:
00455570|.E8 FFEDFAFF CALL 00404374 ;注册码第4位
00455575|.8B55 F0 MOV EDX, DWORD PTR SS:
00455578|.8B45 EC MOV EAX, DWORD PTR SS:
0045557B|.E8 14FAFFFF CALL 00454F94
00455580|.803B 00 CMP BYTE PTR DS:, 0
00455583 0F84 D3030000 JE 0045595C
00455589|.8D45 F8 LEA EAX, DWORD PTR SS:
0045558C|.50 PUSH EAX
0045558D|.B9 07000000 MOV ECX, 7
00455592|.BA 14000000 MOV EDX, 14
00455597|.8B06 MOV EAX, DWORD PTR DS:
00455599|.E8 D6EDFAFF CALL 00404374 ;'SIEMENS'
0045559E|.8B45 F8 MOV EAX, DWORD PTR SS:
004555A1|.E8 0EF7FFFF CALL 00454CB4
004555A6|.50 PUSH EAX
004555A7|.8B45 FC MOV EAX, DWORD PTR SS:
004555AA|.E8 05F7FFFF CALL 00454CB4
004555AF|.5A POP EDX
004555B0|.E8 A7F8FFFF CALL 00454E5C ;异或
004555B5|.BA 07000000 MOV EDX, 7
004555BA|.E8 A5F8FFFF CALL 00454E64 ;/7
004555BF|.8D55 F0 LEA EDX, DWORD PTR SS:
004555C2|.E8 5927FBFF CALL 00407D20
004555C7|.8D45 EC LEA EAX, DWORD PTR SS:
004555CA|.50 PUSH EAX
004555CB|.B9 01000000 MOV ECX, 1
004555D0|.BA 05000000 MOV EDX, 5
004555D5|.8B45 F4 MOV EAX, DWORD PTR SS:
004555D8|.E8 97EDFAFF CALL 00404374 ;注册码第5位
004555DD|.8B55 F0 MOV EDX, DWORD PTR SS:
004555E0|.8B45 EC MOV EAX, DWORD PTR SS:
004555E3|.E8 ACF9FFFF CALL 00454F94
004555E8|.803B 00 CMP BYTE PTR DS:, 0
004555EB 0F84 6B030000 JE 0045595C
004555F1|.8D45 F8 LEA EAX, DWORD PTR SS:
004555F4|.50 PUSH EAX
004555F5|.B9 0D000000 MOV ECX, 0D
004555FA|.BA 1C000000 MOV EDX, 1C
004555FF|.8B06 MOV EAX, DWORD PTR DS:
00455601|.E8 6EEDFAFF CALL 00404374 ;'CISCO SYSTEMS'
00455606|.8B45 F8 MOV EAX, DWORD PTR SS:
00455609|.E8 A6F6FFFF CALL 00454CB4
0045560E|.50 PUSH EAX
0045560F|.8B45 FC MOV EAX, DWORD PTR SS:
00455612|.E8 9DF6FFFF CALL 00454CB4
00455617|.5A POP EDX
00455618|.E8 43F8FFFF CALL 00454E60 ;相与
0045561D|.BA 09000000 MOV EDX, 9
00455622|.E8 3DF8FFFF CALL 00454E64 ;/9
00455627|.8D55 F0 LEA EDX, DWORD PTR SS:
0045562A|.E8 F126FBFF CALL 00407D20
0045562F|.8D45 EC LEA EAX, DWORD PTR SS:
00455632|.50 PUSH EAX
00455633|.B9 01000000 MOV ECX, 1
00455638|.BA 06000000 MOV EDX, 6
0045563D|.8B45 F4 MOV EAX, DWORD PTR SS:
00455640|.E8 2FEDFAFF CALL 00404374 ;注册码第6位
00455645|.8B55 F0 MOV EDX, DWORD PTR SS:
00455648|.8B45 EC MOV EAX, DWORD PTR SS:
0045564B|.E8 44F9FFFF CALL 00454F94
00455650|.803B 00 CMP BYTE PTR DS:, 0
00455653 0F84 03030000 JE 0045595C
00455659|.8D45 F8 LEA EAX, DWORD PTR SS:
0045565C|.50 PUSH EAX
0045565D|.B9 05000000 MOV ECX, 5
00455662|.BA 2A000000 MOV EDX, 2A
00455667|.8B06 MOV EAX, DWORD PTR DS:
00455669|.E8 06EDFAFF CALL 00404374 ;'intel'
0045566E|.8B45 F8 MOV EAX, DWORD PTR SS:
00455671|.E8 3EF6FFFF CALL 00454CB4
00455676|.50 PUSH EAX
00455677|.8B45 FC MOV EAX, DWORD PTR SS:
0045567A|.E8 35F6FFFF CALL 00454CB4
0045567F|.5A POP EDX
00455680|.E8 DBF7FFFF CALL 00454E60 ;相与
00455685|.BA 0A000000 MOV EDX, 0A ;/10
0045568A|.E8 D5F7FFFF CALL 00454E64
0045568F|.8D55 F0 LEA EDX, DWORD PTR SS:
00455692|.E8 8926FBFF CALL 00407D20
00455697|.8D45 EC LEA EAX, DWORD PTR SS:
0045569A|.50 PUSH EAX
0045569B|.B9 01000000 MOV ECX, 1
004556A0|.BA 07000000 MOV EDX, 7
004556A5|.8B45 F4 MOV EAX, DWORD PTR SS:
004556A8|.E8 C7ECFAFF CALL 00404374 ;注册码第7位
004556AD|.8B55 F0 MOV EDX, DWORD PTR SS:
004556B0|.8B45 EC MOV EAX, DWORD PTR SS:
004556B3|.E8 DCF8FFFF CALL 00454F94
004556B8|.803B 00 CMP BYTE PTR DS:, 0
004556BB 0F84 9B020000 JE 0045595C
004556C1|.8D45 F8 LEA EAX, DWORD PTR SS:
004556C4|.50 PUSH EAX
004556C5|.B9 03000000 MOV ECX, 3
004556CA|.BA 30000000 MOV EDX, 30
004556CF|.8B06 MOV EAX, DWORD PTR DS:
004556D1|.E8 9EECFAFF CALL 00404374 ;'Sun'
004556D6|.8B45 F8 MOV EAX, DWORD PTR SS:
004556D9|.E8 D6F5FFFF CALL 00454CB4
004556DE|.50 PUSH EAX
004556DF|.8B45 FC MOV EAX, DWORD PTR SS:
004556E2|.E8 CDF5FFFF CALL 00454CB4
004556E7|.5A POP EDX
004556E8|.E8 6FF7FFFF CALL 00454E5C ;异或
004556ED|.BA 09000000 MOV EDX, 9
004556F2|.E8 6DF7FFFF CALL 00454E64 ;/9
004556F7|.8D55 F0 LEA EDX, DWORD PTR SS:
004556FA|.E8 2126FBFF CALL 00407D20
004556FF|.8D45 EC LEA EAX, DWORD PTR SS:
00455702|.50 PUSH EAX
00455703|.B9 01000000 MOV ECX, 1
00455708|.BA 08000000 MOV EDX, 8
0045570D|.8B45 F4 MOV EAX, DWORD PTR SS:
00455710|.E8 5FECFAFF CALL 00404374 ;注册码第8位
00455715|.8B55 F0 MOV EDX, DWORD PTR SS:
00455718|.8B45 EC MOV EAX, DWORD PTR SS:
0045571B|.E8 74F8FFFF CALL 00454F94
00455720|.803B 00 CMP BYTE PTR DS:, 0
00455723 0F84 33020000 JE 0045595C
00455729|.8D45 F8 LEA EAX, DWORD PTR SS:
0045572C|.50 PUSH EAX
0045572D|.B9 04000000 MOV ECX, 4
00455732|.BA 34000000 MOV EDX, 34
00455737|.8B06 MOV EAX, DWORD PTR DS:
00455739|.E8 36ECFAFF CALL 00404374 ;'DELL'
0045573E|.8B45 F8 MOV EAX, DWORD PTR SS:
00455741|.E8 6EF5FFFF CALL 00454CB4
00455746|.50 PUSH EAX
00455747|.8B45 FC MOV EAX, DWORD PTR SS:
0045574A|.E8 65F5FFFF CALL 00454CB4
0045574F|.5A POP EDX
00455750|.E8 07F7FFFF CALL 00454E5C ;异或
00455755|.BA 07000000 MOV EDX, 7
0045575A|.E8 05F7FFFF CALL 00454E64 ;/7
0045575F|.8D55 F0 LEA EDX, DWORD PTR SS:
00455762|.E8 B925FBFF CALL 00407D20
00455767|.8D45 EC LEA EAX, DWORD PTR SS:
0045576A|.50 PUSH EAX
0045576B|.B9 01000000 MOV ECX, 1
00455770|.BA 09000000 MOV EDX, 9
00455775|.8B45 F4 MOV EAX, DWORD PTR SS:
00455778|.E8 F7EBFAFF CALL 00404374 ;注册码第9位
0045577D|.8B55 F0 MOV EDX, DWORD PTR SS:
00455780|.8B45 EC MOV EAX, DWORD PTR SS:
00455783|.E8 0CF8FFFF CALL 00454F94
00455788|.803B 00 CMP BYTE PTR DS:, 0
0045578B 0F84 CB010000 JE 0045595C
00455791|.8D45 F8 LEA EAX, DWORD PTR SS:
00455794|.50 PUSH EAX
00455795|.B9 06000000 MOV ECX, 6
0045579A|.BA 39000000 MOV EDX, 39
0045579F|.8B06 MOV EAX, DWORD PTR DS:
004557A1|.E8 CEEBFAFF CALL 00404374 ;'SYBASE'
004557A6|.8B45 F8 MOV EAX, DWORD PTR SS:
004557A9|.E8 06F5FFFF CALL 00454CB4
004557AE|.50 PUSH EAX
004557AF|.8B45 FC MOV EAX, DWORD PTR SS:
004557B2|.E8 FDF4FFFF CALL 00454CB4
004557B7|.5A POP EDX
004557B8|.E8 9FF6FFFF CALL 00454E5C ;异或
004557BD|.BA 0A000000 MOV EDX, 0A
004557C2|.E8 9DF6FFFF CALL 00454E64 ;/10
004557C7|.8D55 F0 LEA EDX, DWORD PTR SS:
004557CA|.E8 5125FBFF CALL 00407D20
004557CF|.8D45 EC LEA EAX, DWORD PTR SS:
004557D2|.50 PUSH EAX
004557D3|.B9 01000000 MOV ECX, 1
004557D8|.BA 0A000000 MOV EDX, 0A
004557DD|.8B45 F4 MOV EAX, DWORD PTR SS:
004557E0|.E8 8FEBFAFF CALL 00404374 ;注册码第10位
004557E5|.8B55 F0 MOV EDX, DWORD PTR SS:
004557E8|.8B45 EC MOV EAX, DWORD PTR SS:
004557EB|.E8 A4F7FFFF CALL 00454F94
004557F0|.803B 00 CMP BYTE PTR DS:, 0
004557F3 0F84 63010000 JE 0045595C
004557F9|.8D45 F8 LEA EAX, DWORD PTR SS:
004557FC|.50 PUSH EAX
004557FD|.B9 06000000 MOV ECX, 6
00455802|.BA 40000000 MOV EDX, 40
00455807|.8B06 MOV EAX, DWORD PTR DS:
00455809|.E8 66EBFAFF CALL 00404374 ;'Maxtor'
0045580E|.8B45 F8 MOV EAX, DWORD PTR SS:
00455811|.E8 9EF4FFFF CALL 00454CB4
00455816|.50 PUSH EAX
00455817|.8B45 FC MOV EAX, DWORD PTR SS:
0045581A|.E8 95F4FFFF CALL 00454CB4
0045581F|.5A POP EDX
00455820|.E8 3BF6FFFF CALL 00454E60 ;相与
00455825|.BA 0A000000 MOV EDX, 0A
0045582A|.E8 35F6FFFF CALL 00454E64 ;/10
0045582F|.8D55 F0 LEA EDX, DWORD PTR SS:
00455832|.E8 E924FBFF CALL 00407D20
00455837|.8D45 EC LEA EAX, DWORD PTR SS:
0045583A|.50 PUSH EAX
0045583B|.B9 01000000 MOV ECX, 1
00455840|.BA 0B000000 MOV EDX, 0B
00455845|.8B45 F4 MOV EAX, DWORD PTR SS:
00455848|.E8 27EBFAFF CALL 00404374 ;注册码第11位
0045584D|.8B55 F0 MOV EDX, DWORD PTR SS:
00455850|.8B45 EC MOV EAX, DWORD PTR SS:
00455853|.E8 3CF7FFFF CALL 00454F94
00455858|.803B 00 CMP BYTE PTR DS:, 0
0045585B 0F84 FB000000 JE 0045595C
00455861|.8D45 F8 LEA EAX, DWORD PTR SS:
00455864|.50 PUSH EAX
00455865|.B9 06000000 MOV ECX, 6
0045586A|.BA 47000000 MOV EDX, 47
0045586F|.8B06 MOV EAX, DWORD PTR DS:
00455871|.E8 FEEAFAFF CALL 00404374 ;'lenovo'
00455876|.8B45 F8 MOV EAX, DWORD PTR SS:
00455879|.E8 36F4FFFF CALL 00454CB4
0045587E|.50 PUSH EAX
0045587F|.8B45 FC MOV EAX, DWORD PTR SS:
00455882|.E8 2DF4FFFF CALL 00454CB4
00455887|.5A POP EDX
00455888|.E8 D3F5FFFF CALL 00454E60 ;相与
0045588D|.BA 09000000 MOV EDX, 9
00455892|.E8 CDF5FFFF CALL 00454E64 ;/9
00455897|.8D55 F0 LEA EDX, DWORD PTR SS:
0045589A|.E8 8124FBFF CALL 00407D20
0045589F|.8D45 EC LEA EAX, DWORD PTR SS:
004558A2|.50 PUSH EAX
004558A3|.B9 01000000 MOV ECX, 1
004558A8|.BA 0C000000 MOV EDX, 0C
004558AD|.8B45 F4 MOV EAX, DWORD PTR SS:
004558B0|.E8 BFEAFAFF CALL 00404374 ;注册码第12位
004558B5|.8B55 F0 MOV EDX, DWORD PTR SS:
004558B8|.8B45 EC MOV EAX, DWORD PTR SS:
004558BB|.E8 D4F6FFFF CALL 00454F94
004558C0|.803B 00 CMP BYTE PTR DS:, 0
004558C3 0F84 93000000 JE 0045595C
到这里12位注册码都计算并比较完了.那下面这个又是比较什么呢?在论坛里看到一些大大们说是比较窗口长度,这里就直接窃取成果了:P,具体怎么得到的还请大家补充,不想追了.
004558C9|.E8 DAF3FFFF CALL 00454CA8 ;取窗口长度
004558CE|.3D FE010000 CMP EAX, 1FE ;与0x1fe比较
004558D3|.0F85 83000000 JNZ 0045595C ;相等才行
......
3.算法总结
(1)输入的用户名长度必须在5~15之间;
(2)输入的注册码长度必须是12位;
(3)固定字符串为'ORACLE-BenQ-HP-IBM-SIEMENS-CISCO SYSTEMS-intel-Sun-DELL-SYBASE-Maxtor-lenovo';
(4)依次取一个品牌,计算出各位字母的ASCII码的和,得A;
(5)计算出输入的用户名的各位ASCII码之和,得B;
(6)依次得到各位注册码:A与B相异或(或者相与),结果除以10(或者7、9)的余数.
--------------------------------------------------------------------------------
【版权声明】: 转载请注明作者并保持文章的完整, 谢谢!
2007年01月23日 0:13:46
由于刚学编程,注册机写得很糟,请大家不要笑话:$ 不知附件怎么修改，放了两个上来，第二个有所改进，请需要的下第二个。
请谁告知附件怎么修改或删除。谢谢。:L 原帖由 dewar 于 2007-1-23 08:27 发表
不知附件怎么修改，放了两个上来，第二个有所改进，请需要的下第二个。
请谁告知附件怎么修改或删除。谢谢。:L
再编辑你的贴子，附件有删除项;P 成功删除，谢谢楼上的兄弟～～:handshake 强烈支持~！！！！！！！！！！！
页:
[1]