飞翔鸟桌面百变专家 V1.1
飞翔鸟桌面百变专家 V1.1【加密方式】 注册码
【破解工具】 FlyOD V1.10、W32DASM V8.93
【软件限制】 30次
【破解平台】 Microsoft Windows XP SP2
加了ASPack 2.1 -> Alexey Solodovnikov的外壳，脱掉，Borland Delphi 6.0 - 7.0编写。
由“注册成功，谢谢注册” --4d02e8逐步向上分析
004D013B .837D FC 00 cmp dword ptr ss:,0
004D013F .75 0C jnz short 飞翔鸟桌.004D014D
004D0141 .A1 F0724E00 mov eax,dword ptr ds:
004D0146 .E8 55FFF8FF call 飞翔鸟桌.004600A0
004D014B .EB 51 jmp short 飞翔鸟桌.004D019E
004D014D >8D55 F0 lea edx,dword ptr ss:
004D0150 .8B83 08030000 mov eax,dword ptr ds:
004D0156 .E8 8D2BF7FF call 飞翔鸟桌.00442CE8
004D015B .8B45 F0 mov eax,dword ptr ss:
004D015E .8D55 F4 lea edx,dword ptr ss:
004D0161 .E8 4A8BF3FF call 飞翔鸟桌.00408CB0
004D0166 .837D F4 00 cmp dword ptr ss:,0
004D016A .75 0C jnz short 飞翔鸟桌.004D0178
004D016C .A1 F0724E00 mov eax,dword ptr ds:
004D0171 .E8 2AFFF8FF call 飞翔鸟桌.004600A0
004D0176 .EB 26 jmp short 飞翔鸟桌.004D019E
004D0178 >8BC3 mov eax,ebx
004D017A .E8 71020000 call 飞翔鸟桌.004D03F0--------------关键call，写入标志位
004D017F .84C0 test al,al
004D0181 74 09 je short 飞翔鸟桌.004D018C-------------标志位比较--必须跳
004D0183 .8BC3 mov eax,ebx
004D0185 .E8 6E000000 call 飞翔鸟桌.004D01F8
004D018A .EB 12 jmp short 飞翔鸟桌.004D019E
004D018C >B8 F4010000 mov eax,1F4
004D0191 >48 dec eax
004D0192 .^ 75 FD jnz short 飞翔鸟桌.004D0191
004D0194 .A1 F0724E00 mov eax,dword ptr ds:
004D0199 .E8 02FFF8FF call 飞翔鸟桌.004600A0
004D019E >33C0 xor eax,eax
比较完标志位后的处理004D0185 call 飞翔鸟桌.004D01F8
004D01F8 /$55 push ebp
004D01F9 |.8BEC mov ebp,esp
004D01FB |.33C9 xor ecx,ecx
004D01FD |.51 push ecx
004D01FE |.51 push ecx
004D01FF |.51 push ecx
004D0200 |.51 push ecx
004D0201 |.51 push ecx
004D0202 |.53 push ebx
004D0203 |.56 push esi
004D0204 |.57 push edi
004D0205 |.8945 FC mov dword ptr ss:,eax
004D0208 |.33C0 xor eax,eax
004D020A |.55 push ebp
004D020B |.68 36034D00 push 飞翔鸟桌.004D0336
004D0210 |.64:FF30 push dword ptr fs:
004D0213 |.64:8920 mov dword ptr fs:,esp
004D0216 |.B2 01 mov dl,1
004D0218 |.A1 2C8A4600 mov eax,dword ptr ds:
004D021D |.E8 0A89F9FF call 飞翔鸟桌.00468B2C
004D0222 |.8BF8 mov edi,eax
004D0224 |.BA 01000080 mov edx,80000001
004D0229 |.8BC7 mov eax,edi
004D022B |.E8 9C89F9FF call 飞翔鸟桌.00468BCC
004D0230 |.B1 01 mov cl,1
004D0232 |.BA 4C034D00 mov edx,飞翔鸟桌.004D034C ;ASCII "\Software\Microsoft\Windows\CurrentVersion\Explorer\License"
004D0237 |.8BC7 mov eax,edi
004D0239 |.E8 F289F9FF call 飞翔鸟桌.00468C30
004D023E |.8D45 F8 lea eax,dword ptr ss:
004D0241 |.E8 F643F3FF call 飞翔鸟桌.0040463C
004D0246 |.A1 F4724E00 mov eax,dword ptr ds:
004D024B |.E8 A446F3FF call 飞翔鸟桌.004048F4
004D0250 |.8BD8 mov ebx,eax
004D0252 |.85DB test ebx,ebx
004D0254 |.7E 40 jle short 飞翔鸟桌.004D0296
肯定跳转不管
004D0256 |.BE 01000000 mov esi,1
004D025B |>8D45 EC /lea eax,dword ptr ss:
004D025E |.50 |push eax
004D025F |.B9 01000000 |mov ecx,1
004D0264 |.8BD6 |mov edx,esi
004D0266 |.A1 F4724E00 |mov eax,dword ptr ds:
004D026B |.E8 DC48F3FF |call 飞翔鸟桌.00404B4C
004D0270 |.8B45 EC |mov eax,dword ptr ss:
004D0273 |.E8 7448F3FF |call 飞翔鸟桌.00404AEC
004D0278 |.33D2 |xor edx,edx
004D027A |.8A10 |mov dl,byte ptr ds:
004D027C |.83C2 05 |add edx,5
004D027F |.8D45 F0 |lea eax,dword ptr ss:
004D0282 |.E8 9545F3FF |call 飞翔鸟桌.0040481C
004D0287 |.8B55 F0 |mov edx,dword ptr ss:
004D028A |.8D45 F8 |lea eax,dword ptr ss:
004D028D |.E8 6A46F3FF |call 飞翔鸟桌.004048FC
004D0292 |.46 |inc esi
004D0293 |.4B |dec ebx
004D0294 |.^ 75 C5 \jnz short 飞翔鸟桌.004D025B
后面是“注册成功，谢谢注册”4d02e8
004D0296 |>B8 F4724E00 mov eax,飞翔鸟桌.004E72F4
004D029B |.8B55 F8 mov edx,dword ptr ss:
004D029E |.E8 ED43F3FF call 飞翔鸟桌.00404690
004D02A3 |.8B0D F4724E00 mov ecx,dword ptr ds:
004D02A9 |.BA 90034D00 mov edx,飞翔鸟桌.004D0390 ;ASCII "FN ame"
004D017A call 飞翔鸟桌.004D03F0--------------关键call，写入标志位
004D03F0 /$55 push ebp
004D03F1 |.8BEC mov ebp,esp
004D03F3 |.83C4 E8 add esp,-18
004D03F6 |.53 push ebx
004D03F7 |.56 push esi
004D03F8 |.33D2 xor edx,edx
004D03FA |.8955 E8 mov dword ptr ss:,edx
004D03FD |.8955 EC mov dword ptr ss:,edx
004D0400 |.8955 F4 mov dword ptr ss:,edx
004D0403 |.8945 FC mov dword ptr ss:,eax
004D0406 |.33C0 xor eax,eax
004D0408 |.55 push ebp
004D0409 |.68 EF044D00 push 飞翔鸟桌.004D04EF
004D040E |.64:FF30 push dword ptr fs:
004D0411 |.64:8920 mov dword ptr fs:,esp
004D0414 |.33DB xor ebx,ebx
004D0416 |.8D55 F4 lea edx,dword ptr ss:
004D0419 |.8B45 FC mov eax,dword ptr ss:
004D041C |.8B80 04030000 mov eax,dword ptr ds:
004D0422 |.E8 C128F7FF call 飞翔鸟桌.00442CE8
004D0427 |.8B45 F4 mov eax,dword ptr ss:
Stack ss:=00F41EB0, (ASCII "chenli")
eax=00000006
004D042A |.E8 C544F3FF call 飞翔鸟桌.004048F4
004D042F |.8BF0 mov esi,eax
004D0431 |.85F6 test esi,esi
004D0433 |.7E 38 jle short 飞翔鸟桌.004D046D
004D0435 |.C745 F0 01000000mov dword ptr ss:,1
004D043C |>8D45 EC /lea eax,dword ptr ss:
004D043F |.50 |push eax
004D0440 |.B9 01000000 |mov ecx,1
004D0445 |.8B55 F0 |mov edx,dword ptr ss:
004D0448 |.8B45 F4 |mov eax,dword ptr ss:
004D044B |.E8 FC46F3FF |call 飞翔鸟桌.00404B4C
004D0450 |.8B45 EC |mov eax,dword ptr ss:
004D0453 |.E8 9446F3FF |call 飞翔鸟桌.00404AEC
004D0458 |.8A00 |mov al,byte ptr ds:
004D045A |.25 FF000000 |and eax,0FF
004D045F |.03D8 |add ebx,eax
004D0461 |.81F3 05FA0B00 |xor ebx,0BFA05
004D0467 |.FF45 F0 |inc dword ptr ss:
004D046A |.4E |dec esi
004D046B |.^ 75 CF \jnz short 飞翔鸟桌.004D043C
循环姓名
004D046D |>A1 FC724E00 mov eax,dword ptr ds:
004D0472 |.8BD0 mov edx,eax
004D0474 |.C1E0 04 shl eax,4
004D0477 |.03C2 add eax,edx
004D0479 |.03D8 add ebx,eax
004D047B |.81C3 D4A31300 add ebx,13A3D4
004D0481 |.81F3 8DED5900 xor ebx,59ED8D
004D0487 |.8D55 E8 lea edx,dword ptr ss:
004D048A |.8B45 FC mov eax,dword ptr ss:
004D048D |.8B80 08030000 mov eax,dword ptr ds:
004D0493 |.E8 5028F7FF call 飞翔鸟桌.00442CE8
004D0498 |.8B45 E8 mov eax,dword ptr ss:
Stack ss:=00F7A1AC, (ASCII "987654321")
eax=00000009
004D049B |.E8 748AF3FF call 飞翔鸟桌.00408F14
004D04A0 |.8BF3 mov esi,ebx
ebx=008042AE
esi=00000000
004D04A2 |.81F6 2473C400 xor esi,0C47324------常数
esi=008042AE
004D04A8 |.3BC6 cmp eax,esi
esi=0044318A (飞翔鸟桌.0044318A)异或的结果
eax=3ADE68B1----987654321
004D04AA |.75 19 jnz short 飞翔鸟桌.004D04C5-------改为je就可以写入标志位
004D04AC |.C645 FB 01 mov byte ptr ss:,1
004D04B0 |.B8 F4724E00 mov eax,飞翔鸟桌.004E72F4
004D04B5 |.8B55 F4 mov edx,dword ptr ss:
004D04B8 |.E8 D341F3FF call 飞翔鸟桌.00404690
004D04BD |.8935 F8724E00 mov dword ptr ds:,esi
004D04C3 |.EB 04 jmp short 飞翔鸟桌.004D04C9
004D04C5 |>C645 FB 00 mov byte ptr ss:,0
004D04C9 |>33C0 xor eax,eax
004D04CB |.5A pop edx
004D04CC |.59 pop ecx
004D04CD |.59 pop ecx
004D04CE |.64:8910 mov dword ptr fs:,edx
004D04D1 |.68 F6044D00 push 飞翔鸟桌.004D04F6
004D04D6 |>8D45 E8 lea eax,dword ptr ss:
004D04D9 |.E8 5E41F3FF call 飞翔鸟桌.0040463C
004D04DE |.8D45 EC lea eax,dword ptr ss:
004D04E1 |.E8 5641F3FF call 飞翔鸟桌.0040463C
004D04E6 |.8D45 F4 lea eax,dword ptr ss:
004D04E9 |.E8 4E41F3FF call 飞翔鸟桌.0040463C
004D04EE \.C3 retn
004D04EF .^ E9 CC3AF3FF jmp 飞翔鸟桌.00403FC0
004D04F4 .^ EB E0 jmp short 飞翔鸟桌.004D04D6
004D04F6 .8A45 FB mov al,byte ptr ss:
004D04F9 .5E pop esi
004D04FA .5B pop ebx
004D04FB .8BE5 mov esp,ebp
004D04FD .5D pop ebp
004D04FE .C3 retn
004D04FF 90 nop
004D0500 .C705 FC724E00 2AA>mov dword ptr ds:,0BA62A
004D050A .C3 retn
[ 本帖最后由 tigerisme 于 2006-8-27 08:45 编辑 ] 楼主为什么没篇文章都没有具体分析过程呢?
建议把文件下载地址贴出来!
我的软件下载地址
都是http://www.shareware.cn/在上面直接搜索就可以了,我的具体分析方法是根据确定的关键位置向上找来源,包括call和跳转,多找几个,再用od逐个设断排除,留下有用的,这个过程太多不好写下来,在二次分析,进行破解,
页:
[1]