初学MD5算法-三江门诊收费系统（带药品进销存） 5.68
【破文标题】三江门诊收费系统（带药品进销存） 5.68【破文作者】tianxj
【破解工具】PEiD,OD
【破解平台】Windows XP
【软件名称】三江门诊收费系统（带药品进销存） 5.68(2007-11-23版)
【软件大小】1835KB
【原版下载】华军软件园
【保护方式】注册码
【软件简介】
三江门诊收费系统功能：门诊划价收费、药品进销存管理、医生及科室工作量统计、库存及有效期管理、优惠打折收费、票据可打印明细单，也可只打印总的中西药费等分类，可以根据用户的要求定制各种发票样式，并且能让用户自己调整报表位置及纸张大小。开发者有十多年医院工作经验，成功案例遍布全国各大中城市，软件最大的特点为简单实用，欢迎您下载试用并提出宝贵意见！
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------------------------
【破解内容】
--------------------------------------------------------------------------------
********************************************************************************
一、运行程序，进行注册，输入错误的注册信息进行检测，有提示信息
"未能注册成功,请检查注册码是否正确!"
********************************************************************************
二、用PEiD对SJMZSF查壳，为 Borland Delphi 6.0 - 7.0
********************************************************************************
三、运行OD，打开SJMZSF，右键—超级字串参考—查找ASCII.
发现"未能注册成功,请检查注册码是否正确!"005BD218/.55 PUSH EBP
005BD219|.8BEC MOV EBP,ESP
005BD21B|.B9 07000000 MOV ECX,7
005BD220|>6A 00 /PUSH 0
005BD222|.6A 00 |PUSH 0
005BD224|.49 |DEC ECX
005BD225|.^ 75 F9 \JNZ SHORT SJMZSF.005BD220
005BD227|.51 PUSH ECX
005BD228|.53 PUSH EBX
005BD229|.8BD8 MOV EBX,EAX
005BD22B|.33C0 XOR EAX,EAX
005BD22D|.55 PUSH EBP
005BD22E|.68 68D45B00 PUSH SJMZSF.005BD468
005BD233|.64:FF30 PUSH DWORD PTR FS:
005BD236|.64:8920 MOV DWORD PTR FS:,ESP
005BD239|.8D55 F8 LEA EDX,DWORD PTR SS:
005BD23C|.8B83 04030000 MOV EAX,DWORD PTR DS:
005BD242|.E8 C11BECFF CALL SJMZSF.0047EE08 ;//将试练码长度送入EAX
005BD247|.8B45 F8 MOV EAX,DWORD PTR SS: ;//将试练码送入EAX
005BD24A|.8D55 FC LEA EDX,DWORD PTR SS:
005BD24D|.E8 1EBBE4FF CALL SJMZSF.00408D70
005BD252|.837D FC 00 CMP DWORD PTR SS:,0 ;//将试练码与0比较
005BD256|.75 1D JNZ SHORT SJMZSF.005BD275 ;//若不相等则跳
005BD258|.6A 00 PUSH 0
005BD25A|.B9 74D45B00 MOV ECX,SJMZSF.005BD474 ;提示
005BD25F|.BA 7CD45B00 MOV EDX,SJMZSF.005BD47C ;注册码不能为空!
005BD264|.A1 AC695E00 MOV EAX,DWORD PTR DS:
005BD269|.8B00 MOV EAX,DWORD PTR DS:
005BD26B|.E8 7432EEFF CALL SJMZSF.004A04E4
005BD270|.E9 90010000 JMP SJMZSF.005BD405
005BD275|>8D55 F0 LEA EDX,DWORD PTR SS:
005BD278|.8B83 04030000 MOV EAX,DWORD PTR DS:
005BD27E|.E8 851BECFF CALL SJMZSF.0047EE08 ;//将试练码长度送入EAX
005BD283|.8B45 F0 MOV EAX,DWORD PTR SS: ;//将试练码送入EAX
005BD286|.8D55 F4 LEA EDX,DWORD PTR SS:
005BD289|.E8 E2BAE4FF CALL SJMZSF.00408D70
005BD28E|.8B45 F4 MOV EAX,DWORD PTR SS: ;//将试练码送入EAX
005BD291|.50 PUSH EAX ;//将试练码压栈
005BD292|.8D45 D8 LEA EAX,DWORD PTR SS:
005BD295|.50 PUSH EAX
005BD296|.8D55 D4 LEA EDX,DWORD PTR SS:
005BD299|.8B83 FC020000 MOV EAX,DWORD PTR DS:
005BD29F|.E8 641BECFF CALL SJMZSF.0047EE08 ;//将机器码长度送入EAX
005BD2A4|.8B45 D4 MOV EAX,DWORD PTR SS: ;//将机器码送入EAX
005BD2A7|.B9 1A000000 MOV ECX,1A ;//将1A送入ECX
005BD2AC|.BA 05000000 MOV EDX,5 ;//将5送入EDX
005BD2B1|.E8 DA76E4FF CALL SJMZSF.00404990 ;//从机器码5位起,取26位,设为字符串A
005BD2B6|.8B45 D8 MOV EAX,DWORD PTR SS: ;//将字符串A送入EAX
005BD2B9|.8D55 DC LEA EDX,DWORD PTR SS:
005BD2BC|.E8 6BFBFFFF CALL SJMZSF.005BCE2C ;//标准MD5算法
005BD2C1|.8D45 DC LEA EAX,DWORD PTR SS:
005BD2C4|.8D55 EC LEA EDX,DWORD PTR SS:
005BD2C7|.E8 D4FBFFFF CALL SJMZSF.005BCEA0 ;//MD5代码转小写
005BD2CC|.8B55 EC MOV EDX,DWORD PTR SS: ;//将真码送入EDX
005BD2CF|.58 POP EAX ;//将试练码送入EDX
005BD2D0|.E8 A775E4FF CALL SJMZSF.0040487C ;//比较CALL
005BD2D5|.0F85 12010000 JNZ SJMZSF.005BD3ED ;//关键跳转
005BD2DB|.8B83 10030000 MOV EAX,DWORD PTR DS:
005BD2E1|.E8 72CDEFFF CALL SJMZSF.004BA058
005BD2E6|.8B83 10030000 MOV EAX,DWORD PTR DS:
005BD2EC|.E8 0B88F2FF CALL SJMZSF.004E5AFC
005BD2F1|.8B10 MOV EDX,DWORD PTR DS:
005BD2F3|.FF52 44 CALL DWORD PTR DS:
005BD2F6|.8B83 10030000 MOV EAX,DWORD PTR DS:
005BD2FC|.E8 FB87F2FF CALL SJMZSF.004E5AFC
005BD301|.BA 94D45B00 MOV EDX,SJMZSF.005BD494 ;select * from tb_zc
005BD306|.8B08 MOV ECX,DWORD PTR DS:
005BD308|.FF51 38 CALL DWORD PTR DS:
005BD30B|.8B83 10030000 MOV EAX,DWORD PTR DS:
005BD311|.E8 36CDEFFF CALL SJMZSF.004BA04C
005BD316|.8B83 10030000 MOV EAX,DWORD PTR DS:
005BD31C|.8B10 MOV EDX,DWORD PTR DS:
005BD31E|.FF92 4C010000 CALL DWORD PTR DS:
005BD324|.85C0 TEST EAX,EAX
005BD326|.0F85 9B000000 JNZ SJMZSF.005BD3C7
005BD32C|.8B83 14030000 MOV EAX,DWORD PTR DS:
005BD332|.E8 15CDEFFF CALL SJMZSF.004BA04C
005BD337|.8B83 14030000 MOV EAX,DWORD PTR DS:
005BD33D|.E8 1EF6EFFF CALL SJMZSF.004BC960
005BD342|.8D55 CC LEA EDX,DWORD PTR SS:
005BD345|.8B83 FC020000 MOV EAX,DWORD PTR DS:
005BD34B|.E8 B81AECFF CALL SJMZSF.0047EE08 ;//将机器码长度送入EAX
005BD350|.8B45 CC MOV EAX,DWORD PTR SS: ;//将机器码送入EAX
005BD353|.8D55 D0 LEA EDX,DWORD PTR SS:
005BD356|.E8 15BAE4FF CALL SJMZSF.00408D70
005BD35B|.8B45 D0 MOV EAX,DWORD PTR SS: ;//将机器码送入EAX
005BD35E|.50 PUSH EAX ;//将机器码压栈
005BD35F|.BA B0D45B00 MOV EDX,SJMZSF.005BD4B0 ;机器码
005BD364|.8B83 14030000 MOV EAX,DWORD PTR DS:
005BD36A|.E8 EDDCEFFF CALL SJMZSF.004BB05C
005BD36F|.5A POP EDX ;//将机器码出栈
005BD370|.8B08 MOV ECX,DWORD PTR DS:
005BD372|.FF91 B0000000 CALL DWORD PTR DS:
005BD378|.8D55 C4 LEA EDX,DWORD PTR SS:
005BD37B|.8B83 04030000 MOV EAX,DWORD PTR DS:
005BD381|.E8 821AECFF CALL SJMZSF.0047EE08 ;//将注册码长度送入EAX
005BD386|.8B45 C4 MOV EAX,DWORD PTR SS: ;//将注册码送入EAX
005BD389|.8D55 C8 LEA EDX,DWORD PTR SS:
005BD38C|.E8 DFB9E4FF CALL SJMZSF.00408D70
005BD391|.8B45 C8 MOV EAX,DWORD PTR SS: ;//将注册码送入EAX
005BD394|.50 PUSH EAX ;//将注册码压栈
005BD395|.BA C0D45B00 MOV EDX,SJMZSF.005BD4C0 ;注册码
005BD39A|.8B83 14030000 MOV EAX,DWORD PTR DS: ;//将注册码送入EAX
005BD3A0|.E8 B7DCEFFF CALL SJMZSF.004BB05C
005BD3A5|.5A POP EDX ;//将注册码出栈
005BD3A6|.8B08 MOV ECX,DWORD PTR DS:
005BD3A8|.FF91 B0000000 CALL DWORD PTR DS:
005BD3AE|.8B83 14030000 MOV EAX,DWORD PTR DS:
005BD3B4|.8B10 MOV EDX,DWORD PTR DS:
005BD3B6|.FF92 4C020000 CALL DWORD PTR DS:
005BD3BC|.8B83 14030000 MOV EAX,DWORD PTR DS:
005BD3C2|.E8 91CCEFFF CALL SJMZSF.004BA058
005BD3C7|>6A 00 PUSH 0
005BD3C9|.B9 74D45B00 MOV ECX,SJMZSF.005BD474 ;提示
005BD3CE|.BA C8D45B00 MOV EDX,SJMZSF.005BD4C8 ;注册成功,请重新运行软件!
005BD3D3|.A1 AC695E00 MOV EAX,DWORD PTR DS:
005BD3D8|.8B00 MOV EAX,DWORD PTR DS:
005BD3DA|.E8 0531EEFF CALL SJMZSF.004A04E4
005BD3DF|.A1 AC695E00 MOV EAX,DWORD PTR DS:
005BD3E4|.8B00 MOV EAX,DWORD PTR DS:
005BD3E6|.E8 5530EEFF CALL SJMZSF.004A0440
005BD3EB|.EB 18 JMP SHORT SJMZSF.005BD405
005BD3ED|>6A 00 PUSH 0
005BD3EF|.B9 74D45B00 MOV ECX,SJMZSF.005BD474 ;提示
005BD3F4|.BA E4D45B00 MOV EDX,SJMZSF.005BD4E4 ;未能注册成功,请检查注册码是否正确!
005BD3F9|.A1 AC695E00 MOV EAX,DWORD PTR DS:
005BD3FE|.8B00 MOV EAX,DWORD PTR DS:
005BD400|.E8 DF30EEFF CALL SJMZSF.004A04E4
005BD405|>33C0 XOR EAX,EAX
005BD407|.5A POP EDX
005BD408|.59 POP ECX
005BD409|.59 POP ECX
005BD40A|.64:8910 MOV DWORD PTR FS:,EDX
005BD40D|.68 6FD45B00 PUSH SJMZSF.005BD46F
005BD412|>8D45 C4 LEA EAX,DWORD PTR SS:
005BD415|.E8 5670E4FF CALL SJMZSF.00404470
005BD41A|.8D45 C8 LEA EAX,DWORD PTR SS:
005BD41D|.E8 4E70E4FF CALL SJMZSF.00404470
005BD422|.8D45 CC LEA EAX,DWORD PTR SS:
005BD425|.E8 4670E4FF CALL SJMZSF.00404470
005BD42A|.8D45 D0 LEA EAX,DWORD PTR SS:
005BD42D|.E8 3E70E4FF CALL SJMZSF.00404470
005BD432|.8D45 D4 LEA EAX,DWORD PTR SS:
005BD435|.BA 02000000 MOV EDX,2
005BD43A|.E8 5570E4FF CALL SJMZSF.00404494
005BD43F|.8D45 EC LEA EAX,DWORD PTR SS:
005BD442|.E8 2970E4FF CALL SJMZSF.00404470
005BD447|.8D45 F0 LEA EAX,DWORD PTR SS:
005BD44A|.E8 2170E4FF CALL SJMZSF.00404470
005BD44F|.8D45 F4 LEA EAX,DWORD PTR SS:
005BD452|.E8 1970E4FF CALL SJMZSF.00404470
005BD457|.8D45 F8 LEA EAX,DWORD PTR SS:
005BD45A|.E8 1170E4FF CALL SJMZSF.00404470
005BD45F|.8D45 FC LEA EAX,DWORD PTR SS:
005BD462|.E8 0970E4FF CALL SJMZSF.00404470
005BD467\.C3 RETN
005BD468 .^ E9 2769E4FF JMP SJMZSF.00403D94
005BD46D .^ EB A3 JMP SHORT SJMZSF.005BD412
005BD46F .5B POP EBX
005BD470 .8BE5 MOV ESP,EBP
005BD472 .5D POP EBP
005BD473 .C3 RETN
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
005BCE2C/$55 PUSH EBP
005BCE2D|.8BEC MOV EBP,ESP
005BCE2F|.83C4 A4 ADD ESP,-5C
005BCE32|.53 PUSH EBX
005BCE33|.8BDA MOV EBX,EDX
005BCE35|.8945 FC MOV DWORD PTR SS:,EAX
005BCE38|.8B45 FC MOV EAX,DWORD PTR SS:
005BCE3B|.E8 E07AE4FF CALL SJMZSF.00404920
005BCE40|.33C0 XOR EAX,EAX
005BCE42|.55 PUSH EBP
005BCE43|.68 92CE5B00 PUSH SJMZSF.005BCE92
005BCE48|.64:FF30 PUSH DWORD PTR FS:
005BCE4B|.64:8920 MOV DWORD PTR FS:,ESP
005BCE4E|.8D45 A4 LEA EAX,DWORD PTR SS:
005BCE51|.E8 AEFEFFFF CALL SJMZSF.005BCD04 ;//F7
005BCE56|.8B45 FC MOV EAX,DWORD PTR SS:
005BCE59|.E8 D278E4FF CALL SJMZSF.00404730
005BCE5E|.50 PUSH EAX
005BCE5F|.8B45 FC MOV EAX,DWORD PTR SS:
005BCE62|.E8 C97AE4FF CALL SJMZSF.00404930
005BCE67|.8BD0 MOV EDX,EAX
005BCE69|.8D45 A4 LEA EAX,DWORD PTR SS:
005BCE6C|.59 POP ECX
005BCE6D|.E8 C6FEFFFF CALL SJMZSF.005BCD38
005BCE72|.8BD3 MOV EDX,EBX
005BCE74|.8D45 A4 LEA EAX,DWORD PTR SS:
005BCE77|.E8 3CFFFFFF CALL SJMZSF.005BCDB8
005BCE7C|.33C0 XOR EAX,EAX
005BCE7E|.5A POP EDX
005BCE7F|.59 POP ECX
005BCE80|.59 POP ECX
005BCE81|.64:8910 MOV DWORD PTR FS:,EDX
005BCE84|.68 99CE5B00 PUSH SJMZSF.005BCE99
005BCE89|>8D45 FC LEA EAX,DWORD PTR SS:
005BCE8C|.E8 DF75E4FF CALL SJMZSF.00404470
005BCE91\.C3 RETN
005BCE92 .^ E9 FD6EE4FF JMP SJMZSF.00403D94
005BCE97 .^ EB F0 JMP SHORT SJMZSF.005BCE89
005BCE99 .5B POP EBX
005BCE9A .8BE5 MOV ESP,EBP
005BCE9C .5D POP EBP
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
005BCD04/$C700 01234567 MOV DWORD PTR DS:,67452301
005BCD0A|.C740 04 89ABC>MOV DWORD PTR DS:,EFCDAB89
005BCD11|.C740 08 FEDCB>MOV DWORD PTR DS:,98BADCFE
005BCD18|.C740 0C 76543>MOV DWORD PTR DS:,10325476
005BCD1F|.33D2 XOR EDX,EDX
005BCD21|.8950 10 MOV DWORD PTR DS:,EDX
005BCD24|.33D2 XOR EDX,EDX
005BCD26|.8950 14 MOV DWORD PTR DS:,EDX
005BCD29|.83C0 18 ADD EAX,18
005BCD2C|.BA 40000000 MOV EDX,40
005BCD31|.E8 86AAE4FF CALL SJMZSF.004077BC
005BCD36\.C3 RETN
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
005BCEA0/$55 PUSH EBP
005BCEA1|.8BEC MOV EBP,ESP
005BCEA3|.83C4 E8 ADD ESP,-18
005BCEA6|.53 PUSH EBX
005BCEA7|.56 PUSH ESI
005BCEA8|.57 PUSH EDI
005BCEA9|.33C9 XOR ECX,ECX
005BCEAB|.894D EC MOV DWORD PTR SS:,ECX
005BCEAE|.894D E8 MOV DWORD PTR SS:,ECX
005BCEB1|.8BF0 MOV ESI,EAX
005BCEB3|.8D7D F0 LEA EDI,DWORD PTR SS:
005BCEB6|.A5 MOVS DWORD PTR ES:,DWORD PTR DS: ;//MD5代码第1组
005BCEB7|.A5 MOVS DWORD PTR ES:,DWORD PTR DS: ;//MD5代码第2组
005BCEB8|.A5 MOVS DWORD PTR ES:,DWORD PTR DS: ;//MD5代码第3组
005BCEB9|.A5 MOVS DWORD PTR ES:,DWORD PTR DS: ;//MD5代码第4组
005BCEBA|.8BFA MOV EDI,EDX
005BCEBC|.33C0 XOR EAX,EAX
005BCEBE|.55 PUSH EBP
005BCEBF|.68 3BCF5B00 PUSH SJMZSF.005BCF3B
005BCEC4|.64:FF30 PUSH DWORD PTR FS:
005BCEC7|.64:8920 MOV DWORD PTR FS:,ESP
005BCECA|.8BC7 MOV EAX,EDI
005BCECC|.E8 9F75E4FF CALL SJMZSF.00404470
005BCED1|.B3 10 MOV BL,10
005BCED3|.8D75 F0 LEA ESI,DWORD PTR SS:
005BCED6|>FF37 /PUSH DWORD PTR DS:
005BCED8|.8D45 EC |LEA EAX,DWORD PTR SS:
005BCEDB|.33D2 |XOR EDX,EDX
005BCEDD|.8A16 |MOV DL,BYTE PTR DS:
005BCEDF|.C1EA 04 |SHR EDX,4
005BCEE2|.83E2 0F |AND EDX,0F
005BCEE5|.8A92 28645E00 |MOV DL,BYTE PTR DS:
005BCEEB|.E8 6877E4FF |CALL SJMZSF.00404658
005BCEF0|.FF75 EC |PUSH DWORD PTR SS:
005BCEF3|.8D45 E8 |LEA EAX,DWORD PTR SS:
005BCEF6|.8A16 |MOV DL,BYTE PTR DS:
005BCEF8|.80E2 0F |AND DL,0F
005BCEFB|.81E2 FF000000 |AND EDX,0FF
005BCF01|.8A92 28645E00 |MOV DL,BYTE PTR DS:
005BCF07|.E8 4C77E4FF |CALL SJMZSF.00404658
005BCF0C|.FF75 E8 |PUSH DWORD PTR SS:
005BCF0F|.8BC7 |MOV EAX,EDI
005BCF11|.BA 03000000 |MOV EDX,3
005BCF16|.E8 D578E4FF |CALL SJMZSF.004047F0
005BCF1B|.46 |INC ESI
005BCF1C|.FECB |DEC BL
005BCF1E|.^ 75 B6 \JNZ SHORT SJMZSF.005BCED6
005BCF20|.33C0 XOR EAX,EAX
005BCF22|.5A POP EDX
005BCF23|.59 POP ECX
005BCF24|.59 POP ECX
005BCF25|.64:8910 MOV DWORD PTR FS:,EDX
005BCF28|.68 42CF5B00 PUSH SJMZSF.005BCF42
005BCF2D|>8D45 E8 LEA EAX,DWORD PTR SS:
005BCF30|.BA 02000000 MOV EDX,2
005BCF35|.E8 5A75E4FF CALL SJMZSF.00404494
005BCF3A\.C3 RETN
005BCF3B .^ E9 546EE4FF JMP SJMZSF.00403D94
005BCF40 .^ EB EB JMP SHORT SJMZSF.005BCF2D
005BCF42 .5F POP EDI
005BCF43 .5E POP ESI
005BCF44 .5B POP EBX
005BCF45 .8BE5 MOV ESP,EBP
005BCF47 .5D POP EBP
005BCF48 .C3 RETN********************************************************************************
【破解总结】
--------------------------------------------------------------------------------
【算法总结】
取机器码的5-30位作标准MD5算法，代码转小写，即为注册码
--------------------------------------------------------------------------------
【算法注册机】
VB代码
Private Sub Command1_Click()
If Text1.Text = "" Then
Text2.Text = "输入有误，请重新输入！"
Else
Text2.Text = LCase(MD5(Mid(Text1.Text, 5, 26)))'MD5模块
End If
End Sub
E代码
.版本 2
.支持库 dp1
.判断开始 (编辑框1.内容 ＝ “”)
编辑框2.内容 ＝ “输入有误，请重新输入。”
.默认
编辑框2.内容 ＝ 到文本 (取数据摘要 (到字节集 (取文本中间 (编辑框1.内容, 5, 26))))
.判断结束
--------------------------------------------------------------------------------
【内存注册机】
中断地址 5BD2D0
中断次数 1
第一字节 E8
指令长度 5
内存方式-寄存器-EDX
--------------------------------------------------------------------------------
希望以后可以在猫老大和PYG 5.4Cracker学习小组的帮助下进一步提高自己。
感谢飘云老大、猫老大、Nisy老大以及很多前辈们的学习教程以及所有帮助过我的论坛兄弟姐妹们！谢谢
--------------------------------------------------------------------------------
【版权声明】破文是学习的手记，兴趣是成功的源泉；本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
[ 本帖最后由 tianxj 于 2008-2-10 10:22 编辑 ] 沙发。。。支持下。。。算法一点不懂。。希望可以学习学习 沙发,要的就是这个效果! 这年头怎么这么多人喜欢上了沙发撒！晕。 /:good 厉害，谢谢学习了， 呵呵，不错的东西啊 大大真是牛
也来好好学习MD5算法 谢谢兄弟！兄弟辛苦了！/:017 谢谢.......学习一下..../:018 学习了，谢谢楼主分享！
页:
[1]
2