LRC歌词文件转换器 V2.3 简单算法分析
文章标题：LRC歌词文件转换器 V2.3 算法分析破解作者：风球
软件下载：http://www.skycn.com/soft/25513.html
软件介绍：从网上下载音乐、电影时，常常有歌词、字幕文件与之相伴。而有些歌词文件的制作者为了减小文件大小，就在歌词文件的一行内加入多个时间标识。于是，要按实际顺序输出歌词便成了难题。本软件能将LRC文件内的歌词重新排序，像显示歌词的软件一样按实际顺序将歌词输出。并且可以完成LRC、KSC、SRT、TXT文件的互相转换。
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
简单的破解过程：
0045435B 68 08544200 push LRC_Tool.00425408 ; UNICODE "reg.ini"
00454360 6A 01 push 1
00454362 6A FF push -1
00454364 6A 01 push 1
00454366 FF15 14114000 call dword ptr ds:[<&msvbvm60.__vbaFile>; msvbvm60.__vbaFileOpen
0045436C 8D4D C8 lea ecx,dword ptr ss:
0045436F 51 push ecx
00454370 6A 01 push 1
00454372 68 1C544200 push LRC_Tool.0042541C
00454377 8B3D E4104000 mov edi,dword ptr ds:[<&msvbvm60.__vbaI>; msvbvm60.__vbaInputFile
0045437D FFD7 call edi
0045437F 8D55 C8 lea edx,dword ptr ss:
00454382 52 push edx
00454383 6A 01 push 1
00454385 68 1C544200 push LRC_Tool.0042541C
0045438A FFD7 call edi
0045438C 83C4 18 add esp,18
0045438F C785 7CFFFFFF 0>mov dword ptr ss:,80020004
00454399 C785 74FFFFFF 0>mov dword ptr ss:,0A
004543A3 8D85 74FFFFFF lea eax,dword ptr ss:
004543A9 50 push eax
004543AA 6A 0A push 0A
004543AC 8B4D C8 mov ecx,dword ptr ss: ; 用户名(UNICODE "Username=feng")
004543AF 51 push ecx
004543B0 FF15 88104000 call dword ptr ds:[<&msvbvm60.rtcMidCha>; msvbvm60.rtcMidCharBstr
004543B6 8BD0 mov edx,eax
004543B8 8D4D C0 lea ecx,dword ptr ss:
004543BB FFD6 call esi
004543BD 8D8D 74FFFFFF lea ecx,dword ptr ss:
004543C3 8B1D 14104000 mov ebx,dword ptr ds:[<&msvbvm60.__vbaF>; msvbvm60.__vbaFreeVar
004543C9 FFD3 call ebx
004543CB 8D55 C8 lea edx,dword ptr ss:
004543CE 52 push edx
004543CF 6A 01 push 1
004543D1 68 1C544200 push LRC_Tool.0042541C
004543D6 FFD7 call edi
004543D8 83C4 0C add esp,0C
004543DB C785 7CFFFFFF 0>mov dword ptr ss:,80020004
004543E5 C785 74FFFFFF 0>mov dword ptr ss:,0A
004543EF 8D85 74FFFFFF lea eax,dword ptr ss:
004543F5 50 push eax
004543F6 6A 09 push 9
004543F8 8B4D C8 mov ecx,dword ptr ss:
004543FB 51 push ecx ; 假码(UNICODE "Regcode=123654789")
004543FC FF15 88104000 call dword ptr ds:[<&msvbvm60.rtcMidCha>; msvbvm60.rtcMidCharBstr
00454402 8BD0 mov edx,eax
00454404 8D4D CC lea ecx,dword ptr ss:
00454407 FFD6 call esi
00454409 8D8D 74FFFFFF lea ecx,dword ptr ss:
0045440F FFD3 call ebx
00454411 6A 01 push 1
00454413 FF15 94104000 call dword ptr ds:[<&msvbvm60.__vbaFile>; msvbvm60.__vbaFileClose
00454419 8B55 C0 mov edx,dword ptr ss:
0045441C 52 push edx ; (UNICODE "feng")
0045441D FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaLenB>; msvbvm60.__vbaLenBstr
00454423 83F8 03 cmp eax,3
00454426 0F8C A6040000 jl LRC_Tool.004548D2 ; 用户名长度小于3则出错
0045442C C785 3CFFFFFF 0>mov dword ptr ss:,1
00454436 BF 02000000 mov edi,2
0045443B 89BD 34FFFFFF mov dword ptr ss:,edi
00454441 8B45 C0 mov eax,dword ptr ss:
00454444 50 push eax
00454445 FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaLenB>; msvbvm60.__vbaLenBstr
0045444B 8985 2CFFFFFF mov dword ptr ss:,eax
00454451 C785 24FFFFFF 0>mov dword ptr ss:,3
0045445B C785 1CFFFFFF 0>mov dword ptr ss:,1
00454465 89BD 14FFFFFF mov dword ptr ss:,edi
0045446B 8D8D 34FFFFFF lea ecx,dword ptr ss:
00454471 51 push ecx
00454472 8D95 24FFFFFF lea edx,dword ptr ss:
00454478 52 push edx
00454479 8D85 14FFFFFF lea eax,dword ptr ss:
0045447F 50 push eax
00454480 8D8D DCFEFFFF lea ecx,dword ptr ss:
00454486 51 push ecx
00454487 8D95 ECFEFFFF lea edx,dword ptr ss:
0045448D 52 push edx
0045448E 8D45 D4 lea eax,dword ptr ss:
00454491 50 push eax
00454492 FF15 5C104000 call dword ptr ds:[<&msvbvm60.__vbaVarF>; msvbvm60.__vbaVarForInit
00454498 85C0 test eax,eax
0045449A 0F84 FA000000 je LRC_Tool.0045459A
004544A0 C785 7CFFFFFF 0>mov dword ptr ss:,1
004544AA 89BD 74FFFFFF mov dword ptr ss:,edi
004544B0 8D8D 74FFFFFF lea ecx,dword ptr ss:
004544B6 51 push ecx
004544B7 8D55 D4 lea edx,dword ptr ss:
004544BA 52 push edx
004544BB FF15 4C114000 call dword ptr ds:[<&msvbvm60.__vbaI4Va>; msvbvm60.__vbaI4Var
004544C1 50 push eax ; 取用户名第N位字符 (N为参数1)
004544C2 8B45 C0 mov eax,dword ptr ss:
004544C5 50 push eax
004544C6 FF15 88104000 call dword ptr ds:[<&msvbvm60.rtcMidCha>; msvbvm60.rtcMidCharBstr
004544CC 8BD0 mov edx,eax
004544CE 8D4D D0 lea ecx,dword ptr ss:
004544D1 FFD6 call esi
004544D3 8D8D 74FFFFFF lea ecx,dword ptr ss:
004544D9 FFD3 call ebx
004544DB 8B4D C4 mov ecx,dword ptr ss:
004544DE 898D 1CFFFFFF mov dword ptr ss:,ecx
004544E4 C785 14FFFFFF 0>mov dword ptr ss:,8
004544EE 8B55 D0 mov edx,dword ptr ss:
004544F1 52 push edx
004544F2 FF15 3C104000 call dword ptr ds:[<&msvbvm60.rtcAnsiVa>; msvbvm60.rtcAnsiValueBstr
004544F8 66:8985 2CFFFFF>mov word ptr ss:,ax ; 逐位取用户名的ASCII
004544FF 89BD 24FFFFFF mov dword ptr ss:,edi
00454505 C785 3CFFFFFF 0>mov dword ptr ss:,5 ; 5(参数2)
0045450F 89BD 34FFFFFF mov dword ptr ss:,edi
00454515 8D85 14FFFFFF lea eax,dword ptr ss: ; ASCII值
0045451B 50 push eax
0045451C 8D8D 24FFFFFF lea ecx,dword ptr ss:
00454522 51 push ecx
00454523 8D55 D4 lea edx,dword ptr ss:
00454526 52 push edx
00454527 8D85 34FFFFFF lea eax,dword ptr ss:
0045452D 50 push eax
0045452E 8D8D 74FFFFFF lea ecx,dword ptr ss:
00454534 51 push ecx
00454535 FF15 58114000 call dword ptr ds:[<&msvbvm60.__vbaVarA>; 相加__vbaVarAdd
0045453B 50 push eax
0045453C 8D95 64FFFFFF lea edx,dword ptr ss:
00454542 52 push edx
00454543 FF15 D8104000 call dword ptr ds:[<&msvbvm60.__vbaVarM>; 相乘__vbaVarMul
00454549 50 push eax
0045454A 8D85 54FFFFFF lea eax,dword ptr ss:
00454550 50 push eax
00454551 FF15 F8104000 call dword ptr ds:[<&msvbvm60.__vbaVarC>; 连接__vbaVarCat
00454557 50 push eax
00454558 FF15 24104000 call dword ptr ds:[<&msvbvm60.__vbaStrV>; msvbvm60.__vbaStrVarMove
0045455E 8BD0 mov edx,eax ; 十进制连起来
00454560 8D4D C4 lea ecx,dword ptr ss:
00454563 FFD6 call esi
00454565 8D8D 54FFFFFF lea ecx,dword ptr ss:
0045456B 51 push ecx
0045456C 8D95 74FFFFFF lea edx,dword ptr ss:
00454572 52 push edx
00454573 57 push edi
00454574 FF15 2C104000 call dword ptr ds:[<&msvbvm60.__vbaFree>; msvbvm60.__vbaFreeVarList
0045457A 83C4 0C add esp,0C
0045457D 8D85 DCFEFFFF lea eax,dword ptr ss:
00454583 50 push eax
00454584 8D8D ECFEFFFF lea ecx,dword ptr ss:
0045458A 51 push ecx
0045458B 8D55 D4 lea edx,dword ptr ss:
0045458E 52 push edx
0045458F FF15 90114000 call dword ptr ds:[<&msvbvm60.__vbaVarF>; 下一位__vbaVarForNext
00454595^ E9 FEFEFFFF jmp LRC_Tool.00454498 ; 循环取
0045459A 8B45 C4 mov eax,dword ptr ss: ; 得到真码(UNICODE "612707880927")
0045459D 50 push eax
0045459E 8B4D CC mov ecx,dword ptr ss:
004545A1 51 push ecx
004545A2 FF15 A4104000 call dword ptr ds:[<&msvbvm60.__vbaStrC>; 真假码比较，EAX显真码
004545A8 85C0 test eax,eax
004545AA 0F85 B4000000 jnz LRC_Tool.00454664 ; 跳则OVER，爆破NOP
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
总结：用户名：feng
注册码：612707880927
明码比较的，算法也很简单。
算法不总结了，贴出个粗糙的VB算法注册机源码，希望大家能看得明白吧```哈```
'****** LRC歌词文件转换器 V2.3 算法注册机 ******
Private Sub Command1_Click()
Dim Name, Code As String
Dim temp1, temp2, temp3 As Double
Name = Text1.Text
If Len(Name) < 3 Then
Text2.Text = "注意：用户名长度不得小于3，请重新输入！"
Else
For i = 1 To Len(Name)
temp1 = Asc(Mid(Name, i))
temp2 = i + 5
temp3 = temp1 * temp2
Code = Code & temp3
Next i
Text2.Text = Code
End If
End Sub
Private Sub Command2_Click()
End
End Sub
'***********************************************
[ 本帖最后由 风球 于 2006-2-22 07:45 编辑 ] 学习中。。。。。。。。。 厉害,学习收藏了. 多谢，收了
页:
[1]