极限杀号数字三15.00版简单算法分析+VB注册机源码
【破文标题】极限杀号数字三15.00版简单算法分析+VB注册机源码
【破解作者】hrbx
【作者主页】hrbx.ys168.com
【作者邮箱】[email protected]
【破解平台】WinXP
【使用工具】flyOD1.10、Peid
【破解日期】2006-05-17
【软件名称】极限杀号数字三15.00版
【软件大小】352KB
【下载地址】https://www.chinapyg.com/viewthread.php?tid=4824&highlight=
【加壳方式】无
【软件简介】极限杀号数字三15.00版
-----------------------------------------------------------------------------------------------
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
-----------------------------------------------------------------------------------------------
【破解过程】
1.查壳。用Peid扫描脱壳后的程序，显示为：Microsoft Visual Basic 5.0 / 6.0，无壳。
2.试运行。输入注册信息：
======================
序列号:-73677970
注册码:9876543210
======================
点击"注册"按钮，提示"请重启软件"。同时注册信息保存在程序目录下的注册信息.txt.
3.OD载入程序。命令栏输入：bp CreateFileA, 回车，F9运行，中断：
77E5B476 k>55 push ebp ; 在此中断
77E5B477 8BEC mov ebp,esp
77E5B479 FF75 08 push dword ptr ss:
77E5B47C E8 11FFFFFF call kernel32.77E5B392
77E5B481 85C0 test eax,eax
继续F9运行程序，直到堆栈出现如下友好提示：
0012F6F8 660EC6D7 /CALL 到 CreateFileA 来自 MSVBVM60.660EC6D1
0012F6FC 0012F770 |FileName = "C:\jxsh1500\注册信息.txt"
0012F700 80000000 |Access = GENERIC_READ
0012F704 00000003 |ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE
命令栏输入：bc CreateFileA, 回车，消除断点，ALT+F9返回，来到：
0042943E .FF15 501140>call dword ptr ds:[<&MSVBVM60.__vbaFileOpen>]
00429444 .8D8D 14FFFF>lea ecx,dword ptr ss: ;ALT+F9返回来到这里
0042944A .FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00429450 .8D95 3CFEFF>lea edx,dword ptr ss:
向上查找，来到00428630处F2下断。Ctrl+F2重新载入程序，F9运行，立即中断：
00428630 > \55 push ebp ;F2在此下断，中断后F8往下走
00428631 .8BEC mov ebp,esp
00428633 .83EC 0C sub esp,0C
00428636 .68 96184000 push <jmp.&MSVBVM60.__vbaExceptHandler> ;SE 句柄安装
0042863B .64:A1 00000>mov eax,dword ptr fs:
.......................................................
省略部分代码
.......................................................
00428A4E .BA C0D84000 mov edx,极限杀号.0040D8C0 ;c:\
00428A53 .8D8D 14FFFF>lea ecx,dword ptr ss:
00428A59 .FF15 701140>call dword ptr ds:[<&MSVBVM60.__vbaStrCopy>]
00428A5F .8B7D 08 mov edi,dword ptr ss:
00428A62 .8D85 08FEFF>lea eax,dword ptr ss:
00428A68 .8D8D 14FFFF>lea ecx,dword ptr ss:
00428A6E .50 push eax
00428A6F .8B17 mov edx,dword ptr ds:
00428A71 .51 push ecx
00428A72 .57 push edi
00428A73 .FF92 980800>call dword ptr ds:
00428A79 .3BC6 cmp eax,esi
00428A7B .7D 12 jge short 极限杀号.00428A8F
00428A7D .68 98080000 push 898
00428A82 .68 70CC4000 push 极限杀号.0040CC70
00428A87 .57 push edi
00428A88 .50 push eax
00428A89 .FF15 581040>call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>
00428A8F >8B95 08FEFF>mov edx,dword ptr ss: ;ss:=D81F31F8，C盘卷标号
00428A95 .8B3D 141040>mov edi,dword ptr ds:[<&MSVBVM60.__vbaVarMove>];0xD81F31F8=-669044232(有符号数)
00428A9B .8995 44FEFF>mov dword ptr ss:,edx
00428AA1 .8D95 3CFEFF>lea edx,dword ptr ss:
00428AA7 .8D8D 5CFFFF>lea ecx,dword ptr ss:
00428AAD .C785 3CFEFF>mov dword ptr ss:,3
00428AB7 .FFD7 call edi
00428AB9 .8D8D 14FFFF>lea ecx,dword ptr ss:
00428ABF .FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428AC5 .BA CCD84000 mov edx,极限杀号.0040D8CC ;d:\
00428ACA .8D8D 14FFFF>lea ecx,dword ptr ss:
00428AD0 .FF15 701140>call dword ptr ds:[<&MSVBVM60.__vbaStrCopy>]
00428AD6 .8B45 08 mov eax,dword ptr ss:
00428AD9 .8D95 08FEFF>lea edx,dword ptr ss:
00428ADF .52 push edx
00428AE0 .8D95 14FFFF>lea edx,dword ptr ss:
00428AE6 .8B08 mov ecx,dword ptr ds:
00428AE8 .52 push edx
00428AE9 .50 push eax
00428AEA .FF91 980800>call dword ptr ds:
00428AF0 .3BC6 cmp eax,esi
00428AF2 .7D 15 jge short 极限杀号.00428B09
00428AF4 .8B4D 08 mov ecx,dword ptr ss:
00428AF7 .68 98080000 push 898
00428AFC .68 70CC4000 push 极限杀号.0040CC70
00428B01 .51 push ecx
00428B02 .50 push eax
00428B03 .FF15 581040>call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>
00428B09 >8B95 08FEFF>mov edx,dword ptr ss: ;ss:=1C20CE05，D盘卷标号
00428B0F .8D8D 3CFFFF>lea ecx,dword ptr ss:
00428B15 .8995 44FEFF>mov dword ptr ss:,edx
00428B1B .8D95 3CFEFF>lea edx,dword ptr ss:
00428B21 .C785 3CFEFF>mov dword ptr ss:,3
00428B2B .FFD7 call edi
00428B2D .8D8D 14FFFF>lea ecx,dword ptr ss:
00428B33 .FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428B39 .8B35 3C1140>mov esi,dword ptr ds:[<&MSVBVM60.__vbaStrVarVal>>
00428B3F .8D85 3CFFFF>lea eax,dword ptr ss:
00428B45 .8D8D 10FFFF>lea ecx,dword ptr ss:
00428B4B .50 push eax
00428B4C .51 push ecx
00428B4D .FFD6 call esi ;__vbaStrVarVal，D盘卷标号转为10进制值字符串
00428B4F .50 push eax ;，0x1C20FE05("471911941")
00428B50 .FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ;rtcR8ValFromBstr,字符串转为浮点数
00428B56 .DD9D 00FEFF>fstp qword ptr ss: ;"471911941"-->471911941.0, st=471911941.0
00428B5C .8D95 5CFFFF>lea edx,dword ptr ss:
00428B62 .8D85 14FFFF>lea eax,dword ptr ss:
00428B68 .52 push edx
00428B69 .50 push eax
00428B6A .FFD6 call esi ;__vbaStrVarVal，C盘卷标号转为10进制值字符串
00428B6C .50 push eax ;0xD81F31F8 ("-669044232")
00428B6D .FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ;rtcR8ValFromBstr,字符串转为浮点数 ;"-669044232"-->-669044232.0
00428B73 .DC85 00FEFF>fadd qword ptr ss: ;两个浮点数相加，st=-197132291.0
00428B79 .8D95 3CFEFF>lea edx,dword ptr ss:
00428B7F .8D4D AC lea ecx,dword ptr ss:
00428B82 .C785 3CFEFF>mov dword ptr ss:,5
00428B8C .DC05 E01240>fadd qword ptr ds: ;ds:=123454321.0000000
00428B92 .DD9D 44FEFF>fstp qword ptr ss: ;相加结果再加上123454321.0，st=-73677970.0
00428B98 .FFD7 call edi ;-73677970-->"-73677970",机器码
00428B9A .8D8D 10FFFF>lea ecx,dword ptr ss:
00428BA0 .8D95 14FFFF>lea edx,dword ptr ss:
00428BA6 .51 push ecx
00428BA7 .52 push edx
00428BA8 .6A 02 push 2
00428BAA .FF15 781140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>]
00428BB0 .83C4 0C add esp,0C
00428BB3 .8D85 ECFEFF>lea eax,dword ptr ss:
00428BB9 .8D4D AC lea ecx,dword ptr ss:
00428BBC .8D95 DCFEFF>lea edx,dword ptr ss:
00428BC2 .50 push eax
00428BC3 .6A 01 push 1 ;常数,1
00428BC5 .51 push ecx
00428BC6 .52 push edx
00428BC7 .C785 F4FEFF>mov dword ptr ss:,1
00428BD1 .C785 ECFEFF>mov dword ptr ss:,2
00428BDB .FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ;rtcMidCharVar,取第1位字符"-"
00428BE1 .8D85 DCFEFF>lea eax,dword ptr ss:
00428BE7 .8D8D 14FFFF>lea ecx,dword ptr ss:
00428BED .50 push eax
00428BEE .51 push ecx
00428BEF .FFD6 call esi
00428BF1 .50 push eax
00428BF2 .FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ;rtcR8ValFromBstr,字符串转为浮点数
00428BF8 .DD9D 34FEFF>fstp qword ptr ss: ;st=0.0
00428BFE .8D95 2CFEFF>lea edx,dword ptr ss:
00428C04 .8D4D CC lea ecx,dword ptr ss:
00428C07 .C785 2CFEFF>mov dword ptr ss:,5
00428C11 .FFD7 call edi
00428C13 .8D8D 14FFFF>lea ecx,dword ptr ss:
00428C19 .FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428C1F .8D95 DCFEFF>lea edx,dword ptr ss:
00428C25 .8D85 ECFEFF>lea eax,dword ptr ss:
00428C2B .52 push edx
00428C2C .50 push eax
00428C2D .6A 02 push 2
00428C2F .FFD3 call ebx
00428C31 .83C4 0C add esp,0C
00428C34 .8D8D ECFEFF>lea ecx,dword ptr ss:
00428C3A .8D55 AC lea edx,dword ptr ss:
00428C3D .8D85 DCFEFF>lea eax,dword ptr ss:
00428C43 .51 push ecx
00428C44 .6A 02 push 2 ;常数,2
00428C46 .52 push edx
00428C47 .50 push eax
00428C48 .C785 F4FEFF>mov dword ptr ss:,1
00428C52 .C785 ECFEFF>mov dword ptr ss:,2
00428C5C .FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ;rtcMidCharVar,取第2位字符"7"
00428C62 .8D8D DCFEFF>lea ecx,dword ptr ss:
00428C68 .8D95 14FFFF>lea edx,dword ptr ss:
00428C6E .51 push ecx
00428C6F .52 push edx
00428C70 .FFD6 call esi
00428C72 .50 push eax
00428C73 .FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ;rtcR8ValFromBstr,字符串转为浮点数
00428C79 .DD9D 34FEFF>fstp qword ptr ss: ;st=7.0
00428C7F .8D95 2CFEFF>lea edx,dword ptr ss:
00428C85 .8D4D BC lea ecx,dword ptr ss:
00428C88 .C785 2CFEFF>mov dword ptr ss:,5
00428C92 .FFD7 call edi
00428C94 .8D8D 14FFFF>lea ecx,dword ptr ss:
00428C9A .FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428CA0 .8D85 DCFEFF>lea eax,dword ptr ss:
00428CA6 .8D8D ECFEFF>lea ecx,dword ptr ss:
00428CAC .50 push eax
00428CAD .51 push ecx
00428CAE .6A 02 push 2
00428CB0 .FFD3 call ebx
00428CB2 .83C4 0C add esp,0C
00428CB5 .8D95 ECFEFF>lea edx,dword ptr ss:
00428CBB .8D45 AC lea eax,dword ptr ss:
00428CBE .8D8D DCFEFF>lea ecx,dword ptr ss:
00428CC4 .52 push edx
00428CC5 .6A 03 push 3 ;常数,3
00428CC7 .50 push eax
00428CC8 .51 push ecx
00428CC9 .C785 F4FEFF>mov dword ptr ss:,1
00428CD3 .C785 ECFEFF>mov dword ptr ss:,2
00428CDD .FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ;rtcMidCharVar,取第3位字符"3"
00428CE3 .8D95 DCFEFF>lea edx,dword ptr ss:
00428CE9 .8D85 14FFFF>lea eax,dword ptr ss:
00428CEF .52 push edx
00428CF0 .50 push eax
00428CF1 .FFD6 call esi
00428CF3 .50 push eax
00428CF4 .FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ;rtcR8ValFromBstr,字符串转为浮点数
00428CFA .DD9D 34FEFF>fstp qword ptr ss: ;st=3.0
00428D00 .8D95 2CFEFF>lea edx,dword ptr ss:
00428D06 .8D4D 9C lea ecx,dword ptr ss:
00428D09 .C785 2CFEFF>mov dword ptr ss:,5
00428D13 .FFD7 call edi
00428D15 .8D8D 14FFFF>lea ecx,dword ptr ss:
00428D1B .FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428D21 .8D8D DCFEFF>lea ecx,dword ptr ss:
00428D27 .8D95 ECFEFF>lea edx,dword ptr ss:
00428D2D .51 push ecx
00428D2E .52 push edx
00428D2F .6A 02 push 2
00428D31 .FFD3 call ebx
00428D33 .83C4 0C add esp,0C
00428D36 .8D85 ECFEFF>lea eax,dword ptr ss:
00428D3C .8D4D AC lea ecx,dword ptr ss:
00428D3F .8D95 DCFEFF>lea edx,dword ptr ss:
00428D45 .50 push eax
00428D46 .6A 04 push 4 ;常数,4
00428D48 .51 push ecx
00428D49 .52 push edx
00428D4A .C785 F4FEFF>mov dword ptr ss:,1
00428D54 .C785 ECFEFF>mov dword ptr ss:,2
00428D5E .FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ;rtcMidCharVar,取第4位字符"6"
00428D64 .8D85 DCFEFF>lea eax,dword ptr ss:
00428D6A .8D8D 14FFFF>lea ecx,dword ptr ss:
00428D70 .50 push eax
00428D71 .51 push ecx
00428D72 .FFD6 call esi
00428D74 .50 push eax
00428D75 .FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ;rtcR8ValFromBstr,字符串转为浮点数
00428D7B .DD9D 34FEFF>fstp qword ptr ss: ;st=6.0
00428D81 .8D95 2CFEFF>lea edx,dword ptr ss:
00428D87 .8D4D 8C lea ecx,dword ptr ss:
00428D8A .C785 2CFEFF>mov dword ptr ss:,5
00428D94 .FFD7 call edi
00428D96 .8D8D 14FFFF>lea ecx,dword ptr ss:
00428D9C .FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428DA2 .8D95 DCFEFF>lea edx,dword ptr ss:
00428DA8 .8D85 ECFEFF>lea eax,dword ptr ss:
00428DAE .52 push edx
00428DAF .50 push eax
00428DB0 .6A 02 push 2
00428DB2 .FFD3 call ebx
00428DB4 .83C4 0C add esp,0C
00428DB7 .8D8D ECFEFF>lea ecx,dword ptr ss:
00428DBD .8D55 AC lea edx,dword ptr ss:
00428DC0 .8D85 DCFEFF>lea eax,dword ptr ss:
00428DC6 .51 push ecx
00428DC7 .6A 05 push 5 ;常数,5
00428DC9 .52 push edx
00428DCA .50 push eax
00428DCB .C785 F4FEFF>mov dword ptr ss:,1
00428DD5 .C785 ECFEFF>mov dword ptr ss:,2
00428DDF .FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ;rtcMidCharVar,取第5位字符"7"
00428DE5 .8D8D DCFEFF>lea ecx,dword ptr ss:
00428DEB .8D95 14FFFF>lea edx,dword ptr ss:
00428DF1 .51 push ecx
00428DF2 .52 push edx
00428DF3 .FFD6 call esi
00428DF5 .50 push eax
00428DF6 .FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ;rtcR8ValFromBstr,字符串转为浮点数
00428DFC .DD9D 34FEFF>fstp qword ptr ss: ;st=7.0
00428E02 .8D95 2CFEFF>lea edx,dword ptr ss:
00428E08 .8D8D 7CFFFF>lea ecx,dword ptr ss:
00428E0E .C785 2CFEFF>mov dword ptr ss:,5
00428E18 .FFD7 call edi
00428E1A .8D8D 14FFFF>lea ecx,dword ptr ss:
00428E20 .FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428E26 .8D85 DCFEFF>lea eax,dword ptr ss:
00428E2C .8D8D ECFEFF>lea ecx,dword ptr ss:
00428E32 .50 push eax
00428E33 .51 push ecx
00428E34 .6A 02 push 2
00428E36 .FFD3 call ebx
00428E38 .83C4 0C add esp,0C
00428E3B .8D95 ECFEFF>lea edx,dword ptr ss:
00428E41 .8D45 AC lea eax,dword ptr ss:
00428E44 .8D8D DCFEFF>lea ecx,dword ptr ss:
00428E4A .52 push edx
00428E4B .6A 06 push 6 ;常数,6
00428E4D .50 push eax
00428E4E .51 push ecx
00428E4F .C785 F4FEFF>mov dword ptr ss:,1
00428E59 .C785 ECFEFF>mov dword ptr ss:,2
00428E63 .FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ;rtcMidCharVar,取第6位字符"7"
00428E69 .8D95 DCFEFF>lea edx,dword ptr ss:
00428E6F .8D85 14FFFF>lea eax,dword ptr ss:
00428E75 .52 push edx
00428E76 .50 push eax
00428E77 .FFD6 call esi
00428E79 .50 push eax
00428E7A .FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ;rtcR8ValFromBstr,字符串转为浮点数
00428E80 .DD9D 34FEFF>fstp qword ptr ss: ;st=7.0
00428E86 .8D95 2CFEFF>lea edx,dword ptr ss:
00428E8C .8D8D 6CFFFF>lea ecx,dword ptr ss:
00428E92 .C785 2CFEFF>mov dword ptr ss:,5
00428E9C .FFD7 call edi
00428E9E .8D8D 14FFFF>lea ecx,dword ptr ss:
00428EA4 .FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428EAA .8D8D DCFEFF>lea ecx,dword ptr ss:
00428EB0 .8D95 ECFEFF>lea edx,dword ptr ss:
00428EB6 .51 push ecx
00428EB7 .52 push edx
00428EB8 .6A 02 push 2
00428EBA .FFD3 call ebx
00428EBC .83C4 0C add esp,0C
00428EBF .8D85 ECFEFF>lea eax,dword ptr ss:
00428EC5 .8D4D AC lea ecx,dword ptr ss:
00428EC8 .8D95 DCFEFF>lea edx,dword ptr ss:
00428ECE .50 push eax
00428ECF .6A 07 push 7 ;常数,7
00428ED1 .51 push ecx
00428ED2 .52 push edx
00428ED3 .C785 F4FEFF>mov dword ptr ss:,1
00428EDD .C785 ECFEFF>mov dword ptr ss:,2
00428EE7 .FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ;rtcMidCharVar,取第7位字符"9"
00428EED .8D85 DCFEFF>lea eax,dword ptr ss:
00428EF3 .8D8D 14FFFF>lea ecx,dword ptr ss:
00428EF9 .50 push eax
00428EFA .51 push ecx
00428EFB .FFD6 call esi
00428EFD .50 push eax
00428EFE .FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ;rtcR8ValFromBstr,字符串转为浮点数
00428F04 .DD9D 34FEFF>fstp qword ptr ss: ;st=9.0
00428F0A .8D95 2CFEFF>lea edx,dword ptr ss:
00428F10 .8D8D 4CFFFF>lea ecx,dword ptr ss:
00428F16 .C785 2CFEFF>mov dword ptr ss:,5
00428F20 .FFD7 call edi
00428F22 .8D8D 14FFFF>lea ecx,dword ptr ss:
00428F28 .FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428F2E .8D95 DCFEFF>lea edx,dword ptr ss:
00428F34 .8D85 ECFEFF>lea eax,dword ptr ss:
00428F3A .52 push edx
00428F3B .50 push eax
00428F3C .6A 02 push 2
00428F3E .FFD3 call ebx
00428F40 .6A 00 push 0
00428F42 .6A 07 push 7
00428F44 .6A 01 push 1
00428F46 .8D8D 18FFFF>lea ecx,dword ptr ss:
00428F4C .6A 0C push 0C
00428F4E .51 push ecx
00428F4F .6A 10 push 10
00428F51 .68 80080000 push 880
00428F56 .FF15 E81040>call dword ptr ds:[<&MSVBVM60.__vbaRedim>]
00428F5C .8B35 A01140>mov esi,dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]
00428F62 .83C4 28 add esp,28
00428F65 .8D55 CC lea edx,dword ptr ss:
00428F68 .8D85 3CFEFF>lea eax,dword ptr ss:
00428F6E .6A 01 push 1
00428F70 .52 push edx
00428F71 .8D8D ECFEFF>lea ecx,dword ptr ss:
00428F77 .50 push eax
00428F78 .51 push ecx
00428F79 .C785 44FEFF>mov dword ptr ss:,3 ;常数1－3
00428F83 .C785 3CFEFF>mov dword ptr ss:,2
00428F8D .FFD6 call esi ;__vbaVarAdd,取出的第1个数加上常数1;
00428F8F .8D95 DCFEFF>lea edx,dword ptr ss: ;0+3=3
00428F95 .50 push eax
00428F96 .52 push edx
00428F97 .FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ;rtcRightCharVar,取右边1个字符，"3"
00428F9D .8B85 18FFFF>mov eax,dword ptr ss:
00428FA3 .8D95 DCFEFF>lea edx,dword ptr ss:
00428FA9 .8B48 14 mov ecx,dword ptr ds:
00428FAC .C1E1 04 shl ecx,4
00428FAF .898D 98FDFF>mov dword ptr ss:,ecx
00428FB5 .8B48 0C mov ecx,dword ptr ds:
00428FB8 .8B85 98FDFF>mov eax,dword ptr ss:
00428FBE .2BC8 sub ecx,eax
00428FC0 .83C1 10 add ecx,10
00428FC3 .FFD7 call edi
00428FC5 .8D8D DCFEFF>lea ecx,dword ptr ss:
00428FCB .8D95 ECFEFF>lea edx,dword ptr ss:
00428FD1 .51 push ecx
00428FD2 .52 push edx
00428FD3 .6A 02 push 2
00428FD5 .FFD3 call ebx
00428FD7 .83C4 0C add esp,0C
00428FDA .8D45 CC lea eax,dword ptr ss:
00428FDD .8D4D BC lea ecx,dword ptr ss:
00428FE0 .8D95 ECFEFF>lea edx,dword ptr ss:
00428FE6 .6A 01 push 1
00428FE8 .50 push eax
00428FE9 .51 push ecx
00428FEA .52 push edx
00428FEB .C785 44FEFF>mov dword ptr ss:,7 ;常数2－7
00428FF5 .C785 3CFEFF>mov dword ptr ss:,2
00428FFF .FFD6 call esi ;__vbaVarAdd,取出的第1个数与第2个数相加
00429001 .50 push eax ;0+7=7
00429002 .8D85 3CFEFF>lea eax,dword ptr ss:
00429008 .8D8D DCFEFF>lea ecx,dword ptr ss:
0042900E .50 push eax
0042900F .51 push ecx
00429010 .FFD6 call esi ;__vbaVarAdd,相加结果加上常数2
00429012 .8D95 CCFEFF>lea edx,dword ptr ss: ;7+7=14
00429018 .50 push eax
00429019 .52 push edx
0042901A .FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ;rtcRightCharVar,取右边1个字符，"4"
00429020 .8B85 18FFFF>mov eax,dword ptr ss:
00429026 .B9 02000000 mov ecx,2
0042902B .8D95 CCFEFF>lea edx,dword ptr ss:
00429031 .2B48 14 sub ecx,dword ptr ds:
00429034 .C1E1 04 shl ecx,4
00429037 .0348 0C add ecx,dword ptr ds:
0042903A .FFD7 call edi
0042903C .8D85 CCFEFF>lea eax,dword ptr ss:
00429042 .8D8D DCFEFF>lea ecx,dword ptr ss:
00429048 .50 push eax
00429049 .8D95 ECFEFF>lea edx,dword ptr ss:
0042904F .51 push ecx
00429050 .52 push edx
00429051 .6A 03 push 3
00429053 .FFD3 call ebx
00429055 .B8 02000000 mov eax,2 ;EAX＝2,常数3－2
0042905A .83C4 10 add esp,10
0042905D .8985 44FEFF>mov dword ptr ss:,eax
00429063 .8985 3CFEFF>mov dword ptr ss:,eax
00429069 .8D45 CC lea eax,dword ptr ss:
0042906C .6A 01 push 1
0042906E .8D4D BC lea ecx,dword ptr ss:
00429071 .50 push eax
00429072 .8D95 ECFEFF>lea edx,dword ptr ss:
00429078 .51 push ecx
00429079 .52 push edx
0042907A .FFD6 call esi ;__vbaVarAdd,取出的第1个数与第2个数相加
0042907C .50 push eax ;0+7=7
0042907D .8D45 9C lea eax,dword ptr ss:
00429080 .8D8D DCFEFF>lea ecx,dword ptr ss:
00429086 .50 push eax
00429087 .51 push ecx
00429088 .FFD6 call esi ;__vbaVarAdd,取出的第1,2，3个数相加
0042908A .50 push eax ;0+7+3＝10
0042908B .8D95 3CFEFF>lea edx,dword ptr ss:
00429091 .8D85 CCFEFF>lea eax,dword ptr ss:
00429097 .52 push edx
00429098 .50 push eax
00429099 .FFD6 call esi ;__vbaVarAdd,相加结果加上常数3
0042909B .8D8D BCFEFF>lea ecx,dword ptr ss: ;10+2=12
004290A1 .50 push eax
004290A2 .51 push ecx
004290A3 .FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ;rtcRightCharVar,取右边1个字符，"2"
004290A9 .8B85 18FFFF>mov eax,dword ptr ss:
004290AF .B9 03000000 mov ecx,3
004290B4 .8D95 BCFEFF>lea edx,dword ptr ss:
004290BA .2B48 14 sub ecx,dword ptr ds:
004290BD .C1E1 04 shl ecx,4
004290C0 .0348 0C add ecx,dword ptr ds:
004290C3 .FFD7 call edi
004290C5 .8D95 BCFEFF>lea edx,dword ptr ss:
004290CB .8D85 CCFEFF>lea eax,dword ptr ss:
004290D1 .52 push edx
004290D2 .8D8D DCFEFF>lea ecx,dword ptr ss:
004290D8 .50 push eax
004290D9 .8D95 ECFEFF>lea edx,dword ptr ss:
004290DF .51 push ecx
004290E0 .52 push edx
004290E1 .6A 04 push 4
004290E3 .FFD3 call ebx
004290E5 .B8 02000000 mov eax,2 ;EAX＝2,常数4－2
004290EA .83C4 14 add esp,14
004290ED .8985 44FEFF>mov dword ptr ss:,eax
004290F3 .8985 3CFEFF>mov dword ptr ss:,eax
004290F9 .8D45 CC lea eax,dword ptr ss:
004290FC .6A 01 push 1
004290FE .8D4D BC lea ecx,dword ptr ss:
00429101 .50 push eax
00429102 .8D95 ECFEFF>lea edx,dword ptr ss:
00429108 .51 push ecx
00429109 .52 push edx
0042910A .FFD6 call esi ;__vbaVarAdd,取出的第1个数与第2个数相加
0042910C .50 push eax ;0+7=7
0042910D .8D45 9C lea eax,dword ptr ss:
00429110 .8D8D DCFEFF>lea ecx,dword ptr ss:
00429116 .50 push eax
00429117 .51 push ecx
00429118 .FFD6 call esi ;__vbaVarAdd,取出的第1,2，3个数相加
0042911A .50 push eax ;0+7+3＝10
0042911B .8D55 8C lea edx,dword ptr ss:
0042911E .8D85 CCFEFF>lea eax,dword ptr ss:
00429124 .52 push edx
00429125 .50 push eax
00429126 .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3,4个数相加
00429128 .8D8D 3CFEFF>lea ecx,dword ptr ss: ;0+7+3+6=16
0042912E .50 push eax
0042912F .51 push ecx
00429130 .8D95 BCFEFF>lea edx,dword ptr ss:
00429136 .52 push edx
00429137 .FFD6 call esi ;__vbaVarAdd,相加结果加上常数4
00429139 .50 push eax ;16+2=18
0042913A .8D85 ACFEFF>lea eax,dword ptr ss:
00429140 .50 push eax
00429141 .FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ;rtcRightCharVar,取右边1个字符，"8"
00429147 .8B85 18FFFF>mov eax,dword ptr ss:
0042914D .B9 04000000 mov ecx,4
00429152 .8D95 ACFEFF>lea edx,dword ptr ss:
00429158 .2B48 14 sub ecx,dword ptr ds:
0042915B .C1E1 04 shl ecx,4
0042915E .0348 0C add ecx,dword ptr ds:
00429161 .FFD7 call edi
00429163 .8D8D ACFEFF>lea ecx,dword ptr ss:
00429169 .8D95 BCFEFF>lea edx,dword ptr ss:
0042916F .51 push ecx
00429170 .8D85 CCFEFF>lea eax,dword ptr ss:
00429176 .52 push edx
00429177 .8D8D DCFEFF>lea ecx,dword ptr ss:
0042917D .50 push eax
0042917E .8D95 ECFEFF>lea edx,dword ptr ss:
00429184 .51 push ecx
00429185 .52 push edx
00429186 .6A 05 push 5
00429188 .FFD3 call ebx
0042918A .83C4 18 add esp,18
0042918D .8D45 CC lea eax,dword ptr ss:
00429190 .8D4D BC lea ecx,dword ptr ss:
00429193 .8D95 ECFEFF>lea edx,dword ptr ss:
00429199 .6A 01 push 1
0042919B .50 push eax
0042919C .51 push ecx
0042919D .52 push edx
0042919E .C785 44FEFF>mov dword ptr ss:,8 ;常数5－8
004291A8 .C785 3CFEFF>mov dword ptr ss:,2
004291B2 .FFD6 call esi ;__vbaVarAdd,取出的第1个数与第2个数相加
004291B4 .50 push eax ;0+7=7
004291B5 .8D45 9C lea eax,dword ptr ss:
004291B8 .8D8D DCFEFF>lea ecx,dword ptr ss:
004291BE .50 push eax
004291BF .51 push ecx
004291C0 .FFD6 call esi ;__vbaVarAdd,取出的第1,2，3个数相加
004291C2 .50 push eax ;0+7+3＝10
004291C3 .8D55 8C lea edx,dword ptr ss:
004291C6 .8D85 CCFEFF>lea eax,dword ptr ss:
004291CC .52 push edx
004291CD .50 push eax
004291CE .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3,4个数相加
004291D0 .8D8D 7CFFFF>lea ecx,dword ptr ss: ;0+7+3+6=16
004291D6 .50 push eax
004291D7 .8D95 BCFEFF>lea edx,dword ptr ss:
004291DD .51 push ecx
004291DE .52 push edx
004291DF .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3,4,5个数相加
004291E1 .50 push eax ;0+7+3+6+7=23
004291E2 .8D85 3CFEFF>lea eax,dword ptr ss:
004291E8 .8D8D ACFEFF>lea ecx,dword ptr ss:
004291EE .50 push eax
004291EF .51 push ecx
004291F0 .FFD6 call esi ;__vbaVarAdd,相加结果加上常数5
004291F2 .8D95 9CFEFF>lea edx,dword ptr ss: ;23+8=31
004291F8 .50 push eax
004291F9 .52 push edx
004291FA .FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ;rtcRightCharVar,取右边1个字符，"1"
00429200 .8B85 18FFFF>mov eax,dword ptr ss:
00429206 .B9 05000000 mov ecx,5
0042920B .8D95 9CFEFF>lea edx,dword ptr ss:
00429211 .2B48 14 sub ecx,dword ptr ds:
00429214 .C1E1 04 shl ecx,4
00429217 .0348 0C add ecx,dword ptr ds:
0042921A .FFD7 call edi
0042921C .8D85 9CFEFF>lea eax,dword ptr ss:
00429222 .8D8D ACFEFF>lea ecx,dword ptr ss:
00429228 .50 push eax
00429229 .8D95 BCFEFF>lea edx,dword ptr ss:
0042922F .51 push ecx
00429230 .8D85 CCFEFF>lea eax,dword ptr ss:
00429236 .52 push edx
00429237 .50 push eax
00429238 .8D8D DCFEFF>lea ecx,dword ptr ss:
0042923E .8D95 ECFEFF>lea edx,dword ptr ss:
00429244 .51 push ecx
00429245 .52 push edx
00429246 .6A 06 push 6
00429248 .FFD3 call ebx
0042924A .83C4 1C add esp,1C
0042924D .8D45 CC lea eax,dword ptr ss:
00429250 .8D4D BC lea ecx,dword ptr ss:
00429253 .8D95 ECFEFF>lea edx,dword ptr ss:
00429259 .6A 01 push 1
0042925B .50 push eax
0042925C .51 push ecx
0042925D .52 push edx
0042925E .C785 44FEFF>mov dword ptr ss:,7 ;常数6－7
00429268 .C785 3CFEFF>mov dword ptr ss:,2
00429272 .FFD6 call esi ;__vbaVarAdd,取出的第1个数与第2个数相加
00429274 .50 push eax ;0+7=7
00429275 .8D45 9C lea eax,dword ptr ss:
00429278 .8D8D DCFEFF>lea ecx,dword ptr ss:
0042927E .50 push eax
0042927F .51 push ecx
00429280 .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3个数相加
00429282 .50 push eax ;0+7+3＝10
00429283 .8D55 8C lea edx,dword ptr ss:
00429286 .8D85 CCFEFF>lea eax,dword ptr ss:
0042928C .52 push edx
0042928D .50 push eax
0042928E .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3,4个数相加
00429290 .8D8D 7CFFFF>lea ecx,dword ptr ss: ;0+7+3+6=16
00429296 .50 push eax
00429297 .8D95 BCFEFF>lea edx,dword ptr ss:
0042929D .51 push ecx
0042929E .52 push edx
0042929F .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3,4,5个数相加
004292A1 .50 push eax ;0+7+3+6+7=23
004292A2 .8D85 6CFFFF>lea eax,dword ptr ss:
004292A8 .8D8D ACFEFF>lea ecx,dword ptr ss:
004292AE .50 push eax
004292AF .51 push ecx
004292B0 .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3,4,5,6数相加
004292B2 .50 push eax ;0+7+3+6+7+7=30
004292B3 .8D95 3CFEFF>lea edx,dword ptr ss:
004292B9 .8D85 9CFEFF>lea eax,dword ptr ss:
004292BF .52 push edx
004292C0 .50 push eax
004292C1 .FFD6 call esi ;__vbaVarAdd,相加结果加上常数6
004292C3 .8D8D 8CFEFF>lea ecx,dword ptr ss: ;30+7=37
004292C9 .50 push eax
004292CA .51 push ecx
004292CB .FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ;rtcRightCharVar,取右边1个字符，"7"
004292D1 .8B85 18FFFF>mov eax,dword ptr ss:
004292D7 .B9 06000000 mov ecx,6
004292DC .8D95 8CFEFF>lea edx,dword ptr ss:
004292E2 .2B48 14 sub ecx,dword ptr ds:
004292E5 .C1E1 04 shl ecx,4
004292E8 .0348 0C add ecx,dword ptr ds:
004292EB .FFD7 call edi
004292ED .8D95 8CFEFF>lea edx,dword ptr ss:
004292F3 .8D85 9CFEFF>lea eax,dword ptr ss:
004292F9 .52 push edx
004292FA .8D8D ACFEFF>lea ecx,dword ptr ss:
00429300 .50 push eax
00429301 .8D95 BCFEFF>lea edx,dword ptr ss:
00429307 .51 push ecx
00429308 .8D85 CCFEFF>lea eax,dword ptr ss:
0042930E .52 push edx
0042930F .8D8D DCFEFF>lea ecx,dword ptr ss:
00429315 .50 push eax
00429316 .8D95 ECFEFF>lea edx,dword ptr ss:
0042931C .51 push ecx
0042931D .52 push edx
0042931E .6A 07 push 7
00429320 .FFD3 call ebx
00429322 .83C4 20 add esp,20
00429325 .8D45 CC lea eax,dword ptr ss:
00429328 .8D4D BC lea ecx,dword ptr ss:
0042932B .C785 44FEFF>mov dword ptr ss:,7 ;常数7－7
00429335 .6A 01 push 1
00429337 .50 push eax
00429338 .C785 3CFEFF>mov dword ptr ss:,2
00429342 .51 push ecx
00429343 .8D95 ECFEFF>lea edx,dword ptr ss:
00429349 .52 push edx
0042934A .FFD6 call esi ;__vbaVarAdd,取出的第1个数与第2个数相加
0042934C .50 push eax ;0+7=10
0042934D .8D45 9C lea eax,dword ptr ss:
00429350 .8D8D DCFEFF>lea ecx,dword ptr ss:
00429356 .50 push eax
00429357 .51 push ecx
00429358 .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3,数相加
0042935A .50 push eax ;0+7+3=13
0042935B .8D55 8C lea edx,dword ptr ss:
0042935E .8D85 CCFEFF>lea eax,dword ptr ss:
00429364 .52 push edx
00429365 .50 push eax
00429366 .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3,4数相加
00429368 .8D8D 7CFFFF>lea ecx,dword ptr ss: ;0+7+3+6=16
0042936E .50 push eax
0042936F .8D95 BCFEFF>lea edx,dword ptr ss:
00429375 .51 push ecx
00429376 .52 push edx
00429377 .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3,4,5数相加
00429379 .50 push eax ;0+7+3+6+7=23
0042937A .8D85 6CFFFF>lea eax,dword ptr ss:
00429380 .8D8D ACFEFF>lea ecx,dword ptr ss:
00429386 .50 push eax
00429387 .51 push ecx
00429388 .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3,4,5,6数相加
0042938A .50 push eax ;0+7+3+6+7+7=30
0042938B .8D95 4CFFFF>lea edx,dword ptr ss:
00429391 .8D85 9CFEFF>lea eax,dword ptr ss:
00429397 .52 push edx
00429398 .50 push eax
00429399 .FFD6 call esi ;__vbaVarAdd,取出的第1,2,3,4,5,6,7数相加
0042939B .8D8D 3CFEFF>lea ecx,dword ptr ss: ;0+7+3+6+7+7+9=39
004293A1 .50 push eax
004293A2 .8D95 8CFEFF>lea edx,dword ptr ss:
004293A8 .51 push ecx
004293A9 .52 push edx
004293AA .FFD6 call esi ;__vbaVarAdd,相加结果加上常数7
004293AC .50 push eax ;39+7=46
004293AD .8D85 7CFEFF>lea eax,dword ptr ss:
004293B3 .50 push eax
004293B4 .FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ;rtcRightCharVar,取右边1个字符，"6"
004293BA .8B85 18FFFF>mov eax,dword ptr ss: ;依次连接所得的7个字符即为真码"3428176"
004293C0 .B9 07000000 mov ecx,7
004293C5 .8D95 7CFEFF>lea edx,dword ptr ss:
004293CB .2B48 14 sub ecx,dword ptr ds:
004293CE .C1E1 04 shl ecx,4
004293D1 .0348 0C add ecx,dword ptr ds:
004293D4 .FFD7 call edi
004293D6 .8D8D 7CFEFF>lea ecx,dword ptr ss:
004293DC .8D95 8CFEFF>lea edx,dword ptr ss:
004293E2 .51 push ecx
004293E3 .8D85 9CFEFF>lea eax,dword ptr ss:
004293E9 .52 push edx
004293EA .8D8D ACFEFF>lea ecx,dword ptr ss:
004293F0 .50 push eax
004293F1 .8D95 BCFEFF>lea edx,dword ptr ss:
004293F7 .51 push ecx
004293F8 .8D85 CCFEFF>lea eax,dword ptr ss:
004293FE .52 push edx
004293FF .8D8D DCFEFF>lea ecx,dword ptr ss:
00429405 .50 push eax
00429406 .8D95 ECFEFF>lea edx,dword ptr ss:
0042940C .51 push ecx
0042940D .52 push edx
0042940E .6A 08 push 8
00429410 .FFD3 call ebx
00429412 .8B45 08 mov eax,dword ptr ss:
00429415 .83C4 24 add esp,24
00429418 .83C0 60 add eax,60
0042941B .8B08 mov ecx,dword ptr ds:
0042941D .51 push ecx
0042941E .68 D8D84000 push 极限杀号.0040D8D8
00429423 .FF15 481040>call dword ptr ds:[<&MSVBVM60.__vbaStrCat>]
00429429 .8BD0 mov edx,eax
0042942B .8D8D 14FFFF>lea ecx,dword ptr ss:
00429431 .FF15 C41140>call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]
00429437 .50 push eax
00429438 .6A 01 push 1
0042943A .6A FF push -1
0042943C .6A 01 push 1
0042943E .FF15 501140>call dword ptr ds:[<&MSVBVM60.__vbaFileOpen>] ;打开文件
00429444 .8D8D 14FFFF>lea ecx,dword ptr ss:
0042944A .FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00429450 .8D95 3CFEFF>lea edx,dword ptr ss:
00429456 .8D4D DC lea ecx,dword ptr ss:
00429459 .C785 44FEFF>mov dword ptr ss:,0
00429463 .C785 3CFEFF>mov dword ptr ss:,2
0042946D .FFD7 call edi
0042946F >6A 01 push 1
00429471 .FF15 601140>call dword ptr ds:[<&MSVBVM60.#571>] ;MSVBVM60.rtcEndOfFile
00429477 .66:85C0 test ax,ax
0042947A .0F85 BE0000>jnz 极限杀号.0042953E
00429480 .8D95 1CFFFF>lea edx,dword ptr ss:
00429486 .6A 01 push 1
00429488 .52 push edx
00429489 .FF15 401040>call dword ptr ds:[<&MSVBVM60.__vbaLineInputVar>>
0042948F .8D85 1CFFFF>lea eax,dword ptr ss:
00429495 .8D8D ECFEFF>lea ecx,dword ptr ss:
0042949B .50 push eax
0042949C .51 push ecx
0042949D .C785 44FEFF>mov dword ptr ss:,5
004294A7 .C785 3CFEFF>mov dword ptr ss:,8002
004294B1 .FF15 5C1040>call dword ptr ds:[<&MSVBVM60.__vbaLenVar>]
004294B7 .8D95 3CFEFF>lea edx,dword ptr ss:
004294BD .50 push eax
004294BE .52 push edx
004294BF .FF15 041040>call dword ptr ds:[<&MSVBVM60.__vbaVarTstGt>]
004294C5 .66:85C0 test ax,ax
004294C8 .^ 74 A5 je short 极限杀号.0042946F
004294CA .8D45 DC lea eax,dword ptr ss:
004294CD .8D8D 3CFEFF>lea ecx,dword ptr ss:
004294D3 .50 push eax
004294D4 .8D95 ECFEFF>lea edx,dword ptr ss:
004294DA .51 push ecx
004294DB .52 push edx
004294DC .C785 44FEFF>mov dword ptr ss:,1
004294E6 .C785 3CFEFF>mov dword ptr ss:,2
004294F0 .FFD6 call esi
004294F2 .8BD0 mov edx,eax
004294F4 .8D4D DC lea ecx,dword ptr ss:
004294F7 .FFD7 call edi
004294F9 .8D45 DC lea eax,dword ptr ss:
004294FC .8D8D 3CFEFF>lea ecx,dword ptr ss:
00429502 .50 push eax
00429503 .51 push ecx
00429504 .C785 44FEFF>mov dword ptr ss:,1
0042950E .C785 3CFEFF>mov dword ptr ss:,8002
00429518 .FF15 D41040>call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>]
0042951E .66:85C0 test ax,ax
00429521 .^ 0F84 48FFFF>je 极限杀号.0042946F
00429527 .8D95 1CFFFF>lea edx,dword ptr ss:
0042952D .8D8D 2CFFFF>lea ecx,dword ptr ss:
00429533 .FF15 B81140>call dword ptr ds:[<&MSVBVM60.__vbaVarCopy>]
00429539 .^ E9 31FFFFFF jmp 极限杀号.0042946F
0042953E >BF 01000000 mov edi,1
00429543 .57 push edi
00429544 .FF15 C81040>call dword ptr ds:[<&MSVBVM60.__vbaFileClose>] ;关闭文件
0042954A .8D55 DC lea edx,dword ptr ss:
0042954D .8D85 3CFEFF>lea eax,dword ptr ss:
00429553 .52 push edx
00429554 .50 push eax
00429555 .C785 44FEFF>mov dword ptr ss:,0
0042955F .C785 3CFEFF>mov dword ptr ss:,8002
00429569 .FF15 D41040>call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>] ;比较文件内容是否为空
0042956F .66:85C0 test ax,ax
00429572 .74 26 je short 极限杀号.0042959A ;不为空则跳
00429574 .8D95 3CFEFF>lea edx,dword ptr ss:
0042957A .8D8D 2CFFFF>lea ecx,dword ptr ss:
00429580 .C785 44FEFF>mov dword ptr ss:,极限杀号.0040D8F0 ;1234567,文件内容为空则赋值注册码为1234567
0042958A .C785 3CFEFF>mov dword ptr ss:,8
00429594 .FF15 B81140>call dword ptr ds:[<&MSVBVM60.__vbaVarCopy>]
0042959A >8B75 08 mov esi,dword ptr ss:
0042959D .B8 02000000 mov eax,2
004295A2 .8D8D 3CFEFF>lea ecx,dword ptr ss:
004295A8 .8985 3CFEFF>mov dword ptr ss:,eax
004295AE .8985 2CFEFF>mov dword ptr ss:,eax
004295B4 .8985 1CFEFF>mov dword ptr ss:,eax
004295BA .8D95 2CFEFF>lea edx,dword ptr ss:
004295C0 .51 push ecx
004295C1 .8D85 1CFEFF>lea eax,dword ptr ss:
004295C7 .52 push edx
004295C8 .8D8D B0FDFF>lea ecx,dword ptr ss:
004295CE .50 push eax
004295CF .8D95 C0FDFF>lea edx,dword ptr ss:
004295D5 .51 push ecx
004295D6 .8D45 DC lea eax,dword ptr ss:
004295D9 .52 push edx
004295DA .50 push eax
004295DB .66:C746 7A >mov word ptr ds:,0
004295E1 .89BD 44FEFF>mov dword ptr ss:,edi
004295E7 .C785 34FEFF>mov dword ptr ss:,7
004295F1 .89BD 24FEFF>mov dword ptr ss:,edi
004295F7 .FF15 6C1040>call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>]
004295FD .8B3D 901140>mov edi,dword ptr ds:[<&MSVBVM60.__vbaI4Var>]
00429603 >85C0 test eax,eax
00429605 .0F84 CD0000>je 极限杀号.004296D8
0042960B .8D8D ECFEFF>lea ecx,dword ptr ss:
00429611 .8D55 DC lea edx,dword ptr ss:
00429614 .51 push ecx
00429615 .52 push edx
00429616 .C785 F4FEFF>mov dword ptr ss:,1
00429620 .C785 ECFEFF>mov dword ptr ss:,2
0042962A .FFD7 call edi
0042962C .50 push eax
0042962D .8D85 2CFFFF>lea eax,dword ptr ss:
00429633 .8D8D DCFEFF>lea ecx,dword ptr ss:
00429639 .50 push eax
0042963A .51 push ecx
0042963B .FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ;rtcMidCharVar,依次取假码第一位字符
00429641 .66:8B56 7Amov dx,word ptr ds:
00429645 .8D85 2CFEFF>lea eax,dword ptr ss:
0042964B .8D4D DC lea ecx,dword ptr ss:
0042964E .50 push eax
0042964F .51 push ecx
00429650 .66:8995 34F>mov word ptr ss:,dx
00429657 .C785 2CFEFF>mov dword ptr ss:,2
00429661 .FFD7 call edi
00429663 .8BD0 mov edx,eax
00429665 .8B85 18FFFF>mov eax,dword ptr ss:
0042966B .8B48 14 mov ecx,dword ptr ds:
0042966E .2BD1 sub edx,ecx
00429670 .8B48 0C mov ecx,dword ptr ds:
00429673 .C1E2 04 shl edx,4
00429676 .03D1 add edx,ecx
00429678 .8D85 DCFEFF>lea eax,dword ptr ss:
0042967E .52 push edx
0042967F .8D8D CCFEFF>lea ecx,dword ptr ss:
00429685 .50 push eax
00429686 .51 push ecx
00429687 .FF15 941140>call dword ptr ds:[<&MSVBVM60.__vbaVarCmpEq>] ;取出假码逐位与真码比较
0042968D .8D95 BCFEFF>lea edx,dword ptr ss:
00429693 .50 push eax
00429694 .52 push edx
00429695 .FF15 001040>call dword ptr ds:[<&MSVBVM60.__vbaVarSub>]
0042969B .50 push eax
0042969C .FF15 441140>call dword ptr ds:[<&MSVBVM60.__vbaI2Var>]
004296A2 .66:8946 7Amov word ptr ds:,ax ;AX赋值给ds:,不等时AX为0
004296A6 .8D85 DCFEFF>lea eax,dword ptr ss:
004296AC .8D8D ECFEFF>lea ecx,dword ptr ss:
004296B2 .50 push eax
004296B3 .51 push ecx
004296B4 .6A 02 push 2
004296B6 .FFD3 call ebx
004296B8 .83C4 0C add esp,0C
004296BB .8D95 B0FDFF>lea edx,dword ptr ss:
004296C1 .8D85 C0FDFF>lea eax,dword ptr ss:
004296C7 .8D4D DC lea ecx,dword ptr ss:
004296CA .52 push edx
004296CB .50 push eax
004296CC .51 push ecx
004296CD .FF15 E41140>call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>]
004296D3 .^ E9 2BFFFFFF jmp 极限杀号.00429603
004296D8 >66:837E 7A >cmp word ptr ds:,7 ;ds:中的值与7比较
004296DD 0F84 A30300>je 极限杀号.00429A86 ;相等则跳，暴破点，改为jmp
004296E3 .8B16 mov edx,dword ptr ds:
004296E5 .56 push esi
-----------------------------------------------------------------------------------------------
【破解总结】
1.程序取C盘和D盘卷标号转为有符号10进制数相加后再加上123454321，结果转为字符串形式即为机器码。
2.取机器码前7位进行运算，内置7个常数用于每次的运算，每次运算完取右边一位字符，最后将7个字符连接即为真码。
一组可用注册码：
======================
序列号:-73677970
注册码:3428176
======================
注册信息保存在程序目录下的注册信息.txt,消除则又是未注册状态。
暴破更改以下位置：
004296DD je 极限杀号.00429A86 ; je====>jmp
【VB注册机源码】
Private Sub Generate_Click()
On Error Resume Next
Dim Serial As String
Dim RegCode As String
Dim i As Integer
Dim num1, num2, num3, num4, num5, num6, num7 As Integer
Dim str1, str2, str3, str4, str5, str6, str7 As String
If Len(Text1.Text) < 7 Then
Text2.Text = "序列号错误！"
Else
Serial = Text1.Text
If Asc(Mid(Serial, 1, 1)) = &H2D Then
num1 = 3
Else
num1 = Mid(Serial, 1, 1) + 3
End If
str1 = Right(num1, 1)
num2 = (num1 - 3) + Mid(Serial, 2, 1)
num2 = num2 + 7
str2 = Right(num2, 1)
num3 = (num2 - 7) + Mid(Serial, 3, 1)
num3 = num3 + 2
str3 = Right(num3, 1)
num4 = (num3 - 2) + Mid(Serial, 4, 1)
num4 = num4 + 2
str4 = Right(num4, 1)
num5 = (num4 - 2) + Mid(Serial, 5, 1)
num5 = num5 + 8
str5 = Right(num5, 1)
num6 = (num5 - 8) + Mid(Serial, 6, 1)
num6 = num6 + 7
str6 = Right(num6, 1)
num7 = (num6 - 7) + Mid(Serial, 7, 1)
num7 = num7 + 7
str7 = Right(num7, 1)
RegCode = str1 & str2 & str3 & str4 & str5 & str6 & str7
Text2.Text = RegCode
End If
End Sub
-----------------------------------------------------------------------------------------------
【版权声明】本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
学习了``` 学习了 看到vb的程序就头疼 VB写的，好文章，学习！ VB玩的转啊，学习下。 VB很难搞呀，注册机画面不错呀 请教了,我参照你的方法.表面上是成功了.可是一运行,软件又提示未注册.不知何故.是否还有其他的爆破点.我的机器码是1297419196,能帮吗?先谢了! 试试这个：
序列号：1297419196
注册码：4041110
Enjoy it! 谢谢.菜鸟向大虾致敬!了不起!
注册机
刚学VB，试一下做了个注册机[ 本帖最后由 lhl8730 于 2006-5-23 12:12 编辑 ]