流星网络电视VIP(我个人认为没有网络验证)

qq500com · 发表于 2006-12-9 17:37:52

流星网络电视VIP(我个人认为没有网络验证)

注册码;
标准版 16位

vip版 24位

钻石版 32位

[ 本帖最后由 qq500com 于 2006-12-14 20:20 编辑 ]

yunfeng · 发表于 2006-12-9 18:41:07

我试用了,我怎么有网络验证的?

菜儿 · 发表于 2006-12-9 21:00:51

本帖最后由 qq500com 于 2006-12-9 18:42 发表
流星网络电视VIP(我个人认为没有网络验证 )

:handshake

正版的应该是注册码加补丁...

以前追过老版本...改改跳转就可以看[钻石版]了.....感觉他的[钻石版]验证是固定的字附串...以字附串来决定他是什么版....我个人感觉这不是网络验证...

网络验证---应该是他的数据库内保存有我们的用户名变换字附串...这样这样他保留有底的注册用户才可以看....

[ 本帖最后由菜儿于 2006-12-10 10:05 编辑 ]

菜儿 · 发表于 2006-12-9 21:10:03

原帖由 qq500com 于 2006-12-9 17:37 发表
流星网络电视VIP(我个人认为没有网络验证)

兄弟最好整个教程...让大家学习一下作者加密的思路...
难道只让作者了解我们解密的思路........
谢谢兄弟....:victory:

qq500com · 发表于 2006-12-10 00:14:27

小菜没有注册成功,注册成功后一定做个教程.

wyh1983 · 发表于 2006-12-10 02:34:58

对，把你的思路和你的过程来个贴子，兄弟们一起研究一下了。

yunfeng · 发表于 2006-12-10 08:39:38

原帖由 qq500com 于 2006-12-9 17:37 发表
流星网络电视VIP(我个人认为没有网络验证)

网络验证机制还是有的，没有的话，如何区分标准版、VIP版、和钻石版？

Nisy · 发表于 2006-12-10 10:03:19

不会吧这么好的事咋都让兄弟给遇到了~~ 呵呵确实是有网络验证的~ 不过不清楚兄弟那怎么直接过了VIP~

飘云 · 发表于 2006-12-10 10:07:19

原帖由 qq500com 于 2006-12-9 17:37 发表
流星网络电视VIP(我个人认为没有网络验证)

网络验证乎？呵呵
这么多人讨论，，就发段关键代码出来吧~~
自由发挥！！

00505390 push ebp
00505391 mov ebp, esp
00505393 mov ecx, 14
00505398 /push 0
0050539A |push 0
0050539C |dec ecx
0050539D \jnz short 00505398
0050539F push ecx
005053A0 push ebx
005053A1 push esi
005053A2 mov ebx, eax
005053A4 xor eax, eax
005053A6 push ebp
005053A7 push 005058BF
005053AC push dword ptr fs:[eax]
005053AF mov dword ptr fs:[eax], esp
005053B2 mov dl, 1
005053B4 mov eax, dword ptr [43BF20]
005053B9 call 0043C020
005053BE mov esi, eax
005053C0 mov edx, 80000002
005053C5 mov eax, esi
005053C7 call 0043C0C0
005053CC mov cl, 1
005053CE mov edx, 005058D4 ; \software\microsoft\windows\currentversion\olympic
005053D3 mov eax, esi
005053D5 call 0043C128
005053DA test al, al ;★★★★
005053DC je short 005053FB
005053DE lea ecx, dword ptr [ebp-C]
005053E1 mov edx, 00505910 ; pic
005053E6 mov eax, esi
005053E8 call 0043C598
005053ED mov edx, dword ptr [ebp-C]
005053F0 lea eax, dword ptr [ebx+4B0]
005053F6 call 00404474
005053FB mov edx, 80000001
00505400 mov eax, esi
00505402 call 0043C0C0
00505407 mov cl, 1
00505409 mov edx, 0050591C ; \software\microsoft\windows\currentversion\patron
0050540E mov eax, esi
00505410 call 0043C128
00505415 test al, al ;★★★★
00505417 je short 00505436
00505419 lea ecx, dword ptr [ebp-10]
0050541C mov edx, 00505958 ; mortal
00505421 mov eax, esi
00505423 call 0043C598
00505428 mov edx, dword ptr [ebp-10]
0050542B lea eax, dword ptr [ebx+4B8]
00505431 call 00404474
00505436 mov eax, esi
00505438 call 0043C090
0050543D mov eax, esi
0050543F call 0040356C
00505444 lea ecx, dword ptr [ebp-14]
00505447 mov edx, 00505968 ; meteortv.username
0050544C mov eax, dword ptr [ebx+4B8]
00505452 call 0047B31C
00505457 mov edx, dword ptr [ebp-14]
0050545A lea eax, dword ptr [ebx+4B8]
00505460 call 00404474
00505465 lea edx, dword ptr [ebp-4]
00505468 mov eax, dword ptr [ebx+4B8]
0050546E call 0047BF20
00505473 lea ecx, dword ptr [ebp-18]
00505476 mov edx, 00505984 ; killyou?yes
0050547B mov eax, dword ptr [ebp-4]
0050547E call 004DFA54
00505483 mov edx, dword ptr [ebp-18]
00505486 lea eax, dword ptr [ebp-4]
00505489 call 004044B8
0050548E lea ecx, dword ptr [ebp-20]
00505491 mov edx, 00505998 ; http://www.jesen.cn
00505496 mov eax, dword ptr [ebx+4BC]
0050549C call 0047B134
005054A1 mov edx, dword ptr [ebp-20]
005054A4 lea ecx, dword ptr [ebp-1C]
005054A7 mov eax, dword ptr [ebp-4]
005054AA call 0047B134
005054AF mov edx, dword ptr [ebp-1C]
005054B2 lea eax, dword ptr [ebp-4]
005054B5 call 004044B8
005054BA lea edx, dword ptr [ebp-24]
005054BD mov eax, dword ptr [ebp-4]
005054C0 call 0047BF20
005054C5 mov edx, dword ptr [ebp-24]
005054C8 lea eax, dword ptr [ebp-4]
005054CB call 004044B8
005054D0 mov eax, dword ptr [ebx+4B0]
005054D6 call 004046E0 ;★★★★
005054DB sub eax, 0A
005054DE je short 00505542
005054E0 sub eax, 2
005054E3 je short 005054FC
005054E5 sub eax, 2
005054E8 je 00505606
005054EE sub eax, 2
005054F1 je 005056CA
005054F7 jmp 005058A1
005054FC push 005131AC ; Case C of switch 005054DB
00505501 lea edx, dword ptr [ebp-2C]
00505504 mov eax, dword ptr [ebp-4]
00505507 call 0047BF20
0050550C mov eax, dword ptr [ebp-2C]
0050550F lea ecx, dword ptr [ebp-28]
00505512 mov edx, 005059B4 ; impressions
00505517 call 0047B134
0050551C mov eax, dword ptr [ebp-28]
0050551F mov ecx, 0C
00505524 mov edx, 0C
00505529 call 00404940
0050552E xor eax, eax
00505530 mov dword ptr [5131B4], eax
00505535 lea eax, dword ptr [ebp-8]
00505538 call 00404420
0050553D jmp 005057A8
00505542 push 005131AC ; Case A of switch 005054DB
00505547 lea eax, dword ptr [ebp-3C]
0050554A push eax
0050554B mov ecx, 5
00505550 mov edx, 10
00505555 mov eax, dword ptr [ebp-4]
00505558 call 00404940
0050555D push dword ptr [ebp-3C]
00505560 lea eax, dword ptr [ebp-40]
00505563 push eax
00505564 mov ecx, 4
00505569 mov edx, 4
0050556E mov eax, dword ptr [ebp-4]
00505571 call 00404940
00505576 push dword ptr [ebp-40]
00505579 lea eax, dword ptr [ebp-44]
0050557C push eax
0050557D mov ecx, 4
00505582 mov edx, 12
00505587 mov eax, dword ptr [ebp-4]
0050558A call 00404940
0050558F push dword ptr [ebp-44]
00505592 lea eax, dword ptr [ebp-48]
00505595 push eax
00505596 mov ecx, 3
0050559B mov edx, 1D
005055A0 mov eax, dword ptr [ebp-4]
005055A3 call 00404940
005055A8 push dword ptr [ebp-48]
005055AB lea eax, dword ptr [ebp-38]
005055AE mov edx, 4
005055B3 call 004047A0
005055B8 mov eax, dword ptr [ebp-38]
005055BB lea edx, dword ptr [ebp-34]
005055BE call 0047BF20
005055C3 mov eax, dword ptr [ebp-34]
005055C6 lea ecx, dword ptr [ebp-30]
005055C9 mov edx, 005059B4 ; impressions
005055CE call 0047B134
005055D3 mov eax, dword ptr [ebp-30]
005055D6 mov ecx, 0A
005055DB mov edx, 6
005055E0 call 00404940
005055E5 mov dword ptr [5131B4], 1
005055EF lea ecx, dword ptr [ebp-8]
005055F2 mov edx, 005059C8 ; nmmd-sgpj
005055F7 mov eax, 005059DC ; [标准版]
005055FC call 0047B134
00505601 jmp 005057A8
00505606 push 005131AC ; Case E of switch 005054DB
0050560B lea eax, dword ptr [ebp-58]
0050560E push eax
0050560F mov ecx, 5
00505614 mov edx, 3
00505619 mov eax, dword ptr [ebp-4]
0050561C call 00404940
00505621 push dword ptr [ebp-58]
00505624 lea eax, dword ptr [ebp-5C]
00505627 push eax
00505628 mov ecx, 2
0050562D mov edx, 1D
00505632 mov eax, dword ptr [ebp-4]
00505635 call 00404940
0050563A push dword ptr [ebp-5C]
0050563D lea eax, dword ptr [ebp-60]
00505640 push eax
00505641 mov ecx, 6
00505646 mov edx, 0C
0050564B mov eax, dword ptr [ebp-4]
0050564E call 00404940
00505653 push dword ptr [ebp-60]
00505656 lea eax, dword ptr [ebp-64]
00505659 push eax
0050565A mov ecx, 7
0050565F mov edx, 6
00505664 mov eax, dword ptr [ebp-4]
00505667 call 00404940
0050566C push dword ptr [ebp-64]
0050566F lea eax, dword ptr [ebp-54]
00505672 mov edx, 4
00505677 call 004047A0
0050567C mov eax, dword ptr [ebp-54]
0050567F lea edx, dword ptr [ebp-50]
00505682 call 0047BF20
00505687 mov eax, dword ptr [ebp-50]
0050568A lea ecx, dword ptr [ebp-4C]
0050568D mov edx, 005059B4 ; impressions
00505692 call 0047B134
00505697 mov eax, dword ptr [ebp-4C]
0050569A mov ecx, 0E
0050569F mov edx, 3
005056A4 call 00404940
005056A9 mov dword ptr [5131B4], 2
005056B3 lea ecx, dword ptr [ebp-8]
005056B6 mov edx, 005059C8 ; nmmd-sgpj
005056BB mov eax, 005059F0 ; [vip版]
005056C0 call 0047B134
005056C5 jmp 005057A8
005056CA push 005131AC ; Case 10 of switch 005054DB
005056CF lea eax, dword ptr [ebp-74]
005056D2 push eax
005056D3 mov ecx, 6
005056D8 mov edx, 8
005056DD mov eax, dword ptr [ebp-4]
005056E0 call 00404940
005056E5 push dword ptr [ebp-74]
005056E8 lea eax, dword ptr [ebp-78]
005056EB push eax
005056EC mov ecx, 7
005056F1 mov edx, 12
005056F6 mov eax, dword ptr [ebp-4]
005056F9 call 00404940
005056FE push dword ptr [ebp-78]
00505701 lea eax, dword ptr [ebp-7C]
00505704 push eax
00505705 mov ecx, 3
0050570A mov edx, 3
0050570F mov eax, dword ptr [ebp-4]
00505712 call 00404940
00505717 push dword ptr [ebp-7C]
0050571A lea eax, dword ptr [ebp-80]
0050571D push eax
0050571E mov ecx, 3
00505723 mov edx, 0D
00505728 mov eax, dword ptr [ebp-4]
0050572B call 00404940
00505730 push dword ptr [ebp-80]
00505733 lea eax, dword ptr [ebp-84]
00505739 push eax
0050573A mov ecx, 5
0050573F mov edx, 16
00505744 mov eax, dword ptr [ebp-4]
00505747 call 00404940
0050574C push dword ptr [ebp-84]
00505752 lea eax, dword ptr [ebp-70]
00505755 mov edx, 5
0050575A call 004047A0
0050575F mov eax, dword ptr [ebp-70]
00505762 lea edx, dword ptr [ebp-6C]
00505765 call 0047BF20
0050576A mov eax, dword ptr [ebp-6C]
0050576D lea ecx, dword ptr [ebp-68]
00505770 mov edx, 005059B4 ; impressions
00505775 call 0047B134
0050577A mov eax, dword ptr [ebp-68]
0050577D mov ecx, 10
00505782 mov edx, 5
00505787 call 00404940
0050578C mov dword ptr [5131B4], 3
00505796 lea ecx, dword ptr [ebp-8]
00505799 mov edx, 005059C8 ; nmmd-sgpj
0050579E mov eax, 00505A00 ; [钻石版]
005057A3 call 0047B134
005057A8 lea eax, dword ptr [ebp-90]
005057AE push eax
005057AF mov ecx, 6
005057B4 mov edx, 4
005057B9 mov eax, dword ptr [5131AC]
005057BE call 00404940
005057C3 mov eax, dword ptr [ebp-90]
005057C9 lea edx, dword ptr [ebp-8C]
005057CF call 004DF9B8
005057D4 mov eax, dword ptr [ebp-8C]
005057DA lea ecx, dword ptr [ebp-88]
005057E0 mov edx, 00505A14 ; sgpj-nmmd
005057E5 call 0047B134
005057EA mov eax, dword ptr [ebp-88]
005057F0 push eax
005057F1 lea eax, dword ptr [ebp-9C]
005057F7 push eax
005057F8 mov ecx, 6
005057FD mov edx, 4
00505802 mov eax, dword ptr [ebx+4B0]
00505808 call 00404940
0050580D mov eax, dword ptr [ebp-9C]
00505813 lea edx, dword ptr [ebp-98]
00505819 call 004DF9B8
0050581E mov eax, dword ptr [ebp-98]
00505824 lea ecx, dword ptr [ebp-94]
0050582A mov edx, 00505A14 ; sgpj-nmmd
0050582F call 0047B134
00505834 mov edx, dword ptr [ebp-94]
0050583A pop eax
0050583B call 0040482C ;★★★★
00505840 jnz short 005058A1
00505842 mov byte ptr [ebx+4C4], 1
00505849 cmp dword ptr [5131B4], 1
00505850 je short 00505859
00505852 mov byte ptr [ebx+4C5], 1
00505859 mov eax, 005131B0
0050585E mov edx, dword ptr [ebp-8]
00505861 call 00404474
00505866 lea ecx, dword ptr [ebp-A4]
0050586C mov edx, 005059C8 ; nmmd-sgpj
00505871 mov eax, dword ptr [5131B0]
00505876 call 0047B31C
0050587B mov ecx, dword ptr [ebp-A4]
00505881 lea eax, dword ptr [ebp-A0]
00505887 mov edx, 00505A28 ; 流星网络电视
0050588C call 0040472C
00505891 mov edx, dword ptr [ebp-A0]
00505897 mov eax, dword ptr [5131A0]
0050589C call 00458E2C
005058A1 xor eax, eax ; Default case of switch 005054DB
005058A3 pop edx
005058A4 pop ecx
005058A5 pop ecx
005058A6 mov dword ptr fs:[eax], edx
005058A9 push 005058C6
005058AE lea eax, dword ptr [ebp-A4]
005058B4 mov edx, 29
005058B9 call 00404444
005058BE retn
005058BF jmp 00403CC0
005058C4 jmp short 005058AE
005058C6 pop esi
005058C7 pop ebx
005058C8 mov esp, ebp
005058CA pop ebp
005058CB retn

复制代码

ks5678909 · 发表于 2006-12-10 10:24:18

:lol: 好厉害

		自动登录	找回密码
密码			加入我们

[原创] 流星网络电视VIP(我个人认为没有网络验证)

相关帖子