tianxj申请加入PYG[破文四]

tianxj · 发表于 2007-5-10 19:23:34

【破文标题】PYG 5.4Cracker学习小组tianxj里诺设备管理软件 V2.00(单机版)
【破文作者】tianxj
【作者邮箱】[email protected]
【作者主页】无
【破解工具】PEiD,OD
【破解平台】Windows XP
【软件名称】里诺设备管理软件 V2.00(单机版)（2007-5-6 版）
【软件大小】3824KB
【原版下载】华军软件园http://nmgsk.onlinedown.net/down/leno_57293.zip
【保护方式】无壳
【软件简介】里诺设备管理软件是一款通用性极强的设备管理软件，软件界面设计简洁，美观。其人性化的软件流程，使普通用户不需培训也能很快掌握软件的使用方法，软件界面沿用里诺软件传统风格，简洁、美观、易用。
适用于企业、机关、学校、事业单位等任何需要管理设备的单位。
软件还有以下特色功能：
● 强大的数据导入功能，支持从Excel导入设备资料，减少期初数据录入的工作量。
● 软件界面直观、操作简单，支持全键盘操作；
● 支持设备类型资料树形分类管理；
● 强大的操作员权限管理功能,使用户的权限分配一目了然。
● 完善的数据备份(包括自动备份和手功备份)和恢复功能(密码操作，数据更加安全)；
●高效强大的查询工具：系统提供多种查询方式来帮助您快速找到所需要的资料。无论是使用预制条件还是临时的高级组合查找，都能够让您省心省力；
●开放式的报表设置功能；用户可以方便对合同/报表的外观进行设计（包括对格式、字体、边框、背景等进行设计），而且可以设定报表内部数据的计算方法（包括对数据来源的设定、数据算法的设定等）；
● 设备图片浏览；

【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
------------------------------------------------------------------------
**************************************************************
一、运行程序，输入错误的注册信息进行检测，提示信息
"已保存了注册信息！下次启动本程序时将会对你的注册码进行验证，如注册码正确，
本程序所有功能限制将被解除，您成为我们正式版本用户!"
带有重启动验证功能，比较RegSnap前后两次快照发现注册信息在
HKEY_LOCAL_MACHINE\SOFTWARE\zy\equipment\Date
HKEY_LOCAL_MACHINE\SOFTWARE\zy\equipment\Name
HKEY_LOCAL_MACHINE\SOFTWARE\zy\equipment\Pass
有变化，打开注册表，数值为
[HKEY_LOCAL_MACHINE\SOFTWARE\zy\equipment]
"Date"=hex:00,00,00,00,60,25,e3,40
"Name"="3JV1TH37"----------------------机器码
"Pass"="99999999"----------------------假注册码
**************************************************************
二、用PEiD对LKYD查壳，无壳。Borland Delphi 6.0 - 7.0编写。
**************************************************************
三、运行OD，打开Equipment，右键—超级字串参考—查找ASCII.
找到关键词“Pass”，有两处，双击，分别下断
00671647 .  BA 04176700 MOV EDX,Equipmen.00671704             ;  pass
★★★★★★点击注册时保存注册信息用的
006740ED .  BA 74456700 MOV EDX,Equipmen.00674574             ;  pass
★★★★★★重启验证时验证注册信息用的
———————————————————————————————
006740E0 .  05 98040000 ADD EAX,498
006740E5 .  E8 220AD9FF CALL Equipmen.00404B0C
006740EA .  8D4D B0    LEA ECX,DWORD PTR SS:[EBP-50]
006740ED .  BA 74456700 MOV EDX,Equipmen.00674574             ;  pass
★★★★★★运行程序，停在此处
006740F2 .  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
006740F5 .  E8 1A85DDFF CALL Equipmen.0044C614
006740FA .  8B55 B0    MOV EDX,DWORD PTR SS:[EBP-50]
006740FD .  A1 F07F6900 MOV EAX,DWORD PTR DS:[697FF0]
00674102 .  8B00       MOV EAX,DWORD PTR DS:[EAX]
00674104 .  05 9C040000 ADD EAX,49C
00674109 .  E8 FE09D9FF CALL Equipmen.00404B0C
0067410E .  33C0       XOR EAX,EAX
00674110 .  55          PUSH EBP
00674111 .  68 35416700 PUSH Equipmen.00674135
00674116 .  64:FF30    PUSH DWORD PTR FS:[EAX]
00674119 .  64:8920    MOV DWORD PTR FS:[EAX],ESP
0067411C .  BA 84456700 MOV EDX,Equipmen.00674584             ;  date
00674121 .  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
00674124 .  E8 4B86DDFF CALL Equipmen.0044C774
00674129 .  DDD8       FSTP ST
0067412B .  33C0       XOR EAX,EAX
0067412D .  5A          POP EDX
0067412E .  59          POP ECX
0067412F .  59          POP ECX
00674130 .  64:8910    MOV DWORD PTR FS:[EAX],EDX
00674133 .  EB 1D       JMP SHORT Equipmen.00674152
00674135 .^ E9 4AFFD8FF JMP Equipmen.00404084
0067413A .  FF75 E4    PUSH DWORD PTR SS:[EBP-1C]             ; /Arg2
0067413D .  FF75 E0    PUSH DWORD PTR SS:[EBP-20]             ; |Arg1
00674140 .  BA 84456700 MOV EDX,Equipmen.00674584             ; |ASCII "Date"
00674145 .  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]          ; |
00674148 .  E8 1386DDFF CALL Equipmen.0044C760                ; \Equipmen.0044C760
0067414D .  E8 5E03D9FF CALL Equipmen.004044B0
00674152 >  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
00674155 .  E8 CA7DDDFF CALL Equipmen.0044BF24
0067415A .  33C0       XOR EAX,EAX
0067415C .  5A          POP EDX
0067415D .  59          POP ECX
0067415E .  59          POP ECX
0067415F .  64:8910    MOV DWORD PTR FS:[EAX],EDX
00674162 .  68 77416700 PUSH Equipmen.00674177
00674167 >  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
0067416A .  E8 35FAD8FF CALL Equipmen.00403BA4
0067416F .  C3          RETN
00674170 .^ E9 C301D9FF JMP Equipmen.00404338
00674175 .^ EB F0       JMP SHORT Equipmen.00674167
00674177 .  A1 F07F6900 MOV EAX,DWORD PTR DS:[697FF0]
0067417C .  8B00       MOV EAX,DWORD PTR DS:[EAX]
0067417E .  C780 8C040000>MOV DWORD PTR DS:[EAX+48C],1
00674188 .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
0067418B .  8B90 04030000 MOV EDX,DWORD PTR DS:[EAX+304]
00674191 .  B9 94456700 MOV ECX,Equipmen.00674594             ;  ASCII "select count(*) as T_Num from equipments"
00674196 .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
00674199 .  E8 E2FBFFFF CALL Equipmen.00673D80
0067419E .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
006741A1 .  8B80 04030000 MOV EAX,DWORD PTR DS:[EAX+304]
006741A7 .  BA C8456700 MOV EDX,Equipmen.006745C8             ;  ASCII "T_Num"
006741AC .  E8 CF3CE5FF CALL Equipmen.004C7E80
006741B1 .  8B10       MOV EDX,DWORD PTR DS:[EAX]
006741B3 .  FF52 58    CALL DWORD PTR DS:[EDX+58]
006741B6 .  8B55 FC    MOV EDX,DWORD PTR SS:[EBP-4]
006741B9 .  8982 5C040000 MOV DWORD PTR DS:[EDX+45C],EAX
006741BF .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
006741C2 .  C680 69040000>MOV BYTE PTR DS:[EAX+469],1
006741C9 .  8D4D AC    LEA ECX,DWORD PTR SS:[EBP-54]
006741CC .  A1 F07F6900 MOV EAX,DWORD PTR DS:[697FF0]
006741D1 .  8B00       MOV EAX,DWORD PTR DS:[EAX]
006741D3 .  8B90 98040000 MOV EDX,DWORD PTR DS:[EAX+498]
006741D9 .  A1 B47C6900 MOV EAX,DWORD PTR DS:[697CB4]
006741DE .  8B00       MOV EAX,DWORD PTR DS:[EAX]
006741E0 .  E8 E7D1FFFF CALL Equipmen.006713CC
★★★★★★算法Call，F7跟进
006741E5 .  8B55 AC    MOV EDX,DWORD PTR SS:[EBP-54]
006741E8 .  A1 F07F6900 MOV EAX,DWORD PTR DS:[697FF0]
006741ED .  8B00       MOV EAX,DWORD PTR DS:[EAX]
006741EF .  8B80 9C040000 MOV EAX,DWORD PTR DS:[EAX+49C]
006741F5 .  E8 DA0CD9FF CALL Equipmen.00404ED4
★★★★★★关键CALL,寄存器可以看见真码与假码比较,可用于制作内存注册机
006741FA .  75 71       JNZ SHORT Equipmen.0067426D
★★★★★★关键跳转,JNZ改为JE即可爆破或以此作内存补丁
006741FC .  A1 F07F6900 MOV EAX,DWORD PTR DS:[697FF0]
00674201 .  8B00       MOV EAX,DWORD PTR DS:[EAX]
00674203 .  C680 90040000>MOV BYTE PTR DS:[EAX+490],0
0067420A .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
0067420D .  81B8 5C040000>CMP DWORD PTR DS:[EAX+45C],12C
00674217 .  0F8C 80000000 JL Equipmen.0067429D
0067421D .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
00674220 .  80B8 69040000>CMP BYTE PTR DS:[EAX+469],0
00674227 .  75 10       JNZ SHORT Equipmen.00674239
00674229 .  A1 F07F6900 MOV EAX,DWORD PTR DS:[697FF0]
0067422E .  8B00       MOV EAX,DWORD PTR DS:[EAX]
00674230 .  C680 90040000>MOV BYTE PTR DS:[EAX+490],0
00674237 .  EB 64       JMP SHORT Equipmen.0067429D
00674239 >  A1 F07F6900 MOV EAX,DWORD PTR DS:[697FF0]
0067423E .  8B00       MOV EAX,DWORD PTR DS:[EAX]
00674240 .  C680 90040000>MOV BYTE PTR DS:[EAX+490],1
00674247 .  A1 F07F6900 MOV EAX,DWORD PTR DS:[697FF0]
0067424C .  8B00       MOV EAX,DWORD PTR DS:[EAX]
0067424E .  33D2       XOR EDX,EDX
00674250 .  8990 8C040000 MOV DWORD PTR DS:[EAX+48C],EDX
00674256 .  6A 00       PUSH 0                                  ; /Arg1 = 00000000
00674258 .  66:8B0D D0456>MOV CX,WORD PTR DS:[6745D0]             ; |
0067425F .  B2 03       MOV DL,3                               ; |
00674261 .  B8 DC456700 MOV EAX,Equipmen.006745DC             ; |
00674266 .  E8 99BBDCFF CALL Equipmen.0043FE04                ; \Equipmen.0043FE04
0067426B .  EB 30       JMP SHORT Equipmen.0067429D
0067426D >  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
00674270 .  83B8 5C040000>CMP DWORD PTR DS:[EAX+45C],32
00674277 .  7C 24       JL SHORT Equipmen.0067429D
00674279 .  A1 F07F6900 MOV EAX,DWORD PTR DS:[697FF0]
0067427E .  8B00       MOV EAX,DWORD PTR DS:[EAX]
00674280 .  33D2       XOR EDX,EDX
00674282 .  8990 8C040000 MOV DWORD PTR DS:[EAX+48C],EDX
00674288 .  6A 00       PUSH 0                                  ; /Arg1 = 00000000
0067428A .  66:8B0D D0456>MOV CX,WORD PTR DS:[6745D0]             ; |
00674291 .  B2 03       MOV DL,3                               ; |
00674293 .  B8 14466700 MOV EAX,Equipmen.00674614             ; |
00674298 .  E8 67BBDCFF CALL Equipmen.0043FE04                ; \Equipmen.0043FE04
0067429D >  8D55 A4    LEA EDX,DWORD PTR SS:[EBP-5C]
006742A0 .  A1 B0826900 MOV EAX,DWORD PTR DS:[6982B0]
006742A5 .  8B00       MOV EAX,DWORD PTR DS:[EAX]
006742A7 .  E8 E08DE3FF CALL Equipmen.004AD08C
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
F7跟进关键Call,下面是关键Call的一部分
006713CC  /$  55          PUSH EBP
006713CD  |.  8BEC       MOV EBP,ESP
006713CF  |.  51          PUSH ECX
006713D0  |.  B9 04000000 MOV ECX,4
006713D5  |>  6A 00       /PUSH 0
006713D7  |.  6A 00       |PUSH 0
006713D9  |.  49          |DEC ECX
006713DA  |.^ 75 F9       \JNZ SHORT Equipmen.006713D5
006713DC  |.  51          PUSH ECX
006713DD  |.  874D FC    XCHG DWORD PTR SS:[EBP-4],ECX
006713E0  |.  53          PUSH EBX
006713E1  |.  56          PUSH ESI
006713E2  |.  57          PUSH EDI
006713E3  |.  8BF9       MOV EDI,ECX
006713E5  |.  8955 FC    MOV DWORD PTR SS:[EBP-4],EDX
006713E8  |.  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
006713EB  |.  E8 883BD9FF CALL Equipmen.00404F78
006713F0  |.  33C0       XOR EAX,EAX
006713F2  |.  55          PUSH EBP
006713F3  |.  68 8D156700 PUSH Equipmen.0067158D
006713F8  |.  64:FF30    PUSH DWORD PTR FS:[EAX]
006713FB  |.  64:8920    MOV DWORD PTR FS:[EAX],ESP
006713FE  |.  8BC7       MOV EAX,EDI
00671400  |.  E8 B336D9FF CALL Equipmen.00404AB8
00671405  |.  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
00671408  |.  E8 7B39D9FF CALL Equipmen.00404D88
0067140D  |.  8BF0       MOV ESI,EAX
0067140F  |.  85F6       TEST ESI,ESI
00671411  |.  7E 26       JLE SHORT Equipmen.00671439
00671413  |.  BB 01000000 MOV EBX,1
00671418  |>  8D4D EC    /LEA ECX,DWORD PTR SS:[EBP-14]
0067141B  |.  8B45 FC    |MOV EAX,DWORD PTR SS:[EBP-4]
0067141E  |.  0FB64418 FF |MOVZX EAX,BYTE PTR DS:[EAX+EBX-1]
★★★★★★逐位取机器码转为16进制ASC码
00671423  |.  33D2       |XOR EDX,EDX
00671425  |.  E8 0693D9FF |CALL Equipmen.0040A730
★★★★★★取得的值转为字符串
0067142A  |.  8B55 EC    |MOV EDX,DWORD PTR SS:[EBP-14]
0067142D  |.  8D45 F8    |LEA EAX,DWORD PTR SS:[EBP-8]
00671430  |.  E8 5B39D9FF |CALL Equipmen.00404D90
00671435  |.  43          |INC EBX
00671436  |.  4E          |DEC ESI
00671437  |.^ 75 DF       \JNZ SHORT Equipmen.00671418
00671439  |>  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
★★★★★★信息窗口显示ASCII "334A563154483337";此循环将机器码逐位ASC码并相连接，设为Str1
0067143C  |.  E8 4739D9FF CALL Equipmen.00404D88
00671441  |.  8BF0       MOV ESI,EAX
00671443  |.  85F6       TEST ESI,ESI
00671445  |.  7E 2C       JLE SHORT Equipmen.00671473
00671447  |.  BB 01000000 MOV EBX,1
0067144C  |>  8B45 F8    /MOV EAX,DWORD PTR SS:[EBP-8]
0067144F  |.  E8 3439D9FF |CALL Equipmen.00404D88
00671454  |.  2BC3       |SUB EAX,EBX
00671456  |.  8B55 F8    |MOV EDX,DWORD PTR SS:[EBP-8]
00671459  |.  8A1402       |MOV DL,BYTE PTR DS:[EDX+EAX]
0067145C  |.  8D45 E8    |LEA EAX,DWORD PTR SS:[EBP-18]
0067145F  |.  E8 3C38D9FF |CALL Equipmen.00404CA0
00671464  |.  8B55 E8    |MOV EDX,DWORD PTR SS:[EBP-18]
00671467  |.  8D45 F4    |LEA EAX,DWORD PTR SS:[EBP-C]
0067146A  |.  E8 2139D9FF |CALL Equipmen.00404D90
0067146F  |.  43          |INC EBX
00671470  |.  4E          |DEC ESI
00671471  |.^ 75 D9       \JNZ SHORT Equipmen.0067144C
★★★★★★ 此循环做的是将Str1倒序,设为Str2
00671473  |>  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
00671476  |.  50          PUSH EAX
00671477  |.  B9 04000000 MOV ECX,4
0067147C  |.  BA 01000000 MOV EDX,1
00671481  |.  8B45 F4    MOV EAX,DWORD PTR SS:[EBP-C]
★★★★★★ 相连接ASCII "733384451365A433"
00671484  |.  E8 5F3BD9FF CALL Equipmen.00404FE8
00671489  |.  8D45 F4    LEA EAX,DWORD PTR SS:[EBP-C]
0067148C  |.  50          PUSH EAX
0067148D  |.  B9 04000000 MOV ECX,4
00671492  |.  BA 05000000 MOV EDX,5
00671497  |.  8B45 F4    MOV EAX,DWORD PTR SS:[EBP-C]
0067149A  |.  E8 493BD9FF CALL Equipmen.00404FE8
0067149F  |.  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
★★★★★★取Str2的1-4位,ASCII "7333",设为A
006714A2  |.  E8 E138D9FF CALL Equipmen.00404D88
006714A7  |.  83F8 04    CMP EAX,4
006714AA  |.  7D 2F       JGE SHORT Equipmen.006714DB
006714AC  |.  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
006714AF  |.  E8 D438D9FF CALL Equipmen.00404D88
006714B4  |.  8BD8       MOV EBX,EAX
006714B6  |.  83FB 03    CMP EBX,3
006714B9  |.  7F 20       JG SHORT Equipmen.006714DB
006714BB  |>  8D4D E4    /LEA ECX,DWORD PTR SS:[EBP-1C]
006714BE  |.  8BC3       |MOV EAX,EBX
006714C0  |.  C1E0 02    |SHL EAX,2
006714C3  |.  33D2       |XOR EDX,EDX
006714C5  |.  E8 6692D9FF |CALL Equipmen.0040A730
006714CA  |.  8B55 E4    |MOV EDX,DWORD PTR SS:[EBP-1C]
006714CD  |.  8D45 F8    |LEA EAX,DWORD PTR SS:[EBP-8]
006714D0  |.  E8 BB38D9FF |CALL Equipmen.00404D90
006714D5  |.  43          |INC EBX
006714D6  |.  83FB 04    |CMP EBX,4
006714D9  |.^ 75 E0       \JNZ SHORT Equipmen.006714BB
006714DB  |>  8B45 F4    MOV EAX,DWORD PTR SS:[EBP-C]
★★★★★★取Str2的5-8位,ASCII "8445",设为B
006714DE  |.  E8 A538D9FF CALL Equipmen.00404D88
006714E3  |.  83F8 04    CMP EAX,4
006714E6  |.  7D 2F       JGE SHORT Equipmen.00671517
006714E8  |.  8B45 F4    MOV EAX,DWORD PTR SS:[EBP-C]
006714EB  |.  E8 9838D9FF CALL Equipmen.00404D88
006714F0  |.  8BD8       MOV EBX,EAX
006714F2  |.  83FB 03    CMP EBX,3
006714F5  |.  7F 20       JG SHORT Equipmen.00671517
006714F7  |>  8D4D E0    /LEA ECX,DWORD PTR SS:[EBP-20]
006714FA  |.  8BC3       |MOV EAX,EBX
006714FC  |.  C1E0 02    |SHL EAX,2
006714FF  |.  33D2       |XOR EDX,EDX
00671501  |.  E8 2A92D9FF |CALL Equipmen.0040A730
00671506  |.  8B55 E0    |MOV EDX,DWORD PTR SS:[EBP-20]
00671509  |.  8D45 F4    |LEA EAX,DWORD PTR SS:[EBP-C]
0067150C  |.  E8 7F38D9FF |CALL Equipmen.00404D90
00671511  |.  43          |INC EBX
00671512  |.  83FB 04    |CMP EBX,4
00671515  |.^ 75 E0       \JNZ SHORT Equipmen.006714F7
00671517  |>  8D45 F0    LEA EAX,DWORD PTR SS:[EBP-10]
0067151A  |.  BA A4156700 MOV EDX,Equipmen.006715A4             ;  equipment45yr87
★★★★★★ASCII "equipment45yr87",取固定字符串为Str3
0067151F  |.  E8 2C36D9FF CALL Equipmen.00404B50
00671524  |.  8D45 DC    LEA EAX,DWORD PTR SS:[EBP-24]
00671527  |.  50          PUSH EAX
00671528  |.  B9 04000000 MOV ECX,4
0067152D  |.  BA 01000000 MOV EDX,1
00671532  |.  8B45 F0    MOV EAX,DWORD PTR SS:[EBP-10]
00671535  |.  E8 AE3AD9FF CALL Equipmen.00404FE8
0067153A  |.  FF75 DC    PUSH DWORD PTR SS:[EBP-24]
★★★★★★ASCII "equi",取Str3的1-4位,设为C
0067153D  |.  68 BC156700 PUSH Equipmen.006715BC                ;  -
★★★★★★取固定字符"-",设为E
00671542  |.  FF75 F8    PUSH DWORD PTR SS:[EBP-8]
★★★★★★ASCII "7333"
00671545  |.  8D45 D8    LEA EAX,DWORD PTR SS:[EBP-28]
00671548  |.  50          PUSH EAX
00671549  |.  B9 05000000 MOV ECX,5
0067154E  |.  BA 05000000 MOV EDX,5
00671553  |.  8B45 F0    MOV EAX,DWORD PTR SS:[EBP-10]
00671556  |.  E8 8D3AD9FF CALL Equipmen.00404FE8
0067155B  |.  FF75 D8    PUSH DWORD PTR SS:[EBP-28]
★★★★★★ASCII "pment"，取Str3的5-9位,设为D
0067155E  |.  68 BC156700 PUSH Equipmen.006715BC                ;  -
★★★★★★取固定字符"-",设为E
00671563  |.  FF75 F4    PUSH DWORD PTR SS:[EBP-C]
★★★★★★ASCII "8445"
00671566  |.  8BC7       MOV EAX,EDI
00671568  |.  BA 06000000 MOV EDX,6
0067156D  |.  E8 D638D9FF CALL Equipmen.00404E48
00671572  |.  33C0       XOR EAX,EAX
00671574  |.  5A          POP EDX
00671575  |.  59          POP ECX
00671576  |.  59          POP ECX
00671577  |.  64:8910    MOV DWORD PTR FS:[EAX],EDX
0067157A  |.  68 94156700 PUSH Equipmen.00671594
0067157F  |>  8D45 D8    LEA EAX,DWORD PTR SS:[EBP-28]
00671582  |.  BA 0A000000 MOV EDX,0A
00671587  |.  E8 5035D9FF CALL Equipmen.00404ADC
0067158C  \.  C3          RETN
0067158D .^ E9 A62DD9FF JMP Equipmen.00404338
00671592 .^ EB EB       JMP SHORT Equipmen.0067157F
00671594 .  5F          POP EDI
00671595 .  5E          POP ESI
00671596 .  5B          POP EBX
00671597 .  8BE5       MOV ESP,EBP
00671599 .  5D          POP EBP
0067159A .  C3          RETN
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
返回到
006741E5 .  8B55 AC    MOV EDX,DWORD PTR SS:[EBP-54]
★★★★★★ASCII "equi-7333pment-8445",将字符串相连,顺序为C+E+A+D+E+B,即为注册码
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
【算法总结】
  固定字符串:
  C:"equi"
  D:"pment"
  E:"-"

  将机器码逐位ASC连接为字符串Str1
  将Str1倒序为Str2
  取Str2的第1-4位为字符串A
  取Str2的第5-8位为字符串B
  注册码:C+E+A+D+E+B

  例如:
  我的机器码:3JV1TH37
  Str1:334A563154483337
  Str2:733384451365A433
  A:7333
  B:8445
  C:"equi"
  D:"pment"
  E:"-"
  注册码C+E+A+D+E+B
  equi-7333pment-8445

**************************************************************
四、制作内存注册机
中断地址：6741F5
中断次数：1
第一字节：E8
指令长度：5
内存方式：寄存器EDX

------------------------------------------------------------------------
希望以后可以在猫老大和PYG 5.4Cracker学习小组的帮助下进一步提高自己。
感谢飘云老大、猫老大以及很多前辈们的学习教程以及所有帮助过我的论坛兄弟姐妹们！谢谢
------------------------------------------------------------------------
【版权声明】本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!

新手求教 · 发表于 2007-5-10 20:03:29

佩服!兄弟进步真快啊!拿回去学习学习

飘云 · 发表于 2007-5-10 23:14:58

恩，
努力，PYG成员怎么也得会编程吧？

帖这个软件的KeyGen 代码就过！

tianxj · 发表于 2007-5-11 19:14:32

请飘云老大指点，VB代码
Private Sub Command1_Click()
For i = 1 To Len(Text1.Text)
   a = a & Hex(Asc(Mid(Text1.Text, i, 1)))
Next i
   b = StrReverse(a)
   serial = "equi-" & Left(b, 4) & "pment-" & Mid(b, 5, 4)
Text2.Text = serial
End Sub

[ 本帖最后由 tianxj 于 2007-5-11 19:15 编辑 ]

		自动登录	找回密码
密码			加入我们