菜鸟学分析

Nisy · 发表于 2007-9-6 22:13:45

原帖由 tianxj 于 2007-9-3 20:48 发表
跟了下算法,很简单

机器码每位的ASCII码的十六进制与"6s2i4kj"的ASCII码的十六进制循环异或，相连

强支持下 ~~

lvcaolhx · 发表于 2007-9-7 06:42:28

不错的分析
版主能将详细的算法写出来就好了

tianxj · 发表于 2007-9-7 14:16:30

【破文标题】电子朗读王 2007破文
【破解工具】PEiD,OD
【破解平台】Windows XP
【软件名称】电子朗读王 2007
【软件大小】2494KB
【原版下载】华军软件园
【保护方式】注册码
【软件简介】一款电脑语音朗读软件，利用TTS语音引擎，它可以朗读中文、英文、中英混合的文字内容，还可以将其导出保存为音频文件。利用"朗读剪切"板功能，你便可以在浏览网页、阅读文档时将文本复制到系统剪切板中让其自动读给你听，还可以给你当校对，有声的世界更精彩。更有"鼠标选读"、"录入朗读"更多超酷功能等待着您的使用。电子朗读王，读出你的精彩和快乐！欢迎您选择使用。

【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
------------------------------------------------------------------------
【破解内容】
--------------------------------------------------------------------------------
**************************************************************
一、运行程序，进行注册，输入错误的注册信息进行检测，有提示信息
"您好，注册码错误，注册失败！"
**************************************************************
二、用PEiD对这个软件查壳，无壳,为 Borland Delphi 6.0 - 7.0编写
**************************************************************
三、运行OD，打开VoiceKing，右键—超级字串参考—查找ASCII.
找到“您好，注册码错误，注册失败！”了，双击，来到
004F89B1  |.  55          PUSH EBP
★★★★★★在这里F2下断点,F9运行,注册，程序停在这里
004F89B2  |.  68 7A8B4F00 PUSH VoiceKin.004F8B7A
004F89B7  |.  64:FF30    PUSH DWORD PTR FS:[EAX]
004F89BA  |.  64:8920    MOV DWORD PTR FS:[EAX],ESP
004F89BD  |.  8D55 F4    LEA EDX,DWORD PTR SS:[EBP-C]
004F89C0  |.  8B86 F8020000 MOV EAX,DWORD PTR DS:[ESI+2F8]
004F89C6  |.  E8 91FCF4FF CALL VoiceKin.0044865C
004F89CB  |.  8B45 F4    MOV EAX,DWORD PTR SS:[EBP-C]
004F89CE  |.  8D55 F8    LEA EDX,DWORD PTR SS:[EBP-8]
004F89D1  |.  E8 DE02F1FF CALL VoiceKin.00408CB4
004F89D6  |.  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
004F89D9  |.  50          PUSH EAX
004F89DA  |.  8D55 EC    LEA EDX,DWORD PTR SS:[EBP-14]
004F89DD  |.  8B86 04030000 MOV EAX,DWORD PTR DS:[ESI+304]
004F89E3  |.  E8 74FCF4FF CALL VoiceKin.0044865C
004F89E8  |.  8B45 EC    MOV EAX,DWORD PTR SS:[EBP-14]
004F89EB  |.  8D4D F0    LEA ECX,DWORD PTR SS:[EBP-10]
004F89EE  |.  BA 908B4F00 MOV EDX,VoiceKin.004F8B90             ;  6s2i4kj
004F89F3  |.  E8 ACFAFFFF CALL VoiceKin.004F84A4
★★★★★★算法CALL,F7跟进
004F89F8  |.  8B55 F0    MOV EDX,DWORD PTR SS:[EBP-10]
004F89FB  |.  58          POP EAX
004F89FC  |.  E8 3FBFF0FF CALL VoiceKin.00404940
★★★★★★在这里,寄存器中可以看见真假注册码的对比,比较CALL
004F8A01  |.  0F85 E2000000 JNZ VoiceKin.004F8AE9
★★★★★★在这里,可以看见此跳转跳过正确提示,关键跳转
004F8A07  |.  A1 F0B15000 MOV EAX,DWORD PTR DS:[50B1F0]
004F8A0C  |.  8B00       MOV EAX,DWORD PTR DS:[EAX]
004F8A0E  |.  8B80 08050000 MOV EAX,DWORD PTR DS:[EAX+508]
004F8A14  |.  33D2       XOR EDX,EDX
004F8A16  |.  E8 D14CF4FF CALL VoiceKin.0043D6EC
004F8A1B  |.  8D55 E4    LEA EDX,DWORD PTR SS:[EBP-1C]
004F8A1E  |.  8B86 F8020000 MOV EAX,DWORD PTR DS:[ESI+2F8]
004F8A24  |.  E8 33FCF4FF CALL VoiceKin.0044865C
004F8A29  |.  8B45 E4    MOV EAX,DWORD PTR SS:[EBP-1C]
004F8A2C  |.  8D55 E8    LEA EDX,DWORD PTR SS:[EBP-18]
004F8A2F  |.  E8 8002F1FF CALL VoiceKin.00408CB4
004F8A34  |.  8B55 E8    MOV EDX,DWORD PTR SS:[EBP-18]
004F8A37  |.  A1 F0B15000 MOV EAX,DWORD PTR DS:[50B1F0]
004F8A3C  |.  8B00       MOV EAX,DWORD PTR DS:[EAX]
004F8A3E  |.  8B80 0C050000 MOV EAX,DWORD PTR DS:[EAX+50C]
004F8A44  |.  E8 43FCF4FF CALL VoiceKin.0044868C
004F8A49  |.  8D55 DC    LEA EDX,DWORD PTR SS:[EBP-24]
004F8A4C  |.  A1 50B45000 MOV EAX,DWORD PTR DS:[50B450]
004F8A51  |.  8B00       MOV EAX,DWORD PTR DS:[EAX]
004F8A53  |.  E8 DC12F7FF CALL VoiceKin.00469D34
004F8A58  |.  8B45 DC    MOV EAX,DWORD PTR SS:[EBP-24]
004F8A5B  |.  8D55 E0    LEA EDX,DWORD PTR SS:[EBP-20]
004F8A5E  |.  E8 4509F1FF CALL VoiceKin.004093A8
004F8A63  |.  8B45 E0    MOV EAX,DWORD PTR SS:[EBP-20]
004F8A66  |.  8D55 FC    LEA EDX,DWORD PTR SS:[EBP-4]
004F8A69  |.  E8 3200F1FF CALL VoiceKin.00408AA0
004F8A6E  |.  8D4D D8    LEA ECX,DWORD PTR SS:[EBP-28]
004F8A71  |.  33D2       XOR EDX,EDX
004F8A73  |.  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F8A76  |.  E8 2508F1FF CALL VoiceKin.004092A0
004F8A7B  |.  8B55 D8    MOV EDX,DWORD PTR SS:[EBP-28]
004F8A7E  |.  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
004F8A81  |.  E8 56BBF0FF CALL VoiceKin.004045DC
004F8A86  |.  A1 F0B15000 MOV EAX,DWORD PTR DS:[50B1F0]
004F8A8B  |.  8B00       MOV EAX,DWORD PTR DS:[EAX]
004F8A8D  |.  FFB0 1C050000 PUSH DWORD PTR DS:[EAX+51C]
004F8A93  |.  68 A08B4F00 PUSH VoiceKin.004F8BA0                ;  \
004F8A98  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]
004F8A9B  |.  68 AC8B4F00 PUSH VoiceKin.004F8BAC                ;  .dll
004F8AA0  |.  8D45 D4    LEA EAX,DWORD PTR SS:[EBP-2C]
004F8AA3  |.  BA 04000000 MOV EDX,4
004F8AA8  |.  E8 0FBEF0FF CALL VoiceKin.004048BC
004F8AAD  |.  8B55 D4    MOV EDX,DWORD PTR SS:[EBP-2C]
004F8AB0  |.  A1 F0B15000 MOV EAX,DWORD PTR DS:[50B1F0]
004F8AB5  |.  8B00       MOV EAX,DWORD PTR DS:[EAX]
004F8AB7  |.  8B80 0C050000 MOV EAX,DWORD PTR DS:[EAX+50C]
004F8ABD  |.  8B80 20020000 MOV EAX,DWORD PTR DS:[EAX+220]
004F8AC3  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
004F8AC5  |.  FF51 74    CALL DWORD PTR DS:[ECX+74]
004F8AC8  |.  6A 40       PUSH 40
004F8ACA  |.  B9 B48B4F00 MOV ECX,VoiceKin.004F8BB4             ;  提示
004F8ACF  |.  BA BC8B4F00 MOV EDX,VoiceKin.004F8BBC             ;  恭喜您，注册成功！
004F8AD4  |.  A1 50B45000 MOV EAX,DWORD PTR DS:[50B450]
004F8AD9  |.  8B00       MOV EAX,DWORD PTR DS:[EAX]
004F8ADB  |.  E8 0C0EF7FF CALL VoiceKin.004698EC
004F8AE0  |.  8BC6       MOV EAX,ESI
004F8AE2  |.  E8 91D5F6FF CALL VoiceKin.00466078
004F8AE7  |.  EB 41       JMP SHORT VoiceKin.004F8B2A
004F8AE9  |>  6A 10       PUSH 10
004F8AEB  |.  B9 B48B4F00 MOV ECX,VoiceKin.004F8BB4             ;  提示
004F8AF0  |.  BA D08B4F00 MOV EDX,VoiceKin.004F8BD0             ;  您好，注册码错误，注册失败！\n\n----------------------------------\n\n想获取正确注册码，请点[到网站注册]。
★★★★★★错误提示在这里出现了,向上看
004F8AF5  |.  A1 50B45000 MOV EAX,DWORD PTR DS:[50B450]
004F8AFA  |.  8B00       MOV EAX,DWORD PTR DS:[EAX]
004F8AFC  |.  E8 EB0DF7FF CALL VoiceKin.004698EC
004F8B01  |.  33D2       XOR EDX,EDX
004F8B03  |.  8B86 F8020000 MOV EAX,DWORD PTR DS:[ESI+2F8]
004F8B09  |.  E8 7EFBF4FF CALL VoiceKin.0044868C
004F8B0E  |.  8B86 F8020000 MOV EAX,DWORD PTR DS:[ESI+2F8]
004F8B14  |.  8B10       MOV EDX,DWORD PTR DS:[EAX]
004F8B16  |.  FF92 C0000000 CALL DWORD PTR DS:[EDX+C0]
004F8B1C  |.  8B86 0C030000 MOV EAX,DWORD PTR DS:[ESI+30C]
004F8B22  |.  8B10       MOV EDX,DWORD PTR DS:[EAX]
004F8B24  |.  FF92 C0000000 CALL DWORD PTR DS:[EDX+C0]
004F8B2A  |>  33C0       XOR EAX,EAX
004F8B2C  |.  5A          POP EDX
004F8B2D  |.  59          POP ECX
004F8B2E  |.  59          POP ECX
004F8B2F  |.  64:8910    MOV DWORD PTR FS:[EAX],EDX
004F8B32  |.  68 818B4F00 PUSH VoiceKin.004F8B81
004F8B37  |>  8D45 D4    LEA EAX,DWORD PTR SS:[EBP-2C]
004F8B3A  |.  BA 04000000 MOV EDX,4
004F8B3F  |.  E8 24BAF0FF CALL VoiceKin.00404568
004F8B44  |.  8D45 E4    LEA EAX,DWORD PTR SS:[EBP-1C]
004F8B47  |.  E8 F8B9F0FF CALL VoiceKin.00404544
004F8B4C  |.  8D45 E8    LEA EAX,DWORD PTR SS:[EBP-18]
004F8B4F  |.  E8 F0B9F0FF CALL VoiceKin.00404544
004F8B54  |.  8D45 EC    LEA EAX,DWORD PTR SS:[EBP-14]
004F8B57  |.  E8 E8B9F0FF CALL VoiceKin.00404544
004F8B5C  |.  8D45 F0    LEA EAX,DWORD PTR SS:[EBP-10]
004F8B5F  |.  E8 E0B9F0FF CALL VoiceKin.00404544
004F8B64  |.  8D45 F4    LEA EAX,DWORD PTR SS:[EBP-C]
004F8B67  |.  E8 D8B9F0FF CALL VoiceKin.00404544
004F8B6C  |.  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
004F8B6F  |.  BA 02000000 MOV EDX,2
004F8B74  |.  E8 EFB9F0FF CALL VoiceKin.00404568
004F8B79  \.  C3          RETN
004F8B7A .^ E9 CDB3F0FF JMP VoiceKin.00403F4C
004F8B7F .^ EB B6       JMP SHORT VoiceKin.004F8B37
004F8B81 .  5E          POP ESI
004F8B82 .  8BE5       MOV ESP,EBP
004F8B84 .  5D          POP EBP
004F8B85 .  C3          RETN
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
F7跟进到
004F84A4  /$  55          PUSH EBP
004F84A5  |.  8BEC       MOV EBP,ESP
004F84A7  |.  51          PUSH ECX
004F84A8  |.  B9 07000000 MOV ECX,7
004F84AD  |>  6A 00       /PUSH 0
004F84AF  |.  6A 00       |PUSH 0
004F84B1  |.  49          |DEC ECX
004F84B2  |.^ 75 F9       \JNZ SHORT VoiceKin.004F84AD
004F84B4  |.  874D FC    XCHG DWORD PTR SS:[EBP-4],ECX
004F84B7  |.  53          PUSH EBX
004F84B8  |.  56          PUSH ESI
004F84B9  |.  57          PUSH EDI
004F84BA  |.  894D F8    MOV DWORD PTR SS:[EBP-8],ECX
004F84BD  |.  8955 FC    MOV DWORD PTR SS:[EBP-4],EDX
004F84C0  |.  8BD8       MOV EBX,EAX
004F84C2  |.  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F84C5  |.  E8 1AC5F0FF CALL VoiceKin.004049E4
004F84CA  |.  33C0       XOR EAX,EAX
★★★★★★EAX清零
004F84CC  |.  55          PUSH EBP
004F84CD  |.  68 A6864F00 PUSH VoiceKin.004F86A6
004F84D2  |.  64:FF30    PUSH DWORD PTR FS:[EAX]
004F84D5  |.  64:8920    MOV DWORD PTR FS:[EAX],ESP
004F84D8  |.  8D55 F4    LEA EDX,DWORD PTR SS:[EBP-C]
004F84DB  |.  8BC3       MOV EAX,EBX
★★★★★★将EBX送入EAX
004F84DD  |.  E8 26FFFFFF CALL VoiceKin.004F8408
004F84E2  |.  8D55 F0    LEA EDX,DWORD PTR SS:[EBP-10]
004F84E5  |.  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
★★★★★★将"6s2i4kj"送入EAX
004F84E8  |.  E8 1BFFFFFF CALL VoiceKin.004F8408
004F84ED  |.  8D45 EC    LEA EAX,DWORD PTR SS:[EBP-14]
004F84F0  |.  8B55 F4    MOV EDX,DWORD PTR SS:[EBP-C]
★★★★★★取机器码的ASCII码十六进制送入EDX
004F84F3  |.  E8 E4C0F0FF CALL VoiceKin.004045DC
004F84F8  |.  8B45 F0    MOV EAX,DWORD PTR SS:[EBP-10]
★★★★★★将"6s2i4kj"的ASCII码十六进制送送入EAX
004F84FB  |.  E8 FCC2F0FF CALL VoiceKin.004047FC
004F8500  |.  D1F8       SAR EAX,1
004F8502  |.  79 03       JNS SHORT VoiceKin.004F8507
004F8504  |.  83D0 00    ADC EAX,0
004F8507  |>  85C0       TEST EAX,EAX
004F8509  |.  0F8E 54010000 JLE VoiceKin.004F8663
004F850F  |.  8945 E0    MOV DWORD PTR SS:[EBP-20],EAX
004F8512  |.  BE 01000000 MOV ESI,1
004F8517  |>  83FE 01    /CMP ESI,1
004F851A  |.  74 0B       |JE SHORT VoiceKin.004F8527
004F851C  |.  8D45 EC    |LEA EAX,DWORD PTR SS:[EBP-14]
004F851F  |.  8B55 E8    |MOV EDX,DWORD PTR SS:[EBP-18]
004F8522  |.  E8 B5C0F0FF |CALL VoiceKin.004045DC
004F8527  |>  8D45 E8    |LEA EAX,DWORD PTR SS:[EBP-18]
004F852A  |.  E8 15C0F0FF |CALL VoiceKin.00404544
004F852F  |.  8B45 EC    |MOV EAX,DWORD PTR SS:[EBP-14]
★★★★★★取机器码的ASCII码十六进制送入EAX
004F8532  |.  E8 C5C2F0FF |CALL VoiceKin.004047FC
004F8537  |.  8BF8       |MOV EDI,EAX
004F8539  |.  D1FF       |SAR EDI,1
004F853B  |.  79 03       |JNS SHORT VoiceKin.004F8540
004F853D  |.  83D7 00    |ADC EDI,0
004F8540  |>  85FF       |TEST EDI,EDI
004F8542  |.  0F8E 11010000 |JLE VoiceKin.004F8659
004F8548  |.  BB 01000000 |MOV EBX,1
004F854D  |>  BA B4864F00 |/MOV EDX,VoiceKin.004F86B4
004F8552  |.  8D45 D8    ||LEA EAX,DWORD PTR SS:[EBP-28]
004F8555  |.  E8 AEA9F0FF ||CALL VoiceKin.00402F08
004F855A  |.  8D45 D4    ||LEA EAX,DWORD PTR SS:[EBP-2C]
004F855D  |.  8BD3       ||MOV EDX,EBX
004F855F  |.  03D2       ||ADD EDX,EDX
004F8561  |.  8B4D EC    ||MOV ECX,DWORD PTR SS:[EBP-14]
★★★★★★取机器码的ASCII码十六进制送入ECX
004F8564  |.  8A5411 FE    ||MOV DL,BYTE PTR DS:[ECX+EDX-2]
004F8568  |.  8850 01    ||MOV BYTE PTR DS:[EAX+1],DL
004F856B  |.  C600 01    ||MOV BYTE PTR DS:[EAX],1
004F856E  |.  8D55 D4    ||LEA EDX,DWORD PTR SS:[EBP-2C]
004F8571  |.  8D45 D8    ||LEA EAX,DWORD PTR SS:[EBP-28]
004F8574  |.  B1 02       ||MOV CL,2
004F8576  |.  E8 5DA9F0FF ||CALL VoiceKin.00402ED8
004F857B  |.  8D55 D8    ||LEA EDX,DWORD PTR SS:[EBP-28]
004F857E  |.  8D45 D0    ||LEA EAX,DWORD PTR SS:[EBP-30]
004F8581  |.  E8 82A9F0FF ||CALL VoiceKin.00402F08
004F8586  |.  8D45 D4    ||LEA EAX,DWORD PTR SS:[EBP-2C]
004F8589  |.  8BD3       ||MOV EDX,EBX
004F858B  |.  03D2       ||ADD EDX,EDX
004F858D  |.  8B4D EC    ||MOV ECX,DWORD PTR SS:[EBP-14]
004F8590  |.  8A5411 FF    ||MOV DL,BYTE PTR DS:[ECX+EDX-1]
004F8594  |.  8850 01    ||MOV BYTE PTR DS:[EAX+1],DL
004F8597  |.  C600 01    ||MOV BYTE PTR DS:[EAX],1
004F859A  |.  8D55 D4    ||LEA EDX,DWORD PTR SS:[EBP-2C]
004F859D  |.  8D45 D0    ||LEA EAX,DWORD PTR SS:[EBP-30]
004F85A0  |.  B1 03       ||MOV CL,3
004F85A2  |.  E8 31A9F0FF ||CALL VoiceKin.00402ED8
004F85A7  |.  8D55 D0    ||LEA EDX,DWORD PTR SS:[EBP-30]
004F85AA  |.  8D45 DC    ||LEA EAX,DWORD PTR SS:[EBP-24]
004F85AD  |.  E8 EEC1F0FF ||CALL VoiceKin.004047A0
004F85B2  |.  8B45 DC    ||MOV EAX,DWORD PTR SS:[EBP-24]
004F85B5  |.  E8 060AF1FF ||CALL VoiceKin.00408FC0
004F85BA  |.  8845 E7    ||MOV BYTE PTR SS:[EBP-19],AL
004F85BD  |.  BA B4864F00 ||MOV EDX,VoiceKin.004F86B4
004F85C2  |.  8D45 D8    ||LEA EAX,DWORD PTR SS:[EBP-28]
004F85C5  |.  E8 3EA9F0FF ||CALL VoiceKin.00402F08
004F85CA  |.  8D45 D4    ||LEA EAX,DWORD PTR SS:[EBP-2C]
004F85CD  |.  8BD6       ||MOV EDX,ESI
004F85CF  |.  03D2       ||ADD EDX,EDX
004F85D1  |.  8B4D F0    ||MOV ECX,DWORD PTR SS:[EBP-10]
★★★★★★将"6s2i4kj"的ASCII码十六进制送入ECX
004F85D4  |.  8A5411 FE    ||MOV DL,BYTE PTR DS:[ECX+EDX-2]
004F85D8  |.  8850 01    ||MOV BYTE PTR DS:[EAX+1],DL
004F85DB  |.  C600 01    ||MOV BYTE PTR DS:[EAX],1
004F85DE  |.  8D55 D4    ||LEA EDX,DWORD PTR SS:[EBP-2C]
004F85E1  |.  8D45 D8    ||LEA EAX,DWORD PTR SS:[EBP-28]
004F85E4  |.  B1 02       ||MOV CL,2
004F85E6  |.  E8 EDA8F0FF ||CALL VoiceKin.00402ED8
004F85EB  |.  8D55 D8    ||LEA EDX,DWORD PTR SS:[EBP-28]
004F85EE  |.  8D45 D0    ||LEA EAX,DWORD PTR SS:[EBP-30]
004F85F1  |.  E8 12A9F0FF ||CALL VoiceKin.00402F08
004F85F6  |.  8D45 D4    ||LEA EAX,DWORD PTR SS:[EBP-2C]
004F85F9  |.  8BD6       ||MOV EDX,ESI
004F85FB  |.  03D2       ||ADD EDX,EDX
004F85FD  |.  8B4D F0    ||MOV ECX,DWORD PTR SS:[EBP-10]
004F8600  |.  8A5411 FF    ||MOV DL,BYTE PTR DS:[ECX+EDX-1]
004F8604  |.  8850 01    ||MOV BYTE PTR DS:[EAX+1],DL
004F8607  |.  C600 01    ||MOV BYTE PTR DS:[EAX],1
004F860A  |.  8D55 D4    ||LEA EDX,DWORD PTR SS:[EBP-2C]
004F860D  |.  8D45 D0    ||LEA EAX,DWORD PTR SS:[EBP-30]
004F8610  |.  B1 03       ||MOV CL,3
004F8612  |.  E8 C1A8F0FF ||CALL VoiceKin.00402ED8
004F8617  |.  8D55 D0    ||LEA EDX,DWORD PTR SS:[EBP-30]
004F861A  |.  8D45 CC    ||LEA EAX,DWORD PTR SS:[EBP-34]
004F861D  |.  E8 7EC1F0FF ||CALL VoiceKin.004047A0
004F8622  |.  8B45 CC    ||MOV EAX,DWORD PTR SS:[EBP-34]
004F8625  |.  E8 9609F1FF ||CALL VoiceKin.00408FC0
004F862A  |.  3245 E7    ||XOR AL,BYTE PTR SS:[EBP-19]
★★★★★★将机器码每个字母的ASCII码的十六进制与"6s2i4kj"的ASCII码的十六进制循环异或
004F862D  |.  8845 E6    ||MOV BYTE PTR SS:[EBP-1A],AL
004F8630  |.  8D45 C4    ||LEA EAX,DWORD PTR SS:[EBP-3C]
004F8633  |.  8A55 E6    ||MOV DL,BYTE PTR SS:[EBP-1A]
004F8636  |.  E8 E9C0F0FF ||CALL VoiceKin.00404724
004F863B  |.  8B45 C4    ||MOV EAX,DWORD PTR SS:[EBP-3C]
004F863E  |.  8D55 C8    ||LEA EDX,DWORD PTR SS:[EBP-38]
004F8641  |.  E8 C2FDFFFF ||CALL VoiceKin.004F8408
004F8646  |.  8B55 C8    ||MOV EDX,DWORD PTR SS:[EBP-38]
004F8649  |.  8D45 E8    ||LEA EAX,DWORD PTR SS:[EBP-18]
004F864C  |.  E8 B3C1F0FF ||CALL VoiceKin.00404804
004F8651  |.  43          ||INC EBX
004F8652  |.  4F          ||DEC EDI
004F8653  |.^ 0F85 F4FEFFFF |\JNZ VoiceKin.004F854D
004F8659  |>  46          |INC ESI
004F865A  |.  FF4D E0    |DEC DWORD PTR SS:[EBP-20]
004F865D  |.^ 0F85 B4FEFFFF \JNZ VoiceKin.004F8517
004F8663  |>  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
004F8666  |.  8B55 E8    MOV EDX,DWORD PTR SS:[EBP-18]
★★★★★★将真码放入EDX
004F8669  |.  E8 2ABFF0FF CALL VoiceKin.00404598
004F866E  |.  33C0       XOR EAX,EAX
004F8670  |.  5A          POP EDX
004F8671  |.  59          POP ECX
004F8672  |.  59          POP ECX
004F8673  |.  64:8910    MOV DWORD PTR FS:[EAX],EDX
004F8676  |.  68 AD864F00 PUSH VoiceKin.004F86AD
004F867B  |>  8D45 C4    LEA EAX,DWORD PTR SS:[EBP-3C]
004F867E  |.  BA 03000000 MOV EDX,3
004F8683  |.  E8 E0BEF0FF CALL VoiceKin.00404568
004F8688  |.  8D45 DC    LEA EAX,DWORD PTR SS:[EBP-24]
004F868B  |.  E8 B4BEF0FF CALL VoiceKin.00404544
004F8690  |.  8D45 E8    LEA EAX,DWORD PTR SS:[EBP-18]
004F8693  |.  BA 04000000 MOV EDX,4
004F8698  |.  E8 CBBEF0FF CALL VoiceKin.00404568
004F869D  |.  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
004F86A0  |.  E8 9FBEF0FF CALL VoiceKin.00404544
004F86A5  \.  C3          RETN
004F86A6 .^ E9 A1B8F0FF JMP VoiceKin.00403F4C
004F86AB .^ EB CE       JMP SHORT VoiceKin.004F867B
004F86AD .  5F          POP EDI
004F86AE .  5E          POP ESI
004F86AF .  5B          POP EBX
004F86B0 .  8BE5       MOV ESP,EBP
004F86B2 .  5D          POP EBP
004F86B3 .  C3          RETN

【破解总结】
--------------------------------------------------------------------------------
【算法总结】
机器码每个字母的ASCII码的十六进制与"6s2i4kj"的ASCII码的十六进制循环异或，相连即是注册码

--------------------------------------------------------------------------------
【算法注册机】
略
--------------------------------------------------------------------------------
【内存注册机】
中断地址 004F89FC
中断次数 1
第一字节 E8
指令长度 5
内存方式-寄存器-EDX
--------------------------------------------------------------------------------
希望以后可以在猫老大和PYG 5.4Cracker学习小组的帮助下进一步提高自己。
感谢飘云老大、猫老大、Nisy老大以及很多前辈们的学习教程以及所有帮助过我的论坛兄弟姐妹们！谢谢
--------------------------------------------------------------------------------
【版权声明】破文是学习的手记，兴趣是成功的源泉；本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!

我写的,让大家见笑了/:017

[ 本帖最后由 tianxj 于 2007-9-9 13:45 编辑 ]

pw2000 · 发表于 2007-9-7 16:01:04

下载学习，谢谢分享！

senots · 发表于 2007-9-15 01:10:42

顶咯`~

好东西`~~谢谢LZ。

lzhwe · 发表于 2007-9-15 13:26:12

那就要好好看看，谢谢

lxk836 · 发表于 2007-9-15 14:34:48

tanxj 版主早就分析过这个软件了/:good

天涯之海 · 发表于 2007-9-16 00:34:01

原帖由 tianxj 于 2007-9-7 14:16 发表
【破文标题】电子朗读王 2007破文
【破解工具】PEiD,OD
【破解平台】Windows XP
【软件名称】电子朗读王 2007
【软件大小】2494KB
【原版下载】华军软件园
【保护方式】注册码
【软件简介】一款电脑语音朗读软 ...

谢谢版主分析．．．

dtwys · 发表于 2007-9-16 09:02:12

楼主高手，谢谢了，学习了！

		自动登录	找回密码
密码			加入我们

[原创] 菜鸟学分析