- UID
- 37872
注册时间2007-12-1
阅读权限8
最后登录1970-1-1
初入江湖
该用户从未签到
|
发表于 2007-12-1 19:42:57
|
显示全部楼层
这个其实很容易追码。
调试时用的信息如下：
用户名：3800CC
注册码：1234567890
真正注册码：14387-xiaochun-[]D[][]\/[][]D
--------------
004010C4 FF35 04304000 push dword ptr ds:[403004]
004010CA E8 1F010000 call <jmp.&user32.GetWindowTextA>
004010CF 8D5D 80 lea ebx,dword ptr ss:[ebp-80] ; 读取用户名
004010D2 66:8B03 mov ax,word ptr ds:[ebx]
004010D5 8BD8 mov ebx,eax
004010D7 8D45 80 lea eax,dword ptr ss:[ebp-80]
004010DA 50 push eax
004010DB 53 push ebx
004010DC E8 1F010000 call KeyMeAsm.00401200 ; 用用户名计算出注册码的第一部分(注册码共三
部分)
004010E1 8D5D 80 lea ebx,dword ptr ss:[ebp-80] ; 取得注册码的第一部分数值
004010E4 8D45 80 lea eax,dword ptr ss:[ebp-80]
004010E7 50 push eax
004010E8 8D85 00FFFFFF lea eax,dword ptr ss:[ebp-100]
004010EE 50 push eax
004010EF E8 DC000000 call <jmp.&kernel32.lstrcpyA>
004010F4 68 44204000 push KeyMeAsm.00402044 ; 把注册码用‘-’连接起来
004010F9 8D85 00FFFFFF lea eax,dword ptr ss:[ebp-100]
004010FF 50 push eax
00401100 E8 BF000000 call <jmp.&kernel32.lstrcatA>
00401105 C705 0C314000 00010000 mov dword ptr ds:[40310C],100
0040110F 68 0C314000 push KeyMeAsm.0040310C
00401114 68 0C304000 push KeyMeAsm.0040300C ; ASCII "xiaochun"
00401119 E8 94000000 call <jmp.&kernel32.GetComputerNam>; 注册码的第二部分为计算机名称
0040111E 68 0C304000 push KeyMeAsm.0040300C ; ASCII "xiaochun"
00401123 8D85 00FFFFFF lea eax,dword ptr ss:[ebp-100]
00401129 50 push eax
0040112A E8 95000000 call <jmp.&kernel32.lstrcatA>
0040112F 68 46204000 push KeyMeAsm.00402046 ; 注册码的第三部分为字符串"[]d[][]\/[][]d"
00401134 8D85 00FFFFFF lea eax,dword ptr ss:[ebp-100]
0040113A 50 push eax
0040113B E8 84000000 call <jmp.&kernel32.lstrcatA>
00401140 68 FF000000 push 0FF
00401145 8D45 80 lea eax,dword ptr ss:[ebp-80]
00401148 50 push eax
00401149 FF35 08304000 push dword ptr ds:[403008]
0040114F E8 9A000000 call <jmp.&user32.GetWindowTextA>
00401154 8D45 80 lea eax,dword ptr ss:[ebp-80] ; 读取我们输入的假注册码
00401157 50 push eax
00401158 8D85 00FFFFFF lea eax,dword ptr ss:[ebp-100] ; 读取真注册码
0040115E 50 push eax
0040115F E8 66000000 call <jmp.&kernel32.lstrcmpA> ; 比较注册码是否正确,影响ZF标志
00401164 83F8 00 cmp eax,0
00401167 75 16 jnz short KeyMeAsm.0040117F ; ZF标志为真就是错误注册码，反之为正确注册码
00401169 6A 00 push 0
0040116B 68 6A204000 push KeyMeAsm.0040206A ; well done!
00401170 68 56204000 push KeyMeAsm.00402056 ; you pass this test.
00401175 FF75 08 push dword ptr ss:[ebp+8]
00401178 E8 77000000 call <jmp.&user32.MessageBoxA>
0040117D EB 07 jmp short KeyMeAsm.00401186
0040117F 6A 00 push 0
00401181 E8 26000000 call <jmp.&kernel32.ExitProcess>
----------注册码第一部分的计算过程
00401200 55 push ebp
00401201 8BEC mov ebp,esp
00401203 53 push ebx
00401204 56 push esi
00401205 57 push edi
00401206 8B45 08 mov eax,dword ptr ss:[ebp+8] ; 取用户名前两位
00401209 8B7D 0C mov edi,dword ptr ss:[ebp+C]
0040120C 85C0 test eax,eax ; 检测其是否为空
0040120E 75 07 jnz short KeyMeAsm.00401217
00401210 66:C707 3000 mov word ptr ds:[edi],30
00401215 EB 47 jmp short KeyMeAsm.0040125E
00401217 79 08 jns short KeyMeAsm.00401221
00401219 C607 2D mov byte ptr ds:[edi],2D
0040121C F7D8 neg eax
0040121E 83C7 01 add edi,1
00401221 B9 CDCCCCCC mov ecx,CCCCCCCD ; 将CCCCCCCD放入ECX
00401226 8BF7 mov esi,edi ; 将用户名放入ESI
00401228 EB 18 jmp short KeyMeAsm.00401242
0040122A 8BD8 mov ebx,eax ; 取得上次计算的值
0040122C F7E1 mul ecx ; 用户名前两位ASCII值(16位)乘CCCCCCCD
0040122E C1EA 03 shr edx,3 ; EDX(值为前面的高两位)右移3位
00401231 8BC2 mov eax,edx
00401233 8D1492 lea edx,dword ptr ds:[edx+edx*4] ; 特定值放入EDX
00401236 03D2 add edx,edx ; 特定值＋特定值
00401238 2BDA sub ebx,edx ; 用户名前两位ASCII值-(特定值＋特定值)
0040123A 80C3 30 add bl,30 ; 取得BL里数值的ASCII值
0040123D 881F mov byte ptr ds:[edi],bl
0040123F 83C7 01 add edi,1 ; 计数器加1
00401242 83F8 00 cmp eax,0 ; 检测所取字符长度是否为0
00401245 ^ 77 E3 ja short KeyMeAsm.0040122A
00401247 C607 00 mov byte ptr ds:[edi],0 ; 至此，已计算出第一部分注册码
0040124A EB 0E jmp short KeyMeAsm.0040125A
0040124C 83EF 01 sub edi,1 ; 把前面计算出来的数据把位置颠倒一下--START
0040124F 8A06 mov al,byte ptr ds:[esi]
00401251 8A27 mov ah,byte ptr ds:[edi]
00401253 8807 mov byte ptr ds:[edi],al
00401255 8826 mov byte ptr ds:[esi],ah
00401257 83C6 01 add esi,1
0040125A 3BF7 cmp esi,edi
0040125C ^ 72 EE jb short KeyMeAsm.0040124C ; ---END
0040125E 5F pop edi
0040125F 5E pop esi
00401260 5B pop ebx
00401261 C9 leave
00401262 C2 0800 retn 8
[ 本帖最后由 风林 于 2007-12-1 19:44 编辑 ] |
|
楼主: 受苦
IP卡
发表于 2007-11-30 15:51:47
显身卡
发表于 2007-12-1 12:37:52
