Flash Player Pro 4.0算法分析

tianxj · 发表于 2009-8-29 15:09:28

【破文标题】Flash Player Pro 4.0算法分析
【破文作者】tianxj
【作者邮箱】[email protected]
【作者主页】WwW.ChiNaPYG.CoM
【破解工具】PEiD,OD
【破解平台】Windows XP
【软件名称】Flash Player Pro 4.0
【软件大小】3375KB
【软件语言】英文
【软件类别】国外软件/图像浏览
【软件授权】共享版
【运行环境】Win9x/Me/NT/2000/XP/2003
【更新时间】2009-5-31
【原版下载】http://www.onlinedown.net/soft/36469.htm
【保护方式】注册码
【软件简介】Flash播放与管理工具。可以用来：浏览flash动画、捕捉flash图像并发送为墙纸、方便地制作flash屏保、在SWF文件和可执行flash文件之间相互转换，以及更多功能。所有这些功能可以用来增强或扩展现有flash文件的用途，在加上友好的界面为你提供了一个难以忘怀的flash动画世界。
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------
【破解内容】
--------------------------------------------------------------
**************************************************************
一、运行程序，输入错误的注册信息进行检测，无提示信息
**************************************************************
二、用PEiD对Flash Player Pro.exe查壳，为 Borland Delphi 6.0 - 7.0
**************************************************************
三、载入OD,下万能断点来到关键之处

004EC1E0 . 55 PUSH EBP
004EC1E1 . 8BEC MOV EBP, ESP
004EC1E3 . B9 0E000000 MOV ECX, 0E
004EC1E8 > 6A 00 PUSH 0
004EC1EA . 6A 00 PUSH 0
004EC1EC . 49 DEC ECX
004EC1ED .^ 75 F9 JNZ SHORT Flash_Pl.004EC1E8
004EC1EF . 53 PUSH EBX
004EC1F0 . 56 PUSH ESI
004EC1F1 . 57 PUSH EDI
004EC1F2 . 8945 FC MOV DWORD PTR SS:[EBP-4], EAX
004EC1F5 . 33C0 XOR EAX, EAX
004EC1F7 . 55 PUSH EBP
004EC1F8 . 68 9DC64E00 PUSH Flash_Pl.004EC69D
004EC1FD . 64:FF30 PUSH DWORD PTR FS:[EAX]
004EC200 . 64:8920 MOV DWORD PTR FS:[EAX], ESP
004EC203 . 8D45 EC LEA EAX, DWORD PTR SS:[EBP-14]
004EC206 . E8 8181F1FF CALL Flash_Pl.0040438C
004EC20B . 8D45 E8 LEA EAX, DWORD PTR SS:[EBP-18]
004EC20E . E8 7981F1FF CALL Flash_Pl.0040438C
004EC213 . B2 01 MOV DL, 1
004EC215 . A1 F8AE4300 MOV EAX, DWORD PTR DS:[43AEF8]
004EC21A . E8 D9EDF4FF CALL Flash_Pl.0043AFF8
004EC21F . 8945 D8 MOV DWORD PTR SS:[EBP-28], EAX
004EC222 . BA 01000080 MOV EDX, 80000001
004EC227 . 8B45 D8 MOV EAX, DWORD PTR SS:[EBP-28]
004EC22A . E8 69EEF4FF CALL Flash_Pl.0043B098
004EC22F . B1 01 MOV CL, 1
004EC231 . BA B4C64E00 MOV EDX, Flash_Pl.004EC6B4 ; \software\flash player pro
004EC236 . 8B45 D8 MOV EAX, DWORD PTR SS:[EBP-28]
004EC239 . E8 C2EEF4FF CALL Flash_Pl.0043B100
004EC23E . 8D55 D4 LEA EDX, DWORD PTR SS:[EBP-2C]
004EC241 . 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4]
004EC244 . 8B80 10030000 MOV EAX, DWORD PTR DS:[EAX+310]
004EC24A . E8 1182F7FF CALL Flash_Pl.00464460
004EC24F . 837D D4 00 CMP DWORD PTR SS:[EBP-2C], 0
004EC253 . 0F84 0F040000 JE Flash_Pl.004EC668 ; //用户名为空则跳
004EC259 . 8D55 D0 LEA EDX, DWORD PTR SS:[EBP-30]
004EC25C . 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4]
004EC25F . 8B80 14030000 MOV EAX, DWORD PTR DS:[EAX+314]
004EC265 . E8 F681F7FF CALL Flash_Pl.00464460
004EC26A . 837D D0 00 CMP DWORD PTR SS:[EBP-30], 0
004EC26E . 0F84 F4030000 JE Flash_Pl.004EC668 ; //试炼码为空则跳
004EC274 . 33D2 XOR EDX, EDX
004EC276 . 55 PUSH EBP
004EC277 . 68 61C64E00 PUSH Flash_Pl.004EC661
004EC27C . 64:FF32 PUSH DWORD PTR FS:[EDX]
004EC27F . 64:8922 MOV DWORD PTR FS:[EDX], ESP
004EC282 . 8D55 F8 LEA EDX, DWORD PTR SS:[EBP-8]
004EC285 . 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4]
004EC288 . 8B80 10030000 MOV EAX, DWORD PTR DS:[EAX+310]
004EC28E . E8 CD81F7FF CALL Flash_Pl.00464460
004EC293 . 8D55 F4 LEA EDX, DWORD PTR SS:[EBP-C]
004EC296 . 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4]
004EC299 . 8B80 14030000 MOV EAX, DWORD PTR DS:[EAX+314]
004EC29F . E8 BC81F7FF CALL Flash_Pl.00464460
004EC2A4 . 8D55 CC LEA EDX, DWORD PTR SS:[EBP-34]
004EC2A7 . 8B45 F4 MOV EAX, DWORD PTR SS:[EBP-C] ; //试炼码
004EC2AA . E8 3DFCFFFF CALL Flash_Pl.004EBEEC
004EC2AF . 8B45 CC MOV EAX, DWORD PTR SS:[EBP-34] ; //试炼码MD5值大写
004EC2B2 . BA D8C64E00 MOV EDX, Flash_Pl.004EC6D8 ; 60c3c872bf6b924c4b8d841e7b9f8407
004EC2B7 . E8 DC84F1FF CALL Flash_Pl.00404798
004EC2BC . 0F85 32010000 JNZ Flash_Pl.004EC3F4 ; //不等则跳
004EC2C2 . 8D45 E4 LEA EAX, DWORD PTR SS:[EBP-1C]
004EC2C5 . BA 04C74E00 MOV EDX, Flash_Pl.004EC704 ; 084104097110107115032102111114032121111117114032114101103105115116114097116105111110033
004EC2CA . E8 5581F1FF CALL Flash_Pl.00404424
004EC2CF . 8D45 E0 LEA EAX, DWORD PTR SS:[EBP-20]
004EC2D2 . BA 64C74E00 MOV EDX, Flash_Pl.004EC764 ; 114101103105115116101114032115117099099101115115102117108108121
004EC2D7 . E8 4881F1FF CALL Flash_Pl.00404424
004EC2DC . 8B45 E4 MOV EAX, DWORD PTR SS:[EBP-1C]
004EC2DF . E8 6883F1FF CALL Flash_Pl.0040464C
004EC2E4 . B9 03000000 MOV ECX, 3
004EC2E9 . 99 CDQ
004EC2EA . F7F9 IDIV ECX
004EC2EC . 8BF0 MOV ESI, EAX
004EC2EE . 85F6 TEST ESI, ESI
004EC2F0 . 7E 43 JLE SHORT Flash_Pl.004EC335
004EC2F2 . BF 01000000 MOV EDI, 1
004EC2F7 > 8D45 C8 LEA EAX, DWORD PTR SS:[EBP-38]
004EC2FA . 50 PUSH EAX
004EC2FB . 8BC7 MOV EAX, EDI
004EC2FD . 48 DEC EAX
004EC2FE . 8D1440 LEA EDX, DWORD PTR DS:[EAX+EAX*2]
004EC301 . 42 INC EDX
004EC302 . B9 03000000 MOV ECX, 3
004EC307 . 8B45 E4 MOV EAX, DWORD PTR SS:[EBP-1C]
004EC30A . E8 9D85F1FF CALL Flash_Pl.004048AC
004EC30F . 8B45 C8 MOV EAX, DWORD PTR SS:[EBP-38]
004EC312 . 8D55 DC LEA EDX, DWORD PTR SS:[EBP-24]
004EC315 . E8 0E6CF1FF CALL Flash_Pl.00402F28
004EC31A . 8BD8 MOV EBX, EAX
004EC31C . 8D45 C4 LEA EAX, DWORD PTR SS:[EBP-3C]
004EC31F . 8BD3 MOV EDX, EBX
004EC321 . E8 4E82F1FF CALL Flash_Pl.00404574
004EC326 . 8B55 C4 MOV EDX, DWORD PTR SS:[EBP-3C]
004EC329 . 8D45 EC LEA EAX, DWORD PTR SS:[EBP-14]
004EC32C . E8 2383F1FF CALL Flash_Pl.00404654
004EC331 . 47 INC EDI
004EC332 . 4E DEC ESI
004EC333 .^ 75 C2 JNZ SHORT Flash_Pl.004EC2F7
004EC335 > 8B45 E0 MOV EAX, DWORD PTR SS:[EBP-20]
004EC338 . E8 0F83F1FF CALL Flash_Pl.0040464C
004EC33D . B9 03000000 MOV ECX, 3
004EC342 . 99 CDQ
004EC343 . F7F9 IDIV ECX
004EC345 . 8BF0 MOV ESI, EAX
004EC347 . 85F6 TEST ESI, ESI
004EC349 . 7E 43 JLE SHORT Flash_Pl.004EC38E
004EC34B . BF 01000000 MOV EDI, 1
004EC350 > 8D45 C0 LEA EAX, DWORD PTR SS:[EBP-40]
004EC353 . 50 PUSH EAX
004EC354 . 8BC7 MOV EAX, EDI
004EC356 . 48 DEC EAX
004EC357 . 8D1440 LEA EDX, DWORD PTR DS:[EAX+EAX*2]
004EC35A . 42 INC EDX
004EC35B . B9 03000000 MOV ECX, 3
004EC360 . 8B45 E0 MOV EAX, DWORD PTR SS:[EBP-20]
004EC363 . E8 4485F1FF CALL Flash_Pl.004048AC
004EC368 . 8B45 C0 MOV EAX, DWORD PTR SS:[EBP-40]
004EC36B . 8D55 DC LEA EDX, DWORD PTR SS:[EBP-24]
004EC36E . E8 B56BF1FF CALL Flash_Pl.00402F28
004EC373 . 8BD8 MOV EBX, EAX
004EC375 . 8D45 BC LEA EAX, DWORD PTR SS:[EBP-44]
004EC378 . 8BD3 MOV EDX, EBX
004EC37A . E8 F581F1FF CALL Flash_Pl.00404574
004EC37F . 8B55 BC MOV EDX, DWORD PTR SS:[EBP-44]
004EC382 . 8D45 E8 LEA EAX, DWORD PTR SS:[EBP-18]
004EC385 . E8 CA82F1FF CALL Flash_Pl.00404654
004EC38A . 47 INC EDI
004EC38B . 4E DEC ESI
004EC38C .^ 75 C2 JNZ SHORT Flash_Pl.004EC350
004EC38E > 6A 40 PUSH 40
004EC390 . 8B45 E8 MOV EAX, DWORD PTR SS:[EBP-18]
004EC393 . E8 B484F1FF CALL Flash_Pl.0040484C
004EC398 . 50 PUSH EAX
004EC399 . 8B45 EC MOV EAX, DWORD PTR SS:[EBP-14]
004EC39C . E8 AB84F1FF CALL Flash_Pl.0040484C
004EC3A1 . 50 PUSH EAX
004EC3A2 . A1 8C8E5100 MOV EAX, DWORD PTR DS:[518E8C]
004EC3A7 . E8 34E9F7FF CALL Flash_Pl.0046ACE0
004EC3AC . 50 PUSH EAX ; |hOwner
004EC3AD . E8 1AAFF1FF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
004EC3B2 . 8B4D F8 MOV ECX, DWORD PTR SS:[EBP-8]
004EC3B5 . BA ACC74E00 MOV EDX, Flash_Pl.004EC7AC ; username
004EC3BA . 8B45 D8 MOV EAX, DWORD PTR SS:[EBP-28]
004EC3BD . E8 BAF0F4FF CALL Flash_Pl.0043B47C
004EC3C2 . 8B4D F4 MOV ECX, DWORD PTR SS:[EBP-C]
004EC3C5 . BA C0C74E00 MOV EDX, Flash_Pl.004EC7C0 ; code
004EC3CA . 8B45 D8 MOV EAX, DWORD PTR SS:[EBP-28]
004EC3CD . E8 AAF0F4FF CALL Flash_Pl.0043B47C
004EC3D2 . 8B45 D8 MOV EAX, DWORD PTR SS:[EBP-28]
004EC3D5 . E8 8EECF4FF CALL Flash_Pl.0043B068
004EC3DA . 8B45 D8 MOV EAX, DWORD PTR SS:[EBP-28]
004EC3DD . E8 7671F1FF CALL Flash_Pl.00403558
004EC3E2 . 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4]
004EC3E5 . E8 3E48F9FF CALL Flash_Pl.00480C28
004EC3EA . E8 E179F1FF CALL Flash_Pl.00403DD0
004EC3EF . E9 74020000 JMP Flash_Pl.004EC668
004EC3F4 > 8D45 F0 LEA EAX, DWORD PTR SS:[EBP-10]
004EC3F7 . 50 PUSH EAX
004EC3F8 . B9 07000000 MOV ECX, 7
004EC3FD . BA 01000000 MOV EDX, 1
004EC402 . 8B45 F4 MOV EAX, DWORD PTR SS:[EBP-C] ; //试炼码
004EC405 . E8 A284F1FF CALL Flash_Pl.004048AC
004EC40A . 8D55 B8 LEA EDX, DWORD PTR SS:[EBP-48]
004EC40D . 8B45 F0 MOV EAX, DWORD PTR SS:[EBP-10] ; //试炼码1-7位
004EC410 . E8 D7FAFFFF CALL Flash_Pl.004EBEEC
004EC415 . 8B45 B8 MOV EAX, DWORD PTR SS:[EBP-48] ; //试炼码1-7位MD5值大写
004EC418 . BA D0C74E00 MOV EDX, Flash_Pl.004EC7D0 ; 22698600a285bdef56ea4a344b0712f7
004EC41D . E8 7683F1FF CALL Flash_Pl.00404798
004EC422 . 74 0A JE SHORT Flash_Pl.004EC42E ; //相等则跳,1-7位必须是"LdfFla-"
004EC424 . E8 A779F1FF CALL Flash_Pl.00403DD0
004EC429 . E9 3A020000 JMP Flash_Pl.004EC668
004EC42E > 8D55 F0 LEA EDX, DWORD PTR SS:[EBP-10]
004EC431 . 8B45 F8 MOV EAX, DWORD PTR SS:[EBP-8]
004EC434 . E8 B3FAFFFF CALL Flash_Pl.004EBEEC
004EC439 . 8D45 B4 LEA EAX, DWORD PTR SS:[EBP-4C]
004EC43C . 50 PUSH EAX
004EC43D . B9 02000000 MOV ECX, 2
004EC442 . BA 08000000 MOV EDX, 8
004EC447 . 8B45 F4 MOV EAX, DWORD PTR SS:[EBP-C] ; //试炼码
004EC44A . E8 5D84F1FF CALL Flash_Pl.004048AC
004EC44F . 8B45 B4 MOV EAX, DWORD PTR SS:[EBP-4C] ; //试炼码8-9位
004EC452 . 50 PUSH EAX
004EC453 . 8D45 B0 LEA EAX, DWORD PTR SS:[EBP-50]
004EC456 . 50 PUSH EAX
004EC457 . B9 02000000 MOV ECX, 2
004EC45C . BA 0D000000 MOV EDX, 0D
004EC461 . 8B45 F0 MOV EAX, DWORD PTR SS:[EBP-10] ; //用户名MD5值大写
004EC464 . E8 4384F1FF CALL Flash_Pl.004048AC
004EC469 . 8B55 B0 MOV EDX, DWORD PTR SS:[EBP-50] ; //用户名MD5值大写13-14位
004EC46C . 58 POP EAX ; //试炼码8-9位
004EC46D . E8 2683F1FF CALL Flash_Pl.00404798
004EC472 . 74 0A JE SHORT Flash_Pl.004EC47E ; //相等则跳
004EC474 . E8 5779F1FF CALL Flash_Pl.00403DD0
004EC479 . E9 EA010000 JMP Flash_Pl.004EC668
004EC47E > 8D45 A8 LEA EAX, DWORD PTR SS:[EBP-58]
004EC481 . 50 PUSH EAX
004EC482 . B9 0B000000 MOV ECX, 0B
004EC487 . BA 11000000 MOV EDX, 11
004EC48C . 8B45 F0 MOV EAX, DWORD PTR SS:[EBP-10] ; //用户名MD5值大写
004EC48F . E8 1884F1FF CALL Flash_Pl.004048AC
004EC494 . 8B45 A8 MOV EAX, DWORD PTR SS:[EBP-58] ; //用户名MD5值大写17-27位
004EC497 . 8D55 AC LEA EDX, DWORD PTR SS:[EBP-54]
004EC49A . E8 4DFAFFFF CALL Flash_Pl.004EBEEC
004EC49F . 8B55 AC MOV EDX, DWORD PTR SS:[EBP-54] ; //用户名MD5值大写17-27位的MD5值大写
004EC4A2 . 8D45 F0 LEA EAX, DWORD PTR SS:[EBP-10]
004EC4A5 . E8 7A7FF1FF CALL Flash_Pl.00404424
004EC4AA . 8D45 A4 LEA EAX, DWORD PTR SS:[EBP-5C]
004EC4AD . 50 PUSH EAX
004EC4AE . B9 03000000 MOV ECX, 3
004EC4B3 . BA 0A000000 MOV EDX, 0A
004EC4B8 . 8B45 F4 MOV EAX, DWORD PTR SS:[EBP-C] ; //试炼码
004EC4BB . E8 EC83F1FF CALL Flash_Pl.004048AC
004EC4C0 . 8B45 A4 MOV EAX, DWORD PTR SS:[EBP-5C] ; //试炼码10-12位
004EC4C3 . 50 PUSH EAX
004EC4C4 . 8D45 A0 LEA EAX, DWORD PTR SS:[EBP-60]
004EC4C7 . 50 PUSH EAX
004EC4C8 . B9 03000000 MOV ECX, 3
004EC4CD . BA 14000000 MOV EDX, 14
004EC4D2 . 8B45 F0 MOV EAX, DWORD PTR SS:[EBP-10] ; //用户名MD5值大写17-27位的MD5值大写
004EC4D5 . E8 D283F1FF CALL Flash_Pl.004048AC
004EC4DA . 8B55 A0 MOV EDX, DWORD PTR SS:[EBP-60] ; //用户名MD5值大写17-27位的MD5值大写20-22位
004EC4DD . 58 POP EAX ; //试炼码10-12位
004EC4DE . E8 B582F1FF CALL Flash_Pl.00404798
004EC4E3 . 74 0A JE SHORT Flash_Pl.004EC4EF ; //相等则跳
004EC4E5 . E8 E678F1FF CALL Flash_Pl.00403DD0
004EC4EA . E9 79010000 JMP Flash_Pl.004EC668
004EC4EF > 8D45 E4 LEA EAX, DWORD PTR SS:[EBP-1C]
004EC4F2 . BA 04C74E00 MOV EDX, Flash_Pl.004EC704 ; 084104097110107115032102111114032121111117114032114101103105115116114097116105111110033
004EC4F7 . E8 287FF1FF CALL Flash_Pl.00404424
004EC4FC . 8D45 E0 LEA EAX, DWORD PTR SS:[EBP-20]
004EC4FF . BA 64C74E00 MOV EDX, Flash_Pl.004EC764 ; 114101103105115116101114032115117099099101115115102117108108121
004EC504 . E8 1B7FF1FF CALL Flash_Pl.00404424
004EC509 . 8B45 E4 MOV EAX, DWORD PTR SS:[EBP-1C]
004EC50C . E8 3B81F1FF CALL Flash_Pl.0040464C
004EC511 . B9 03000000 MOV ECX, 3
004EC516 . 99 CDQ
004EC517 . F7F9 IDIV ECX
004EC519 . 8BF0 MOV ESI, EAX
004EC51B . 85F6 TEST ESI, ESI
004EC51D . 7E 43 JLE SHORT Flash_Pl.004EC562
004EC51F . BF 01000000 MOV EDI, 1
004EC524 > 8D45 9C LEA EAX, DWORD PTR SS:[EBP-64]
004EC527 . 50 PUSH EAX
004EC528 . 8BC7 MOV EAX, EDI
004EC52A . 48 DEC EAX
004EC52B . 8D1440 LEA EDX, DWORD PTR DS:[EAX+EAX*2]
004EC52E . 42 INC EDX
004EC52F . B9 03000000 MOV ECX, 3
004EC534 . 8B45 E4 MOV EAX, DWORD PTR SS:[EBP-1C]
004EC537 . E8 7083F1FF CALL Flash_Pl.004048AC
004EC53C . 8B45 9C MOV EAX, DWORD PTR SS:[EBP-64]
004EC53F . 8D55 DC LEA EDX, DWORD PTR SS:[EBP-24]
004EC542 . E8 E169F1FF CALL Flash_Pl.00402F28
004EC547 . 8BD8 MOV EBX, EAX
004EC549 . 8D45 98 LEA EAX, DWORD PTR SS:[EBP-68]
004EC54C . 8BD3 MOV EDX, EBX
004EC54E . E8 2180F1FF CALL Flash_Pl.00404574
004EC553 . 8B55 98 MOV EDX, DWORD PTR SS:[EBP-68]
004EC556 . 8D45 EC LEA EAX, DWORD PTR SS:[EBP-14]
004EC559 . E8 F680F1FF CALL Flash_Pl.00404654
004EC55E . 47 INC EDI
004EC55F . 4E DEC ESI
004EC560 .^ 75 C2 JNZ SHORT Flash_Pl.004EC524
004EC562 > 8B45 E0 MOV EAX, DWORD PTR SS:[EBP-20]
004EC565 . E8 E280F1FF CALL Flash_Pl.0040464C
004EC56A . B9 03000000 MOV ECX, 3
004EC56F . 99 CDQ
004EC570 . F7F9 IDIV ECX
004EC572 . 8BF0 MOV ESI, EAX
004EC574 . 85F6 TEST ESI, ESI
004EC576 . 7E 43 JLE SHORT Flash_Pl.004EC5BB
004EC578 . BF 01000000 MOV EDI, 1
004EC57D > 8D45 94 LEA EAX, DWORD PTR SS:[EBP-6C]
004EC580 . 50 PUSH EAX
004EC581 . 8BC7 MOV EAX, EDI
004EC583 . 48 DEC EAX
004EC584 . 8D1440 LEA EDX, DWORD PTR DS:[EAX+EAX*2]
004EC587 . 42 INC EDX
004EC588 . B9 03000000 MOV ECX, 3
004EC58D . 8B45 E0 MOV EAX, DWORD PTR SS:[EBP-20]
004EC590 . E8 1783F1FF CALL Flash_Pl.004048AC
004EC595 . 8B45 94 MOV EAX, DWORD PTR SS:[EBP-6C]
004EC598 . 8D55 DC LEA EDX, DWORD PTR SS:[EBP-24]
004EC59B . E8 8869F1FF CALL Flash_Pl.00402F28
004EC5A0 . 8BD8 MOV EBX, EAX
004EC5A2 . 8D45 90 LEA EAX, DWORD PTR SS:[EBP-70]
004EC5A5 . 8BD3 MOV EDX, EBX
004EC5A7 . E8 C87FF1FF CALL Flash_Pl.00404574
004EC5AC . 8B55 90 MOV EDX, DWORD PTR SS:[EBP-70]
004EC5AF . 8D45 E8 LEA EAX, DWORD PTR SS:[EBP-18]
004EC5B2 . E8 9D80F1FF CALL Flash_Pl.00404654
004EC5B7 . 47 INC EDI
004EC5B8 . 4E DEC ESI
004EC5B9 .^ 75 C2 JNZ SHORT Flash_Pl.004EC57D
004EC5BB > 33C0 XOR EAX, EAX
004EC5BD . 55 PUSH EBP
004EC5BE . 68 17C64E00 PUSH Flash_Pl.004EC617
004EC5C3 . 64:FF30 PUSH DWORD PTR FS:[EAX]
004EC5C6 . 64:8920 MOV DWORD PTR FS:[EAX], ESP
004EC5C9 . 8B4D F8 MOV ECX, DWORD PTR SS:[EBP-8]
004EC5CC . BA ACC74E00 MOV EDX, Flash_Pl.004EC7AC ; username
004EC5D1 . 8B45 D8 MOV EAX, DWORD PTR SS:[EBP-28]
004EC5D4 . E8 A3EEF4FF CALL Flash_Pl.0043B47C
004EC5D9 . 8B4D F4 MOV ECX, DWORD PTR SS:[EBP-C]
004EC5DC . BA C0C74E00 MOV EDX, Flash_Pl.004EC7C0 ; code
004EC5E1 . 8B45 D8 MOV EAX, DWORD PTR SS:[EBP-28]
004EC5E4 . E8 93EEF4FF CALL Flash_Pl.0043B47C
004EC5E9 . 6A 40 PUSH 40
004EC5EB . 8B45 E8 MOV EAX, DWORD PTR SS:[EBP-18]
004EC5EE . E8 5982F1FF CALL Flash_Pl.0040484C
004EC5F3 . 50 PUSH EAX
004EC5F4 . 8B45 EC MOV EAX, DWORD PTR SS:[EBP-14]
004EC5F7 . E8 5082F1FF CALL Flash_Pl.0040484C
004EC5FC . 50 PUSH EAX
004EC5FD . A1 8C8E5100 MOV EAX, DWORD PTR DS:[518E8C]
004EC602 . E8 D9E6F7FF CALL Flash_Pl.0046ACE0
004EC607 . 50 PUSH EAX ; |hOwner
004EC608 . E8 BFACF1FF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
004EC60D . 33C0 XOR EAX, EAX
004EC60F . 5A POP EDX
004EC610 . 59 POP ECX
004EC611 . 59 POP ECX
004EC612 . 64:8910 MOV DWORD PTR FS:[EAX], EDX
004EC615 . EB 34 JMP SHORT Flash_Pl.004EC64B
004EC617 .^ E9 1C74F1FF JMP Flash_Pl.00403A38
004EC61C . 8D45 F0 LEA EAX, DWORD PTR SS:[EBP-10]
004EC61F . BA FCC74E00 MOV EDX, Flash_Pl.004EC7FC ; flash player pro can not save registraton information. please try it again.
004EC624 . E8 FB7DF1FF CALL Flash_Pl.00404424
004EC629 . 6A 10 PUSH 10
004EC62B . 8B45 F0 MOV EAX, DWORD PTR SS:[EBP-10]
004EC62E . E8 1982F1FF CALL Flash_Pl.0040484C
004EC633 . 8BD0 MOV EDX, EAX
004EC635 . B9 48C84E00 MOV ECX, Flash_Pl.004EC848 ; error
004EC63A . A1 D0795100 MOV EAX, DWORD PTR DS:[5179D0]
004EC63F . 8B00 MOV EAX, DWORD PTR DS:[EAX]
004EC641 . E8 567FF9FF CALL Flash_Pl.0048459C
004EC646 . E8 5577F1FF CALL Flash_Pl.00403DA0
004EC64B > 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4]
004EC64E . E8 D545F9FF CALL Flash_Pl.00480C28
004EC653 . 33C0 XOR EAX, EAX
004EC655 . 5A POP EDX
004EC656 . 59 POP ECX
004EC657 . 59 POP ECX
004EC658 . 64:8910 MOV DWORD PTR FS:[EAX], EDX
004EC65B . 68 68C64E00 PUSH Flash_Pl.004EC668
004EC660 > C3 RETN ; RET 用作跳转到 004EC668
004EC661 .^ E9 8676F1FF JMP Flash_Pl.00403CEC
004EC666 .^ EB F8 JMP SHORT Flash_Pl.004EC660
004EC668 > 33C0 XOR EAX, EAX
004EC66A . 5A POP EDX
004EC66B . 59 POP ECX
004EC66C . 59 POP ECX
004EC66D . 64:8910 MOV DWORD PTR FS:[EAX], EDX
004EC670 . 68 A4C64E00 PUSH Flash_Pl.004EC6A4
004EC675 > 8D45 90 LEA EAX, DWORD PTR SS:[EBP-70]
004EC678 . BA 10000000 MOV EDX, 10
004EC67D . E8 2E7DF1FF CALL Flash_Pl.004043B0
004EC682 . 8D45 D0 LEA EAX, DWORD PTR SS:[EBP-30]
004EC685 . BA 02000000 MOV EDX, 2
004EC68A . E8 217DF1FF CALL Flash_Pl.004043B0
004EC68F . 8D45 E0 LEA EAX, DWORD PTR SS:[EBP-20]
004EC692 . BA 07000000 MOV EDX, 7
004EC697 . E8 147DF1FF CALL Flash_Pl.004043B0
004EC69C . C3 RETN
004EC69D .^ E9 4A76F1FF JMP Flash_Pl.00403CEC
004EC6A2 .^ EB D1 JMP SHORT Flash_Pl.004EC675
004EC6A4 . 5F POP EDI
004EC6A5 . 5E POP ESI
004EC6A6 . 5B POP EBX
004EC6A7 . 8BE5 MOV ESP, EBP
004EC6A9 . 5D POP EBP
004EC6AA . C3 RETN

复制代码

**************************************************************
【破解总结】
没啥总结的，小菜鸟一个，复习下算法分析而已
--------------------------------------------------------------
【算法总结】
主要是MD5算法
--------------------------------------------------------------
【算法注册机】
〖易语言代码〗
.版本 2
.支持库 dp1

.局部变量 MD5_1, 文本型
.局部变量 MD5_2, 文本型

.判断开始 (编辑框1.内容＝ “”)
编辑框2.内容＝ “输入有误，请重新输入。”
.默认

MD5_1 ＝到大写 (取数据摘要 (到字节集 (编辑框1.内容)))
MD5_2 ＝到大写 (取数据摘要 (到字节集 (取文本中间 (MD5_1, 17, 11))))
编辑框2.内容＝ “LdfFla-” ＋取文本中间 (MD5_1, 13, 2) ＋取文本中间 (MD5_2, 20, 3)

.判断结束
--------------------------------------------------------------
【注册信息】
保存在注册表[HKEY_CURRENT_USER\Software\Flash Player Pro]
--------------------------------------------------------------
感谢飘云老大、猫老大、Nisy老大以及很多前辈们的学习教程以及所有帮助过我的论坛兄弟姐妹们！谢谢
--------------------------------------------------------------
【版权声明】破文是学习的手记，兴趣是成功的源泉；本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!

Luckly · 发表于 2009-8-29 17:51:02

...第一次看到 Flash Player 也要注册了...

老万 · 发表于 2009-8-29 20:22:57

学习了，谢谢分享

mantou · 发表于 2009-8-29 21:37:27

1-7位的值是那个MD5解密出来的么？还是在哪个地址可以看到呢？

win7 · 发表于 2009-8-31 08:25:23

同楼上的问题，请楼主帮忙解答一下

cjteam · 发表于 2009-9-1 10:06:36

看看1-7是不是这里

004EC402 . 8B45 F4 MOV EAX, DWORD PTR SS:[EBP-C] ; //试炼码
004EC405 . E8 A284F1FF CALL Flash_Pl.004048AC
004EC40A . 8D55 B8 LEA EDX, DWORD PTR SS:[EBP-48]
004EC40D . 8B45 F0 MOV EAX, DWORD PTR SS:[EBP-10] ; //试炼码1-7位
004EC410 . E8 D7FAFFFF CALL Flash_Pl.004EBEEC
004EC415 . 8B45 B8 MOV EAX, DWORD PTR SS:[EBP-48] ; //试炼码1-7位MD5值大写
004EC418 . BA D0C74E00 MOV EDX, Flash_Pl.004EC7D0 ; 22698600a285bdef56ea4a344b0712f7
004EC41D . E8 7683F1FF CALL Flash_Pl.00404798
004EC422 . 74 0A JE SHORT Flash_Pl.004EC42E ; //相等则跳,1-7位必须是"LdfFla-"

复制代码

kiss-you · 发表于 2009-9-2 09:33:20

1-7位必须是"LdfFla-"

对应我的用户名的注册码是：LdfFla-5B677B4AEC0

229402931 · 发表于 2009-9-3 02:00:34

我是来学习的，你们说的我怎么看不懂啊/:L

yunfeng · 发表于 2009-9-3 09:12:15

Name:yunfeng
Code:LdfFla-65563

桂子飘香 · 发表于 2009-9-11 10:02:56

flash是非常好的一种实用工具。进来学习学习。谢谢分享。

		自动登录	找回密码
密码			加入我们

[原创] Flash Player Pro 4.0算法分析

相关帖子