美达网络电视 2.10 算法分析

cxx17 · 发表于 2006-9-5 17:34:31

【破文标题】美达网络电视 2.10 算法分析
【破文作者】cxx17
【破解工具】OD
【破解平台】Win9x/NT/2000/XP/2003
【软件名称】美达网络电视 2.10
【更新时间】2006-09-04
【原版下载】http://www.newhua.com/soft/45502.htm
【保护方式】注册码
【软件简介】
一款值得推荐的高速网络电视软件，集当前流行网络电视软件的优点于一身，虽然软件推出较晚，但

无论从界面、功能，还是从节目质量、速度都超过其它同类软件。独家配备完善的节目中心和专业的节目

维护队伍，24小时开启频道监测系统，对节目实时检测，采用用户端节目与服务器端实时更新技术，保证

节目畅通稳定，让用户尽享观看网络电视的乐趣。
★ 界面设计美观，布局合理;
★ 提供数百套超高清晰的体育台（CCTV-5、卫视体育各地市体育台等）、电影台、电视剧频道、卫

星电视节目，包括国内（中央、地方各省市卫星电视节目等）、港澳台（凤凰卫视、阳光卫视等）、国

外（CNN、NHK ABC、BBC、ESPN、、TVB、韩国等）系列系列节目。
★ 电视屏幕自由缩放,不影响其它爱作
★ 绿色软件,不产生垃圾文件,不修改注册表!
★ 一次注册,终身免费使用、免费升级。

【算法分析】

一、PEiD查无壳。软件是Borland Delphi 6.0 - 7.0编写。

运行，注册名：cxx17 试练码：97979797

二、OD载入后，超级ASCII参串

超级字串参考＋       , 条目 1518
地址=004F2DB4
反汇编=PUSH MDTV.004F2E9C
文本字串=注册失败，请检查您的注册名和注册码!

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

004F2CA4 $  55          PUSH EBP                               ;  这里f2下断
004F2CA5 .  8BEC       MOV EBP,ESP
004F2CA7 .  33C9       XOR ECX,ECX
004F2CA9 .  51          PUSH ECX
004F2CAA .  51          PUSH ECX
004F2CAB .  51          PUSH ECX
004F2CAC .  51          PUSH ECX
004F2CAD .  51          PUSH ECX
004F2CAE .  53          PUSH EBX
004F2CAF .  56          PUSH ESI
004F2CB0 .  57          PUSH EDI
004F2CB1 .  8945 FC    MOV DWORD PTR SS:[EBP-4],EAX
004F2CB4 .  33C0       XOR EAX,EAX
004F2CB6 .  55          PUSH EBP
004F2CB7 .  68 F52D4F00 PUSH MDTV.004F2DF5
004F2CBC .  64:FF30    PUSH DWORD PTR FS:[EAX]
004F2CBF .  64:8920    MOV DWORD PTR FS:[EAX],ESP
004F2CC2 .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F2CC5 .  E8 AE020000 CALL MDTV.004F2F78                      ;  关键call，f7进入
004F2CCA .  84C0       TEST AL,AL
004F2CCC .  0F84 DB000000 JE MDTV.004F2DAD                      ;  关键跳，跳就注册失败
004F2CD2 .  33C0       XOR EAX,EAX
004F2CD4 .  55          PUSH EBP
004F2CD5 .  68 912D4F00 PUSH MDTV.004F2D91
004F2CDA .  64:FF30    PUSH DWORD PTR FS:[EAX]
004F2CDD .  64:8920    MOV DWORD PTR FS:[EAX],ESP
004F2CE0 .  B2 01       MOV DL,1
004F2CE2 .  A1 F8904300 MOV EAX,DWORD PTR DS:[4390F8]
004F2CE7 .  E8 0C65F4FF CALL MDTV.004391F8
004F2CEC .  8BD8       MOV EBX,EAX
004F2CEE .  BA 02000080 MOV EDX,80000002
004F2CF3 .  8BC3       MOV EAX,EBX
004F2CF5 .  E8 9E65F4FF CALL MDTV.00439298
004F2CFA .  B1 01       MOV CL,1
004F2CFC .  BA 0C2E4F00 MOV EDX,MDTV.004F2E0C                   ;  software\zy\mdtv
004F2D01 .  8BC3       MOV EAX,EBX
004F2D03 .  E8 F465F4FF CALL MDTV.004392FC
004F2D08 .  8D55 F4    LEA EDX,DWORD PTR SS:[EBP-C]
004F2D0B .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F2D0E .  8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
004F2D14 .  E8 8BCEF5FF CALL MDTV.0044FBA4
004F2D19 .  8B45 F4    MOV EAX,DWORD PTR SS:[EBP-C]
004F2D1C .  8D55 F8    LEA EDX,DWORD PTR SS:[EBP-8]
004F2D1F .  E8 545DF1FF CALL MDTV.00408A78
004F2D24 .  8B4D F8    MOV ECX,DWORD PTR SS:[EBP-8]
004F2D27 .  BA 282E4F00 MOV EDX,MDTV.004F2E28                   ;  name
004F2D2C .  8BC3       MOV EAX,EBX
004F2D2E .  E8 6567F4FF CALL MDTV.00439498
004F2D33 .  8D55 EC    LEA EDX,DWORD PTR SS:[EBP-14]
004F2D36 .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F2D39 .  8B80 04030000 MOV EAX,DWORD PTR DS:[EAX+304]
004F2D3F .  E8 60CEF5FF CALL MDTV.0044FBA4
004F2D44 .  8B45 EC    MOV EAX,DWORD PTR SS:[EBP-14]
004F2D47 .  8D55 F0    LEA EDX,DWORD PTR SS:[EBP-10]
004F2D4A .  E8 295DF1FF CALL MDTV.00408A78
004F2D4F .  8B4D F0    MOV ECX,DWORD PTR SS:[EBP-10]
004F2D52 .  BA 382E4F00 MOV EDX,MDTV.004F2E38                   ;  pass
004F2D57 .  8BC3       MOV EAX,EBX
004F2D59 .  E8 3A67F4FF CALL MDTV.00439498
004F2D5E .  8BC3       MOV EAX,EBX
004F2D60 .  E8 BF06F1FF CALL MDTV.00403424
004F2D65 .  6A 40       PUSH 40
004F2D67 .  68 402E4F00 PUSH MDTV.004F2E40                      ;  软件注册
004F2D6C .  68 4C2E4F00 PUSH MDTV.004F2E4C                      ;  注册成功，本程序所有

功能限制下次启动时将被自动解除，欢迎您成为我们正式版本用户!
004F2D71 .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F2D74 .  E8 4B36F6FF CALL MDTV.004563C4
004F2D79 .  50          PUSH EAX                               ; |hOwner
004F2D7A .  E8 8545F1FF CALL <JMP.&user32.MessageBoxA>          ; \MessageBoxA
004F2D7F .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F2D82 .  E8 DD95F7FF CALL MDTV.0046C364
004F2D87 .  33C0       XOR EAX,EAX
004F2D89 .  5A          POP EDX
004F2D8A .  59          POP ECX
004F2D8B .  59          POP ECX
004F2D8C .  64:8910    MOV DWORD PTR FS:[EAX],EDX
004F2D8F .  EB 36       JMP SHORT MDTV.004F2DC7
004F2D91 .^ E9 2E0BF1FF JMP MDTV.004038C4
004F2D96 .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F2D99 .  E8 C695F7FF CALL MDTV.0046C364
004F2D9E .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F2DA1 .  E8 1A010000 CALL MDTV.004F2EC0
004F2DA6 .  E8 450FF1FF CALL MDTV.00403CF0
004F2DAB .  EB 1A       JMP SHORT MDTV.004F2DC7
004F2DAD >  6A 40       PUSH 40
004F2DAF .  68 402E4F00 PUSH MDTV.004F2E40                      ;  软件注册
004F2DB4 .  68 9C2E4F00 PUSH MDTV.004F2E9C                      ;  注册失败，请检查您的

注册名和注册码!
004F2DB9 .  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F2DBC .  E8 0336F6FF CALL MDTV.004563C4
004F2DC1 .  50          PUSH EAX                               ; |hOwner
004F2DC2 .  E8 3D45F1FF CALL <JMP.&user32.MessageBoxA>          ; \MessageBoxA

f7进入后来到这里：
004F2F78  /$  55          PUSH EBP
004F2F79  |.  8BEC       MOV EBP,ESP
004F2F7B  |.  33C9       XOR ECX,ECX
004F2F7D  |.  51          PUSH ECX
004F2F7E  |.  51          PUSH ECX
004F2F7F  |.  51          PUSH ECX
004F2F80  |.  51          PUSH ECX
004F2F81  |.  51          PUSH ECX
004F2F82  |.  53          PUSH EBX
004F2F83  |.  56          PUSH ESI
004F2F84  |.  8BF0       MOV ESI,EAX
004F2F86  |.  33C0       XOR EAX,EAX
004F2F88  |.  55          PUSH EBP
004F2F89  |.  68 33304F00 PUSH MDTV.004F3033
004F2F8E  |.  64:FF30    PUSH DWORD PTR FS:[EAX]
004F2F91  |.  64:8920    MOV DWORD PTR FS:[EAX],ESP
004F2F94  |.  8D55 FC    LEA EDX,DWORD PTR SS:[EBP-4]
004F2F97  |.  8B86 04030000 MOV EAX,DWORD PTR DS:[ESI+304]
004F2F9D  |.  E8 02CCF5FF CALL MDTV.0044FBA4
004F2FA2  |.  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]          ;  假码  97979797
004F2FA5  |.  50          PUSH EAX
004F2FA6  |.  8D55 F4    LEA EDX,DWORD PTR SS:[EBP-C]
004F2FA9  |.  8B86 00030000 MOV EAX,DWORD PTR DS:[ESI+300]
004F2FAF  |.  E8 F0CBF5FF CALL MDTV.0044FBA4
004F2FB4  |.  8B55 F4    MOV EDX,DWORD PTR SS:[EBP-C]          ;  这里见到用户名 cxx17
004F2FB7  |.  8D4D F8    LEA ECX,DWORD PTR SS:[EBP-8]
004F2FBA  |.  8BC6       MOV EAX,ESI
004F2FBC  |.  E8 F3FAFFFF CALL MDTV.004F2AB4                      ;  算法call，f7进入
004F2FC1  |.  8B55 F8    MOV EDX,DWORD PTR SS:[EBP-8]          ;  这里看见真码 TV45-

7313erpe-8787
004F2FC4  |.  58          POP EAX
004F2FC5  |.  E8 9616F1FF CALL MDTV.00404660
004F2FCA  |.  75 3A       JNZ SHORT MDTV.004F3006                ;  这里跳就失败
004F2FCC  |.  B3 01       MOV BL,1
004F2FCE  |.  8D55 F0    LEA EDX,DWORD PTR SS:[EBP-10]
004F2FD1  |.  8B86 00030000 MOV EAX,DWORD PTR DS:[ESI+300]
004F2FD7  |.  E8 C8CBF5FF CALL MDTV.0044FBA4
004F2FDC  |.  8B55 F0    MOV EDX,DWORD PTR SS:[EBP-10]
004F2FDF  |.  B8 08904F00 MOV EAX,MDTV.004F9008
004F2FE4  |.  E8 BF12F1FF CALL MDTV.004042A8
004F2FE9  |.  8D55 EC    LEA EDX,DWORD PTR SS:[EBP-14]
004F2FEC  |.  8B86 04030000 MOV EAX,DWORD PTR DS:[ESI+304]
004F2FF2  |.  E8 ADCBF5FF CALL MDTV.0044FBA4
004F2FF7  |.  8B55 EC    MOV EDX,DWORD PTR SS:[EBP-14]
004F2FFA  |.  B8 0C904F00 MOV EAX,MDTV.004F900C
004F2FFF  |.  E8 A412F1FF CALL MDTV.004042A8
004F3004  |.  EB 02       JMP SHORT MDTV.004F3008
004F3006  |>  33DB       XOR EBX,EBX
004F3008  |>  33C0       XOR EAX,EAX
004F300A  |.  5A          POP EDX
004F300B  |.  59          POP ECX
004F300C  |.  59          POP ECX
004F300D  |.  64:8910    MOV DWORD PTR FS:[EAX],EDX
004F3010  |.  68 3A304F00 PUSH MDTV.004F303A
004F3015  |>  8D45 EC    LEA EAX,DWORD PTR SS:[EBP-14]
004F3018  |.  BA 03000000 MOV EDX,3
004F301D  |.  E8 5612F1FF CALL MDTV.00404278
004F3022  |.  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
004F3025  |.  E8 2A12F1FF CALL MDTV.00404254
004F302A  |.  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
004F302D  |.  E8 2212F1FF CALL MDTV.00404254
004F3032  \.  C3          RETN
004F3033 .^ E9 400BF1FF JMP MDTV.00403B78
004F3038 .^ EB DB       JMP SHORT MDTV.004F3015
004F303A .  8BC3       MOV EAX,EBX
004F303C .  5E          POP ESI
004F303D .  5B          POP EBX
004F303E .  8BE5       MOV ESP,EBP
004F3040 .  5D          POP EBP
004F3041 .  C3          RETN
004F3042    8BC0       MOV EAX,EAX
004F3044 .  53          PUSH EBX
004F3045 .  8BD8       MOV EBX,EAX
004F3047 .  BA 78304F00 MOV EDX,MDTV.004F3078                   ;  软件注册
004F304C .  8BC3       MOV EAX,EBX
004F304E .  E8 81CBF5FF CALL MDTV.0044FBD4
004F3053 .  33D2       XOR EDX,EDX
004F3055 .  8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
004F305B .  E8 74CBF5FF CALL MDTV.0044FBD4
004F3060 .  33D2       XOR EDX,EDX
004F3062 .  8B83 04030000 MOV EAX,DWORD PTR DS:[EBX+304]
004F3068 .  E8 67CBF5FF CALL MDTV.0044FBD4
004F306D .  5B          POP EBX
004F306E .  C3          RETN
004F306F    00          DB 00
004F3070    FF          DB FF
004F3071    FF          DB FF
004F3072    FF          DB FF
004F3073    FF          DB FF
004F3074    08          DB 08
004F3075    00          DB 00
004F3076    00          DB 00
004F3077    00          DB 00
004F3078    C8          DB C8
004F3079    ED          DB ED
004F307A    BC          DB BC
004F307B    FE          DB FE
004F307C    D7          DB D7
004F307D    A2          DB A2
004F307E    B2          DB B2
004F307F    E1          DB E1
004F3080    00          DB 00
004F3081    00          DB 00
004F3082    00          DB 00
004F3083    00          DB 00
004F3084 .  E8 DB92F7FF CALL MDTV.0046C364
004F3089 .  C3          RETN
004F308A    8BC0       MOV EAX,EAX
004F308C  /.  55          PUSH EBP
004F308D  |.  8BEC       MOV EBP,ESP
004F308F  |.  6A 00       PUSH 0
004F3091  |.  6A 00       PUSH 0
004F3093  |.  53          PUSH EBX
004F3094  |.  8BD8       MOV EBX,EAX
004F3096  |.  33C0       XOR EAX,EAX
004F3098  |.  55          PUSH EBP
004F3099  |.  68 4C314F00 PUSH MDTV.004F314C
004F309E  |.  64:FF30    PUSH DWORD PTR FS:[EAX]
004F30A1  |.  64:8920    MOV DWORD PTR FS:[EAX],ESP
004F30A4  |.  8D55 FC    LEA EDX,DWORD PTR SS:[EBP-4]
004F30A7  |.  8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
004F30AD  |.  E8 F2CAF5FF CALL MDTV.0044FBA4
004F30B2  |.  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F30B5  |.  E8 5A14F1FF CALL MDTV.00404514
004F30BA  |.  85C0       TEST EAX,EAX
004F30BC  |.  75 29       JNZ SHORT MDTV.004F30E7
004F30BE  |.  6A 40       PUSH 40
004F30C0  |.  68 58314F00 PUSH MDTV.004F3158                      ;  警告
004F30C5  |.  68 60314F00 PUSH MDTV.004F3160                      ;  注册名不能为空!
004F30CA  |.  8BC3       MOV EAX,EBX
004F30CC  |.  E8 F332F6FF CALL MDTV.004563C4
004F30D1  |.  50          PUSH EAX                               ; |hOwner
004F30D2  |.  E8 2D42F1FF CALL <JMP.&user32.MessageBoxA>          ; \MessageBoxA
004F30D7  |.  8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
004F30DD  |.  8B10       MOV EDX,DWORD PTR DS:[EAX]
004F30DF  |.  FF92 C4000000 CALL DWORD PTR DS:[EDX+C4]
004F30E5  |.  EB 4A       JMP SHORT MDTV.004F3131
004F30E7  |>  8D55 F8    LEA EDX,DWORD PTR SS:[EBP-8]
004F30EA  |.  8B83 04030000 MOV EAX,DWORD PTR DS:[EBX+304]
004F30F0  |.  E8 AFCAF5FF CALL MDTV.0044FBA4
004F30F5  |.  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
004F30F8  |.  E8 1714F1FF CALL MDTV.00404514
004F30FD  |.  85C0       TEST EAX,EAX
004F30FF  |.  75 29       JNZ SHORT MDTV.004F312A
004F3101  |.  6A 40       PUSH 40
004F3103  |.  68 58314F00 PUSH MDTV.004F3158                      ;  警告
004F3108  |.  68 70314F00 PUSH MDTV.004F3170                      ;  注册码不能为空!
004F310D  |.  8BC3       MOV EAX,EBX
004F310F  |.  E8 B032F6FF CALL MDTV.004563C4
004F3114  |.  50          PUSH EAX                               ; |hOwner
004F3115  |.  E8 EA41F1FF CALL <JMP.&user32.MessageBoxA>          ; \MessageBoxA
004F311A  |.  8B83 04030000 MOV EAX,DWORD PTR DS:[EBX+304]
004F3120  |.  8B10       MOV EDX,DWORD PTR DS:[EAX]
004F3122  |.  FF92 C4000000 CALL DWORD PTR DS:[EDX+C4]
004F3128  |.  EB 07       JMP SHORT MDTV.004F3131
004F312A  |>  8BC3       MOV EAX,EBX
004F312C  |.  E8 73FBFFFF CALL MDTV.004F2CA4
004F3131  |>  33C0       XOR EAX,EAX
004F3133  |.  5A          POP EDX
004F3134  |.  59          POP ECX
004F3135  |.  59          POP ECX
004F3136  |.  64:8910    MOV DWORD PTR FS:[EAX],EDX
004F3139  |.  68 53314F00 PUSH MDTV.004F3153
004F313E  |>  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
004F3141  |.  BA 02000000 MOV EDX,2
004F3146  |.  E8 2D11F1FF CALL MDTV.00404278
004F314B  \.  C3          RETN
004F314C .^ E9 270AF1FF JMP MDTV.00403B78
004F3151 .^ EB EB       JMP SHORT MDTV.004F313E
004F3153 .  5B          POP EBX
004F3154 .  59          POP ECX
004F3155 .  59          POP ECX
004F3156 .  5D          POP EBP
004F3157 .  C3          RETN

f7进入后到这里：
004F2AB4  /$  55          PUSH EBP
004F2AB5  |.  8BEC       MOV EBP,ESP
004F2AB7  |.  51          PUSH ECX
004F2AB8  |.  B9 04000000 MOV ECX,4
004F2ABD  |>  6A 00       /PUSH 0
004F2ABF  |.  6A 00       |PUSH 0
004F2AC1  |.  49          |DEC ECX
004F2AC2  |.^ 75 F9       \JNZ SHORT MDTV.004F2ABD
004F2AC4  |.  51          PUSH ECX
004F2AC5  |.  874D FC    XCHG DWORD PTR SS:[EBP-4],ECX
004F2AC8  |.  53          PUSH EBX
004F2AC9  |.  56          PUSH ESI
004F2ACA  |.  57          PUSH EDI
004F2ACB  |.  8BF9       MOV EDI,ECX
004F2ACD  |.  8955 FC    MOV DWORD PTR SS:[EBP-4],EDX          ;  见到用户名 cxx17
004F2AD0  |.  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F2AD3  |.  E8 2C1CF1FF CALL MDTV.00404704
004F2AD8  |.  33C0       XOR EAX,EAX
004F2ADA  |.  55          PUSH EBP
004F2ADB  |.  68 752C4F00 PUSH MDTV.004F2C75
004F2AE0  |.  64:FF30    PUSH DWORD PTR FS:[EAX]
004F2AE3  |.  64:8920    MOV DWORD PTR FS:[EAX],ESP
004F2AE6  |.  8BC7       MOV EAX,EDI
004F2AE8  |.  E8 6717F1FF CALL MDTV.00404254
004F2AED  |.  8B45 FC    MOV EAX,DWORD PTR SS:[EBP-4]
004F2AF0  |.  E8 1F1AF1FF CALL MDTV.00404514
004F2AF5  |.  8BF0       MOV ESI,EAX
004F2AF7  |.  85F6       TEST ESI,ESI
004F2AF9  |.  7E 26       JLE SHORT MDTV.004F2B21
004F2AFB  |.  BB 01000000 MOV EBX,1
004F2B00  |>  8D4D EC    /LEA ECX,DWORD PTR SS:[EBP-14]
004F2B03  |.  8B45 FC    |MOV EAX,DWORD PTR SS:[EBP-4]
004F2B06  |.  0FB64418 FF |MOVZX EAX,BYTE PTR DS:[EAX+EBX-1]
004F2B0B  |.  33D2       |XOR EDX,EDX
004F2B0D  |.  E8 3264F1FF |CALL MDTV.00408F44
004F2B12  |.  8B55 EC    |MOV EDX,DWORD PTR SS:[EBP-14]
004F2B15  |.  8D45 F8    |LEA EAX,DWORD PTR SS:[EBP-8]
004F2B18  |.  E8 FF19F1FF |CALL MDTV.0040451C
004F2B1D  |.  43          |INC EBX
004F2B1E  |.  4E          |DEC ESI
004F2B1F  |.^ 75 DF       \JNZ SHORT MDTV.004F2B00                ;  这里循环取用户名的

ascii十六进制值
004F2B21  |>  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]          ;  见到用户名ascii十六

进制值 6378783137
004F2B24  |.  E8 EB19F1FF CALL MDTV.00404514
004F2B29  |.  8BF0       MOV ESI,EAX
004F2B2B  |.  85F6       TEST ESI,ESI
004F2B2D  |.  7E 2C       JLE SHORT MDTV.004F2B5B
004F2B2F  |.  BB 01000000 MOV EBX,1
004F2B34  |>  8B45 F8    /MOV EAX,DWORD PTR SS:[EBP-8]
004F2B37  |.  E8 D819F1FF |CALL MDTV.00404514
004F2B3C  |.  2BC3       |SUB EAX,EBX
004F2B3E  |.  8B55 F8    |MOV EDX,DWORD PTR SS:[EBP-8]
004F2B41  |.  8A1402       |MOV DL,BYTE PTR DS:[EDX+EAX]
004F2B44  |.  8D45 E8    |LEA EAX,DWORD PTR SS:[EBP-18]
004F2B47  |.  E8 F018F1FF |CALL MDTV.0040443C
004F2B4C  |.  8B55 E8    |MOV EDX,DWORD PTR SS:[EBP-18]
004F2B4F  |.  8D45 F4    |LEA EAX,DWORD PTR SS:[EBP-C]
004F2B52  |.  E8 C519F1FF |CALL MDTV.0040451C
004F2B57  |.  43          |INC EBX
004F2B58  |.  4E          |DEC ESI
004F2B59  |.^ 75 D9       \JNZ SHORT MDTV.004F2B34                ;  这里把用户名的ascii

十六进制值倒转排列
004F2B5B  |>  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
004F2B5E  |.  50          PUSH EAX
004F2B5F  |.  B9 04000000 MOV ECX,4
004F2B64  |.  BA 01000000 MOV EDX,1
004F2B69  |.  8B45 F4    MOV EAX,DWORD PTR SS:[EBP-C]          ;  这里见到倒转排列后的

结果  7313878736
004F2B6C  |.  E8 031CF1FF CALL MDTV.00404774
004F2B71  |.  8D45 F4    LEA EAX,DWORD PTR SS:[EBP-C]
004F2B74  |.  50          PUSH EAX
004F2B75  |.  B9 04000000 MOV ECX,4
004F2B7A  |.  BA 05000000 MOV EDX,5
004F2B7F  |.  8B45 F4    MOV EAX,DWORD PTR SS:[EBP-C]
004F2B82  |.  E8 ED1BF1FF CALL MDTV.00404774
004F2B87  |.  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]          ;  到转排列后的前四位

7313
004F2B8A  |.  E8 8519F1FF CALL MDTV.00404514
004F2B8F  |.  83F8 04    CMP EAX,4
004F2B92  |.  7D 2F       JGE SHORT MDTV.004F2BC3
004F2B94  |.  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
004F2B97  |.  E8 7819F1FF CALL MDTV.00404514
004F2B9C  |.  8BD8       MOV EBX,EAX
004F2B9E  |.  83FB 03    CMP EBX,3
004F2BA1  |.  7F 20       JG SHORT MDTV.004F2BC3
004F2BA3  |>  8D4D E4    /LEA ECX,DWORD PTR SS:[EBP-1C]
004F2BA6  |.  8BC3       |MOV EAX,EBX
004F2BA8  |.  C1E0 02    |SHL EAX,2
004F2BAB  |.  33D2       |XOR EDX,EDX
004F2BAD  |.  E8 9263F1FF |CALL MDTV.00408F44
004F2BB2  |.  8B55 E4    |MOV EDX,DWORD PTR SS:[EBP-1C]
004F2BB5  |.  8D45 F8    |LEA EAX,DWORD PTR SS:[EBP-8]
004F2BB8  |.  E8 5F19F1FF |CALL MDTV.0040451C
004F2BBD  |.  43          |INC EBX
004F2BBE  |.  83FB 04    |CMP EBX,4
004F2BC1  |.^ 75 E0       \JNZ SHORT MDTV.004F2BA3
004F2BC3  |>  8B45 F4    MOV EAX,DWORD PTR SS:[EBP-C]          ;  到转排列后的第5-8位

8787
004F2BC6  |.  E8 4919F1FF CALL MDTV.00404514
004F2BCB  |.  83F8 04    CMP EAX,4
004F2BCE  |.  7D 2F       JGE SHORT MDTV.004F2BFF
004F2BD0  |.  8B45 F4    MOV EAX,DWORD PTR SS:[EBP-C]
004F2BD3  |.  E8 3C19F1FF CALL MDTV.00404514
004F2BD8  |.  8BD8       MOV EBX,EAX
004F2BDA  |.  83FB 03    CMP EBX,3
004F2BDD  |.  7F 20       JG SHORT MDTV.004F2BFF
004F2BDF  |>  8D4D E0    /LEA ECX,DWORD PTR SS:[EBP-20]
004F2BE2  |.  8BC3       |MOV EAX,EBX
004F2BE4  |.  C1E0 02    |SHL EAX,2
004F2BE7  |.  33D2       |XOR EDX,EDX
004F2BE9  |.  E8 5663F1FF |CALL MDTV.00408F44
004F2BEE  |.  8B55 E0    |MOV EDX,DWORD PTR SS:[EBP-20]
004F2BF1  |.  8D45 F4    |LEA EAX,DWORD PTR SS:[EBP-C]
004F2BF4  |.  E8 2319F1FF |CALL MDTV.0040451C
004F2BF9  |.  43          |INC EBX
004F2BFA  |.  83FB 04    |CMP EBX,4
004F2BFD  |.^ 75 E0       \JNZ SHORT MDTV.004F2BDF
004F2BFF  |>  8D45 F0    LEA EAX,DWORD PTR SS:[EBP-10]
004F2C02  |.  BA 8C2C4F00 MOV EDX,MDTV.004F2C8C                   ;  tv45erpe  注册码的固

定部分
004F2C07  |.  E8 E016F1FF CALL MDTV.004042EC
004F2C0C  |.  8D45 DC    LEA EAX,DWORD PTR SS:[EBP-24]
004F2C0F  |.  50          PUSH EAX
004F2C10  |.  B9 04000000 MOV ECX,4
004F2C15  |.  BA 01000000 MOV EDX,1
004F2C1A  |.  8B45 F0    MOV EAX,DWORD PTR SS:[EBP-10]
004F2C1D  |.  E8 521BF1FF CALL MDTV.00404774
004F2C22  |.  FF75 DC    PUSH DWORD PTR SS:[EBP-24]             ;  注册码第一部分  TV45
004F2C25  |.  68 A02C4F00 PUSH MDTV.004F2CA0                      ;  -  连接符
004F2C2A  |.  FF75 F8    PUSH DWORD PTR SS:[EBP-8]             ;  注册码第二部分  7313
004F2C2D  |.  8D45 D8    LEA EAX,DWORD PTR SS:[EBP-28]
004F2C30  |.  50          PUSH EAX
004F2C31  |.  B9 05000000 MOV ECX,5
004F2C36  |.  BA 05000000 MOV EDX,5
004F2C3B  |.  8B45 F0    MOV EAX,DWORD PTR SS:[EBP-10]
004F2C3E  |.  E8 311BF1FF CALL MDTV.00404774
004F2C43  |.  FF75 D8    PUSH DWORD PTR SS:[EBP-28]             ;  注册码第三部分  erpe
004F2C46  |.  68 A02C4F00 PUSH MDTV.004F2CA0                      ;  - 连接符
004F2C4B  |.  FF75 F4    PUSH DWORD PTR SS:[EBP-C]             ;  注册码第四部分  8787
004F2C4E  |.  8BC7       MOV EAX,EDI
004F2C50  |.  BA 06000000 MOV EDX,6
004F2C55  |.  E8 7A19F1FF CALL MDTV.004045D4
004F2C5A  |.  33C0       XOR EAX,EAX
004F2C5C  |.  5A          POP EDX
004F2C5D  |.  59          POP ECX
004F2C5E  |.  59          POP ECX
004F2C5F  |.  64:8910    MOV DWORD PTR FS:[EAX],EDX
004F2C62  |.  68 7C2C4F00 PUSH MDTV.004F2C7C
004F2C67  |>  8D45 D8    LEA EAX,DWORD PTR SS:[EBP-28]
004F2C6A  |.  BA 0A000000 MOV EDX,0A
004F2C6F  |.  E8 0416F1FF CALL MDTV.00404278
004F2C74  \.  C3          RETN

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
【算法小结】

1、取用户名的ASCII码(16进制)          6378783137
2、ASCII码，重尾到头重新排列          7313878736
3、部分注册码TV45-                   这是固定的
4、取第2点的前4位                   7313
5、部分注册码erpe-　　　　　　　　　　这是固定的
6、取第2点的第5位到第8位             8787

【vb注册机源码】

Private Sub Command1_Click()
Dim i As Integer
For i = 1 To Len(Text1.Text)
a = a & Hex(Asc(Mid$(Text1.Text, i)))
Next i
b = StrReverse(a)
c = "TV45erpe"
sn3 = Mid(c, 1, 4)
sn4 = Mid(c, 5, 4)
Select Case Len(b)
Case 0
sn1 = "048C"
sn2 = "048C"
Case 2
sn1 = Mid(b, 1, 2) & "8C"
sn2 = "048C"
Case 4
sn1 = Mid(b, 1, 4)
sn2 = "048C"
Case 6
sn1 = Mid(b, 1, 4)
sn2 = Mid(b, 5, 4) & "8C"
Case Else
sn1 = Mid(b, 1, 4)
sn2 = Mid(b, 5, 4)
End Select
Text2.Text = sn3 & "-" & sn1 & sn4 & "-" & sn2
End Sub

zyhxhw · 发表于 2006-9-5 18:30:39

谢谢学习了！

yunfeng · 发表于 2006-9-5 19:18:41

学习一下它的算法.

bfqyygy · 发表于 2006-9-5 21:44:24

不错。蛮简单的！！

hangyubin · 发表于 2006-9-6 10:15:21

汇编我不懂
不过是明码比较
堆栈 ss:[0012F40C]=00A946EC, (ASCII "TV45-E696erpe-2657")
edx=00A946C0, (ASCII "hangyubin")

hangyubin · 发表于 2006-9-6 15:06:47

不过这个网络电视不是很好用~！电视台也不多！能够看的电视台也不多！强列BS它！

tianshimama · 发表于 2006-9-8 10:28:03

进来学习一下

brian802233 · 发表于 2006-9-11 07:11:56

呵呵.偶是菜鸟...简单的先学下~:lol:

caterpilla · 发表于 2006-9-11 07:54:08

支持。。。。。。。。

matin · 发表于 2006-9-17 19:14:01

明码比较的`~~~支持下

		自动登录	找回密码
密码			加入我们

[原创] 美达网络电视 2.10 算法分析

相关帖子