五笔打字员2.5

目的：初学破解，属技术交流，无其它目的，请不要任意散布或用用商业用途。

工具：wktvbdebuger1.4e,exdec

假设：

机器码：818314132231985

注册码：987654321

前几天在学习破解vb的p-code的程序破解，有所体会，所以公布这篇笔记。

好了，在wktvbdebuger中，在反汇编窗口，右击，选bpx api list,找rtcLeftCharVar函数，并在上面下断，运行注册，断下来了，看一面地址51c39e，好运行反汇篇程序exdec,查找地址51c39e，向上找这一call的第一条

语句，如下：

Proc: 51d0e0

51BCD8: 00 LargeBos

51BCDA: 00 LargeBos

51BCDC: 4b onErrorGoto

51BCDF: 00 LargeBos

好了，可以在wktvbdebuger中在51BCD8处下断，运行如下：

Proc: 51d0e0

51BCD8: 00 LargeBos ＝＝＞不知这个含义

51BCDA: 00 LargeBos

51BCDC: 4b onErrorGoto

51BCDF: 00 LargeBos

51BCE1: f5 LitI4: 0xbb8 3000 (....)

51BCE6: 71 FStR4 local_008C

51BCE9: 00 LargeBos

51BCEB: 27 LitVar_Missing

51BCEE: 0a ImpAdCallFPR4: 

51BCF3: 35 FFree1Var local_00B0

51BCF6: 00 LargeBos

51BCF8: 27 LitVar_Missing

51BCFB: 0a ImpAdCallFPR4: 

51BD00: 73 FStFPR4

51BD03: f4 LitI2_Byte: 0x18 24 (.)==>装入一个字节值24

51BD05: eb CR8I2 ＝＞数据类型转换为double

51BD06: 6e FLdFPR4

51BD09: b3 MulR8

51BD0A: Lead0/e6 FnIntR8

51BD0C: f4 LitI2_Byte: 0x1 1 (.)

51BD0E: eb CR8I2

51BD0F: ab AddR8

51BD10: e5 CI2R8

51BD11: 70 FStI2 local_0086

51BD14: 35 FFree1Var local_00B0

51BD17: 00 LargeBos

51BD19: 6b FLdI2 local_0086

51BD1C: 70 FStI2 local_00B6

51BD1F: 00 LargeBos

51BD21: 6b FLdI2 local_00B6

51BD24: f4 LitI2_Byte: 0x1 1 (.)

51BD26: c6 EqI2

51BD27: 1c BranchF: 51BD5F==>跳到51BD5F

51BD2A: 00 LargeBos

51BD2C: 6c ILdRf local_008C

51BD2F: 71 FStR4 local_0090

51BD32: 00 LargeBos

51BD34: 6c ILdRf local_008C

51BD37: f5 LitI4: 0x168 360 (...h)

51BD3C: aa AddI4

51BD3D: 71 FStR4 local_0090

51BD40: 00 LargeBos

51BD42: 6c ILdRf local_008C

51BD45: f5 LitI4: 0x2d0 720 (....)

51BD4A: aa AddI4

51BD4B: 71 FStR4 local_0090

51BD4E: 00 LargeBos

51BD50: 6c ILdRf local_008C

51BD53: f5 LitI4: 0x438 1080 (...8)

51BD58: aa AddI4

51BD59: 71 FStR4 local_0090

51BD5C: 1e Branch: 51c31c

51BD5F: 00 LargeBos

51BD61: 6b FLdI2 local_00B6

51BD64: f4 LitI2_Byte: 0x2 2 (.)

51BD66: c6 EqI2 =>与2是否相等

51BD67: 1c BranchF: 51BD9F＝＞跳到51BD9F

51BD6A: 00 LargeBos

51BD6C: 6c ILdRf local_008C

51BD6F: 71 FStR4 local_0090

51BD72: 00 LargeBos

51BD74: 6c ILdRf local_008C

51BD77: f5 LitI4: 0x168 360 (...h)

51BD7C: aa AddI4

51BD7D: 71 FStR4 local_0090

51BD80: 00 LargeBos

51BD82: 6c ILdRf local_008C

51BD85: f5 LitI4: 0x2d0 720 (....)

51BD8A: aa AddI4

51BD8B: 71 FStR4 local_0090

51BD8E: 00 LargeBos

51BD90: 6c ILdRf local_008C

51BD93: f5 LitI4: 0x438 1080 (...8)

51BD98: aa AddI4

51BD99: 71 FStR4 local_0090

51BD9C: 1e Branch: 51c31c

51BD9F: 00 LargeBos

51BDA1: 6b FLdI2 local_00B6

51BDA4: f4 LitI2_Byte: 0x3 3 (.)

51BDA6: c6 EqI2 ＝＞3是否等于8

51BDA7: 1c BranchF: 51BDDF＝＞不等则跳到51BDDF

51BDAA: 00 LargeBos

51BDAC: 6c ILdRf local_008C

51BDAF: 71 FStR4 local_0090

51BDB2: 00 LargeBos

51BDB4: 6c ILdRf local_008C

51BDB7: f5 LitI4: 0x168 360 (...h)

51BDBC: aa AddI4

51BDBD: 71 FStR4 local_0090

51BDC0: 00 LargeBos

51BDC2: 6c ILdRf local_008C

51BDC5: f5 LitI4: 0x2d0 720 (....)

51BDCA: aa AddI4

51BDCB: 71 FStR4 local_0090

51BDCE: 00 LargeBos

51BDD0: 6c ILdRf local_008C

51BDD3: f5 LitI4: 0x438 1080 (...8)

51BDD8: aa AddI4

51BDD9: 71 FStR4 local_0090

51BDDC: 1e Branch: 51c31c

51BDDF: 00 LargeBos

51BDE1: 6b FLdI2 local_00B6

51BDE4: f4 LitI2_Byte: 0x4 4 (.)

51BDE6: c6 EqI2 ＝＞8与4是否等

51BDE7: 1c BranchF: 51BE1F＝＞不等则跳

51BDEA: 00 LargeBos

51BDEC: 6c ILdRf local_008C

51BDEF: 71 FStR4 local_0090

51BDF2: 00 LargeBos

51BDF4: 6c ILdRf local_008C

51BDF7: f5 LitI4: 0x168 360 (...h)

51BDFC: aa AddI4

51BDFD: 71 FStR4 local_0090

51BE00: 00 LargeBos

51BE02: 6c ILdRf local_008C

51BE05: f5 LitI4: 0x2d0 720 (....)

51BE0A: aa AddI4

51BE0B: 71 FStR4 local_0090

51BE0E: 00 LargeBos

51BE10: 6c ILdRf local_008C

51BE13: f5 LitI4: 0x438 1080 (...8)

51BE18: aa AddI4

51BE19: 71 FStR4 local_0090

51BE1C: 1e Branch: 51c31c

51BE1F: 00 LargeBos

51BE21: 6b FLdI2 local_00B6

51BE24: f4 LitI2_Byte: 0x5 5 (.)

51BE26: c6 EqI2 ＝＝＞是否等5

51BE27: 1c BranchF: 51BE5F＝不则跳

51BE2A: 00 LargeBos

51BE2C: 6c ILdRf local_008C

51BE2F: 71 FStR4 local_0090

51BE32: 00 LargeBos

51BE34: 6c ILdRf local_008C

51BE37: f5 LitI4: 0x168 360 (...h)

51BE3C: aa AddI4

51BE3D: 71 FStR4 local_0090

51BE40: 00 LargeBos

51BE42: 6c ILdRf local_008C

51BE45: f5 LitI4: 0x2d0 720 (....)

51BE4A: aa AddI4

51BE4B: 71 FStR4 local_0090

51BE4E: 00 LargeBos

51BE50: 6c ILdRf local_008C

51BE53: f5 LitI4: 0x438 1080 (...8)

51BE58: aa AddI4

51BE59: 71 FStR4 local_0090

51BE5C: 1e Branch: 51c31c

51BE5F: 00 LargeBos

51BE61: 6b FLdI2 local_00B6

51BE64: f4 LitI2_Byte: 0x6 6 (.)

51BE66: c6 EqI2 ＝＞等于6吗

51BE67: 1c BranchF: 51BE9F＝＞否则跳

51BE6A: 00 LargeBos

51BE6C: 6c ILdRf local_008C

51BE6F: 71 FStR4 local_0090

51BE72: 00 LargeBos

51BE74: 6c ILdRf local_008C

51BE77: f5 LitI4: 0x168 360 (...h)

51BE7C: aa AddI4

51BE7D: 71 FStR4 local_0090

51BE80: 00 LargeBos

51BE82: 6c ILdRf local_008C

51BE85: f5 LitI4: 0x2d0 720 (....)

51BE8A: aa AddI4

51BE8B: 71 FStR4 local_0090

51BE8E: 00 LargeBos

51BE90: 6c ILdRf local_008C

51BE93: f5 LitI4: 0x438 1080 (...8)

51BE98: aa AddI4

51BE99: 71 FStR4 local_0090

51BE9C: 1e Branch: 51c31c

51BE9F: 00 LargeBos

51BEA1: 6b FLdI2 local_00B6

51BEA4: f4 LitI2_Byte: 0x7 7 (.)

51BEA6: c6 EqI2 ＝＞7呢

51BEA7: 1c BranchF: 51BEDF＝＞跳

51BEAA: 00 LargeBos

51BEAC: 6c ILdRf local_008C

51BEAF: 71 FStR4 local_0090

51BEB2: 00 LargeBos

51BEB4: 6c ILdRf local_008C

51BEB7: f5 LitI4: 0x168 360 (...h)

51BEBC: aa AddI4

51BEBD: 71 FStR4 local_0090

51BEC0: 00 LargeBos

51BEC2: 6c ILdRf local_008C

51BEC5: f5 LitI4: 0x2d0 720 (....)

51BECA: aa AddI4

51BECB: 71 FStR4 local_0090

51BECE: 00 LargeBos

51BED0: 6c ILdRf local_008C

51BED3: f5 LitI4: 0x438 1080 (...8)

51BED8: aa AddI4

51BED9: 71 FStR4 local_0090

51BEDC: 1e Branch: 51c31c

51BEDF: 00 LargeBos

51BEE1: 6b FLdI2 local_00B6

51BEE4: f4 LitI2_Byte: 0x8 8 (.)

51BEE6: c6 EqI2 ＝＞8呢

51BEE7: 1c BranchF: 51BF1F

51BEEA: 00 LargeBos

51BEEC: 6c ILdRf local_008C

51BEEF: 71 FStR4 local_0090

51BEF2: 00 LargeBos

51BEF4: 6c ILdRf local_008C=>为bb8

51BEF7: f5 LitI4: 0x168 360 (...h)＝＞装入360

51BEFC: aa AddI4 =>相加

51BEFD: 71 FStR4 local_0090

51BF00: 00 LargeBos

51BF02: 6c ILdRf local_008C

51BF05: f5 LitI4: 0x2d0 720 (....)

51BF0A: aa AddI4

51BF0B: 71 FStR4 local_0090

51BF0E: 00 LargeBos

51BF10: 6c ILdRf local_008C

51BF13: f5 LitI4: 0x438 1080 (...8)

51BF18: aa AddI4

51BF19: 71 FStR4 local_0090

51BF1C: 1e Branch: 51c31c＝＞jmp 51c31c

51BF1F: 00 LargeBos

51BF21: 6b FLdI2 local_00B6

51BF24: f4 LitI2_Byte: 0x9 9 (.)

51BF26: c6 EqI2

51BF27: 1c BranchF: 51BF5F

51BF2A: 00 LargeBos

51BF2C: 6c ILdRf local_008C

51BF2F: 71 FStR4 local_0090

51BF32: 00 LargeBos

51BF34: 6c ILdRf local_008C

51BF37: f5 LitI4: 0x168 360 (...h)

..........

........

51C25F: 00 LargeBos

51C261: 6b FLdI2 local_00B6

51C264: f4 LitI2_Byte: 0x16 22 (.)

51C266: c6 EqI2

51C267: 1c BranchF: 51C29F

51C26A: 00 LargeBos

51C26C: 6c ILdRf local_008C

51C26F: 71 FStR4 local_0090

51C272: 00 LargeBos

51C274: 6c ILdRf local_008C

51C277: f5 LitI4: 0x168 360 (...h)

51C27C: aa AddI4

51C27D: 71 FStR4 local_0090

51C280: 00 LargeBos

51C282: 6c ILdRf local_008C

51C285: f5 LitI4: 0x2d0 720 (....)

51C28A: aa AddI4

51C28B: 71 FStR4 local_0090

51C28E: 00 LargeBos

51C290: 6c ILdRf local_008C

51C293: f5 LitI4: 0x438 1080 (...8)

51C298: aa AddI4

51C299: 71 FStR4 local_0090

51C29C: 1e Branch: 51c31c

51C29F: 00 LargeBos

51C2A1: 6b FLdI2 local_00B6

51C2A4: f4 LitI2_Byte: 0x17 23 (.)

51C2A6: c6 EqI2

51C2A7: 1c BranchF: 51C2DF

以上为注册码的长度－1，然后与1－23间的值比较，不知有何用，

51C2AA: 00 LargeBos

51C2AC: 6c ILdRf local_008C

51C2AF: 71 FStR4 local_0090

51C2B2: 00 LargeBos

51C2B4: 6c ILdRf local_008C

51C2B7: f5 LitI4: 0x168 360 (...h)

51C2BC: aa AddI4

51C2BD: 71 FStR4 local_0090

51C2C0: 00 LargeBos

51C2C2: 6c ILdRf local_008C

51C2C5: f5 LitI4: 0x2d0 720 (....)

51C2CA: aa AddI4

51C2CB: 71 FStR4 local_0090

51C2CE: 00 LargeBos

51C2D0: 6c ILdRf local_008C

51C2D3: f5 LitI4: 0x438 1080 (...8)

51C2D8: aa AddI4

51C2D9: 71 FStR4 local_0090

51C2DC: 1e Branch: 51c31c

51C2DF: 00 LargeBos

51C2E1: 6b FLdI2 local_00B6

51C2E4: f4 LitI2_Byte: 0x18 24 (.)

51C2E6: c6 EqI2

51C2E7: 1c BranchF: 51C31C

51C2EA: 00 LargeBos

51C2EC: 6c ILdRf local_008C

51C2EF: 71 FStR4 local_0090

51C2F2: 00 LargeBos

51C2F4: 6c ILdRf local_008C

51C2F7: f5 LitI4: 0x168 360 (...h)

51C2FC: aa AddI4

51C2FD: 71 FStR4 local_0090

51C300: 00 LargeBos

51C302: 6c ILdRf local_008C

51C305: f5 LitI4: 0x2d0 720 (....)

51C30A: aa AddI4

51C30B: 71 FStR4 local_0090

51C30E: 00 LargeBos

51C310: 6c ILdRf local_008C

51C313: f5 LitI4: 0x438 1080 (...8)

51C318: aa AddI4

51C319: 71 FStR4 local_0090

51C31C: 00 LargeBos

51C31E: 00 LargeBos

51C320: 04 FLdRfVar local_00D0

51C323: 21 FLdPrThis

51C324: 0f VCallAd menu＝＝＞取text5框中的句柄

51C327: 19 FStAdFunc local_00CC＝＞取得的内容放入到指针中

51C32A: 08 FLdPr local_00CC ＝＞地址内容

51C32D: 0d VCallHresult get__ipropMDIWINDOWMENU

51C332: 6c ILdRf local_00D0＝＞取得text5中的内容，此为41093315

51C335: 50 CI4Str

51C336: f5 LitI4: 0x3fe 1022 (....)＝＞取3fe

51C33B: c0 IDvI4 27308c3（十进制为41093315）除以3fe=9d10

51C33C: Lead0/fe CStrI4 =>转为十进制，此为40208

51C33E: 23 FStStrNoPop local_00D4＝＞保存

51C341: 0b ImpAdCallI2 ＝＞40208反倒即为80204

51C346: 46 CVarStr local_00B0

51C349: Lead1/f6 FStVar

51C34D: 32 FFreeStr

51C354: 1a FFree1Ad local_00CC

51C357: 00 LargeBos

51C359: 04 FLdRfVar local_00D0

51C35C: 21 FLdPrThis

51C35D: 0f VCallAd menu

51C360: 19 FStAdFunc local_00CC

51C363: 08 FLdPr local_00CC

51C366: 0d VCallHresult get__ipropMDIWINDOWMENU

51C36B: 04 FLdRfVar local_00D4

51C36E: 21 FLdPrThis

51C36F: 0f VCallAd menu

51C372: 19 FStAdFunc local_00D8

51C375: 08 FLdPr local_00D8

51C378: 0d VCallHresult get__ipropMDIWINDOWMENU

51C37D: 6c ILdRf local_00D4==>再次取得41093315

51C380: 50 CI4Str

51C381: f5 LitI4: 0x3fe 1022 (....)

51C386: c0 IDvI4 =>41093315除以1022＝

51C387: Lead0/fe CStrI4

51C389: 23 FStStrNoPop local_00DC

51C38C: 0b ImpAdCallI2 

51C391: 23 FStStrNoPop local_00E0

51C394: 4a FnLenStr ＝＞取得长度，为5

51C395: 3e FLdZeroAd local_00D0

51C398: 46 CVarStr local_00B0＝＞取得输入的注册码

51C39B: 04 FLdRfVar local_00F0

51C39E: 0a ImpAdCallFPR4: ＝＞取得注册码左边5位数

51C3A3: 04 FLdRfVar local_00F0

51C3A6: 04 FLdRfVar local_00F8

51C3A9: 21 FLdPrThis

51C3AA: 0f VCallAd menu

51C3AD: 19 FStAdFunc local_00F4

51C3B0: 08 FLdPr local_00F4

51C3B3: 0d VCallHresult get__ipropMDIWINDOWMENU

51C3B8: 6c ILdRf local_00F8

51C3BB: 50 CI4Str

51C3BC: f5 LitI4: 0x3fe 1022 (....)

51C3C1: c0 IDvI4

51C3C2: Lead0/fe CStrI4

51C3C4: 23 FStStrNoPop local_00FC

51C3C7: 0b ImpAdCallI2 

51C3CC: 46 CVarStr local_010C

51C3CF: 5d HardType

51C3D0: Lead0/33 EqVarBool

51C3D2: 32 FFreeStr

51C3DF: 29 FFreeAd:

51C3E8: 36 FFreeVar

51C3F1: 1c BranchF: 51D0C5＝＞是否跳出错地方

51C3F4: 00 LargeBos

51C3F6: f5 LitI4: 0x7530 30000 (..u0)

51C3FB: 71 FStR4 local_008C

......(省略).........

51CA38: 21 FLdPrThis

51CA39: 0f VCallAd menu

51CA3C: 19 FStAdFunc local_00CC

51CA3F: 08 FLdPr local_00CC

51CA42: 0d VCallHresult get__ipropMDIWINDOWMENU

51CA47: 6c ILdRf local_00D0＝＞取得注册码

51CA4A: 0b ImpAdCallI2 ＝＞注册码串反倒

51CA4F: 23 FStStrNoPop local_00D4

51CA52: 1b LitStr: wbregfilename

51CA55: 1b LitStr: wbregfile

51CA58: 1b LitStr: wbreg

51CA5B: 0a ImpAdCallFPR4: 衊帬＝＞写入到注册表中

51CA60: 32 FFreeStr

51CA67: 1a FFree1Ad local_00CC

51CA6A: 00 LargeBos

51CA6C: 27 LitVar_Missing

51CA6F: 27 LitVar_Missing

51CA72: 3a LitVarStr: ( local_0130 )

51CA77: 4e FStVarCopyObj local_00F0

51CA7A: 04 FLdRfVar local_00F0

51CA7D: f5 LitI4: 0x40 64 (...@)

51CA82: 3a LitVarStr: ( local_00A0 )

51CA87: 4e FStVarCopyObj local_00B0

51CA8A: 04 FLdRfVar local_00B0

51CA8D: 0a ImpAdCallFPR4: ＝＞注册成功标志框

51CA92: 36 FFreeVar

51CA9D: 00 LargeBos

51CA9F: 27 LitVar_Missing

51CAA2: 0a ImpAdCallFPR4: 

51CAA7: 73 FStFPR4

51CAAA: f4 LitI2_Byte: 0x18 24 (.)

51CAAC: eb CR8I2

51CAAD: 6e FLdFPR4

........(省略)..........

51D0AC: f5 LitI4: 0x2d0 720 (....)

51D0B1: aa AddI4

51D0B2: 71 FStR4 local_0090

51D0B5: 00 LargeBos

51D0B7: 6c ILdRf local_008C

51D0BA: f5 LitI4: 0x438 1080 (...8)

51D0BF: aa AddI4

51D0C0: 71 FStR4 local_0090

51D0C3: 00 LargeBos

51D0C5: 00 LargeBos

51D0C7: 00 LargeBos

51D0C9: 21 FLdPrThis

51D0CA: 0f VCallAd menu

51D0CD: 19 FStAdFunc local_00CC

51D0D0: 08 FLdPr local_00CC

51D0D3: 0d VCallHresult 

51D0D8: 1a FFree1Ad local_00CC

51D0DB: 00 LargeBos

51D0DD: 13 ExitProcHresult ＝＞注册码不正确则直接跳出

此外还还一个暗桩：

用rclmsg下断，代码如下：

Proc: 50598c

5058D0: f5 LitI4: 0x1 1 (....)

5058D5: 3a LitVarStr: ( local_0094 ) 110

5058DA: 25 PopAdLdVar

5058DB: 1b LitStr: wbregfilename

5058DE: 1b LitStr: wbregfile

5058E1: 1b LitStr: wbreg

5058E4: 0b ImpAdCallI2 衊帬＝＝＝＝＞从注册表中读取注册码

5058E9: 23 FStStrNoPop local_0098

5058EC: 0b ImpAdCallI2 

5058F1: 23 FStStrNoPop local_00D0

5058F4: 05 ImpAdLdRf: 526030

5058F7: 28 LitVarI2: ( local_00A8 ) 0x3fe (1022)

5058FC: Lead0/ac IDvVar

505900: Lead1/4b FnCStrVar

505902: 23 FStStrNoPop local_00BC

505905: 0b ImpAdCallI2 

50590A: 23 FStStrNoPop local_00C4

50590D: 76 ImpAdLdI4

505910: 50 CI4Str

505911: f5 LitI4: 0x7 7 (....)

505916: c0 IDvI4 ＝＞值除以7

505917: Lead0/fe CStrI4

505919: 23 FStStrNoPop local_00C0

50591C: 0b ImpAdCallI2 ＝＞反转为注册码

505921: 23 FStStrNoPop local_00C8

505924: 2a ConcatStr

505925: 23 FStStrNoPop local_00CC

505928: f5 LitI4: 0x1 1 (....)

50592D: Lead3/fd FnInStr4

50592F: f5 LitI4: 0x1 1 (....)

505934: d1 LtI4

505935: 32 FFreeStr

505946: 1c BranchF: 505988

505949: 04 FLdRfVar local_0098

50594C: f5 LitI4: 0xd3 211 (....)

505951: 05 ImpAdLdRf: 5267dc

505954: 24 NewIfNullPr 40bfe4

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－

注册码总结，共为8位，分两部分，左边5位，及右边3位，在输入时先检验左边的5位，如正确则存 注册表中，在运行时，从注册表中取得右边3位进行检验。

左边5位注册码：

走到51c33e时会产生40208，反过来就是注册码左边5位了，即为：08021

右边3位注册码：

走到50591C处会得到。

总结：

机器码：818314132231985

注册码：08021716

注册信息保存在：

[HKEY_CURRENT_USER\Software\VB and VBA Program Settings\wbreg\wbregfile]

"wbregfilename"="61712080"

cracked by lordor[BCG]

（出处：赢政天下整理收藏）

相关文章：

·Tornado2之Licence暴力破解

·万能五笔2001注册码分析及暴力破解

·万能五笔2001注册码分析及暴力破解

·万能五笔2001注册码分析及暴力破解 －－－可怜的思考者 (27千字)

·一个拨号软件的Win32Dasm暴力破解法

·CuteFTP V4.2.4之暴力破解

相关软件：

·电话卡暴力破解器 v2.0 (0425版)

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net