应用程序图标更换器 (非明码比较)

【下载地址】：

http://www.softreg.com.cn/download.asp?id=/CD05D77E-E9F5-4445-9350-E2FFC8B4F89A/

【软件限制】：还没注意。

【作者声明】：初学Crack，只是感兴趣，没有其它目的。失误之处敬请诸位大侠赐教！如果你有条件，请支持国产软件。

【破解工具】：Ollydbg1.09、Language2K、Dede3.02

【过 程】：

1、用 Language2K 检查 有壳,脱壳后为Delphi程序。

2、想办法找到这个关键Call

0040C9A4 /$ 55 PUSH EBP

0040C9A5 |. 8BEC MOV EBP,ESP

0040C9A7 |. 81C4 2CFFFFFF ADD ESP,-0D4

0040C9AD |. 56 PUSH ESI

0040C9AE |. 57 PUSH EDI

0040C9AF |. B8 EC6D4A00 MOV EAX,CREXEICO.004A6DEC

0040C9B4 |. E8 4B6C0700 CALL CREXEICO.00483604

0040C9B9 |. C745 F8 01000>MOV DWORD PTR SS:[EBP-8],1

0040C9C0 |. 8D55 08 LEA EDX,DWORD PTR SS:[EBP+8]

0040C9C3 |. 8D45 08 LEA EAX,DWORD PTR SS:[EBP+8]

0040C9C6 |. E8 D91B0800 CALL CREXEICO.0048E5A4

0040C9CB |. FF45 F8 INC DWORD PTR SS:[EBP-8]

0040C9CE |. 66:C745 EC 08>MOV WORD PTR SS:[EBP-14],8

0040C9D4 |. C645 DB 00 MOV BYTE PTR SS:[EBP-25],0

0040C9D8 |. 837D 08 00 CMP DWORD PTR SS:[EBP+8],0

0040C9DC |. 74 08 JE SHORT CREXEICO.0040C9E6

0040C9DE |. 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]

0040C9E1 |. 8B4A FC MOV ECX,DWORD PTR DS:[EDX-4]

0040C9E4 |. EB 02 JMP SHORT CREXEICO.0040C9E8

0040C9E6 |> 33C9 XOR ECX,ECX

0040C9E8 |> 83F9 18 CMP ECX,18

0040C9EB |. 0F85 90000000 JNZ CREXEICO.0040CA81

0040C9F1 |. BE C1684A00 MOV ESI,CREXEICO.004A68C1 ; ASCII "1z1h+2a0n-0g8y*9a1n|"

0040C9F6 |. 8D7D 84 LEA EDI,DWORD PTR SS:[EBP-7C]

0040C9F9 |. B9 05000000 MOV ECX,5

0040C9FE |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]

0040CA00 |. A4 MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]

0040CA01 |. 837D 08 00 CMP DWORD PTR SS:[EBP+8],0

0040CA05 |. 74 05 JE SHORT CREXEICO.0040CA0C

0040CA07 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

0040CA0A |. EB 05 JMP SHORT CREXEICO.0040CA11

0040CA0C |> B8 4D694A00 MOV EAX,CREXEICO.004A694D

0040CA11 |> 50 PUSH EAX ; /Arg2

0040CA12 |. 8D55 9C LEA EDX,DWORD PTR SS:[EBP-64] ; |

0040CA15 |. 52 PUSH EDX ; |Arg1

0040CA16 |. E8 45690700 CALL CREXEICO.00483360 ; \CREXEICO.00483360

0040CA1B |. 83C4 08 ADD ESP,8

0040CA1E |. C645 DB 01 MOV BYTE PTR SS:[EBP-25],1

0040CA22 |. 33C9 XOR ECX,ECX

0040CA24 |. 894D D4 MOV DWORD PTR SS:[EBP-2C],ECX

0040CA27 |> 8B45 D4 /MOV EAX,DWORD PTR SS:[EBP-2C]

0040CA2A |. 40 |INC EAX

0040CA2B |. B9 05000000 |MOV ECX,5

0040CA30 |. 99 |CDQ

0040CA31 |. F7F9 |IDIV ECX

0040CA33 |. 85D2 |TEST EDX,EDX

0040CA35 |. 74 41 |JE SHORT CREXEICO.0040CA78

0040CA37 |. 8B45 D4 |MOV EAX,DWORD PTR SS:[EBP-2C]

0040CA3A |. 8A90 28384B00 |MOV DL,BYTE PTR DS:[EAX+4B3828]

0040CA40 |. 8B4D D4 |MOV ECX,DWORD PTR SS:[EBP-2C]

0040CA43 |. 32540D 84 |XOR DL,BYTE PTR SS:[EBP+ECX-7C] ；这里对应密钥串异或

0040CA47 |. 0FBEC2 |MOVSX EAX,DL

0040CA4A |. 8945 D0 |MOV DWORD PTR SS:[EBP-30],EAX

0040CA4D |. 8B45 D0 |MOV EAX,DWORD PTR SS:[EBP-30]

0040CA50 |. 99 |CDQ

0040CA51 |. 33C2 |XOR EAX,EDX

0040CA53 |. 2BC2 |SUB EAX,EDX

0040CA55 |. 69C0 F00A0000 |IMUL EAX,EAX,0AF0 ;再把异或的值 * 0x0AF0

0040CA5B |. B9 1A000000 |MOV ECX,1A ;得到的值再除以 0x1A

0040CA60 |. 99 |CDQ

0040CA61 |. F7F9 |IDIV ECX

0040CA63 |. 83C2 41 |ADD EDX,41 ;结果再加上41

0040CA66 |. 8B45 D4 |MOV EAX,DWORD PTR SS:[EBP-2C]

0040CA69 |. 0FBE4C05 9C |MOVSX ECX,BYTE PTR SS:[EBP+EAX-64]

0040CA6E |. 3BD1 |CMP EDX,ECX

0040CA70 |. 74 06 |JE SHORT CREXEICO.0040CA78

0040CA72 |. C645 DB 00 |MOV BYTE PTR SS:[EBP-25],0

0040CA76 |. EB 09 |JMP SHORT CREXEICO.0040CA81

0040CA78 |> FF45 D4 |INC DWORD PTR SS:[EBP-2C]

0040CA7B |. 837D D4 14 |CMP DWORD PTR SS:[EBP-2C],14

0040CA7F |.^ 7C A6 \JL SHORT CREXEICO.0040CA27

0040CA81 |> 837D 08 00 CMP DWORD PTR SS:[EBP+8],0

0040CA85 |. 74 08 JE SHORT CREXEICO.0040CA8F

0040CA87 |. 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]

0040CA8A |. 8B42 FC MOV EAX,DWORD PTR DS:[EDX-4]

0040CA8D |. EB 02 JMP SHORT CREXEICO.0040CA91

0040CA8F |> 33C0 XOR EAX,EAX

0040CA91 |> 83F8 28 CMP EAX,28

0040CA94 |. 0F85 B1010000 JNZ CREXEICO.0040CC4B

0040CA9A |. BE D6684A00 MOV ESI,CREXEICO.004A68D6 ; ASCII "1z1h+2a0n-0g8y*9a1n|"

0040CA9F |. 8DBD 40FFFFFF LEA EDI,DWORD PTR SS:[EBP-C0]

0040CAA5 |. B9 05000000 MOV ECX,5

0040CAAA |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]

0040CAAC |. A4 MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]

0040CAAD |. 66:C745 EC 08>MOV WORD PTR SS:[EBP-14],8

0040CAB3 |. 837D 08 00 CMP DWORD PTR SS:[EBP+8],0

0040CAB7 |. 74 05 JE SHORT CREXEICO.0040CABE

0040CAB9 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

0040CABC |. EB 05 JMP SHORT CREXEICO.0040CAC3

0040CABE |> B8 4E694A00 MOV EAX,CREXEICO.004A694E

0040CAC3 |> 50 PUSH EAX ; /Arg2

0040CAC4 |. 8D95 58FFFFFF LEA EDX,DWORD PTR SS:[EBP-A8] ; |

0040CACA |. 52 PUSH EDX ; |Arg1

0040CACB |. E8 90680700 CALL CREXEICO.00483360 ; \CREXEICO.00483360

0040CAD0 |. 83C4 08 ADD ESP,8

0040CAD3 |. 0FBE8D 59FFFF>MOVSX ECX,BYTE PTR SS:[EBP-A7]

0040CADA |. 83F9 23 CMP ECX,23

0040CADD |. 0F85 68010000 JNZ CREXEICO.0040CC4B

0040CAE3 |. C645 DB 01 MOV BYTE PTR SS:[EBP-25],1

0040CAE7 |. C745 CC 02000>MOV DWORD PTR SS:[EBP-34],2

0040CAEE |> 8B45 CC /MOV EAX,DWORD PTR SS:[EBP-34]

0040CAF1 |. 0FBE9405 40FF>|MOVSX EDX,BYTE PTR SS:[EBP+EAX-C0]

0040CAF9 |. 8B4D CC |MOV ECX,DWORD PTR SS:[EBP-34]

0040CAFC |. 0FBE840D 57FF>|MOVSX EAX,BYTE PTR SS:[EBP+ECX-A9]

0040CB04 |. 03D0 |ADD EDX,EAX

0040CB06 |. 8B4D CC |MOV ECX,DWORD PTR SS:[EBP-34]

0040CB09 |. 0FBE840D 58FF>|MOVSX EAX,BYTE PTR SS:[EBP+ECX-A8]

0040CB11 |. 33D0 |XOR EDX,EAX

0040CB13 |. 8B4D CC |MOV ECX,DWORD PTR SS:[EBP-34]

0040CB16 |. 0FBE840D 40FF>|MOVSX EAX,BYTE PTR SS:[EBP+ECX-C0]

0040CB1E |. 33D0 |XOR EDX,EAX

0040CB20 |. 8955 C8 |MOV DWORD PTR SS:[EBP-38],EDX

0040CB23 |. 8B45 C8 |MOV EAX,DWORD PTR SS:[EBP-38]

0040CB26 |. 99 |CDQ

0040CB27 |. 33C2 |XOR EAX,EDX

0040CB29 |. 2BC2 |SUB EAX,EDX

0040CB2B |. B9 1A000000 |MOV ECX,1A

0040CB30 |. 99 |CDQ

0040CB31 |. F7F9 |IDIV ECX

0040CB33 |. 83C2 41 |ADD EDX,41

0040CB36 |. 8B45 CC |MOV EAX,DWORD PTR SS:[EBP-34]

0040CB39 |. 0FBE8405 61FF>|MOVSX EAX,BYTE PTR SS:[EBP+EAX-9F]

0040CB41 |. 3BD0 |CMP EDX,EAX

0040CB43 |. 74 06 |JE SHORT CREXEICO.0040CB4B

0040CB45 |. C645 DB 00 |MOV BYTE PTR SS:[EBP-25],0

0040CB49 |. EB 09 |JMP SHORT CREXEICO.0040CB54

0040CB4B |> FF45 CC |INC DWORD PTR SS:[EBP-34]

0040CB4E |. 837D CC 0A |CMP DWORD PTR SS:[EBP-34],0A

0040CB52 |.^ 7C 9A \JL SHORT CREXEICO.0040CAEE

0040CB54 |> 807D DB 00 CMP BYTE PTR SS:[EBP-25],0

0040CB58 |. 0F84 DD000000 JE CREXEICO.0040CC3B

0040CB5E |. C745 C4 18000>MOV DWORD PTR SS:[EBP-3C],18

0040CB65 |. 66:C745 EC 08>MOV WORD PTR SS:[EBP-14],8

0040CB6B |. 837D C4 28 CMP DWORD PTR SS:[EBP-3C],28

0040CB6F |. 7D 58 JGE SHORT CREXEICO.0040CBC9

0040CB71 |> 8B55 C4 /MOV EDX,DWORD PTR SS:[EBP-3C]

0040CB74 |. 0FBE8415 41FF>|MOVSX EAX,BYTE PTR SS:[EBP+EDX-BF]

0040CB7C |. B9 06000000 |MOV ECX,6

0040CB81 |. 99 |CDQ

0040CB82 |. F7F9 |IDIV ECX

0040CB84 |. 8BCA |MOV ECX,EDX

0040CB86 |. 8B45 C4 |MOV EAX,DWORD PTR SS:[EBP-3C]

0040CB89 |. 0FBE9405 42FF>|MOVSX EDX,BYTE PTR SS:[EBP+EAX-BE]

0040CB91 |. D3E2 |SHL EDX,CL

0040CB93 |. 8B45 C4 |MOV EAX,DWORD PTR SS:[EBP-3C]

0040CB96 |. 0FBE8C05 43FF>|MOVSX ECX,BYTE PTR SS:[EBP+EAX-BD]

0040CB9E |. 0BD1 |OR EDX,ECX

0040CBA0 |. 8955 C0 |MOV DWORD PTR SS:[EBP-40],EDX

0040CBA3 |. 8B45 C0 |MOV EAX,DWORD PTR SS:[EBP-40]

0040CBA6 |. 99 |CDQ

0040CBA7 |. 33C2 |XOR EAX,EDX

0040CBA9 |. 2BC2 |SUB EAX,EDX

0040CBAB |. B9 1A000000 |MOV ECX,1A

0040CBB0 |. 99 |CDQ

0040CBB1 |. F7F9 |IDIV ECX

0040CBB3 |. 80C2 61 |ADD DL,61

0040CBB6 |. 8B45 C4 |MOV EAX,DWORD PTR SS:[EBP-3C]

0040CBB9 |. 889405 14FFFF>|MOV BYTE PTR SS:[EBP+EAX-EC],DL

0040CBC0 |. FF45 C4 |INC DWORD PTR SS:[EBP-3C]

0040CBC3 |. 837D C4 28 |CMP DWORD PTR SS:[EBP-3C],28

0040CBC7 |.^ 7C A8 \JL SHORT CREXEICO.0040CB71

0040CBC9 |> C685 3CFFFFFF>MOV BYTE PTR SS:[EBP-C4],5A

0040CBD0 |. C685 3DFFFFFF>MOV BYTE PTR SS:[EBP-C3],59

0040CBD7 |. C745 BC 18000>MOV DWORD PTR SS:[EBP-44],18

0040CBDE |. 66:C745 EC 08>MOV WORD PTR SS:[EBP-14],8

0040CBE4 |. 837D BC 28 CMP DWORD PTR SS:[EBP-44],28

0040CBE8 |. 7D 51 JGE SHORT CREXEICO.0040CC3B

0040CBEA |> 8B45 BC /MOV EAX,DWORD PTR SS:[EBP-44]

0040CBED |. 0FBE9405 14FF>|MOVSX EDX,BYTE PTR SS:[EBP+EAX-EC]

0040CBF5 |. C1E2 04 |SHL EDX,4

0040CBF8 |. 8B4D BC |MOV ECX,DWORD PTR SS:[EBP-44]

0040CBFB |. 0FBE840D 15FF>|MOVSX EAX,BYTE PTR SS:[EBP+ECX-EB]

0040CC03 |. D1F8 |SAR EAX,1

0040CC05 |. 33D0 |XOR EDX,EAX

0040CC07 |. 8955 B8 |MOV DWORD PTR SS:[EBP-48],EDX

0040CC0A |. 8B45 B8 |MOV EAX,DWORD PTR SS:[EBP-48]

0040CC0D |. 99 |CDQ

0040CC0E |. 33C2 |XOR EAX,EDX

0040CC10 |. 2BC2 |SUB EAX,EDX

0040CC12 |. B9 1A000000 |MOV ECX,1A

0040CC17 |. 99 |CDQ

0040CC18 |. F7F9 |IDIV ECX

0040CC1A |. 83C2 41 |ADD EDX,41

0040CC1D |. 8B45 BC |MOV EAX,DWORD PTR SS:[EBP-44]

0040CC20 |. 0FBE8405 58FF>|MOVSX EAX,BYTE PTR SS:[EBP+EAX-A8]

0040CC28 |. 3BD0 |CMP EDX,EAX

0040CC2A |. 74 06 |JE SHORT CREXEICO.0040CC32

0040CC2C |. C645 DB 00 |MOV BYTE PTR SS:[EBP-25],0

0040CC30 |. EB 09 |JMP SHORT CREXEICO.0040CC3B

0040CC32 |> FF45 BC |INC DWORD PTR SS:[EBP-44]

0040CC35 |. 837D BC 28 |CMP DWORD PTR SS:[EBP-44],28

0040CC39 |.^ 7C AF \JL SHORT CREXEICO.0040CBEA

0040CC3B |> 0FBE95 62FFFF>MOVSX EDX,BYTE PTR SS:[EBP-9E]

0040CC42 |. 83FA 5A CMP EDX,5A

0040CC45 |. 74 04 JE SHORT CREXEICO.0040CC4B

0040CC47 |. C645 DB 00 MOV BYTE PTR SS:[EBP-25],0

0040CC4B |> 8A45 DB MOV AL,BYTE PTR SS:[EBP-25]

0040CC4E |. 50 PUSH EAX

0040CC4F |. FF4D F8 DEC DWORD PTR SS:[EBP-8]

0040CC52 |. 8D45 08 LEA EAX,DWORD PTR SS:[EBP+8]

0040CC55 |. BA 02000000 MOV EDX,2

0040CC5A |. E8 111A0800 CALL CREXEICO.0048E670

0040CC5F |. 58 POP EAX

0040CC60 |. 8B55 DC MOV EDX,DWORD PTR SS:[EBP-24]

0040CC63 |. 64:8915 00000>MOV DWORD PTR FS:[0],EDX

0040CC6A |. 5F POP EDI

0040CC6B |. 5E POP ESI

0040CC6C |. 8BE5 MOV ESP,EBP

0040CC6E |. 5D POP EBP

0040CC6F \. C3 RETN

【算法总结】：

1、注册码需要24位。

2、"1z1h+2a0n-0g8y*9a1n|" 与机器码异或，5，10，15，20位不计算，得到20位的注册码。再加上任意4位即可。

【应用程序图标更换器v2.01 Java 注册机】：

public class ExeIcoKey

{

public static void main(String[] args)

{

String key = new String("1z1h+2a0n-0g8y*9a1n|");

String id = new String("YZAB-DEFG-AABD-LKKG-EI20"); //这里是机器码

String sn = "";

for(int i=0;i<key.length();i++)

{

char ckey = key.charAt(i);

char cid = id.charAt(i);

int flag =(i+1) % 5;

if(flag == 0)

{

sn+='-';

continue;

}

int c1 = cid ^ ckey;

int c2 = c1* 0x0AF0;

int c3 = c2 % 0x1A;

int c4 = c3+ 0x41;

sn+=(char)c4;

}

sn+="8888";

System.out .println("－－－ 应用程序图标更换器 v2.01 注册机 Cracked By CrazyXY[DFCG]－－－");

System.out .println("用户名：" +id);

System.out .println("注册码：" +sn);

System.out .println("－－－--------------------------－－－---------------------");

}

}

（出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net