CheckFiles V1.8破解

【软件类别】：国外软件 / 共享版 / 文件管理

【开 发 商】http://www.lightlink.com/ym/chkfiles.htm

【破解过程】：用Fi2.45检查，VC 5.0编写，无壳。于是用W32Dasm反汇编后查找错误信息，找到关键点如下：

【破解过程】：

:00408483 E8017B0100 call 0041FF89

:00408488 8BC8 mov ecx, eax

:0040848A E8217C0100 call 004200B0

/* 取用户名位数 */

:0040848F 85C0 test eax, eax

:00408491 7518 jne 004084AB

:00408493 50 push eax

* Possible StringData Ref from Data Obj ->"CheckFiles Registration"

|

:00408494 6848ED4200 push 0042ED48

* Possible StringData Ref from Data Obj ->"You need to enter a user name."

|

:00408499 6828ED4200 push 0042ED28

:0040849E 8BCE mov ecx, esi

:004084A0 E87DA20100 call 00422722

:004084A5 5F pop edi

:004084A6 5E pop esi

:004084A7 83C420 add esp, 00000020

:004084AA C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00408491(C)

|

:004084AB 83F814 cmp eax, 00000014

/* 用户名是否在20位以内？ */

:004084AE 7E19 jle 004084C9

:004084B0 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"CheckFiles Registration"

|

:004084B2 6848ED4200 push 0042ED48

* Possible StringData Ref from Data Obj ->"The user name must be 20 characters "

->"or less."

|

:004084B7 68F8EC4200 push 0042ECF8

:004084BC 8BCE mov ecx, esi

:004084BE E85FA20100 call 00422722

:004084C3 5F pop edi

:004084C4 5E pop esi

:004084C5 83C420 add esp, 00000020

:004084C8 C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004084AE(C)

|

:004084C9 8D44240C lea eax, dword ptr [esp+0C]

:004084CD 6A17 push 00000017

:004084CF 50 push eax

* Possible Reference to Dialog: DialogID_0087, CONTROL_ID:040F, ""

|

:004084D0 680F040000 push 0000040F

:004084D5 8BCE mov ecx, esi

:004084D7 E8AD7A0100 call 0041FF89

:004084DC 8BC8 mov ecx, eax

:004084DE E8CD7B0100 call 004200B0

/* 取试炼码位数 */

:004084E3 85C0 test eax, eax

:004084E5 7518 jne 004084FF

:004084E7 50 push eax

* Possible StringData Ref from Data Obj ->"CheckFiles Registration"

|

:004084E8 6848ED4200 push 0042ED48

* Possible StringData Ref from Data Obj ->"You need to enter a registration "

->"number."

|

:004084ED 68CCEC4200 push 0042ECCC

:004084F2 8BCE mov ecx, esi

:004084F4 E829A20100 call 00422722

:004084F9 5F pop edi

:004084FA 5E pop esi

:004084FB 83C420 add esp, 00000020

:004084FE C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004084E5(C)

|

:004084FF 8D4C2408 lea ecx, dword ptr [esp+08]

:00408503 8D54240C lea edx, dword ptr [esp+0C]

/* 取试炼码地址 */

:00408507 51 push ecx

* Possible StringData Ref from Data Obj ->"%lu"

|

:00408508 6854E24200 push 0042E254

:0040850D 52 push edx

:0040850E E8AD100000 call 004095C0

/* 判断试炼码是否全是数字，若是则转为16进制，不是则给出错误信息 */

:00408513 83C40C add esp, 0000000C

:00408516 83F801 cmp eax, 00000001

:00408519 7419 je 00408534

:0040851B 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"CheckFiles Registration"

|

:0040851D 6848ED4200 push 0042ED48

* Possible StringData Ref from Data Obj ->"You need to enter a valid registration "

->"number."

|

:00408522 689CEC4200 push 0042EC9C

:00408527 8BCE mov ecx, esi

:00408529 E8F4A10100 call 00422722

:0040852E 5F pop edi

:0040852F 5E pop esi

:00408530 83C420 add esp, 00000020

:00408533 C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00408519(C)

|

:00408534 8B442408 mov eax, dword ptr [esp+08]

/* 16进制值送eax */

:00408538 85C0 test eax, eax

:0040853A 7519 jne 00408555

:0040853C 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"CheckFiles Registration"

|

:0040853E 6848ED4200 push 0042ED48

* Possible StringData Ref from Data Obj ->"You need to enter a valid registartion "

->"number."

|

:00408543 686CEC4200 push 0042EC6C

:00408548 8BCE mov ecx, esi

:0040854A E8D3A10100 call 00422722

:0040854F 5F pop edi

:00408550 5E pop esi

:00408551 83C420 add esp, 00000020

:00408554 C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0040853A(C)

|

:00408555 68282D4300 push 00432D28

/* 用户名地址入栈 */

:0040855A E8A18AFFFF call 00401000

/* 算法call */

:0040855F 8B4C240C mov ecx, dword ptr [esp+0C]

:00408563 83C404 add esp, 00000004

:00408566 3BC8 cmp ecx, eax

/* 关键比较 */

:00408568 7419 je 00408583

/* 一定要跳 */

:0040856A 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"CheckFiles Registration"

|

:0040856C 6848ED4200 push 0042ED48

* Possible StringData Ref from Data Obj ->"Sorry, this registration number "

->"is not valid."

|

:00408571 683CEC4200 push 0042EC3C

:00408576 8BCE mov ecx, esi

:00408578 E8A5A10100 call 00422722

:0040857D 5F pop edi

:0040857E 5E pop esi

:0040857F 83C420 add esp, 00000020

:00408582 C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00408568(C)

|

* Possible StringData Ref from Data Obj ->"ww"

|

:00408583 68FCE34200 push 0042E3FC

* Possible StringData Ref from Data Obj ->"chkfiles.ser"

|

:00408588 685CE24200 push 0042E25C

:0040858D E86E120000 call 00409800

:00408592 8BF8 mov edi, eax

:00408594 83C408 add esp, 00000008

:00408597 85FF test edi, edi

:00408599 7439 je 004085D4

:0040859B 8B442408 mov eax, dword ptr [esp+08]

:0040859F 50 push eax

:004085A0 68282D4300 push 00432D28

* Possible StringData Ref from Data Obj ->"%s%lu"

:004085A5 6834EC4200 push 0042EC34

:004085AA 57 push edi

:004085AB E870120000 call 00409820

:004085B0 83C410 add esp, 00000010

:004085B3 83F8FF cmp eax, FFFFFFFF

:004085B6 741C je 004085D4

:004085B8 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"CheckFiles Registration"

|

:004085BA 6848ED4200 push 0042ED48

* Possible StringData Ref from Data Obj ->"Thank you for registering."

|

:004085BF 6818EC4200 push 0042EC18

:004085C4 8BCE mov ecx, esi

:004085C6 E857A10100 call 00422722

:004085CB C605202D430001 mov byte ptr [00432D20], 01

:004085D2 EB13 jmp 004085E7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00408599(C), :004085B6(C)

|

:004085D4 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"CheckFiles Registration"

|

:004085D6 6848ED4200 push 0042ED48

* Possible StringData Ref from Data Obj ->"Error writing registration file."

|

:004085DB 68F4EB4200 push 0042EBF4

:004085E0 8BCE mov ecx, esi

:004085E2 E83BA10100 call 00422722

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004085D2(U)

|

:004085E7 57 push edi

:004085E8 E873080000 call 00408E60

:004085ED 83C404 add esp, 00000004

:004085F0 8BCE mov ecx, esi

:004085F2 E8394B0100 call 0041D130

:004085F7 5F pop edi

:004085F8 5E pop esi

:004085F9 83C420 add esp, 00000020

:004085FC C3 ret

___________________________________________________________

算法call：

:00401000 53 push ebx

:00401001 55 push ebp

:00401002 8B6C240C mov ebp, dword ptr [esp+0C]

:00401006 56 push esi

:00401007 57 push edi

:00401008 8BFD mov edi, ebp

:0040100A 83C9FF or ecx, FFFFFFFF

:0040100D 33C0 xor eax, eax

:0040100F F2 repnz

:00401010 AE scasb

:00401011 F7D1 not ecx

:00401013 49 dec ecx

/* 这里取得用户名长度 */

:00401014 8BC1 mov eax, ecx

:00401016 8BD8 mov ebx, eax

:00401018 7452 je 0040106C

:0040101A 83F814 cmp eax, 00000014

:0040101D 7F4D jg 0040106C

:0040101F 7D1D jge 0040103E

:00401021 B914000000 mov ecx, 00000014

:00401026 8D3C28 lea edi, dword ptr [eax+ebp]

:00401029 2BC8 sub ecx, eax

:0040102B B820202020 mov eax, 20202020

:00401030 8BD1 mov edx, ecx

:00401032 C1E902 shr ecx, 02

:00401035 F3 repz

:00401036 AB stosd

/* 上面这段指令用0x20将未满20位的用户名补足20位 */

:00401037 8BCA mov ecx, edx

:00401039 83E103 and ecx, 00000003

:0040103C F3 repz

:0040103D AA stosb

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0040101F(C)

|

:0040103E BE322DFB21 mov esi, 21FB2D32

:00401043 B929197C6B mov ecx, 6B7C1929

/* 以上是两个计算关键值 */

:00401048 33D2 xor edx, edx

/* edx清零 */

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0040105F(C)

|

:0040104A 33C0 xor eax, eax

/* eax清零 */

:0040104C 8A042A mov al, byte ptr [edx+ebp]

/* 依次取用户名的每一位 */

:0040104F 0FAFC1 imul eax, ecx

/* eax=eax*ecx */

:00401052 03F0 add esi, eax

/* esi=eax+esi */

:00401054 42 inc edx

/* edx++ */

:00401055 83FA14 cmp edx, 00000014

/* 20位是否都算完？ */

:00401058 8D8C092106471E lea ecx, dword ptr [ecx+ecx+1E470621]

/* ecx=ecx*2+1E470621 */

:0040105F 7CE9 jl 0040104A

/* 未满20位则返回继续运算 */

:00401061 C6042B00 mov byte ptr [ebx+ebp], 00

:00401065 8BC6 mov eax, esi

/* 运算结果作为返回值送出 */

:00401067 5F pop edi

:00401068 5E pop esi

:00401069 5D pop ebp

:0040106A 5B pop ebx

:0040106B C3 ret

【整 理】：

用户名：cyclotron

注册码：101258879

【注册信息存放】：

主目录下chkfiles.ser

【Turbo C 注册机】：

#include "stdio.h"

#include "string.h"

void main()

{char regname[21];

unsigned long regcode=0x21FB2D32,ecx=0x6B7C1929;

int i,length;

printf("\t*******************************************************************\n\n");

printf("\t\tKeyGen for CheckFiles V1.5\n\t\t\tProduced by cyclotron\n\n");

printf("\t*******************************************************************\n\n");

do

{printf("\n\tPlease input your Regname(less than or equal to 20):");

length=strlen(gets(regname));

}

while(!length||length>20);

for(i=length;i<20;i++)

regname[i]=0x20;

for(i=0;i<20;i++)

{regcode+=regname[i]*ecx;

ecx=ecx*2+0x1E470621;

}

printf("\n\tYour Regcode is:\t%lu\n",regcode);

printf("\n\tThank you for your use!\n");

getchar();

}

（出处：赢政天下整理收藏）

相关资讯：

·Tornado2之Licence暴力破解

·万能五笔2001注册码分析及暴力破解

·万能五笔2001注册码分析及暴力破解

·万能五笔2001注册码分析及暴力破解 －－－可怜的思考者 (27千字)

·一个拨号软件的Win32Dasm暴力破解法

·CuteFTP V4.2.4之暴力破解

相关软件：

·电话卡暴力破解器 v2.0 (0425版)

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1998-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net