简单算法 GIF Movie Gear 3.0

工具：trw 2000 娃娃版，w32dasm,windows 计算器，regmon.

运行注册对话框，输入 happycreator,注册码： 123456789

在trw 2000 中下断点bpx hmemcpy

点“确定”中断

来到004317d2

向下看：

:004317EE 8D4C2460 lea ecx, dword ptr [esp+60]

:004317F2 50 push eax

:004317F3 51 push ecx

:004317F4 E8F7FBFFFF call 004313F0 <-----关键call!

:004317F9 83C408 add esp, 00000008

:004317FC 85C0 test eax, eax

:004317FE 0F84AD000000 je 004318B1

:00431804 8D542410 lea edx, dword ptr [esp+10]

:00431808 8D44240C lea eax, dword ptr [esp+0C]

:0043180C 52 push edx

:0043180D 50 push eax

:0043180E 6A00 push 00000000

:00431810 683F000F00 push 000F003F

:00431815 6A00 push 00000000

:00431817 6814ED4400 push 0044ED14

:0043181C 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"Software\gamani\GIFMovieGear\2.0"

|

:0043181E 68B8B34400 push 0044B3B8

:00431823 6801000080 push 80000001

* Reference To: ADVAPI32.RegCreateKeyExA, Ord:015Fh

|

:00431828 FF1514804400 Call dword ptr [00448014]

:0043182E 8D7C2460 lea edi, dword ptr [esp+60]

:00431832 83C9FF or ecx, FFFFFFFF

:00431835 33C0 xor eax, eax

:00431837 8B54240C mov edx, dword ptr [esp+0C]

:0043183B F2 repnz

:0043183C AE scasb

:0043183D F7D1 not ecx

* Reference To: ADVAPI32.RegSetvalueExA, Ord:0186h

|

:0043183F 8B1D08804400 mov ebx, dword ptr [00448008]

:00431845 51 push ecx

:00431846 8D4C2464 lea ecx, dword ptr [esp+64]

:0043184A 51 push ecx

:0043184B 6A01 push 00000001

:0043184D 50 push eax

* Possible StringData Ref from Data Obj ->"RegName3"

|

:0043184E 6890D44400 push 0044D490

:00431853 52 push edx

:00431854 FFD3 call ebx

:00431856 8DBC24C4000000 lea edi, dword ptr [esp+000000C4]

:0043185D 83C9FF or ecx, FFFFFFFF

:00431860 33C0 xor eax, eax

:00431862 F2 repnz

:00431863 AE scasb

:00431864 F7D1 not ecx

:00431866 8D8424C4000000 lea eax, dword ptr [esp+000000C4]

:0043186D 51 push ecx

:0043186E 8B4C2410 mov ecx, dword ptr [esp+10]

:00431872 50 push eax

:00431873 6A01 push 00000001

:00431875 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"RegCode3"

|

:00431877 689CD44400 push 0044D49C

:0043187C 51 push ecx

:0043187D FFD3 call ebx

:0043187F 8B54240C mov edx, dword ptr [esp+0C]

:00431883 52 push edx

* Reference To: ADVAPI32.RegCloseKey, Ord:015Bh

|

:00431884 FF1518804400 Call dword ptr [00448018]

* Possible StringData Ref from Data Obj ->"Software\Loani\MG3t"

|

:0043188A 68A8D44400 push 0044D4A8

:0043188F 6802000080 push 80000002

* Reference To: ADVAPI32.RegDeleteKeyA, Ord:0162h

|

:00431894 FF1510804400 Call dword ptr [00448010]

:0043189A 6A01 push 00000001

:0043189C 56 push esi

-------------------------------------------------------------------------

:004313F0 53 push ebx

:004313F1 55 push ebp

:004313F2 8B6C2410 mov ebp, dword ptr [esp+10]

:004313F6 56 push esi

:004313F7 57 push edi

:004313F8 807D006D cmp byte ptr [ebp+00], 6D<----首位为"m"否则失败

:004313FC 0F85A0000000 jne 004314A2

:00431402 807D0167 cmp byte ptr [ebp+01], 67<------第二位为"g"

:00431406 0F8596000000 jne 004314A2

:0043140C 807D0233 cmp byte ptr [ebp+02], 33<-----第三位为“3”

:00431410 0F858C000000 jne 004314A2

:00431416 807D0337 cmp byte ptr [ebp+03], 37<-----第四位为“7”

:0043141A 0F8582000000 jne 004314A2

<---改过来，再试。

* Possible Indirect StringData Ref from Data Obj ->"mvg21951736"<---不知道是不是从前的非法注册码？

|

:00431420 BBBCD44400 mov ebx, 0044D4BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00431446(C)

|

:00431425 8B13 mov edx, dword ptr [ebx]

:00431427 83C9FF or ecx, FFFFFFFF

:0043142A 8BFA mov edi, edx

:0043142C 33C0 xor eax, eax

:0043142E F2 repnz

:0043142F AE scasb

:00431430 F7D1 not ecx

:00431432 49 dec ecx

:00431433 8BFA mov edi, edx

:00431435 8BF5 mov esi, ebp

:00431437 33C0 xor eax, eax

:00431439 F3 repz

:0043143A A6 cmpsb

:0043143B 7465 je 004314A2

:0043143D 83C304 add ebx, 00000004

:00431440 81FBC0D44400 cmp ebx, 0044D4C0

:00431446 7CDD jl 00431425

:00431448 807D0473 cmp byte ptr [ebp+04], 73<----第五位是否为"s"，改之，试一下。

:0043144C 7501 jne 0043144F

:0043144E 45 inc ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043144C(C)

|

:0043144F 83C507 add ebp, 00000007

:00431452 55 push ebp

:00431453 E8C4DD0000 call 0043F21C<-------对注册码的关键运算！

:00431458 8B542418 mov edx, dword ptr [esp+18]

:0043145C 83C404 add esp, 00000004

:0043145F 8BFA mov edi, edx<----对注册名开始运算！

:00431461 33C9 xor ecx, ecx

:00431463 8A12 mov dl, byte ptr [edx]

:00431465 BEDF0B0000 mov esi, 00000BDF<---esi的初始值。

:0043146A 84D2 test dl, dl

:0043146C 7426 je 00431494

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00431492(C)

|

:0043146E 0FBED2 movsx edx, dl 注册名各字符进edx

:00431471 41 inc ecx<------ecx计数

:00431472 0FAFD1 imul edx, ecx<------位数与注册名ASC码相乘。

:00431475 03F2 add esi, edx<-----和加入esi

:00431477 81FEBE170000 cmp esi, 000017BE

:0043147D 7E06 jle 00431485

:0043147F 81EEBE170000 sub esi, 000017BE<---最后取esi除17be的余数。

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043147D(C)

|

:00431485 83F90A cmp ecx, 0000000A<----ecx以十为一组。

:00431488 7E02 jle 0043148C

:0043148A 33C9 xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00431488(C)

|

:0043148C 8A5701 mov dl, byte ptr [edi+01]

:0043148F 47 inc edi

:00431490 84D2 test dl, dl<----直到取尽注册名。

:00431492 75DA jne 0043146E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043146C(C)

|

:00431494 3BF0 cmp esi, eax<----与注册码计算结果比较，不等则失败！

:00431496 750A jne 004314A2

:00431498 5F pop edi

:00431499 5E pop esi

:0043149A 5D pop ebp

:0043149B B801000000 mov eax, 00000001

:004314A0 5B pop ebx

:004314A1 C3 ret

:0043F21C FF742404 push [esp+04]

:0043F220 E86CFFFFFF call 0043F191<-----跟进！

:0043F225 59 pop ecx

:0043F226 C3 ret

--------------------------------------------------------------------------

* Referenced by a CALL at Addresses:

|:0043F220 , :004463E3 , :00446411 , :0044643C

|

:0043F191 53 push ebx

:0043F192 55 push ebp

:0043F193 56 push esi

:0043F194 57 push edi

:0043F195 8B7C2414 mov edi, dword ptr [esp+14]<---edi指向第九位。

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043F1C5(U)

|

:0043F199 833D4CE2440001 cmp dword ptr [0044E24C], 00000001<---查看是否取尽

:0043F1A0 7E0F jle 0043F1B1

:0043F1A2 0FB607 movzx eax, byte ptr [edi]

:0043F1A5 6A08 push 00000008

:0043F1A7 50 push eax

:0043F1A8 E812230000 call 004414BF

:0043F1AD 59 pop ecx

:0043F1AE 59 pop ecx

:0043F1AF EB0F jmp 0043F1C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043F1A0(C)

|

:0043F1B1 0FB607 movzx eax, byte ptr [edi]

* Possible StringData Ref from Data Obj ->" ((((( "

->" H"

|

:0043F1B4 8B0D40E04400 mov ecx, dword ptr [0044E040]

:0043F1BA 8A0441 mov al, byte ptr [ecx+2*eax]

:0043F1BD 83E008 and eax, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043F1AF(U)

|

:0043F1C0 85C0 test eax, eax

:0043F1C2 7403 je 0043F1C7

:0043F1C4 47 inc edi

:0043F1C5 EBD2 jmp 0043F199

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043F1C2(C)

|

:0043F1C7 0FB637 movzx esi, byte ptr [edi]

:0043F1CA 47 inc edi

:0043F1CB 83FE2D cmp esi, 0000002D<---第九位是否为"-"

:0043F1CE 8BEE mov ebp, esi

:0043F1D0 7405 je 0043F1D7<-----是则有另一种算法，最后取eax的补码。

:0043F1D2 83FE2B cmp esi, 0000002B<----第九位是不是"+"？

:0043F1D5 7504 jne 0043F1DB<---不是则跳！

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043F1D0(C)

|

:0043F1D7 0FB637 movzx esi, byte ptr [edi] <-对于第九位“-”或“+”的对其后数

字进行计算。

:0043F1DA 47 inc edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043F1D5(C)

|

:0043F1DB 33DB xor ebx, ebx<--否则直接进行计算。

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043F20C(U)

|

:0043F1DD 833D4CE2440001 cmp dword ptr [0044E24C], 00000001<--以下好像是在验证是否取完数码。

:0043F1E4 7E0C jle 0043F1F2

:0043F1E6 6A04 push 00000004

:0043F1E8 56 push esi

:0043F1E9 E8D1220000 call 004414BF

:0043F1EE 59 pop ecx

:0043F1EF 59 pop ecx

:0043F1F0 EB0B jmp 0043F1FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043F1E4(C)

|

* Possible StringData Ref from Data Obj ->" ((((( "

->" H"

|

:0043F1F2 A140E04400 mov eax, dword ptr [0044E040]

:0043F1F7 8A0470 mov al, byte ptr [eax+2*esi]

:0043F1FA 83E004 and eax, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043F1F0(U)

|

:0043F1FD 85C0 test eax, eax

:0043F1FF 740D je 0043F20E

:0043F201 8D049B lea eax, dword ptr [ebx+4*ebx]<---对eax取值！

:0043F204 8D5C46D0 lea ebx, dword ptr [esi+2*eax-30]<---对ebx取值！！

:0043F208 0FB637 movzx esi, byte ptr [edi] <----esi为相应数字的ASC码。

:0043F20B 47 inc edi<-- 下一位

:0043F20C EBCF jmp 0043F1DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043F1FF(C)

|

:0043F20E 83FD2D cmp ebp, 0000002D<--算法选择。

:0043F211 8BC3 mov eax, ebx <----返回eax的值！

:0043F213 7502 jne 0043F217

:0043F215 F7D8 neg eax <--是否取反，视有无"-"而定。

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0043F213(C)

|

:0043F217 5F pop edi

:0043F218 5E pop esi

:0043F219 5D pop ebp

:0043F21A 5B pop ebx

:0043F21B C3 ret

在00431494处的比较决定了注册成功与否。相等既大功告成！

在对注册码的计算中实际上是对输入的九至n位数字转化为十六进制，而在对注册名的算法中是在esi的初始值

上再加上各位字符和位数的积的和除17be的余数。两者相等既可成功。在前面还有一个对第五位的测试，时间原因就不能再分析了

我的结果：注册名：happycreator

注册码：mg37s6784216

注册后信息会保存在注册表中：HKCU\Software\gamani\GIFMovieGear\2.0

删除相关信息后又变为未注册。注册码第6、7、8三位无关。

（出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net