EffeTech HTTP Sniffer 3.2注册算法分析

最近在搞HTTP监听，顺便要找类似的软件对比对比研究研究，找到了EffeTech HTTP Sniffer 3.2，看见要注册码的，手痒于是开开刀。

EffeTech HTTP Sniffer 3.2是用来监听局域网内HTTP包的。但是在我机器上似乎没什么用。一个这么破的软件都要注册，实在让人不爽。

用TRW2000载入，在要求注册框内填点儿东西，下bpx hmemcpy，断两次后弹出出错框。

经过跟踪分析得到结论：注册码长度必须是18位，和用户名无关，其中某几个字符得符合一定条件（条件在下面分析）。

下面是算法分析：

:004109D0 51 push ecx

:004109D1 55 push ebp

:004109D2 56 push esi

:004109D3 57 push edi

:004109D4 8BE9 mov ebp, ecx

:004109D6 6A01 push 00000001

:004109D8 E868E30100 call 0042ED45

:004109DD 8BBD9C000000 mov edi, dword ptr [ebp+0000009C] // EDI是假注册码地址

:004109E3 837FF812 cmp dword ptr [edi-08], 00000012 // 长度必须是0x12

:004109E7 0F850D010000 jne 00410AFA

:004109ED 8B74240C mov esi, dword ptr [esp+0C]

:004109F1 8B44240C mov eax, dword ptr [esp+0C]

:004109F5 53 push ebx

:004109F6 8B5C2410 mov ebx, dword ptr [esp+10]

:004109FA 33D2 xor edx, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00410A5D(C)

|

:004109FC 8A0C17 mov cl, byte ptr [edi+edx]

:004109FF 85D2 test edx, edx

:00410A01 7505 jne 00410A08

:00410A03 0FBED9 movsx ebx, cl // 第0个字符放入EBX

:00410A06 EB51 jmp 00410A59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00410A01(C)

|

:00410A08 83FA01 cmp edx, 00000001

:00410A0B 7507 jne 00410A14

:00410A0D 0FBEC1 movsx eax, cl

:00410A10 8BF0 mov esi, eax

:00410A12 EB45 jmp 00410A59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00410A0B(C)

|

:00410A14 83FA03 cmp edx, 00000003

:00410A17 7431 je 00410A4A

:00410A19 83FA06 cmp edx, 00000006

:00410A1C 7507 jne 00410A25

:00410A1E 0FBEC1 movsx eax, cl

:00410A21 8BF0 mov esi, eax

:00410A23 EB34 jmp 00410A59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00410A1C(C)

|

:00410A25 83FA0A cmp edx, 0000000A

:00410A28 7509 jne 00410A33

:00410A2A 0FBEC1 movsx eax, cl

:00410A2D 89442410 mov dword ptr [esp+10], eax // 把第0x0A个字符放入ESP+10

:00410A31 EB26 jmp 00410A59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00410A28(C)

|

:00410A33 83FA0E cmp edx, 0000000E

:00410A36 7508 jne 00410A40

:00410A38 0FBEC1 movsx eax, cl

:00410A3B 83EB50 sub ebx, 00000050

// 处理到第0xE个字符时，EBX <- EBX - Ox50

:00410A3E EB19 jmp 00410A59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00410A36(C)

|

:00410A40 83FA12 cmp edx, 00000012

:00410A43 7411 je 00410A56

:00410A45 83FA08 cmp edx, 00000008

:00410A48 7507 jne 00410A51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00410A17(C)

|

:00410A4A 0FBEC1 movsx eax, cl

:00410A4D 8BF0 mov esi, eax // 第8个字符放入ESI

:00410A4F EB08 jmp 00410A59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00410A48(C)

|

:00410A51 83FA0F cmp edx, 0000000F

:00410A54 7503 jne 00410A59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00410A43(C)

|

:00410A56 0FBEC1 movsx eax, cl // 第0x0F个字符最后放入EAX

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00410A06(U), :00410A12(U), :00410A23(U), :00410A31(U), :00410A3E(U)

|:00410A4F(U), :00410A54(C)

|

:00410A59 42 inc edx

:00410A5A 83FA12 cmp edx, 00000012

:00410A5D 7C9D jl 004109FC // 这里是对假注册码的遍历循环

:00410A5F 2B442410 sub eax, dword ptr [esp+10]

:00410A63 2BC6 sub eax, esi

:00410A65 03C3 add eax, ebx

:00410A67 5B pop ebx

:00410A68 0F858C000000 jne 00410AFA // 此处是终极判断，不能跳

最后的JNE条件表示EAX - [ESP+10] - ESI + EBX必须等于0，假设正确注册码是

a: array[0..17] of Char;

EAX := a[F];

[ESP+10] := a[10];

ESI := a[8];

EBX := a[0] - $50;

所以注册成功的条件就是Length(a) = 18而且a[F] - a[10] - a[8]- (a[0] - $50) = 0

捏造一番：a[F] := #$56; a[10] := #$30; a[8] := #$30; a[0] := #$5A;

也就是： a[F] := 'V'; a[10] := '0'; a[8] := '0'; a[0] := 'Z';

用户名和别的位可以随便捏造，如：

Passion

Z12345670901234V67 （出处：嬴政天下整理收藏）

相关文章：

·ASProtect的加密算法初步分析

·MD5算法研究

·Active Ebook Compiler的注册算法

·语音界面2.0算法分析及注册机源码！

·简单算法——小护士 V1.2

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·加密算法之RSA算法

·加密算法之DES算法

·加密算法之ElGamal算法

相关软件：

·胜新通用人事工资管理系统 V5.01注册码算法

·胜新出纳-支票打印软件 V4.0X 的注册码算法

·胜新现代办公百宝箱 V5.01 的注册码算法

·胜新信函宝典-信封打印软件 V2.02 注册码的算法

·胜新通用企业计划管理系统的注册码算法

·共享软件加密算法库 2.5

·操作系统内存分配银行家算法模拟系统 XP

→ 特别推荐

→ 热点TOP10

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net