工会图书管理系统 V1.0 算法分析

简单算法——工会图书管理系统 V1.0

软件大小：496K

下载页面：http://www.wtybook.com/GHOSTAR

【软件简介】：图书管理

【软件限制】：必须注册，否则无法使用

【作者声明】：初学Crack，只是感兴趣，没有其它目的。失误之处敬请诸位大侠赐教！

【破解工具】：TRW2000娃娃修改版、FI2.5、CasprGui、W32Dasm8.93黄金版

—————————————————————————————————

【过 程】：

GhBook.exe是ASPROTECT 1.1壳，用CasprGui脱之。485K->1.21M。DELPHI编写。

反汇编，查找关键提示："对不起, 此软件已被锁定!"在4FC7AB。

向上分析，很容易就找到关键点了。

激活验证代码 ：21291120 （程序自给）

激活代码-光盘号：1357-0 （试 炼 码）

—————————————————————————————————

* Possible StringData Ref from Data Obj ->"您的激活验证号码:"

|

:004FC648 BA90C74F00 mov edx, 004FC790

:004FC64D E8267AF0FF call 00404078

:004FC652 8B55F4 mov edx, dword ptr [ebp-0C]

:004FC655 8B83E8020000 mov eax, dword ptr [ebx+000002E8]

:004FC65B E87873F3FF call 004339D8

:004FC660 33C0 xor eax, eax

:004FC662 55 push ebp

:004FC663 6829C74F00 push 004FC729

:004FC668 64FF30 push dword ptr fs:[eax]

:004FC66B 648920 mov dword ptr fs:[eax], esp

:004FC66E 8BC3 mov eax, ebx

:004FC670 8B10 mov edx, dword ptr [eax]

:004FC672 FF92D8000000 call dword ptr [edx+000000D8]

:004FC678 48 dec eax

:004FC679 7559 jne 004FC6D4

:004FC67B 8D55EC lea edx, dword ptr [ebp-14]

:004FC67E 8B83D4020000 mov eax, dword ptr [ebx+000002D4]

:004FC684 E81F73F3FF call 004339A8

:004FC689 8B45EC mov eax, dword ptr [ebp-14]

:004FC68C E8FFFAFFFF call 004FC190

:004FC691 84C0 test al, al

:004FC693 740E je 004FC6A3

:004FC695 8D55FC lea edx, dword ptr [ebp-04]

:004FC698 8B83D4020000 mov eax, dword ptr [ebx+000002D4]

:004FC69E E80573F3FF call 004339A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004FC693(C)

|

:004FC6A3 8D55E8 lea edx, dword ptr [ebp-18]

:004FC6A6 8B83D8020000 mov eax, dword ptr [ebx+000002D8]

:004FC6AC E8F772F3FF call 004339A8

:004FC6B1 8B45E8 mov eax, dword ptr [ebp-18]

:004FC6B4 E8D7FAFFFF call 004FC190

:004FC6B9 84C0 test al, al

:004FC6BB 740E je 004FC6CB

:004FC6BD 8D55F8 lea edx, dword ptr [ebp-08]

:004FC6C0 8B83D8020000 mov eax, dword ptr [ebx+000002D8]

:004FC6C6 E8DD72F3FF call 004339A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004FC6BB(C)

|

:004FC6CB 8BC3 mov eax, ebx

:004FC6CD E8762CF5FF call 0044F348

:004FC6D2 EB13 jmp 004FC6E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004FC679(C)

|

:004FC6D4 A120EB4F00 mov eax, dword ptr [004FEB20]

:004FC6D9 8B00 mov eax, dword ptr [eax]

:004FC6DB E8AC63F5FF call 00452A8C

:004FC6E0 8BC3 mov eax, ebx

:004FC6E2 E8612CF5FF call 0044F348

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004FC6D2(U)

|

:004FC6E7 8B55F8 mov edx, dword ptr [ebp-08]

====>EDX=0 光盘号

:004FC6EA 8B45FC mov eax, dword ptr [ebp-04]

====>EAX=1357 激活代码

:004FC6ED E8BEFBFFFF call 004FC2B0

====>关键CALL！进入！

:004FC6F2 84C0 test al, al

:004FC6F4 7424 je 004FC71A

====>跳则OVER！

:004FC6F6 B89CFA4F00 mov eax, 004FFA9C

:004FC6FB 8B55FC mov edx, dword ptr [ebp-04]

:004FC6FE E8FD76F0FF call 00403E00

:004FC703 B8A0FA4F00 mov eax, 004FFAA0

:004FC708 8B55F8 mov edx, dword ptr [ebp-08]

:004FC70B E8F076F0FF call 00403E00

:004FC710 33C0 xor eax, eax

:004FC712 5A pop edx

:004FC713 59 pop ecx

:004FC714 59 pop ecx

:004FC715 648910 mov dword ptr fs:[eax], edx

:004FC718 EB1E jmp 004FC738

====>呵呵，跳向胜利！

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004FC6F4(C)

|

:004FC71A E885000000 call 004FC7A4

:004FC71F 33C0 xor eax, eax

:004FC721 5A pop edx

:004FC722 59 pop ecx

:004FC723 59 pop ecx

:004FC724 648910 mov dword ptr fs:[eax], edx

:004FC727 EB0F jmp 004FC738

:004FC729 E9C26DF0FF jmp 004034F0

:004FC72E E871000000 call 004FC7A4

* Referenced by a CALL at Addresses:

|:004FC71A , :004FC72E

|

:004FC7A4 6A10 push 00000010

:004FC7A6 68C4C74F00 push 004FC7C4

* Possible StringData Ref from Data Obj ->"对不起, 此软件已被锁定!"

====>BAD BOY！

:004FC7AB 68CCC74F00 push 004FC7CC

—————————————————————————————————

F8进入算法CALL：4FC6ED call 004FC2B0

* Referenced by a CALL at Addresses:

|:004FC5B2 , :004FC6ED

|

:004FC2B0 55 push ebp

:004FC2B1 8BEC mov ebp, esp

:004FC2B3 83C4F0 add esp, FFFFFFF0

:004FC2B6 53 push ebx

:004FC2B7 56 push esi

:004FC2B8 33C9 xor ecx, ecx

:004FC2BA 894DF4 mov dword ptr [ebp-0C], ecx

:004FC2BD 894DF0 mov dword ptr [ebp-10], ecx

:004FC2C0 8955F8 mov dword ptr [ebp-08], edx

:004FC2C3 8945FC mov dword ptr [ebp-04], eax

:004FC2C6 8B45FC mov eax, dword ptr [ebp-04]

:004FC2C9 E8127FF0FF call 004041E0

:004FC2CE 8B45F8 mov eax, dword ptr [ebp-08]

:004FC2D1 E80A7FF0FF call 004041E0

:004FC2D6 33C0 xor eax, eax

:004FC2D8 55 push ebp

:004FC2D9 6857C34F00 push 004FC357

:004FC2DE 64FF30 push dword ptr fs:[eax]

:004FC2E1 648920 mov dword ptr fs:[eax], esp

:004FC2E4 8B45FC mov eax, dword ptr [ebp-04]

:004FC2E7 E884DAF0FF call 00409D70

====>把1357转化16进制值

:004FC2EC 8BC8 mov ecx, eax

1、 ====>EAX=54D（H）=1357（D）

:004FC2EE 8BC1 mov eax, ecx

:004FC2F0 2DBF020000 sub eax, 000002BF

2、 ====>EAX=54D-2BF=28E

:004FC2F5 B903000000 mov ecx, 00000003

====>3 入 ECX

:004FC2FA 99 cdq

:004FC2FB F7F9 idiv ecx

3、 ====>EAX=54D/3=DA

:004FC2FD 8BD8 mov ebx, eax

====>EBX=EAX=DA

:004FC2FF 81EB87000000 sub ebx, 00000087

4、 ====>EBX=DA-87=53

:004FC305 D1FB sar ebx, 1

5、 ====>EBX=53 右移1位=29

:004FC307 7903 jns 004FC30C

:004FC309 83D300 adc ebx, 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004FC307(C)

|

:004FC30C 8B45F8 mov eax, dword ptr [ebp-08]

====>0入EAX，即光盘号

:004FC30F E85CDAF0FF call 00409D70

====>转化成16进制值

:004FC314 8BF0 mov esi, eax

====>ESX=EAX=0

:004FC316 8D55F4 lea edx, dword ptr [ebp-0C]

:004FC319 8BC3 mov eax, ebx

====>EAX=EBX=29

:004FC31B 2BC6 sub eax, esi

6、 ====>EBX=29-0=29

即上面对输入的1357运算后得出的29减去光盘号的16进制值！

:004FC31D E8AED9F0FF call 00409CD0

====>把29转化成10进制值：41

:004FC322 8B45F4 mov eax, dword ptr [ebp-0C]

====>EAX=41

:004FC325 50 push eax

:004FC326 8D45F0 lea eax, dword ptr [ebp-10]

:004FC329 E80AFFFFFF call 004FC238

:004FC32E 8B55F0 mov edx, dword ptr [ebp-10]

====>EDX=21291120 即：我的激活验证代码

:004FC331 58 pop eax

:004FC332 E8057EF0FF call 0040413C

====>比较CALL！进入！

:004FC337 0F94C0 sete al

====>设置标志位！

:004FC33A 8BD8 mov ebx, eax

:004FC33C 33C0 xor eax, eax

:004FC33E 5A pop edx

:004FC33F 59 pop ecx

:004FC340 59 pop ecx

:004FC341 648910 mov dword ptr fs:[eax], edx

:004FC344 685EC34F00 push 004FC35E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004FC35C(U)

|

:004FC349 8D45F0 lea eax, dword ptr [ebp-10]

:004FC34C BA04000000 mov edx, 00000004

:004FC351 E87A7AF0FF call 00403DD0

:004FC356 C3 ret

—————————————————————————————————

F8进入比较CALL：4FC332 call 0040413C

* Referenced by a CALL at Addresses:

|:00413C97 , :00418AAB , :00419F4B , :0041F3DD , :00420728

…… …… 省略 …… ……

:0040413C 53 push ebx

:0040413D 56 push esi

:0040413E 57 push edi

:0040413F 89C6 mov esi, eax

:00404141 89D7 mov edi, edx

:00404143 39D0 cmp eax, edx

====>EAX=41

====>EDX=21291120

上面运算的最后结果与激活验证代码比较，相同则OK！

:00404145 0F848F000000 je 004041DA

:0040414B 85F6 test esi, esi

:0040414D 7468 je 004041B7

:0040414F 85FF test edi, edi

:00404151 746B je 004041BE

:00404153 8B46FC mov eax, dword ptr [esi-04]

:00404156 8B57FC mov edx, dword ptr [edi-04]

:00404159 29D0 sub eax, edx

:0040415B 7702 ja 0040415F

—————————————————————————————————

【算 法 总 结】：

算法不复杂，简单求逆即可算出相应的注册码。

设：激活验证代码为S、激活代码为K1、光盘号为K2、对K1运算的结果为KK

1、 KK-K2 = S 成功的条件！

我把K2固定为0（呵呵，省点事），所以KK-0=144E070（H）=21291120（D）

2、逆反第5步的右移1位：144E070*2=289C0E0

3、逆反第4步：289C0E0+87=289C167

4、逆反第3步：289C167*3=79D4435

5、逆反第2步：79D4435+2BF=79D46F4

6、逆反第1步：79D46F4的10进制值=127747828

呵呵，至此，求出我的激活代码 K1=127747828

—————————————————————————————————

【注册信息保存】：

REGEDIT4

[HKEY_CURRENT_USER\Software\GHOStar\Main]

"F1"="127747828"

"F2"="0"

—————————————————————————————————

【整 理】：

激活验证代码 ：21291120

激活代码-光盘号：127747828-0

—————————————————————————————————

Cracked By 巢水工作坊——fly【OCN】

19:50 03-3-7

（出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net