豪杰大眼睛（II）注册码分析（算法与XXXX3000英雄版基本一样，哈哈） (15千字)

这几天比较无聊，找了个豪杰大眼睛II，发现它的注册的算法基本与豪杰II3000英雄版的算法很相似，第一组的注册码是一样的，从第二组开始的变化稍有不同，以下是它的算法的分析过程。

* Reference To: USER32.GetWindowTextA, Ord:015Eh

|

:00401CCA 8B35F8604000 mov esi, dword ptr [004060F8]

:00401CD0 8D442404 lea eax, dword ptr [esp+04]

:00401CD4 6A08 push 00000008

:00401CD6 50 push eax

:00401CD7 51 push ecx

:00401CD8 FFD6 call esi

:00401CDA A128984000 mov eax, dword ptr [00409828]

:00401CDF 8D542409 lea edx, dword ptr [esp+09]

:00401CE3 6A08 push 00000008

:00401CE5 52 push edx

:00401CE6 50 push eax

:00401CE7 FFD6 call esi

:00401CE9 8B1534984000 mov edx, dword ptr [00409834]

:00401CEF 8D4C240E lea ecx, dword ptr [esp+0E]

:00401CF3 6A08 push 00000008

:00401CF5 51 push ecx

:00401CF6 52 push edx

:00401CF7 FFD6 call esi

:00401CF9 8B0D30984000 mov ecx, dword ptr [00409830]

:00401CFF 8D442413 lea eax, dword ptr [esp+13]

:00401D03 6A08 push 00000008

:00401D05 50 push eax

:00401D06 51 push ecx

:00401D07 FFD6 call esi

:00401D09 8B1524984000 mov edx, dword ptr [00409824]

:00401D0F 6800010000 push 00000100

:00401D14 B02D mov al, 2D

:00401D16 6860994000 push 00409960

:00401D1B 52 push edx

:00401D1C 8844241E mov byte ptr [esp+1E], al

:00401D20 88442419 mov byte ptr [esp+19], al

:00401D24 88442414 mov byte ptr [esp+14], al

:00401D28 C644242300 mov [esp+23], 00

:00401D2D FFD6 call esi

:00401D2F 8D442404 lea eax, dword ptr [esp+04]

:00401D33 50 push eax

:00401D34 6860994000 push 00409960 <----经过动态跟踪，发现409960处存放的是输入的用户名

:00401D39 E842090000 call 00402680 <----进行注册码比较的关键CALL,要用F8跟入

:00401D3E F7D8 neg eax <---- 如果返回值为0,则注册失败

:00401D40 1BC0 sbb eax, eax

:00401D42 8D4C2404 lea ecx, dword ptr [esp+04]

:00401D46 F7D8 neg eax

:00401D48 51 push ecx

:00401D49 6860994000 push 00409960

:00401D4E A3689A4000 mov dword ptr [00409A68], eax<----将EAX的值写入[409A68]

:00401D53 E838000000 call 00401D90 <----此CALL将用户名与注册码写入注册表

:00401D58 8B442450 mov eax, dword ptr [esp+50]

:00401D5C 8B0D44994000 mov ecx, dword ptr [00409944]

:00401D62 83C408 add esp, 00000008

:00401D65 8D542404 lea edx, dword ptr [esp+04]

:00401D69 52 push edx

:00401D6A 68201C4000 push 00401C20

:00401D6F 50 push eax

* Possible Reference to Dialog: DialogID_0069

|

:00401D70 6A69 push 00000069

:00401D72 51 push ecx

* Reference To: USER32.DialogBoxParamA, Ord:0093h

|

:00401D73 FF15E8604000 Call dword ptr [004060E8]<----如果[409A68]为0，显示注册失败，为1时显示注册成功

:00401D79 A1689A4000 mov eax, dword ptr [00409A68]

:00401D7E 5E pop esi

:00401D7F 83C440 add esp, 00000040

:00401D82 C3 ret

---------------------按F8进入注册码比较的关键CALL----------------------

:00402680 83EC20 sub esp, 00000020

:00402683 56 push esi

:00402684 57 push edi

:00402685 B908000000 mov ecx, 00000008

:0040268A 33C0 xor eax, eax

:0040268C 8D7C2408 lea edi, dword ptr [esp+08]<----存放第一组注册码的地址，以下记为reg1

:00402690 F3 repz

:00402691 AB stosd

:00402692 8B44242C mov eax, dword ptr [esp+2C]

:00402696 50 push eax<----将用户名作为参数，压栈。

:00402697 E8A4010000 call 00402840 <----此CALL将用户名进入变换后，变为一个DWORD类型，从EAX中返回,它内部的算法与XXXX3000英雄版完全相同，这里不再详细说明，可以参考XXXX3000英雄版的分析

:0040269C 83C404 add esp, 00000004

:0040269F 89442408 mov dword ptr [esp+08], eax 将返回值存入reg1

:004026A3 33F6 xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004026C8(C)

|

:004026A5 0FBE443408 movsx eax, byte ptr [esp+esi+08] 取出reg1中的一个字节。（共4字节）

:004026AA 83F841 cmp eax, 00000041

:004026AD 7C08 jl 004026B7

:004026AF 83F85A cmp eax, 0000005A

:004026B2 7F03 jg 004026B7

:004026B4 83C020 add eax, 00000020 <----这里是将大写的变为小写

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:004026AD(C), :004026B2(C)

|

:004026B7 50 push eax

:004026B8 E853020000 call 00402910 <----此CALL将取出的值转换为一个字符。

:004026BD 83C404 add esp, 00000004

:004026C0 88443408 mov byte ptr [esp+esi+08], al <----将变换后的值再存入。

:004026C4 46 inc esi

:004026C5 83FE04 cmp esi, 00000004 <---四个字节是否处理完

:004026C8 7CDB jl 004026A5

:004026CA 8B7C2430 mov edi, dword ptr [esp+30]

:004026CE 8D4C2408 lea ecx, dword ptr [esp+08]

:004026D2 8BF7 mov esi, edi

:004026D4 33D2 xor edx, edx

:004026D6 2BF1 sub esi, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004026FC(C)

|

:004026D8 8D4C1408 lea ecx, dword ptr [esp+edx+08]

:004026DC 0FBE040E movsx eax, byte ptr [esi+ecx]<----取出我们输入的第一组注册码的1个字节。

:004026E0 83F841 cmp eax, 00000041

:004026E3 7C08 jl 004026ED

:004026E5 83F85A cmp eax, 0000005A

:004026E8 7F03 jg 004026ED

:004026EA 83C020 add eax, 00000020 <----如果是大写则转为小写

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:004026E3(C), :004026E8(C)

|

:004026ED 0FBE09 movsx ecx, byte ptr [ecx]<----取出真正注册码的1位

:004026F0 3BC1 cmp eax, ecx <----比较

:004026F2 0F8514010000 jne 0040280C

:004026F8 42 inc edx

:004026F9 83FA04 cmp edx, 00000004 <----第一组注册码共4位是否比较完毕。

:004026FC 7CDA jl 004026D8

:004026FE 8B442408 mov eax, dword ptr [esp+08]

:00402702 8D5008 lea edx, dword ptr [eax+08] 将reg1的值加上8后，作为第2组注册码

:00402705 0FAFD0 imul edx, eax

:00402708 8954240C mov dword ptr [esp+0C], edx<----此地址记为reg2 = (reg1+8)*reg1

:0040270C 33F6 xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0040272F(C)

|

:0040270E 8A44340C mov al, byte ptr [esp+esi+0C]<----取出第2组中的一个字节

:00402712 50 push eax

:00402713 56 push esi

:00402714 E807010000 call 00402820<----先进行一次变换

:00402719 25FF000000 and eax, 000000FF

:0040271E 50 push eax

:0040271F E8EC010000 call 00402910 <----将变换后的值再转变为字符形式

:00402724 83C40C add esp, 0000000C

:00402727 8844340C mov byte ptr [esp+esi+0C], al

:0040272B 46 inc esi

:0040272C 83FE04 cmp esi, 00000004 <----是否处理完4个字符

:0040272F 7CDD jl 0040270E

:00402731 33C9 xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00402756(C)

|

:00402733 0FBE440F05 movsx eax, byte ptr [edi+ecx+05]<----这里开始取出第2组进行比较

:00402738 83F841 cmp eax, 00000041

:0040273B 7C08 jl 00402745

:0040273D 83F85A cmp eax, 0000005A

:00402740 7F03 jg 00402745

:00402742 83C020 add eax, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:0040273B(C), :00402740(C)

|

:00402745 0FBE540C0C movsx edx, byte ptr [esp+ecx+0C]

:0040274A 3BC2 cmp eax, edx<----比较注册码

:0040274C 0F85BA000000 jne 0040280C

:00402752 41 inc ecx

:00402753 83F904 cmp ecx, 00000004

:00402756 7CDB jl 00402733

:00402758 8B44240C mov eax, dword ptr [esp+0C]

:0040275C 8B4C2408 mov ecx, dword ptr [esp+08]

:00402760 8BD0 mov edx, eax

:00402762 33D1 xor edx, ecx

:00402764 42 inc edx

:00402765 0FAFD1 imul edx, ecx

:00402768 03D0 add edx, eax

:0040276A 33F6 xor esi, esi

:0040276C 89542410 mov dword ptr [esp+10], edx<----第三组注册码 reg3 = reg2 +((reg1 ^ reg2)+1)*reg1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00402786(C)

|

:00402770 0FBE443410 movsx eax, byte ptr [esp+esi+10]

:00402775 50 push eax

:00402776 E895010000 call 00402910<----将第三组转变为字符形式的注册码

:0040277B 83C404 add esp, 00000004

:0040277E 88443410 mov byte ptr [esp+esi+10], al

:00402782 46 inc esi

:00402783 83FE04 cmp esi, 00000004<---4个字节是否都完成了

:00402786 7CE8 jl 00402770

:00402788 33C9 xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004027A9(C)

|

:0040278A 0FBE440F0A movsx eax, byte ptr [edi+ecx+0A]<----这里开始比较第3组注册码

:0040278F 83F841 cmp eax, 00000041

:00402792 7C08 jl 0040279C

:00402794 83F85A cmp eax, 0000005A

:00402797 7F03 jg 0040279C

:00402799 83C020 add eax, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00402792(C), :00402797(C)

|

:0040279C 0FBE540C10 movsx edx, byte ptr [esp+ecx+10]

:004027A1 3BC2 cmp eax, edx<----比较注册码

:004027A3 7567 jne 0040280C

:004027A5 41 inc ecx

:004027A6 83F904 cmp ecx, 00000004

:004027A9 7CDF jl 0040278A

:004027AB 8B4C240C mov ecx, dword ptr [esp+0C]

:004027AF 8B442408 mov eax, dword ptr [esp+08]

:004027B3 0FAFC8 imul ecx, eax

:004027B6 41 inc ecx

:004027B7 0FAF4C2410 imul ecx, dword ptr [esp+10]

:004027BC 03C8 add ecx, eax

:004027BE 33F6 xor esi, esi

:004027C0 894C2414 mov dword ptr [esp+14], ecx<----第四组注册码reg4 = reg1 +((reg2 * reg1)+1)*reg3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004027DA(C)

|

:004027C4 0FBE543414 movsx edx, byte ptr [esp+esi+14]

:004027C9 52 push edx

:004027CA E841010000 call 00402910<----将第4组转变化字符形式的注册码

:004027CF 83C404 add esp, 00000004

:004027D2 88443414 mov byte ptr [esp+esi+14], al

:004027D6 46 inc esi

:004027D7 83FE04 cmp esi, 00000004

:004027DA 7CE8 jl 004027C4

:004027DC 33C9 xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004027FD(C)

|

:004027DE 0FBE440F0F movsx eax, byte ptr [edi+ecx+0F]<----这里开始比较第4组注册码

:004027E3 83F841 cmp eax, 00000041

:004027E6 7C08 jl 004027F0

:004027E8 83F85A cmp eax, 0000005A

:004027EB 7F03 jg 004027F0

:004027ED 83C020 add eax, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:004027E6(C), :004027EB(C)

|

:004027F0 0FBE540C14 movsx edx, byte ptr [esp+ecx+14]

:004027F5 3BC2 cmp eax, edx<----比较注册码

:004027F7 7513 jne 0040280C

:004027F9 41 inc ecx

:004027FA 83F904 cmp ecx, 00000004

:004027FD 7CDF jl 004027DE

:004027FF 5F pop edi

* Possible Reference to String Resource ID=00001: "Register Success"

|

:00402800 B801000000 mov eax, 00000001

:00402805 5E pop esi

:00402806 83C420 add esp, 00000020

:00402809 C20800 ret 0008

----------------此CALL是将EAX的值转化为一个字符形式--------------

* Referenced by a CALL at Addresses:

|:004026B8 , :0040271F , :00402776 , :004027CA

|

:00402910 8B442404 mov eax, dword ptr [esp+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00402932(U), :00402943(U), :0040295E(U)

|

:00402914 83E07F and eax, 0000007F<---取低7位的值

:00402917 83F841 cmp eax, 00000041

:0040291A 7C07 jl 00402923

:0040291C 83F85A cmp eax, 0000005A

:0040291F 7F02 jg 00402923

:00402921 0C20 or al, 20<----如果是大写字母，则转为小写

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:0040291A(C), :0040291F(C)

|

:00402923 83F86F cmp eax, 0000006F<----如果是字母'o'，不要它

:00402926 750C jne 00402934

:00402928 B890000000 mov eax, 00000090

:0040292D 83F00E xor eax, 0000000E

:00402930 0C31 or al, 31

:00402932 EBE0 jmp 00402914

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00402926(C)

|

:00402934 83F830 cmp eax, 00000030<----如果是字母'0'，也不要它

:00402937 750C jne 00402945

:00402939 B8CF000000 mov eax, 000000CF

:0040293E 83F00E xor eax, 0000000E

:00402941 0C31 or al, 31

:00402943 EBCF jmp 00402914

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00402937(C)

|

:00402945 83F861 cmp eax, 00000061 <----如果已经是小写字母了，则返回

:00402948 7C05 jl 0040294F

:0040294A 83F87A cmp eax, 0000007A

:0040294D 7E11 jle 00402960

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00402948(C)

|

:0040294F 83F831 cmp eax, 00000031<---如果已经是数学了，则返回

:00402952 7C05 jl 00402959

:00402954 83F839 cmp eax, 00000039

:00402957 7E07 jle 00402960

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00402952(C)

|

:00402959 83F00E xor eax, 0000000E<----继续变化

:0040295C 0C31 or al, 31

:0040295E EBB4 jmp 00402914

-----------------------------------------------------------

注册机的代码与XXXX3000英雄版基本相同，只需要修改以下几处即可：

reg2 = (reg1+8)*reg1

reg3 = reg2 +((reg1 ^ reg2)+1)*reg1

reg4 = reg1 +((reg2 * reg1)+1)*reg3 （出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net