再来一篇算法分析,eryl兄弟你要的东西!! (15千字)

===================Open Cracking Group========================

=

= 邮件先知 v2.5.2.50注册算法分析

=

= ssljx/OCG

= http://www.newclw.com/lllufh/cgi-bin/leoboard.cgi

=

===================Open Cracking Group========================

* Possible StringData Ref from Code Obj ->"SOFTWARE\Microsoft\tpcip\CurrentVersion"

\\\\\\\\\\读取注册表的键名///////////////

//////////////////////////读取注册表的过程\\\\\\\\\\\\\\\\\\\\\

|

:004C25CE 6848294C00 push 004C2948

:004C25D3 6802000080 push 80000002

* Reference To: advapi32.RegCreateKeyExA, Ord:0000h

|

:004C25D8 E85F4DF4FF Call 0040733C

:004C25DD 85C0 test eax, eax

:004C25DF 7548 jne 004C2629

:004C25E1 8D45FC lea eax, dword ptr [ebp-04]

:004C25E4 50 push eax

* Possible StringData Ref from Code Obj ->"PPPPP"

|

:004C25E5 B978294C00 mov ecx, 004C2978

* Possible StringData Ref from Code Obj ->"Rotescode"=========>注册表的注册名

|

:004C25EA BA88294C00 mov edx, 004C2988

:004C25EF 8B45F0 mov eax, dword ptr [ebp-10]

:004C25F2 E8C182FCFF call 0048A8B8

:004C25F7 8D45F8 lea eax, dword ptr [ebp-08]

:004C25FA 50 push eax

* Possible StringData Ref from Code Obj ->"H012123"

|

:004C25FB B99C294C00 mov ecx, 004C299C

* Possible StringData Ref from Code Obj ->"RotesNum"==========>注册表的用户编号

|

:004C2600 BAAC294C00 mov edx, 004C29AC

:004C2605 8B45F0 mov eax, dword ptr [ebp-10]

:004C2608 E8AB82FCFF call 0048A8B8

:004C260D 8D45F4 lea eax, dword ptr [ebp-0C]

:004C2610 50 push eax

:004C2611 33C9 xor ecx, ecx

* Possible StringData Ref from Code Obj ->"Object"===========>注册表的注册码

|

:004C2613 BAC0294C00 mov edx, 004C29C0

:004C2618 8B45F0 mov eax, dword ptr [ebp-10]

:004C261B E89882FCFF call 0048A8B8

:004C2620 8B45F0 mov eax, dword ptr [ebp-10]

:004C2623 50 push eax

* Reference To: advapi32.RegCloseKey, Ord:0000h

|

:004C2624 E80B4DF4FF Call 00407334

////////////////////////////////读去注册表过程结束\\\\\\\\\\\\\\\\\\\\\\\\\\\

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004C25DF(C)

|

:004C2629 8B45F8 mov eax, dword ptr [ebp-08]

* Possible StringData Ref from Code Obj ->"AHF000186"

|

:004C262C BAD0294C00 mov edx, 004C29D0

:004C2631 E83E28F4FF call 00404E74========>用户编号与'AHF000186'比较

:004C2636 7516 jne 004C264E=========>一定要不等,转向!!

:004C2638 8D55D8 lea edx, dword ptr [ebp-28]

:004C263B 8B45F8 mov eax, dword ptr [ebp-08]

:004C263E E8196AF4FF call 0040905C

:004C2643 8B55D8 mov edx, dword ptr [ebp-28]

:004C2646 8D45F8 lea eax, dword ptr [ebp-08]

:004C2649 E8C224F4FF call 00404B10

\\\\\\\用户编号与'AHF000186'相等就把'AHF000186'转为小写字母,这样到后面判断就会出错\\\\\\\\\

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004C2636(C)

|

:004C264E A1D49F4C00 mov eax, dword ptr [004C9FD4]

:004C2653 833800 cmp dword ptr [eax], 00000000

:004C2656 7516 jne 004C266E

:004C2658 8BCF mov ecx, edi

:004C265A B201 mov dl, 01

* Possible StringData Ref from Code Obj ->"癿D"

|

:004C265C A1C0694B00 mov eax, dword ptr [004B69C0]

:004C2661 E87A5DF9FF call 004583E0

:004C2666 8B15D49F4C00 mov edx, dword ptr [004C9FD4]

:004C266C 8902 mov dword ptr [edx], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004C2656(C)

|

:004C266E 8D4DD4 lea ecx, dword ptr [ebp-2C]

:004C2671 8B55F8 mov edx, dword ptr [ebp-08]

:004C2674 8B45FC mov eax, dword ptr [ebp-04]

:004C2677 E80074FCFF call 00489A7C

:004C267C 8B45D4 mov eax, dword ptr [ebp-2C]=>根据注册名计算出来的注册码,怎么计算注册码都是零

:004C267F 8B55F4 mov edx, dword ptr [ebp-0C]=>输入的注册码,只要输入0就行

:004C2682 E8ED27F4FF call 00404E74===============>比较

:004C2687 740C je 004C2695=================>要等,转到下面比较

:004C2689 C605BC9E4C0001 mov byte ptr [004C9EBC], 01==>不等,给标志赋值,1表示失败

:004C2690 E9E6000000 jmp 004C277B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004C2687(C)

|

:004C2695 C605BC9E4C0000 mov byte ptr [004C9EBC], 00==>注册码相同,标志为赋值0,0表示成功

:004C269C 837DF800 cmp dword ptr [ebp-08], 00000000===>用户编号是空的,直接结束比较

:004C26A0 0F84D5000000 je 004C277B

//////////用户编号不是空值,进行下面比较\\\\\\\\\\\\\\\\\\\\\

:004C26A6 8B45F8 mov eax, dword ptr [ebp-08]

:004C26A9 8A00 mov al, byte ptr [eax]====>用户编号第一位(N1)

:004C26AB 04BF add al, BF===============>这里控制要大于'A'

:004C26AD 2C1A sub al, 1A===============>这里控制要小于'Z'

:004C26AF 731E jnb 004C26CF=============>不再A-Z范围就出错

//////////////用户编号第一位要在A-Z范围,$1A-$BF=$5B注意这是字节运算,下面简单说说这算法\\\\\\

我们先了解jnb的转向条件是CF=0,那么CF受什么影响,CF==>进位标志,在进行字/字节运算产生进位或借位是置1,这是我以前的书上讲的,不知现在有没改变..

举例:

当AL=$40时,CF=0

AL=$40+$BF=$FF CF=0(没变)

AL=$FF-$1A=$E6 CF=0(没变)

所以jnb 004C26CF合乎转向条件,跳转出错!!

当AL=$5B,CF=0

AL=$5B+$BF=$11A CF=1(改变)

AL=$11A-$1A=100 CF=0(改变)

这样jnb 004C26CF合乎转向条件,跳转出错!!

当AL=$41, CF=0

AL=$41+$BF=101 CF=1(改变)

AL=$101-$1A=$E6 CF=1(没变)

这样jnb 004C26CF不合乎转向条件,继续比较!!

/////////////////下面的比较同理就不罗嗦了!!!\\\\\\\\\\\\\\\\

:004C26B1 8B45F8 mov eax, dword ptr [ebp-08]

:004C26B4 8A4001 mov al, byte ptr [eax+01]

:004C26B7 04BF add al, BF

:004C26B9 2C0C sub al, 0C

:004C26BB 7312 jnb 004C26CF=======>第二位用户编号范围A-L

:004C26BD 8B45F8 mov eax, dword ptr [ebp-08]

:004C26C0 8A4002 mov al, byte ptr [eax+02]

:004C26C3 04BF add al, BF

:004C26C5 2C1A sub al, 1A

:004C26C7 722E jb 004C26F7=======>第三位用户编码在A-Z就转向,不再继续

:004C26C9 04FA add al, FA

:004C26CB 2C06 sub al, 06

:004C26CD 7228 jb 004C26F7======>第三位用户编码在a-f就转向

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:004C26AF(C), :004C26BB(C)

|

:004C26CF C605BC9E4C0001 mov byte ptr [004C9EBC], 01==>上面不通过设标志为1

:004C26D6 B804000000 mov eax, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004C26F5(C)

|

:004C26DB 8B55F8 mov edx, dword ptr [ebp-08]

:004C26DE 8A5402FF mov dl, byte ptr [edx+eax-01]

:004C26E2 80C2D0 add dl, D0

:004C26E5 80EA0A sub dl, 0A

:004C26E8 7207 jb 004C26F1

:004C26EA C605BC9E4C0001 mov byte ptr [004C9EBC], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004C26E8(C)

|

:004C26F1 40 inc eax

:004C26F2 83F80A cmp eax, 0000000A

:004C26F5 75E4 jne 004C26DB

///////////上面是当用户编号前面三位不通过就进行比较后面是否全是数字,但这比较没用的\\\

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:004C26C7(C), :004C26CD(C)

|

:004C26F7 803DBC9E4C0000 cmp byte ptr [004C9EBC], 00======>比较标志是否0

:004C26FE 757B jne 004C277B=====================>不为0,OVER!!!!

:004C2700 A1D49F4C00 mov eax, dword ptr [004C9FD4]

:004C2705 8B00 mov eax, dword ptr [eax]

:004C2707 8B8020030000 mov eax, dword ptr [eax+00000320]

:004C270D 8B55FC mov edx, dword ptr [ebp-04]

:004C2710 E8E7D3F7FF call 0043FAFC

:004C2715 A1D49F4C00 mov eax, dword ptr [004C9FD4]

:004C271A 8B00 mov eax, dword ptr [eax]

:004C271C 8B8028030000 mov eax, dword ptr [eax+00000328]

:004C2722 8B55F8 mov edx, dword ptr [ebp-08]

:004C2725 E8D2D3F7FF call 0043FAFC

:004C272A A1D49F4C00 mov eax, dword ptr [004C9FD4]

:004C272F 8B00 mov eax, dword ptr [eax]

:004C2731 8B8024030000 mov eax, dword ptr [eax+00000324]

:004C2737 8B55F4 mov edx, dword ptr [ebp-0C]

:004C273A E8BDD3F7FF call 0043FAFC

:004C273F A1D49F4C00 mov eax, dword ptr [004C9FD4]

:004C2744 8B00 mov eax, dword ptr [eax]

:004C2746 8B8020030000 mov eax, dword ptr [eax+00000320]

:004C274C 33D2 xor edx, edx

:004C274E 8B08 mov ecx, dword ptr [eax]

:004C2750 FF5164 call [ecx+64]

:004C2753 A1D49F4C00 mov eax, dword ptr [004C9FD4]

:004C2758 8B00 mov eax, dword ptr [eax]

:004C275A 8B8028030000 mov eax, dword ptr [eax+00000328]

:004C2760 33D2 xor edx, edx

:004C2762 8B08 mov ecx, dword ptr [eax]

:004C2764 FF5164 call [ecx+64]

:004C2767 A1D49F4C00 mov eax, dword ptr [004C9FD4]

:004C276C 8B00 mov eax, dword ptr [eax]

:004C276E 8B8024030000 mov eax, dword ptr [eax+00000324]

:004C2774 33D2 xor edx, edx

:004C2776 8B08 mov ecx, dword ptr [eax]

:004C2778 FF5164 call [ecx+64]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:004C2690(U), :004C26A0(C), :004C26FE(C)

|

:004C277B 8D55C8 lea edx, dword ptr [ebp-38]

:004C277E A1F4A24C00 mov eax, dword ptr [004CA2F4]

:004C2783 8B00 mov eax, dword ptr [eax]

:004C2785 E8DED8F9FF call 00460068

:004C278A 8B45C8 mov eax, dword ptr [ebp-38]

:004C278D 8D55CC lea edx, dword ptr [ebp-34]

:004C2790 E8FB71FCFF call 00489990

:004C2795 8B4DCC mov ecx, dword ptr [ebp-34]

:004C2798 8D45D0 lea eax, dword ptr [ebp-30]

* Possible StringData Ref from Code Obj ->"当前版本号："

|

:004C279B BAE4294C00 mov edx, 004C29E4

:004C27A0 E8D725F4FF call 00404D7C

:004C27A5 8B55D0 mov edx, dword ptr [ebp-30]

:004C27A8 A1D49F4C00 mov eax, dword ptr [004C9FD4]

:004C27AD 8B00 mov eax, dword ptr [eax]

:004C27AF 8B801C030000 mov eax, dword ptr [eax+0000031C]

:004C27B5 E842D3F7FF call 0043FAFC

:004C27BA 33F6 xor esi, esi

:004C27BC 803DBC9E4C0000 cmp byte ptr [004C9EBC], 00=======>再次比较标志

:004C27C3 743A je 004C27FF=======================>这里要跳!!!

:004C27C5 A1D49F4C00 mov eax, dword ptr [004C9FD4]

:004C27CA 8B00 mov eax, dword ptr [eax]

:004C27CC 8B8018030000 mov eax, dword ptr [eax+00000318]

* Possible StringData Ref from Code Obj ->"本版为未注册试用版，部分功能只能在注册后才能使"

->"用！"

|

:004C27D2 BAFC294C00 mov edx, 004C29FC

:004C27D7 E820D3F7FF call 0043FAFC

:004C27DC 8D55C4 lea edx, dword ptr [ebp-3C]

:004C27DF 8BC7 mov eax, edi

:004C27E1 E8E6D2F7FF call 0043FACC

:004C27E6 8D45C4 lea eax, dword ptr [ebp-3C]

* Possible StringData Ref from Code Obj ->"[未注册功能限制版]"

|

:004C27E9 BA382A4C00 mov edx, 004C2A38

:004C27EE E84525F4FF call 00404D38

:004C27F3 8B55C4 mov edx, dword ptr [ebp-3C]

:004C27F6 8BC7 mov eax, edi

:004C27F8 E8FFD2F7FF call 0043FAFC

:004C27FD EB55 jmp 004C2854

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004C27C3(C)

|

:004C27FF A1D49F4C00 mov eax, dword ptr [004C9FD4]

:004C2804 8B00 mov eax, dword ptr [eax]

:004C2806 8B8018030000 mov eax, dword ptr [eax+00000318]

* Possible StringData Ref from Code Obj ->"恭喜您成为完全版的荣誉注册用户！"

|

:004C280C BA542A4C00 mov edx, 004C2A54

:004C2811 E8E6D2F7FF call 0043FAFC

:004C2816 8D55BC lea edx, dword ptr [ebp-44]

:004C2819 8BC7 mov eax, edi

:004C281B E8ACD2F7FF call 0043FACC

:004C2820 FF75BC push [ebp-44]

* Possible StringData Ref from Code Obj ->" [荣誉注册用户："

|

:004C2823 68802A4C00 push 004C2A80

:004C2828 FF75FC push [ebp-04]

:004C282B 689C2A4C00 push 004C2A9C

:004C2830 8D45C0 lea eax, dword ptr [ebp-40]

:004C2833 BA04000000 mov edx, 00000004

:004C2838 E8B325F4FF call 00404DF0

:004C283D 8B55C0 mov edx, dword ptr [ebp-40]

:004C2840 8BC7 mov eax, edi

:004C2842 E8B5D2F7FF call 0043FAFC

:004C2847 33DB xor ebx, ebx

:004C2849 8B8734030000 mov eax, dword ptr [edi+00000334]

:004C284F E8A0D7F7FF call 0043FFF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004C27FD(U)

|

:004C2854 84DB test bl, bl

:004C2856 7413 je 004C286B

:004C2858 6A00 push 00000000

* Possible StringData Ref from Code Obj ->"提示！"

|

:004C285A 68A02A4C00 push 004C2AA0

* Possible StringData Ref from Code Obj ->"本软件的试用版只能使用15次!

如果您对试用结果满"

->"意，可以向我们注册。

注册信息请访问“帮助”菜?

->"サ摹白⒉帷弊酉?注册费用为12元。"

|

:004C285F 68A82A4C00 push 004C2AA8

:004C2864 6A00 push 00000000

* Reference To: user32.MessageBoxA, Ord:0000h

|

:004C2866 E8B153F4FF Call 00407C1C

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\END\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

总结:

1.注册名是任意

2.注册码永远是0

3.用户编号有两种情况

A.用户编号可以空值

B.用户编号第一位在:A-Z范围

用户编号第二位在:A-L范围

用户编号第三位在:A-L或a-f范围

还有用户编号一定不能为'AHF000186'

注册表:

"SOFTWARE\Microsoft\tpcip\CurrentVersion"

怎么还要写注册机..不用吧...哈哈...

===================Open Cracking Group========================

=

= 邮件先知 v2.5.2.50注册算法分析

=

= ssljx/OCG

= http://www.newclw.com/lllufh/cgi-bin/leoboard.cgi

=

===================Open Cracking Group======================== （出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net