老文章档案 · 2003 年

SuperCleaner算法分析----菜鸟级 (12千字)

赢政天下 [WINZHENG.COM] · 网络学院 · 2003-07-29 · 作者：wolflh2002 人气： · 出处：赢政天下整理收藏）

软件名称：SuperCleaner

最新版本：2.42

文件大小：276KB

软件简介：

是帮助用户清洗他们的计算机硬盘内不必要的文件的程序。它能扫描你的系统让你选择不再需要的文件进行删除。并能备份文件已避免你误删除有用的文件，此备份功能将不必要的文件扔进再循环箱，这样可以让你再必要的时候恢复信息。

下载地址:http://gwbn.onlinedown.net/down/cleansetup.exe

软件信息:VC,无壳,30天使用限制.保护简单,明码比较.最适合我等菜鸟了

破解工具llyDbg,pw32dasmgold(在此篇破文中只用它来抓代码)

破解者:wolflh2002

破解过程:

以前在看雪老师的论坛上发表过一次,并有幸被看雪老师收入精华.但那次是在WIN98下,用TRW(我喜欢用这个工具了)可以很容易的跟出,注册码是用明码比较,且没有分析出算法.这次因为机器升级了,摒弃了WIN98.而WIN2K下TRW的"万能断点"(HMEMCPY)无用.所以只好借助OllyDbg了.

根据各种教程、破文的教导,用w32dasm反汇编.可找来找去,也找不着注册成功的标志;出错的信息倒有一个,不过多次双击却有多个结果,而我这个菜鸟也看不出哪一个对我有用的.

破罐子破摔了,用OllyDbg载入RUN,选择"Enter Registration"项,出现注册对话框.输入

用户名:wolflh2002

注册码:5378378(当然是假的,有真的我还用这么辛苦?)

回到OllyDbg界面,按CTRL+N或单击鼠标右键选择"Search for"->"Name(label) in current module"

.按明码比较的惯例选择"KERNEL32.lstrcmpA",回车.在第一项(00402005)上按F2设置断点.再回到注册界面,点击"OK".YEAH,被OllyDbg断下了.

* Possible Reference to Dialog: DialogID_0065, CONTROL_ID:03FC, ""

:00411DD3 68FC030000 push 000003FC

:00411DD8 56 push esi

:00411DD9 FFD7 call edi

:00411DDB 8D442408 lea eax, dword ptr [esp+08]

:00411DDF 8D8C2408010000 lea ecx, dword ptr [esp+00000108]

:00411DE6 50 push eax ----压入假注册码

:00411DE7 51 push ecx ----压入真用户名crazywolf(这就是用英文的好处,不然寄存器不可能显示中文的)

:00411DE8 E8B3050000 call 004123A0 ----停在这里,可疑!!!F7进入(在OllyDbg里相当于TRW的F8)

:00411DED 83C408 add esp, 00000008

:00411DF0 85C0 test eax, eax

:00411DF2 5F pop edi

:00411DF3 7443 je 00411E38 -----这里弹出出错对话框

:00411DF5 8D542404 lea edx, dword ptr [esp+04]

:00411DF9 8D842404010000 lea eax, dword ptr [esp+00000104]

:00411E00 52 push edx

:00411E01 50 push eax

(此处略去XXXXX个字节)

进入此CALL后:

* Referenced by a CALL at Addresses:

|:00411DE8 , :004122CE

:004123A0 81EC00010000 sub esp, 00000100

:004123A6 A080964200 mov al, byte ptr [00429680]

:004123AB 56 push esi

:004123AC 57 push edi

:004123AD 88442408 mov byte ptr [esp+08], al

* Possible Reference to String Resource ID=00063: "The location you specified does not contain a Netscape 4 pro"

:004123B1 B93F000000 mov ecx, 0000003F

:004123B6 33C0 xor eax, eax

:004123B8 8D7C2409 lea edi, dword ptr [esp+09]

:004123BC 8B94240C010000 mov edx, dword ptr [esp+0000010C]

:004123C3 F3 repz

:004123C4 AB stosd

:004123C5 66AB stosw

:004123C7 8D4C2408 lea ecx, dword ptr [esp+08]

:004123CB 33F6 xor esi, esi

:004123CD 51 push ecx

:004123CE 52 push edx

:004123CF AA stosb

:004123D0 E8AB000000 call 00412480 ----过了这里就出现我们所需要的注册码了.(虽然我不懂算法,进入看看总可以吧??)

:004123D5 8B8C2418010000 mov ecx, dword ptr [esp+00000118]

:004123DC 8D442410 lea eax, dword ptr [esp+10]

:004123E0 50 push eax ----真码

:004123E1 51 push ecx ----假码

:004123E2 E869FFFFFF call 00412350

:004123E7 83C410 add esp, 00000010

:004123EA 85C0 test eax, eax

* Possible Reference to String Resource ID=00001: "Registered to: %s"

:004123EC B801000000 mov eax, 00000001

:004123F1 7502 jne 004123F5

:004123F3 8BC6 mov eax, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004123F1(C)

:004123F5 5F pop edi

:004123F6 5E pop esi

:004123F7 81C400010000 add esp, 00000100

:004123FD C3 ret

(继续略去XXXXX个字节)

.以下是完整的算法过程:

:00412480 81EC00010000 sub esp, 00000100

:00412486 A080964200 mov al, byte ptr [00429680]

:0041248B 53 push ebx

:0041248C 55 push ebp

:0041248D 56 push esi

:0041248E 57 push edi

:0041248F 88442410 mov byte ptr [esp+10], al

* Possible Reference to String Resource ID=00063: "The location you specified does not contain a Netscape 4 pro"

:00412493 B93F000000 mov ecx, 0000003F

:00412498 33C0 xor eax, eax

:0041249A 8D7C2411 lea edi, dword ptr [esp+11]

:0041249E F3 repz

:0041249F AB stosd

:004124A0 66AB stosw

:004124A2 AA stosb

:004124A3 8BBC2414010000 mov edi, dword ptr [esp+00000114] ----用户名送edi

:004124AA 57 push edi ----压入用户名

* Reference To: KERNEL32.lstrlenA, Ord:03AEh

:004124AB FF1538024200 Call dword ptr [00420238] ----计算用户名长度

:004124B1 8BF0 mov esi, eax ----用户名长度送esi

:004124B3 33C9 xor ecx, ecx ----ecx清零

:004124B5 33C0 xor eax, eax ----eax清零

:004124B7 85F6 test esi, esi

:004124B9 7E13 jle 004124CE

:004124BB 8B1508664200 mov edx, dword ptr [00426608] ----注册名送入edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004124CC(C)

:004124C1 0FBE1C38 movsx ebx, byte ptr [eax+edi] ----依次将用户名字节转换为ascii送ebx

:004124C5 03DA add ebx, edx ----ebx+edx的值送ebx (edx=26)

:004124C7 03CB add ecx, ebx ----ecx+ebx的值送ecx

:004124C9 40 inc eax ----eax加1

:004124CA 3BC6 cmp eax, esi ----是否计算完毕

:004124CC 7CF3 jl 004124C1 ----循环

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004124B9(C)

:004124CE 8B9C2418010000 mov ebx, dword ptr [esp+00000118] ----显示注册码的第一部分(这里是我自己猜的)

:004124D5 51 push ecx ----压入累加的值(十六进制)

* Possible StringData Ref from Data Obj ->"%ld-" ----加入分隔符"-"

:004124D6 681C664200 push 0042661C

:004124DB 53 push ebx

* Reference To: USER32.wsprintfA, Ord:02D6h

:004124DC FF1520034200 Call dword ptr [00420320]

:004124E2 83C40C add esp, 0000000C

:004124E5 33C9 xor ecx, ecx

:004124E7 33C0 xor eax, eax

:004124E9 85F6 test esi, esi

:004124EB 7E14 jle 00412501

:004124ED 8B150C664200 mov edx, dword ptr [0042660C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004124FF(C)

:004124F3 0FBE2C38 movsx ebp, byte ptr [eax+edi] ----依次将用户名字节转换为ascii送ebp

:004124F7 0FAFEA imul ebp, edx ----ebp*edx的值送ebp (edx=34)

:004124FA 03CD add ecx, ebp ----ecx+ebp的值送ecx

:004124FC 40 inc eax ----eax加1

:004124FD 3BC6 cmp eax, esi ----是否计算完毕

:004124FF 7CF2 jl 004124F3 ----循环

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004124EB(C)

:00412501 51 push ecx

:00412502 8D4C2414 lea ecx, dword ptr [esp+14]

* Possible StringData Ref from Data Obj ->"%ld-" ----加入分隔符"-"

:00412506 681C664200 push 0042661C

:0041250B 51 push ecx

* Reference To: USER32.wsprintfA, Ord:02D6h

:0041250C FF1520034200 Call dword ptr [00420320]

:00412512 83C40C add esp, 0000000C

:00412515 8D542410 lea edx, dword ptr [esp+10]

:00412519 52 push edx

:0041251A 53 push ebx

* Reference To: KERNEL32.lstrcatA, Ord:039Fh

:0041251B FF1520024200 Call dword ptr [00420220]

:00412521 33C9 xor ecx, ecx

:00412523 33C0 xor eax, eax

:00412525 85F6 test esi, esi

:00412527 7E13 jle 0041253C

:00412529 8B1510664200 mov edx, dword ptr [00426610]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0041253A(C)

:0041252F 0FBE2C38 movsx ebp, byte ptr [eax+edi] ----依次将用户名字节转换为ascii送

:00412533 03EA add ebp, edx ----ebp+edx的值送ebp (edx=0C)

:00412535 03CD add ecx, ebp ----ecx+ebp的值送ecx

:00412537 40 inc eax ----eax加1

:00412538 3BC6 cmp eax, esi ----是否计算完毕

:0041253A 7CF3 jl 0041252F ----循环

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00412527(C)

:0041253C 51 push ecx

:0041253D 8D442414 lea eax, dword ptr [esp+14]

* Possible StringData Ref from Data Obj ->"%ld-" ----加入分隔符"-"

:00412541 681C664200 push 0042661C

:00412546 50 push eax

* Reference To: USER32.wsprintfA, Ord:02D6h

:00412547 FF1520034200 Call dword ptr [00420320]

:0041254D 83C40C add esp, 0000000C

:00412550 8D4C2410 lea ecx, dword ptr [esp+10]

:00412554 51 push ecx

:00412555 53 push ebx

* Reference To: KERNEL32.lstrcatA, Ord:039Fh

:00412556 FF1520024200 Call dword ptr [00420220]

:0041255C 33C9 xor ecx, ecx

:0041255E 33C0 xor eax, eax

:00412560 85F6 test esi, esi

:00412562 7E14 jle 00412578

:00412564 8B1514664200 mov edx, dword ptr [00426614]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00412576(C)

:0041256A 0FBE2C38 movsx ebp, byte ptr [eax+edi]

:0041256E 0FAFEA imul ebp, edx ----ebp*edx的值送ebp (edx=0E)

:00412571 03CD add ecx, ebp ----ecx+ebp的值送ecx

:00412573 40 inc eax ----eax加1

:00412574 3BC6 cmp eax, esi ----是否计算完毕

:00412576 7CF2 jl 0041256A ----循环

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00412562(C)

:00412578 51 push ecx

:00412579 8D542414 lea edx, dword ptr [esp+14]

* Possible StringData Ref from Data Obj ->"%ld" ----加入分隔符"-"

:0041257D 6818664200 push 00426618

:00412582 52 push edx

* Reference To: USER32.wsprintfA, Ord:02D6h

:00412583 FF1520034200 Call dword ptr [00420320]

:00412589 83C40C add esp, 0000000C

:0041258C 8D442410 lea eax, dword ptr [esp+10]

:00412590 50 push eax

:00412591 53 push ebx

* Reference To: KERNEL32.lstrcatA, Ord:039Fh

:00412592 FF1520024200 Call dword ptr [00420220]

:00412598 5F pop edi

:00412599 5E pop esi

:0041259A 5D pop ebp

:0041259B 5B pop ebx

:0041259C 81C400010000 add esp, 00000100

:004125A2 C3 ret

恕我刚加入"风飘雪",汇编知识不太丰富,所以大部分算法都是自己乱猜的.分析如有错误,欢迎指出.

#############################################################################################################################

因为对OllyDbg的使用还不熟悉,所以在对选择"KERNEL32.lstrcmpA"时使用了鼠标双击命令(没有使用回车),致使无法弹出"References in 'xxsoftwarename'"界面.一厢情愿的认为该命令无效,而采取了另外一种断点:

"Search for"->"All referenced text strings"查找出错提示信息,找不到!!!!(吐血)

从弹出出错的对话框入手,CTRL+N选择"USER32.GetDlgItemTextA",回车,选择最后一项(00411DAE)F2设断.因为总共有三项,估计前两项是检查是否输入用户名和注册码用的,所以不设.

* Reference To: USER32.GetDlgItemTextA, Ord:0113h

:00411DAE 8B3D9C024200 mov edi, dword ptr [0042029C] ----停在此处

:00411DB4 8D8C2408010000 lea ecx, dword ptr [esp+00000108]

:00411DBB 6800010000 push 00000100

:00411DC0 51 push ecx

* Possible Reference to Dialog: DialogID_0065, CONTROL_ID:0417, ""

:00411DC1 6817040000 push 00000417

:00411DC6 56 push esi

:00411DC7 FFD7 call edi

:00411DC9 8D542408 lea edx, dword ptr [esp+08]

:00411DCD 6800010000 push 00000100

:00411DD2 52 push edx

* Possible Reference to Dialog: DialogID_0065, CONTROL_ID:03FC, ""

:00411DD3 68FC030000 push 000003FC

:00411DD8 56 push esi

:00411DD9 FFD7 call edi

:00411DDB 8D442408 lea eax, dword ptr [esp+08] ----假注册码

:00411DDF 8D8C2408010000 lea ecx, dword ptr [esp+00000108] ----真用户名(呵呵)

:00411DE6 50 push eax ----压入假注册码

:00411DE7 51 push ecx ----压入用户名

:00411DE8 E8B3050000 call 004123A0 ----所以这里可疑F7进入,剩下的分析同上

:00411DED 83C408 add esp, 00000008

:00411DF0 85C0 test eax, eax

:00411DF2 5F pop edi

:00411DF3 7443 je 00411E38

:00411DF5 8D542404 lea edx, dword ptr [esp+04]

:00411DF9 8D842404010000 lea eax, dword ptr [esp+00000104]

:00411E00 52 push edx

:00411E01 50 push eax

总结:算法分析:

注册码算法由四个部分组成:

第一部分算法:依次取用户名各字节的ascii码,转换成十六进制,然后和26(十六进制)乘以用户名长度(十六进制)的积相加

(A1+A2+An)+(26*用户名长度),再转换为十进制.

第二部分算法:依次取用户名各字节的ascii码,转换成十六进制,相加之后的和乘以34(十六进制)

(A1+A2+An)*34

第三部分算法:依次取用户名各字节的ascii码,转换成十六进制,然后和0C(十六进制)乘以用户名长度(十六进制)的积相加

(A1+A2+An)+(0C*用户名长度),再转换为十进制.

第四部分算法:依次取用户名各字节的ascii码,转换成十六进制,相加之后的和乘以0E(十六进制)

(A1+A2+An)*0E

将四个部分的注册码使用分隔符"-"连接

将这个软件翻来覆去搞了一个下午.

突然发现用英文名注册才会出现以上破文所写的注册码,

但是中文却需要添加两个分隔符"--",而且注册码的首个字节也是"-"

黔驴技穷了!

这是我第一次写算法分析,每个算法部分都是靠多次使用OllyDbg演练猜测得出的结果,遗憾的是只能适合英文用户名注册.

后记:使用了OllyDbg,越发感觉它的强大和方便易用.真希望风飘雪老师能多写几篇OllyDbg的教程.

（出处：赢政天下整理收藏）

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

同类老文章：网络学院

主题专题：网络学院：当年的电脑教程 →

档案性质声明：本页为赢政天下（1998-2011）老文章的历史档案复原，内容反映当年发表时的原貌——包括当年的技术表述、软件版本与观点，部分方法在今天已不适用或不合规，仅作互联网历史记录与研究用途， 不提供任何形式的下载。原始数据经由公共网络存档（Internet Archive）复原。发现问题请联系我们。

← 返回老文章档案 · 软件史档案馆 · 赢政天下站史