easyclean 清理工具1.5算法分析

Crack by simonyan

注册名： simonyan

注册码： CFC0-C3C1-D7C7-DDC0

此为重启校验的，注册码在注册表内，如运行脱壳程序，则注册码在脱壳程序的项内。

下断点bpx regqueryvalueexa do "d *(esp+8)"

看见userID停下，进入程序跟踪。

到下面地方可看见算法。

算法如下：

:0040C735 8A0C28 mov cl, byte ptr [eax+ebp] EBP中为注册名

:0040C738 884C0410 mov byte ptr [esp+eax+10], cl

:0040C73C 40 inc eax

:0040C73D 83F808 cmp eax, 00000008

:0040C740 7CF3 jl 0040C735 （上面只是个检查注册名长度的动作，小于8就无效）

:0040C742 83FB08 cmp ebx, 00000008

:0040C745 7E24 jle 0040C76B （如长度小于等于8跳转）

:0040C747 BE08000000 mov esi, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0040C769(C)

|

:0040C74C 8BC6 mov eax, esi

:0040C74E 2507000080 and eax, 80000007

:0040C753 7905 jns 0040C75A

:0040C755 48 dec eax

:0040C756 83C8F8 or eax, FFFFFFF8

:0040C759 40 inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0040C753(C)

|

:0040C75A 8A1428 mov dl, byte ptr [eax+ebp]

:0040C75D 8A0C2E mov cl, byte ptr [esi+ebp]

:0040C760 32CA xor cl, dl

:0040C762 46 inc esi

:0040C763 3BF3 cmp esi, ebx

:0040C765 884C0410 mov byte ptr [esp+eax+10], cl

:0040C769 7CE1 jl 0040C74C (上面为大于8的处理，就是第一位和第9位，第二和第10位异或，类推)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0040C745(C)

|

:0040C76B 33C0 xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0040C786(C)

|

:0040C76D 8B4C045C mov ecx, dword ptr [esp+eax+5C] (EBP+5c中值依次为6,7,2,3,5,1,0,4)

:0040C771 83C004 add eax, 00000004

:0040C774 0FBE4C0C10 movsx ecx, byte ptr [esp+ecx+10]

:0040C779 81F1AE000000 xor ecx, 000000AE

:0040C77F 83F820 cmp eax, 00000020 （每次加4，共有8组）

:0040C782 894C0418 mov dword ptr [esp+eax+18], ecx

:0040C786 7CE5 jl 0040C76D

:0040C788 8B1564564500 mov edx, dword ptr [00455664]

:0040C78E 89542410 mov dword ptr [esp+10], edx

:0040C792 8B442438 mov eax, dword ptr [esp+38]

:0040C796 8B4C2434 mov ecx, dword ptr [esp+34]

:0040C79A 8B542430 mov edx, dword ptr [esp+30]

:0040C79E 50 push eax

:0040C79F 8B442430 mov eax, dword ptr [esp+30]

:0040C7A3 51 push ecx

:0040C7A4 8B4C2430 mov ecx, dword ptr [esp+30]

:0040C7A8 52 push edx

:0040C7A9 8B542430 mov edx, dword ptr [esp+30]

:0040C7AD 50 push eax

:0040C7AE 8B442430 mov eax, dword ptr [esp+30]

:0040C7B2 51 push ecx

:0040C7B3 8B4C2430 mov ecx, dword ptr [esp+30]

:0040C7B7 52 push edx

:0040C7B8 50 push eax

:0040C7B9 51 push ecx

:0040C7BA 8D542430 lea edx, dword ptr [esp+30]

* Possible StringData Ref from Data Obj ->"%02X%02X-%02X%02X-%02X%02X-%02X%02X" （注册码格式)

|

:0040C7BE 685C444500 push 0045445C

:0040C7C3 52 push edx

:0040C7C4 C784248C08000000000000 mov dword ptr [esp+0000088C], 00000000

:0040C7CF E8AE020200 call 0042CA82 (将前面所得值转为此格式就OK了)

:0040C7D4 8BB42498080000 mov esi, dword ptr [esp+00000898] （这里可以看见注册码明码了）

:0040C7DB 8B06 mov eax, dword ptr [esi]

:0040C7DD 50 push eax

:0040C7DE 8B44243C mov eax, dword ptr [esp+3C]

:0040C7E2 50 push eax

:0040C7E3 E859320100 call 0041FA41 （这里开始比较，不等就未注册了）

:0040C7E8 83C430 add esp, 00000030

:0040C7EB 85C0 test eax, eax

:0040C7ED 753E jne 0040C82D

:0040C7EF 8B8C246C080000 mov ecx, dword ptr [esp+0000086C]

有空再写注册机吧。

（出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net