sitman2.01算法分析

软件保护介绍：该软件注册码有两个计算的地址，属于重起效验性。并且只有重起时的注册码算法是正确

的。注册成功后注册码写在注册表中，并且在config.ini中也有标记。

【第一步】

§输入用户名：powerboy

§输入注册码：987654321

§下断点：BPX HMEMCPY

§在算法中你会发现注册码必须为18为和前三位注册码是根据用户名算出的，并且必须都为小写或数字；

§先在注册码输入时用r fl z强行使其注册成功。

§（就是在:00491594 0F8420010000 je 004916BA用啦）

【第二步】

§先重起

§下断点：BPX RegQueryvalueExa DO "D*(esp+8)"不知为什么总是停在api32.TEXT531处不能拦截到软件

§所以下：Bpx GetPrivateProfileStringA拦截到后。

§按F10数百次（看来不会下断点真是不行啊！！！！！）

§如何判断呢（常用D呀，当内存中出现用户名时就要注意有没有比较跳转什么的啦^_^）

到达下面后

:004A3D08 BE01000000 mov esi, 00000001----------------ESI=1

:004A3D0D A174664A00 mov eax, dword ptr [004A6674]----EAX=[4A6674]

:004A3D12 8B00 mov eax, dword ptr [eax]---------EAX=SN

:004A3D14 E88701F6FF call 00403EA0--------------------

:004A3D19 8BC8 mov ecx, eax---------------------ECX=EAX

:004A3D1B 85C9 test ecx, ecx--------------------

:004A3D1D 7E29 jle 004A3D48---------------------

:004A3D1F BB01000000 mov ebx, 00000001----------------EBX=1(小计数)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004A3D46(C)

| 前3位通用小循环

:004A3D24 A174664A00 mov eax, dword ptr [004A6674]-----------------------|

:004A3D29 8B00 mov eax, dword ptr [eax] |

:004A3D2B 0FB64418FF movzx eax, byte ptr [eax+ebx-01]--EAX=NAME(n) |

:004A3D30 F7EE imul esi--------------------------EAX=EAX*ESI |

:004A3D32 03055C7C4A00 add eax, dword ptr [004A7C5C]-----EAX=EAX+大计数 |

:004A3D38 03C3 add eax, ebx----------------------EAX=EAX+EBX |

:004A3D3A BE65010000 mov esi, 00000165-----------------ESI=&H165 |

:004A3D3F 99 cdq |

:004A3D40 F7FE idiv esi--------------------------EAX=EAX / ESI |

:004A3D42 8BF2 mov esi, edx----------------------ESI=EDX=EAX % ESI |

:004A3D44 43 inc ebx---------------------------EBX=EBX+1 |

:004A3D45 49 dec ecx---------------------------ECX=ECX-1 |

:004A3D46 75DC jne 004A3D24----------------------------------------|

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004A3D1D(C)

|

:004A3D48 8BC6 mov eax, esi----------------------EAX=ESI

:004A3D4A B924000000 mov ecx, 00000024-----------------ECX=&H24

:004A3D4F 99 cdq

:004A3D50 F7F9 idiv ecx--------------------------EAX=EAX/ECX

EDX=EAX％ECX

* Possible StringData Ref from Code Obj ->"0123456789abcdefghijklmnopqrstuvwxyz"

| 把EDX的值作为指针查表

:004A3D52 B840434A00 mov eax, 004A4340-----------------EAX=表

:004A3D57 8A0410 mov al, byte ptr [eax+edx]--------AL=正确的注册码

:004A3D5A 8B15A4634A00 mov edx, dword ptr [004A63A4]

:004A3D60 8B12 mov edx, dword ptr [edx]

:004A3D62 8B0D5C7C4A00 mov ecx, dword ptr [004A7C5C]

:004A3D68 3A440AFF cmp al, byte ptr [edx+ecx-01]-----|比较正确的注册码和

:004A3D6C 7408 je 004A3D76-----------------------|取出的注册码相等则跳

:004A3D6E A16C664A00 mov eax, dword ptr [004A666C]

:004A3D73 C60001 mov byte ptr [eax], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004A3D6C(C)

|

:004A3D76 FF055C7C4A00 inc dword ptr [004A7C5C]----------计数＋1

:004A3D7C 833D5C7C4A0004 cmp dword ptr [004A7C5C], 00000004比较是否等于4

:004A3D83 7583 jne 004A3D08----------------------不等则循环

前3位注册码大循环

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－

:004A3D85 33C0 xor eax, eax

:004A3D87 55 push ebp

:004A3D88 68B53D4A00 push 004A3DB5

:004A3D8D 64FF30 push dword ptr fs:[eax]

:004A3D90 648920 mov dword ptr fs:[eax], esp

:004A3D93 8B0D7C674A00 mov ecx, dword ptr [004A677C]

:004A3D99 A188664A00 mov eax, dword ptr [004A6688]

:004A3D9E 8B00 mov eax, dword ptr [eax]

* Possible StringData Ref from Code Obj ->"HtC"

|

:004A3DA0 8B1530CC4800 mov edx, dword ptr [0048CC30]

:004A3DA6 E84DB3FAFF call 0044F0F8

:004A3DAB 33C0 xor eax, eax

:004A3DAD 5A pop edx

:004A3DAE 59 pop ecx

:004A3DAF 59 pop ecx

:004A3DB0 648910 mov dword ptr fs:[eax], edx

:004A3DB3 EB52 jmp 004A3E07

:004A3DB5 E94AF6F5FF jmp 00403404

:004A3DBA A138674A00 mov eax, dword ptr [004A6738]

:004A3DBF 803800 cmp byte ptr [eax], 00

:004A3DC2 741A je 004A3DDE

:004A3DC4 6A00 push 00000000

* Possible StringData Ref from Code Obj ->"您可能没有安装 RealPlayer"

|

:004A3DC6 B968434A00 mov ecx, 004A4368

* Possible StringData Ref from Code Obj ->"本程序需要媒体播放软件RealPlayer的支持 "

->"！

您可能没有安装，因此本程序无法运行。

详细"

->"说明请参见附带的帮助文件"

|

:004A3DCB BA84434A00 mov edx, 004A4384

:004A3DD0 A188664A00 mov eax, dword ptr [004A6688]

:004A3DD5 8B00 mov eax, dword ptr [eax]

:004A3DD7 E8F4B4FAFF call 0044F2D0

:004A3DDC EB18 jmp 004A3DF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004A3DC2(C)

|

:004A3DDE 6A00 push 00000000

* Possible StringData Ref from Code Obj ->"Perhaps you have not RealPlayer "

->"installed !"

|

:004A3DE0 B9F4434A00 mov ecx, 004A43F4

* Possible StringData Ref from Code Obj ->"This software can't run without "

->"RealPlayer installed !

Click "

->"OK to exit.

Get more infomation "

->"from the HELP file !"

|

:004A3DE5 BA20444A00 mov edx, 004A4420

:004A3DEA A188664A00 mov eax, dword ptr [004A6688]

:004A3DEF 8B00 mov eax, dword ptr [eax]

:004A3DF1 E8DAB4FAFF call 0044F2D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004A3DDC(U)

|

:004A3DF6 A188664A00 mov eax, dword ptr [004A6688]

:004A3DFB 8B00 mov eax, dword ptr [eax]

:004A3DFD E82AB4FAFF call 0044F22C

:004A3E02 E859F9F5FF call 00403760

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004A3DB3(U)

|

:004A3E07 A1DC664A00 mov eax, dword ptr [004A66DC]

:004A3E0C 803800 cmp byte ptr [eax], 00

:004A3E0F 0F8481000000 je 004A3E96

:004A3E15 A16C664A00 mov eax, dword ptr [004A666C]

:004A3E1A 803800 cmp byte ptr [eax], 00

:004A3E1D 7577 jne 004A3E96

:004A3E1F 8D45CC lea eax, dword ptr [ebp-34]

:004A3E22 50 push eax

:004A3E23 A1A4634A00 mov eax, dword ptr [004A63A4]

:004A3E28 8B00 mov eax, dword ptr [eax]

:004A3E2A B909000000 mov ecx, 00000009

:004A3E2F BA04000000 mov edx, 00000004

:004A3E34 E8ABE6FEFF call 004924E4

:004A3E39 8B55CC mov edx, dword ptr [ebp-34]

:004A3E3C B8607C4A00 mov eax, 004A7C60

:004A3E41 E82EFEF5FF call 00403C74

:004A3E46 33C0 xor eax, eax

:004A3E48 55 push ebp

:004A3E49 686A3E4A00 push 004A3E6A

:004A3E4E 64FF30 push dword ptr fs:[eax]

:004A3E51 648920 mov dword ptr fs:[eax], esp

:004A3E54 A1607C4A00 mov eax, dword ptr [004A7C60]

:004A3E59 E8964FF6FF call 00408DF4

:004A3E5E 8BD8 mov ebx, eax

:004A3E60 33C0 xor eax, eax

:004A3E62 5A pop edx

:004A3E63 59 pop ecx

:004A3E64 59 pop ecx

:004A3E65 648910 mov dword ptr fs:[eax], edx

:004A3E68 EB15 jmp 004A3E7F

:004A3E6A E995F5F5FF jmp 00403404

:004A3E6F 83CBFF or ebx, FFFFFFFF

:004A3E72 A16C664A00 mov eax, dword ptr [004A666C]

:004A3E77 C60001 mov byte ptr [eax], 01

:004A3E7A E8E1F8F5FF call 00403760

判断4～9位是否位100000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004A3E68(U)

|

:004A3E7F 8BC3 mov eax, ebx-----------------EAX=EBX（4～9位注册码）

:004A3E81 B9E8030000 mov ecx, 000003E8------------ECX=&H3E8

:004A3E86 99 cdq

:004A3E87 F7F9 idiv ecx---------------------EAX=EAX/ECX

:004A3E89 83F864 cmp eax, 00000064------------比较EAX是否等于&H64

:004A3E8C 7408 je 004A3E96------------------相等则跳

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－

根据前9位计算后9位注册码

:004A3E96 E8912CFFFF call 00496B2C----------------关键CALL

:004A3E9B A158634A00 mov eax, dword ptr [004A6358]

:004A3EA0 803800 cmp byte ptr [eax], 00-------比较位是否为0

:004A3EA3 0F85A4000000 jne 004A3F4D-----------------不等则跳

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－

F8进入关键CALL后按F10数次到达下面..........

:00497205 C745FC0A000000 mov [ebp-04], 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00497266(C)

|

:0049720C BB01000000 mov ebx, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00497232(C)

|

:00497211 A1A4634A00 mov eax, dword ptr [004A63A4]－－－－－|

:00497216 8B00 mov eax, dword ptr [eax]

:00497218 0FB64418FF movzx eax, byte ptr [eax+ebx-01]----EAX=SN1～9(n)

:0049721D F7E9 imul ecx----------------------------EAX=EAX*ECX

:0049721F 03C3 add eax, ebx------------------------EAX=EAX+EBX

:00497221 0345FC add eax, dword ptr [ebp-04]---------EAX=EAX+大计数

:00497224 B979010000 mov ecx, 00000179-------------------ECX=&H179

:00497229 99 cdq

:0049722A F7F9 idiv ecx----------------------------EAX=EAX/ECX

:0049722C 8BCA mov ecx, edx------------------------ECX=EDX=EAX%ECX

:0049722E 43 inc ebx-----------------------------EBX=EBX+1(小计数)

:0049722F 83FB0A cmp ebx, 0000000A-------------------比较EBX是否为&HA |

:00497232 75DD jne 00497211------------------------不等则跳(小循环) |

:00497234 8BC1 mov eax, ecx------------------------EAX=ECX

:00497236 BB24000000 mov ebx, 00000024-------------------EBX=&H24

:0049723B 99 cdq

:0049723C F7FB idiv ebx----------------------------EAX=EAX/EBX

EDX=EAX%EBX

* Possible StringData Ref from Code Obj ->"0123456789abcdefghijklmnopqrstuvwxyz"

| 把EDX的值作为指针查表

:0049723E B83C7E4900 mov eax, 00497E3C-------------------EAX=表

:00497243 8A0410 mov al, byte ptr [eax+edx]----------AL为正确的注册码

:00497246 8B15A4634A00 mov edx, dword ptr [004A63A4]-------输入的注册码

:0049724C 8B12 mov edx, dword ptr [edx]

:0049724E 8B5DFC mov ebx, dword ptr [ebp-04]

:00497251 3A441AFF cmp al, byte ptr [edx+ebx-01]-------AL与SN(n)n＝9～18比较

:00497255 7408 je 0049725F-------------------------相等则跳

:00497257 A16C664A00 mov eax, dword ptr [004A666C]

:0049725C C60001 mov byte ptr [eax], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00497255(C)

|

:0049725F FF45FC inc [ebp-04]------------------------计数＋1

:00497262 837DFC13 cmp dword ptr [ebp-04], 00000013----比较计数是否等于&H13

:00497266 75A4 jne 0049720C------------------------不等则跳

后9位大循环

整理：用户名为：powerboy

注册码为：bac100000ka49fmp6i

分析：注册码的计算分为3步

1. (算出前3位的注册码)

ECX=8(用户名个数)

ESI=1(中间量初值为1)

EBX=1(小循环计数)

EAX=ASC(NAME)每次取得1位用户名的ASCII值

EAX=EAX*ESI

EAX=EAX+

EAX=EAX+EBX

ESI=&H165

EDX=EAX MOD ESI

ESI=EDX

EBX=EBX+1

ECX=ECX-1

经过8次循环算出一个ESI值；

EAX=ESI

ECX=&H24

EDX=EAX MOD ECX

以EDX的值作为表"0123456789abcdefghijklmnopqrstuvwxyz"的指针进行查表；

循环3次算出前3位注册码

2.(判断注册码的4～9是否是100000)

EBX="100000"

ECX=&H3E8

EBX=EBX/ECX

判断EBX是否等于&H64

根据前2步的计算可得出前9位的注册码为SN1=***100000

3.(根据前9位的注册码算出后9位的注册码)

ECX=1(为中间量初值为1)

EBX=1(小计数)

[EBP-04]=&HA(大计数初值为10)

EAX=ASC(SN1)每次取得1位SN1中的ASCII值

EAX=EAX*ECX

EAX=EAX+EBX

EAX=EAX+[EBP-04]

ECX=&H179

EDX=EAX MOD ECX

ECX=EDX

EBX=EBX+1

比较EBX是否等于&HA

共循环9次算出一个ECX值

EAX=ECX

EBX=&H24

EDX=EAX MOD EBX

把EDX的值作为表"0123456789abcdefghijklmnopqrstuvwxyz"的指针进行查表。

（出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net