影音卫士2003全能版的破戒 算法分析

工具：oll/ w32dasm

下载地址：URL

http://www.skycn.com/download.php?id=7581&url=http://gdhttp.skycn.net/down/MgxpPro.exe

说明：

此软件的算法不难，就是在注册上有一些新的花样，若有注册成功的，请不要向外传播！！！

安装好软件后，你打开c:\windows\regmg.cfg 可看见：44604/%SQWRR#[[RTPO5".1TZ[

将/%SQWRR#[[RTPO5".1TZ[的每一位xor 62 得到MG13500Ap99062-Wyu@LS689

注意第一个的ASCI=12 第二个的ASCI=1B 第三个的ASCI=17

44604是 MG13500Ap99062-Wyu@LS689经过运算后得到的十进制数字

分析如下：

:0048FA8C 8D4C2418 lea ecx, dword ptr [esp+18] ecx=2448

:0048FA90 51 push ecx

:0048FA91 8D8E10060000 lea ecx, dword ptr [esi+00000610]

* Reference To: MFC42.Ordinal:0F22, Ord:0F22h

|

:0048FA97 E8F8D60000 Call 0049D194

:0048FA9C 8B542418 mov edx, dword ptr [esp+18] edx=2448MG13500Ap99062-Wyu@LS689

:0048FAA0 8B4C241C mov ecx, dword ptr [esp+1C] ecx=2448

:0048FAA4 8B42F8 mov eax, dword ptr [edx-08] eax=1C (注册码长度）

:0048FAA7 8B51F8 mov edx, dword ptr [ecx-08] EDX=4 （姓名长度）

:0048FAAA 3BC2 cmp eax, edx

:0048FAAC 7F0C jg 0048FABA

一定要跳转呀（注册码长度一定要大于姓名的长度）

:0048FAAE 8BCE mov ecx, esi

* Reference To: MFC42.Ordinal:12F5, Ord:12F5h

|

:0048FAB0 E859D80000 Call 0049D30E

:0048FAB5 E949070000 jmp 00490203

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048FAAC(C)

|

:0048FABA 8D4C2428 lea ecx, dword ptr [esp+28] （跳转到这里）

* Reference To: MFC42.Ordinal:021C, Ord:021Ch

|

:0048FABE E8D7D60000 Call 0049D19A

:0048FAC3 8D542418 lea edx, dword ptr [esp+18]

:0048FAC7 8D4C2428 lea ecx, dword ptr [esp+28]

:0048FACB 52 push edx

:0048FACC C68424A003010002 mov byte ptr [esp+000103A0], 02

* Reference To: MFC42.Ordinal:035A, Ord:035Ah

|

:0048FAD4 E811D80000 Call 0049D2EA

:0048FAD9 8B442418 mov eax, dword ptr [esp+18]

eax=2448MG13500Ap99062-Wyu@LS689

:0048FADD 8B4C241C mov ecx, dword ptr [esp+1C] ecx=2448

:0048FAE1 8D542414 lea edx, dword ptr [esp+14]

:0048FAE5 8B40F8 mov eax, dword ptr [eax-08] eax=1c

:0048FAE8 8B59F8 mov ebx, dword ptr [ecx-08] ebx=4

:0048FAEB 2BC3 sub eax, ebx eax=18

:0048FAED 8D4C2418 lea ecx, dword ptr [esp+18]

:0048FAF1 50 push eax

:0048FAF2 52 push edx

* Reference To: MFC42.Ordinal:164E, Ord:164Eh

|

:0048FAF3 E85ED80000 Call 0049D356

:0048FAF8 50 push eax

:0048FAF9 8D4C241C lea ecx, dword ptr [esp+1C]

:0048FAFD C68424A003010003 mov byte ptr [esp+000103A0], 03

* Reference To: MFC42.Ordinal:035A, Ord:035Ah

|

:0048FB05 E8E0D70000 Call 0049D2EA

:0048FB0A 8D4C2414 lea ecx, dword ptr [esp+14]

:0048FB0E C684249C03010002 mov byte ptr [esp+0001039C], 02

* Reference To: MFC42.Ordinal:0320, Ord:0320h

|

:0048FB16 E861D60000 Call 0049D17C

:0048FB1B 8B44241C mov eax, dword ptr [esp+1C]

:0048FB1F 8D4C2410 lea ecx, dword ptr [esp+10]

:0048FB23 8B40F8 mov eax, dword ptr [eax-08] eax=4

:0048FB26 50 push eax

:0048FB27 51 push ecx

:0048FB28 8D4C2430 lea ecx, dword ptr [esp+30]

* Reference To: MFC42.Ordinal:1021, Ord:1021h

|

:0048FB2C E8BFD70000 Call 0049D2F0

:0048FB31 8D54241C lea edx, dword ptr [esp+1C]

:0048FB35 C684249C03010004 mov byte ptr [esp+0001039C], 04

:0048FB3D 52 push edx

:0048FB3E 50 push eax

:0048FB3F 8D44241C lea eax, dword ptr [esp+1C]

:0048FB43 50 push eax

* Reference To: MFC42.Ordinal:039A, Ord:039Ah

|

:0048FB44 E89BDA0000 Call 0049D5E4

:0048FB49 50 push eax

:0048FB4A 8D4C242C lea ecx, dword ptr [esp+2C]

:0048FB4E C68424A003010005 mov byte ptr [esp+000103A0], 05

* Reference To: MFC42.Ordinal:035A, Ord:035Ah

|

:0048FB56 E88FD70000 Call 0049D2EA

:0048FB5B 8D4C2414 lea ecx, dword ptr [esp+14]

:0048FB5F C684249C03010004 mov byte ptr [esp+0001039C], 04

* Reference To: MFC42.Ordinal:0320, Ord:0320h

|

:0048FB67 E810D60000 Call 0049D17C

:0048FB6C 8D4C2410 lea ecx, dword ptr [esp+10]

:0048FB70 C684249C03010002 mov byte ptr [esp+0001039C], 02

* Reference To: MFC42.Ordinal:0320, Ord:0320h

|

:0048FB78 E8FFD50000 Call 0049D17C

:0048FB7D 8B4C2418 mov ecx, dword ptr [esp+18]

ecx=2448MG13500Ap99062-Wyu@LS689

:0048FB81 8D942494030000 lea edx, dword ptr [esp+00000394]

:0048FB88 51 push ecx

* Possible StringData Ref from Data Obj ->"%s"

|

:0048FB89 6808044C00 push 004C0408 004C0408 =%s

:0048FB8E 52 push edx

* Reference To: MSVCRT.sprintf, Ord:02B2h

|

:0048FB8F FF1574C84A00 Call dword ptr [004AC874]

:0048FB95 8A8424A0030000 mov al, byte ptr [esp+000003A0]

:0048FB9C 83C40C add esp, 0000000C

:0048FB9F 33D2 xor edx, edx

:0048FBA1 84C0 test al, al

:0048FBA3 89542414 mov dword ptr [esp+14], edx

:0048FBA7 7418 je 0048FBC1

:0048FBA9 8D8C2494030000 lea ecx, dword ptr [esp+00000394]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048FBBB(C)

|

:0048FBB0 0FBEC0 movsx eax, al

:0048FBB3 03D0 add edx, eax edx初始数字为0 edx=640

:0048FBB5 8A4101 mov al, byte ptr [ecx+01] （取MG13500Ap99062-Wyu@LS689的 每一位）

:0048FBB8 41 inc ecx

:0048FBB9 84C0 test al, al

:0048FBBB 75F3 jne 0048FBB0 (取位完了确认）

:0048FBBD 89542414 mov dword ptr [esp+14], edx edx=640 [esp+14]=640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048FBA7(C)

|

:0048FBC1 8B4C2418 mov ecx, dword ptr [esp+18] ecx=MG13500Ap99062-Wyu@LS689

:0048FBC5 33FF xor edi, edi edi=0

:0048FBC7 8B41F8 mov eax, dword ptr [ecx-08]

eax=18 (MG13500Ap99062-Wyu@LS689的长度）

:0048FBCA 99 cdq edx=0

:0048FBCB 2BC2 sub eax, edx eax=18

:0048FBCD D1F8 sar eax, 1 右移动一位 eax=c

:0048FBCF 8A1C08 mov bl, byte ptr [eax+ecx] 取ecx的第c位即 bl=(6)36

:0048FBD2 33C0 xor eax, eax eax=0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048FBEC(C)

|

:0048FBD4 8A8C0494030000 mov cl, byte ptr [esp+eax+00000394]

（ 对MG13500Ap99062-Wyu@LS689进行选择取）位

:0048FBDB 84C9 test cl, cl cl=M(4D)

:0048FBDD 740F je 0048FBEE (取位完了就跳转）

:0048FBDF 0FBEC9 movsx ecx, cl

:0048FBE2 83C002 add eax, 00000002 eax=eax+2 (即取位的原则是第0位，第二 位，第四位－－－－）

:0048FBE5 03F9 add edi, ecx edi=333

:0048FBE7 3DFFFF0000 cmp eax, 0000FFFF

:0048FBEC 7CE6 jl 0048FBD4 eax<ffff 继续循环

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048FBDD(C)

|

:0048FBEE D9ED fldln2 (沸点运行）

:0048FBF0 DB442414 fild dword ptr [esp+14] [esp+14]=640

:0048FBF4 D9F1 fyl2x

* Reference To: MSVCRT._ftol, Ord:00F1h

|

:0048FBF6 E8C5DE0000 Call 0049DAC0 eax=7

:0048FBFB 8BF0 mov esi, eax esi=7

:0048FBFD 8D4C2430 lea ecx, dword ptr [esp+30]

:0048FC01 0FBED3 movsx edx, bl bl=(6)36(看上面）edx=36

:0048FC04 03F7 add esi, edi

:0048FC06 0FAFF2 imul esi, edx esi=ae3c

* Reference To: MFC42.Ordinal:021C, Ord:021Ch

|

:0048FC09 E88CD50000 Call 0049D19A

:0048FC0E 56 push esi

:0048FC0F 8D442434 lea eax, dword ptr [esp+34]

* Possible StringData Ref from Data Obj ->"%ld"

|

:0048FC13 681C184C00 push 004C181C

:0048FC18 50 push eax

:0048FC19 C68424A803010006 mov byte ptr [esp+000103A8], 06

* Reference To: MFC42.Ordinal:0B02, Ord:0B02h

|

:0048FC21 E83AD60000 Call 0049D260 将esi=ae3c转换撑十进制＝44604

:0048FC26 83C40C add esp, 0000000C

:0048FC29 8D4C2418 lea ecx, dword ptr [esp+18]

:0048FC2D 51 push ecx

:0048FC2E 8D4C2430 lea ecx, dword ptr [esp+30]

* Reference To: MFC42.Ordinal:0217, Ord:0217h

|

:0048FC32 E8A7D60000 Call 0049D2DE

:0048FC37 8B44242C mov eax, dword ptr [esp+2C]

:0048FC3B 33F6 xor esi, esi

:0048FC3D C684249C03010007 mov byte ptr [esp+0001039C], 07

:0048FC45 3968F8 cmp dword ptr [eax-08], ebp

:0048FC48 7E1A jle 0048FC64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048FC62(C)

|

:0048FC4A 8A0430 mov al, byte ptr [eax+esi]

取MG13500Ap99062-Wyu@LS689的每一位

:0048FC4D 8D4C242C lea ecx, dword ptr [esp+2C]

:0048FC51 3462 xor al, 62 每一位xor 62

:0048FC53 50 push eax

:0048FC54 56 push esi

* Reference To: MFC42.Ordinal:16E0, Ord:16E0h

|

:0048FC55 E8BAD90000 Call 0049D614 将每一位xor 62得到的结果转换成字符

:0048FC5A 8B44242C mov eax, dword ptr [esp+2C] eax=/%SQWRR#[[RTPO5".1TZ[

:0048FC5E 46 inc esi

:0048FC5F 3B70F8 cmp esi, dword ptr [eax-08]

:0048FC62 7CE6 jl 0048FC4A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048FC48(C)

|

:0048FC64 8D54242C lea edx, dword ptr [esp+2C]

:0048FC68 8D442430 lea eax, dword ptr [esp+30]

:0048FC6C 52 push edx

:0048FC6D 8D4C2444 lea ecx, dword ptr [esp+44]

:0048FC71 50 push eax

:0048FC72 51 push ecx

* Reference To: MFC42.Ordinal:039A, Ord:039Ah

|

:0048FC73 E86CD90000 Call 0049D5E4

:0048FC78 55 push ebp

:0048FC79 8D542460 lea edx, dword ptr [esp+60]

:0048FC7D 55 push ebp

:0048FC7E 8D442468 lea eax, dword ptr [esp+68]

:0048FC82 52 push edx

:0048FC83 8D4C2464 lea ecx, dword ptr [esp+64]

:0048FC87 50 push eax

:0048FC88 51 push ecx

:0048FC89 8D9424A8020000 lea edx, dword ptr [esp+000002A8]

* Possible Reference to String Resource ID=00255: "*妍?N(!"

|

:0048FC90 68FF000000 push 000000FF

:0048FC95 52 push edx

* Possible StringData Ref from Data Obj ->"c:\"

|

:0048FC96 6820184C00 push 004C1820

:0048FC9B C68424BC03010008 mov byte ptr [esp+000103BC], 08

* Reference To: KERNEL32.GetVolumeInformationA, Ord:0177h

|

:0048FCA3 FF15C4C14A00 Call dword ptr [004AC1C4]

:0048FCA9 8B442458 mov eax, dword ptr [esp+58]

:0048FCAD 8B4C243C mov ecx, dword ptr [esp+3C]

:0048FCB1 50 push eax

:0048FCB2 E829060000 call 004902E0

:0048FCB7 8D4C2438 lea ecx, dword ptr [esp+38]

:0048FCBB 8BF0 mov esi, eax

* Reference To: MFC42.Ordinal:021C, Ord:021Ch

|

:0048FCBD E8D8D40000 Call 0049D19A

:0048FCC2 56 push esi

:0048FCC3 8D4C243C lea ecx, dword ptr [esp+3C]

* Possible StringData Ref from Data Obj ->"%ld"

|

:0048FCC7 681C184C00 push 004C181C

:0048FCCC 51 push ecx

:0048FCCD C68424A803010009 mov byte ptr [esp+000103A8], 09

* Reference To: MFC42.Ordinal:0B02, Ord:0B02h

|

:0048FCD5 E886D50000 Call 0049D260

ecx=2448(软件得到的注册名）你的注册名不是2448,你也可以注 册成功，但是在后面的软件进行有比对，不否则你不能用软件的定时提醒）

:0048FCDA 83C40C add esp, 0000000C

:0048FCDD 8D4C2448 lea ecx, dword ptr [esp+48]

* Reference To: MFC42.Ordinal:0162, Ord:0162h

|

:0048FCE1 E810D90000 Call 0049D5F6

:0048FCE6 668B15DC394C00 mov dx, word ptr [004C39DC]

:0048FCED B940000000 mov ecx, 00000040

:0048FCF2 33C0 xor eax, eax

:0048FCF4 8D7C2466 lea edi, dword ptr [esp+66]

:0048FCF8 6689542464 mov word ptr [esp+64], dx

* Possible Reference to String Resource ID=00260: "婼"

|

:0048FCFD 6804010000 push 00000104

:0048FD02 F3 repz

:0048FD03 AB stosd

:0048FD04 66AB stosw

:0048FD06 8D442468 lea eax, dword ptr [esp+68]

:0048FD0A C68424A00301000A mov byte ptr [esp+000103A0], 0A

:0048FD12 50 push eax

* Reference To: KERNEL32.GetWindowsDirectoryA, Ord:017Dh

|

:0048FD13 FF15CCC14A00 Call dword ptr [004AC1CC]

:0048FD19 8D4C2464 lea ecx, dword ptr [esp+64]

:0048FD1D 51 push ecx

:0048FD1E 8D4C2414 lea ecx, dword ptr [esp+14]

* Reference To: MFC42.Ordinal:0219, Ord:0219h

|

:0048FD22 E8E1D50000 Call 0049D308

* Possible StringData Ref from Data Obj ->"\regmg.cfg"

|

:0048FD27 6800184C00 push 004C1800

:0048FD2C 8D542418 lea edx, dword ptr [esp+18]

:0048FD30 50 push eax

:0048FD31 52 push edx

:0048FD32 C68424A80301000B mov byte ptr [esp+000103A8], 0B

* Reference To: MFC42.Ordinal:039C, Ord:039Ch

|

:0048FD3A E899D50000 Call 0049D2D8

:0048FD3F 8B00 mov eax, dword ptr [eax]

:0048FD41 55 push ebp

:0048FD42 55 push ebp

:0048FD43 50 push eax

:0048FD44 8D4C2454 lea ecx, dword ptr [esp+54]

:0048FD48 C68424A80301000C mov byte ptr [esp+000103A8], 0C

* Reference To: MFC42.Ordinal:1442, Ord:1442h

|

:0048FD50 E89BD80000 Call 0049D5F0

:0048FD55 85C0 test eax, eax

:0048FD57 8D4C2414 lea ecx, dword ptr [esp+14]

:0048FD5B C684249C0301000B mov byte ptr [esp+0001039C], 0B

:0048FD63 0F94C3 sete bl

* Reference To: MFC42.Ordinal:0320, Ord:0320h

|

:0048FD66 E811D40000 Call 0049D17C

:0048FD6B 8D4C2410 lea ecx, dword ptr [esp+10]

:0048FD6F C684249C0301000A mov byte ptr [esp+0001039C], 0A

* Reference To: MFC42.Ordinal:0320, Ord:0320h

|

:0048FD77 E800D40000 Call 0049D17C

:0048FD7C 84DB test bl, bl

:0048FD7E 747A je 0048FDFA

:0048FD80 8D4C2420 lea ecx, dword ptr [esp+20]

* Reference To: MFC42.Ordinal:021C, Ord:021Ch

|

:0048FD84 E811D40000 Call 0049D19A

:0048FD89 B30D mov bl, 0D

:0048FD8B 8D4C2434 lea ecx, dword ptr [esp+34]

:0048FD8F 889C249C030100 mov byte ptr [esp+0001039C], bl

* Reference To: MFC42.Ordinal:021C, Ord:021Ch

|

:0048FD96 E8FFD30000 Call 0049D19A

* Possible Reference to String Resource ID=00664: "`勮尷K圅"1_O`舺桶 }錹?&嗾鑼?宼H,
"

|

:0048FD9B 6898020000 push 00000298

:0048FDA0 8D4C2424 lea ecx, dword ptr [esp+24]

:0048FDA4 C68424A00301000E mov byte ptr [esp+000103A0], 0E

* Reference To: MFC42.Ordinal:1040, Ord:1040h

|

:0048FDAC E869D50000 Call 0049D31A

* Possible Reference to String Resource ID=00665: "q髃?003---鑼1%"

|

:0048FDB1 6899020000 push 00000299

:0048FDB6 8D4C2438 lea ecx, dword ptr [esp+38]

* Reference To: MFC42.Ordinal:1040, Ord:1040h

|

:0048FDBA E85BD50000 Call 0049D31A

:0048FDBF 8B442434 mov eax, dword ptr [esp+34]

:0048FDC3 8B4C2420 mov ecx, dword ptr [esp+20]

:0048FDC7 6A10 push 00000010

:0048FDC9 50 push eax

:0048FDCA 51 push ecx

:0048FDCB 8B4C2448 mov ecx, dword ptr [esp+48]

* Reference To: MFC42.Ordinal:1080, Ord:1080h

|

:0048FDCF E840D50000 Call 0049D314

:0048FDD4 8D4C2434 lea ecx, dword ptr [esp+34]

:0048FDD8 889C249C030100 mov byte ptr [esp+0001039C], bl

* Reference To: MFC42.Ordinal:0320, Ord:0320h

|

:0048FDDF E898D30000 Call 0049D17C

:0048FDE4 8D4C2420 lea ecx, dword ptr [esp+20]

:0048FDE8 C684249C0301000A mov byte ptr [esp+0001039C], 0A

* Reference To: MFC42.Ordinal:0320, Ord:0320h

|

:0048FDF0 E887D30000 Call 0049D17C

:0048FDF5 E9A3030000 jmp 0049019D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048FD7E(C)

|

:0048FDFA 8D942468010000 lea edx, dword ptr [esp+00000168]

* Possible Reference to String Resource ID=00300: "寻v-"

|

:0048FE01 682C010000 push 0000012C

:0048FE06 52 push edx

:0048FE07 8D4C2450 lea ecx, dword ptr [esp+50]

* Reference To: MFC42.Ordinal:1542, Ord:1542h

|

:0048FE0B E80AD80000 Call 0049D61A

:0048FE10 8D4C2448 lea ecx, dword ptr [esp+48]

* Reference To: MFC42.Ordinal:07BB, Ord:07BBh

|

:0048FE14 E807D80000 Call 0049D620

:0048FE19 8D842468010000 lea eax, dword ptr [esp+00000168]

:0048FE20 8D4C2414 lea ecx, dword ptr [esp+14]

:0048FE24 50 push eax

* Reference To: MFC42.Ordinal:0219, Ord:0219h

|

:0048FE25 E8DED40000 Call 0049D308

:0048FE2A 8B30 mov esi, dword ptr [eax]

:0048FE2C 8B442440 mov eax, dword ptr [esp+40]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048FE52(C)

|

:0048FE30 8A10 mov dl, byte ptr [eax]

eax=前面得到的44604与MG13500Ap99062-Wyu@LS689运算得到/%SQWRR#[[RTPO5".1TZ[的组合---1

:0048FE32 8A1E mov bl, byte ptr [esi]

（ esi=c:\windows\regmg.cfg文件你的内容即44604/%SQWRR#[[RTPO5".1TZ[ ）----2

在这里你可以看见三个的数字是不一样的！！

:0048FE34 8ACA mov cl, dl

比较－－1和－－－2的每一位 （全部相等就调到0048FE54)

:0048FE36 3AD3 cmp dl, bl

:0048FE38 751E jne 0048FE58

:0048FE3A 84C9 test cl, cl

:0048FE3C 7416 je 0048FE54

:0048FE3E 8A5001 mov dl, byte ptr [eax+01]

:0048FE41 8A5E01 mov bl, byte ptr [esi+01]

:0048FE44 8ACA mov cl, dl

:0048FE46 3AD3 cmp dl, bl

:0048FE48 750E jne 0048FE58

:0048FE4A 83C002 add eax, 00000002

:0048FE4D 83C602 add esi, 00000002

:0048FE50 84C9 test cl, cl

:0048FE52 75DC jne 0048FE30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048FE3C(C)

|

:0048FE54 33C0 xor eax, eax （调到这里，好了eax=0)

:0048FE56 EB05 jmp 0048FE5D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:0048FE38(C), :0048FE48(C)

|

:0048FE58 1BC0 sbb eax, eax

:0048FE5A 83D8FF sbb eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048FE56(U)

|

:0048FE5D 3BC5 cmp eax, ebp eax=ebp=0

:0048FE5F 8D4C2414 lea ecx, dword ptr [esp+14]

:0048FE63 0F94C3 sete bl (b1=1好东西）

* Reference To: MFC42.Ordinal:0320, Ord:0320h

|

:0048FE66 E811D30000 Call 0049D17C

:0048FE6B 84DB test bl, bl （b1=1哟，看看不跳了，注册ok)

:0048FE6D 0F8421030000 je 00490194

* Possible StringData Ref from Data Obj ->"软注支件持册"

|

:0048FE73 68E8174C00 push 004C17E8

:0048FE78 B9683B5000 mov ecx, 00503B68

* Reference To: MFC42.Ordinal:035C, Ord:035Ch

|

:0048FE7D E8B6D40000 Call 0049D338

:0048FE82 8D442464 lea eax, dword ptr [esp+64]

:0048FE86 8D4C2424 lea ecx, dword ptr [esp+24]

:0048FE8A 50 push eax

* Reference To: MFC42.Ordinal:0219, Ord:0219h

|

:0048FE8B E878D40000 Call 0049D308

* Possible StringData Ref from Data Obj ->"\regmg.cfg"

|

:0048FE90 6800184C00 push 004C1800

:0048FE95 8D4C2414 lea ecx, dword ptr [esp+14]

:0048FE99 B30F mov bl, 0F

:0048FE9B 50 push eax

:0048FE9C 51 push ecx

:0048FE9D 889C24A8030100 mov byte ptr [esp+000103A8], bl

注册完了后把c:\windows\regmg.cfg的内容改成04460 即把44604/%SQWRR#[[RTPO5".1TZ[取前面的四位，并在前面加0

在软件退出后在起动时会读c:\windows\regmg.cfg的内容是否是04460若不是你还是注册不成功！！

（出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net