统护卫1.0注册算法分析

破解工具:dede3.10,trw2000v1.22

破解日期:2002.7.2

得到注册申请码的分析:

* Reference to control NameEdit : TEdit

|

00473DF8 8B8308040000 mov eax, [ebx+$0408]

* Reference to: controls.TControl.GetText(TControl):System.String;

|

00473DFE E8D988FBFF call 0042C6DC

00473E03 8B45EC mov eax, [ebp-$14]

00473E06 8A00 mov al, byte ptr [eax]

00473E08 04D0 add al, -$30

00473E0A 2C0A sub al, $0A

00473E0C 7316 jnb 00473E24

* Possible String Reference to: '请输入您的姓名！'

|

00473E0E B9F83F4700 mov ecx, $00473FF8

00473E13 B201 mov dl, $01

00473E15 A16C774000 mov eax, dword ptr [$0040776C]

* Reference to: axctrls.TOleStream.Create(TOleStream;boolean;ActiveX.IStream);

| or: inifiles.TCustomIniFile.Create(TCustomIniFile;boolean;System.AnsiString);

| or: sysutils.Exception.Create(Exception;boolean;System.AnsiString);

|

00473E1A E8A977F9FF call 0040B5C8

* Reference to: system.@RaiseExcept;

|

00473E1F E888F7F8FF call 004035AC

00473E24 8D55E8 lea edx, [ebp-$18]

* Reference to control NameEdit : TEdit

|

00473E27 8B8308040000 mov eax, [ebx+$0408]

* Reference to: controls.TControl.GetText(TControl):System.String;

|

00473E2D E8AA88FBFF call 0042C6DC

00473E32 8B45E8 mov eax, [ebp-$18]

00473E35 8A10 mov dl, byte ptr [eax]

00473E37 8D45F4 lea eax, [ebp-$0C]

* Reference to: system.@LStrFromChar(String;Char);

| or: system.@LStrFromWChar(String;WideChar);

| or: system.@WStrFromChar(WideString;Char);

| or: system.@WStrFromWChar(WideString;WideChar);

|

00473E3A E845FEF8FF call 00403C84

00473E3F 8B45F4 mov eax, [ebp-$0C]-------->eax=注册名

00473E42 8A00 mov al, byte ptr [eax]----->注册名的第一位asc到al

00473E44 25FF000000 and eax, $000000FF----->清除高位

00473E49 33D2 xor edx, edx

00473E4B 52 push edx

00473E4C 50 push eax------>压栈

00473E4D 8B8350040000 mov eax, [ebx+$0450]------>常数183f9ff

00473E53 8B9354040000 mov edx, [ebx+$0454]

00473E59 038358040000 add eax, [ebx+$0458]----->常数183f9ff+c盘的序列号

00473E5F 13935C040000 adc edx, [ebx+$045C]

00473E65 2DDF493400 sub eax, $003449DF---->(常数183f9ff+c盘的序列号)-3449df

00473E6A 83DA00 sbb edx, +$00

00473E6D 030424 add eax, [esp]---->(常数183f9ff+c盘的序列号-3449df)+注册名的第一位asc是注册申请码.

00473E70 13542404 adc edx, [esp+$04]

00473E74 83C408 add esp, +$08

00473E77 52 push edx

00473E78 50 push eax

00473E79 8D45F8 lea eax, [ebp-$08]

* Reference to: sysutils.IntToStr(System.Int64):System.AnsiString;overload;

|

00473E7C E82B48F9FF call 004086AC---->变成整数字符串

00473E81 6A40 push $40

00473E83 8D55E4 lea edx, [ebp-$1C]

00473E86 A120604700 mov eax, dword ptr [$00476020]

00473E8B 8B00 mov eax, [eax]

* Reference to: forms.TApplication.GetTitle(TApplication):System.AnsiString;

|

00473E8D E86E64FDFF call 0044A300

00473E92 8B45E4 mov eax, [ebp-$1C]

* Reference to: system.@LStrToPChar;

|

00473E95 E88600F9FF call 00403F20

00473E9A 50 push eax

* Possible String Reference to: '您好 '

|

00473E9B 6814404700 push $00474014

00473EA0 8D55DC lea edx, [ebp-$24]

* Reference to control NameEdit : TEdit

|

00473EA3 8B8308040000 mov eax, [ebx+$0408]

* Reference to: controls.TControl.GetText(TControl):System.String;

|

00473EA9 E82E88FBFF call 0042C6DC

00473EAE FF75DC push dword ptr [ebp-$24]

00473EB1 6824404700 push $00474024

00473EB6 6830404700 push $00474030

00473EBB 6830404700 push $00474030

* Possible String Reference to: '谢谢您使用《系统护卫》'

|

00473EC0 683C404700 push $0047403C

00473EC5 6830404700 push $00474030

00473ECA 6830404700 push $00474030

* Possible String Reference to: '您的注册申请码是：'

|

00473ECF 685C404700 push $0047405C

00473ED4 FF75F8 push dword ptr [ebp-$08]

00473ED7 8D45E0 lea eax, [ebp-$20]

00473EDA BA0A000000 mov edx, $0000000A

得到认证码的分析:

004739C2 8B45D4 mov eax, [ebp-$2C]

004739C5 85C0 test eax, eax

004739C7 7E16 jle 004739DF

004739C9 BE01000000 mov esi, $00000001--------->第一段算法

004739CE 8B55E0 mov edx, [ebp-$20]----->常数359264856

004739D1 8A5432FF mov dl, byte ptr [edx+esi-$01]取1位

004739D5 8B4DD8 mov ecx, [ebp-$28]----->常数183f9ff+c盘的序列号

004739D8 301419 xor [ecx+ebx], dl----->((常数183f9ff+c盘的序列号)取1位的asc)xor常数359264856取1位的asc

004739DB 46 inc esi

004739DC 48 dec eax

004739DD 75EF jnz 004739CE

004739DF 43 inc ebx

004739E0 83FB09 cmp ebx, +$09--->考察计数器是否为9

004739E3 75DD jnz 004739C2--------->第一段算法

004739E5 8B45E4 mov eax, [ebp-$1C]----->ecx中是结果设为m.

* Reference to: system.@LStrLen:Integer;

| or: system.@DynArrayLength;

| or: system.DynArraySize(Pointer):Integer;

|

004739E8 E86F03F9FF call 00403D5C

004739ED D1F8 sar eax, 1

004739EF 7903 jns 004739F4

004739F1 83D000 adc eax, +$00

004739F4 03C0 add eax, eax

004739F6 8945D4 mov [ebp-$2C], eax

004739F9 33DB xor ebx, ebx

004739FB 8B45D4 mov eax, [ebp-$2C]---->第二段算法同第一段算法

004739FE 85C0 test eax, eax

00473A00 7E16 jle 00473A18

00473A02 BE01000000 mov esi, $00000001

00473A07 8B55E4 mov edx, [ebp-$1C]------->申请号

00473A0A 8A5432FF mov dl, byte ptr [edx+esi-$01]

00473A0E 8B4DD8 mov ecx, [ebp-$28]----->第一段算法的结果m

00473A11 301419 xor [ecx+ebx], dl

00473A14 46 inc esi

00473A15 48 dec eax

00473A16 75EF jnz 00473A07

00473A18 43 inc ebx

00473A19 83FB09 cmp ebx, +$09

00473A1C 75DD jnz 004739FB--------->第二段算法

00473A1E BE01000000 mov esi, $00000001-->ecx为真认证码

00473A23 33DB xor ebx, ebx

00473A25 8B45D8 mov eax, [ebp-$28]

00473A28 8A0418 mov al, byte ptr [eax+ebx]

00473A2B 04DF add al, -$21

00473A2D 2C5E sub al, $5E

00473A2F 7312 jnb 00473A43

00473A31 8D45F0 lea eax, [ebp-$10]

* Reference to: system.UniqueString(String);

|

00473A34 E8F304F9FF call 00403F2C

00473A39 8B55D8 mov edx, [ebp-$28]

00473A3C 8A141A mov dl, byte ptr [edx+ebx]

00473A3F 885430FF mov [eax+esi-$01], dl

00473A43 46 inc esi

00473A44 43 inc ebx

00473A45 83FB09 cmp ebx, +$09

00473A48 75DB jnz 00473A25

00473A4A 8D45DC lea eax, [ebp-$24]

00473A4D 50 push eax

00473A4E 8D55A0 lea edx, [ebp-$60]

00473A51 8B45FC mov eax, [ebp-$04]

* Reference to control RegistryEdit1 : TEdit

|

00473A54 8B8010040000 mov eax, [eax+$0410]

* Reference to: controls.TControl.GetText(TControl):System.String;

|

00473A5A E87D8CFBFF call 0042C6DC

00473A5F 8B45A0 mov eax, [ebp-$60]

00473A62 B903000000 mov ecx, $00000003

00473A67 BA01000000 mov edx, $00000001

* Reference to: system.@LStrCopy;

|

00473A6C E8F304F9FF call 00403F64

00473A71 8D559C lea edx, [ebp-$64]

00473A74 8B45FC mov eax, [ebp-$04]

* Reference to control RegistryEdit2 : TEdit

|

00473A77 8B8014040000 mov eax, [eax+$0414]

* Reference to: controls.TControl.GetText(TControl):System.String;

|

00473A7D E85A8CFBFF call 0042C6DC

00473A82 8B559C mov edx, [ebp-$64]

00473A85 8D45DC lea eax, [ebp-$24]

* Reference to: system.@LStrCat;

|

00473A88 E8D702F9FF call 00403D64

00473A8D 8B45DC mov eax, [ebp-$24]---->假认证码

00473A90 8B55F0 mov edx, [ebp-$10]----->真认证码

* Reference to: system.@LStrCmp;

|

00473A93 E8D403F9FF call 00403E6C

00473A98 7462 jz 00473AFC

00473A9A 6A10 push $10

00473A9C 8D5598 lea edx, [ebp-$68]

00473A9F A120604700 mov eax, dword ptr [$00476020]

00473AA4 8B00 mov eax, [eax]

* Reference to: forms.TApplication.GetTitle(TApplication):System.AnsiString;

|

00473AA6 E85568FDFF call 0044A300

00473AAB 8B4598 mov eax, [ebp-$68]

* Reference to: system.@LStrToPChar;

|

00473AAE E86D04F9FF call 00403F20

00473AB3 50 push eax

* Possible String Reference to: '输入的认证码无效！'

|

00473AB4 68203D4700 push $00473D20

00473AB9 8B45FC mov eax, [ebp-$04]

* Reference to: controls.TWinControl.GetHandle(TWinControl):Windows.HWND;

|

00473ABC E8F3ECFBFF call 004327B4

00473AC1 50 push eax

|

00473AC2 E87535F9FF call 0040703C

00473AC7 8D45D8 lea eax, [ebp-$28]

00473ACA 8B159C374700 mov edx, [$0047379C]

* Reference to: system.@DynArrayClear(Pointer;Pointer);

|

00473AD0 E83319F9FF call 00405408

00473AD5 8B45FC mov eax, [ebp-$04]

* Reference to control TabSheet1 : TTabSheet

|

00473AD8 8B904C030000 mov edx, [eax+$034C]

00473ADE 8B45FC mov eax, [ebp-$04]

* Reference to control PageControl1 : TPageControl

|

00473AE1 8B8048030000 mov eax, [eax+$0348]

* Reference to: comctrls.TPageControl.SetActivePage(TPageControl;TTabSheet);

|

00473AE7 E80830FEFF call 00456AF4

00473AEC 8B55F8 mov edx, [ebp-$08]

00473AEF 8B45FC mov eax, [ebp-$04]

* Reference to : TMainform.PageControl1Change()

|

00473AF2 E879CEFFFF call 00470970

00473AF7 E943010000 jmp 00473C3F

00473AFC 8D45F0 lea eax, [ebp-$10]

* Reference to: system.@LStrClr(String);

|

00473AFF E8D8FFF8FF call 00403ADC

00473B04 8D45F0 lea eax, [ebp-$10]

00473B07 BA09000000 mov edx, $00000009

* Reference to: system.@LStrSetLength;

|

00473B0C E87F05F9FF call 00404090

00473B11 BE01000000 mov esi, $00000001

00473B16 33DB xor ebx, ebx

00473B18 8B45D8 mov eax, [ebp-$28]

00473B1B 8A0418 mov al, byte ptr [eax+ebx]

00473B1E 04DF add al, -$21

00473B20 2C5E sub al, $5E

00473B22 7312 jnb 00473B36

00473B24 8D45F0 lea eax, [ebp-$10]

* Reference to: system.UniqueString(String);

|

00473B27 E80004F9FF call 00403F2C

00473B2C 8B55D8 mov edx, [ebp-$28]

00473B2F 8A141A mov dl, byte ptr [edx+ebx]

00473B32 885430FF mov [eax+esi-$01], dl

00473B36 46 inc esi

00473B37 43 inc ebx

00473B38 83FB09 cmp ebx, +$09

00473B3B 75DB jnz 00473B18

00473B3D 8D45D8 lea eax, [ebp-$28]

00473B40 8B159C374700 mov edx, [$0047379C]

* Reference to: system.@DynArrayClear(Pointer;Pointer);

|

00473B46 E8BD18F9FF call 00405408

00473B4B C645C048 mov byte ptr [ebp-$40], $48

00473B4F C645C143 mov byte ptr [ebp-$3F], $43

00473B53 C645C248 mov byte ptr [ebp-$3E], $48

00473B57 8D55EC lea edx, [ebp-$14]

00473B5A 8B45FC mov eax, [ebp-$04]

* Reference to control ApplyEdit : TEdit

|

00473B5D 8B800C040000 mov eax, [eax+$040C]

* Reference to: controls.TControl.GetText(TControl):System.String;

|

00473B63 E8748BFBFF call 0042C6DC

00473B68 8D45E8 lea eax, [ebp-$18]

00473B6B 8B55F0 mov edx, [ebp-$10]

* Reference to: system.@LStrLAsg;

|

00473B6E E80100F9FF call 00403B74

00473B73 BB04000000 mov ebx, $00000004

00473B78 8D45C3 lea eax, [ebp-$3D]

00473B7B 8B55EC mov edx, [ebp-$14]

00473B7E 8A541AFC mov dl, byte ptr [edx+ebx-$04]

00473B82 80F258 xor dl, $58

00473B85 8810 mov [eax], dl

00473B87 43 inc ebx

00473B88 40 inc eax

00473B89 83FB0C cmp ebx, +$0C

00473B8C 75ED jnz 00473B7B

00473B8E BB0C000000 mov ebx, $0000000C

00473B93 8D45CB lea eax, [ebp-$35]

00473B96 8B55E8 mov edx, [ebp-$18]

00473B99 8A541AF4 mov dl, byte ptr [edx+ebx-$0C]

00473B9D 80F258 xor dl, $58

00473BA0 8810 mov [eax], dl

00473BA2 43 inc ebx

00473BA3 40 inc eax

00473BA4 83FB15 cmp ebx, +$15

00473BA7 75ED jnz 00473B96

00473BA9 B201 mov dl, $01

00473BAB A1DCCF4600 mov eax, dword ptr [$0046CFDC]

|

00473BB0 E82795FFFF call 0046D0DC

00473BB5 8945F4 mov [ebp-$0C], eax

00473BB8 33C0 xor eax, eax

00473BBA 55 push ebp

* Possible String Reference to: '閉腓j@hl=G'

|

00473BBB 68123C4700 push $00473C12

***** TRY

|

00473BC0 64FF30 push dword ptr fs:[eax]

00473BC3 648920 mov fs:[eax], esp

00473BC6 BA01000080 mov edx, $80000001

00473BCB 8B45F4 mov eax, [ebp-$0C]

* Reference to: registry.TRegistry.SetRootKey(TRegistry;Windows.HKEY);

|

00473BCE E8A995FFFF call 0046D17C

00473BD3 B101 mov cl, $01

* Possible String Reference to: 'SOFTWARE\系统护卫\2.0.0.0'

|

00473BD5 BA3C3D4700 mov edx, $00473D3C

00473BDA 8B45F4 mov eax, [ebp-$0C]

* Reference to: registry.TRegistry.OpenKey(TRegistry;System.AnsiString;System.Boolean):System.Boolean;

|

00473BDD E8FE95FFFF call 0046D1E0

00473BE2 6A14 push $14

00473BE4 8D4DC0 lea ecx, [ebp-$40]

* Possible String Reference to: 'Registry'

|

00473BE7 BA603D4700 mov edx, $00473D60

00473BEC 8B45F4 mov eax, [ebp-$0C]

|

00473BEF E87098FFFF call 0046D464

00473BF4 33C0 xor eax, eax

00473BF6 5A pop edx

00473BF7 59 pop ecx

00473BF8 59 pop ecx

00473BF9 648910 mov fs:[eax], edx

****** FINALLY

|

* Possible String Reference to: 'j@hl=G'

|

00473BFC 68193C4700 push $00473C19

00473C01 8B45F4 mov eax, [ebp-$0C]

* Reference to: registry.TRegistry.CloseKey(TRegistry);

|

00473C04 E84395FFFF call 0046D14C

00473C09 8B45F4 mov eax, [ebp-$0C]

* Reference to: system.TObject.Free(TObject);

|

00473C0C E803F2F8FF call 00402E14

00473C11 C3 ret

00473C12 E95DF9F8FF jmp 00403574

00473C17 EBE8 jmp 00473C01

****** END

|

00473C19 6A40 push $40

* Possible String Reference to: '系统护卫'

|

00473C1B 686C3D4700 push $00473D6C

* Possible String Reference to: '注册成功！谢谢您注册《系统护卫》！?

| 肽匦略诵小断低郴の馈罚?

|

00473C20 68783D4700 push $00473D78

00473C25 8B45FC mov eax, [ebp-$04]

* Reference to: controls.TWinControl.GetHandle(TWinControl):Windows.HWND;

|

00473C28 E887EBFBFF call 004327B4

00473C2D 50 push eax

|

00473C2E E80934F9FF call 0040703C

00473C33 A120604700 mov eax, dword ptr [$00476020]

00473C38 8B00 mov eax, [eax]

* Reference to: forms.TApplication.Terminate(TApplication);

|

00473C3A E8516CFDFF call 0044A890

00473C3F 33C0 xor eax, eax

00473C41 5A pop edx

00473C42 59 pop ecx

以下是注册机的VB原码:

Private Sub Command1_Click()

Dim aa As Scripting.Drive

Dim bb As Scripting.FileSystemObject

Dim cc As Long

Set bb = New FileSystemObject

Set aa = bb.GetDrive("c:\")

If Len(Text4.Text) < 2 Then Exit Sub

'c盘序列号++ &H183F9FF

Text1.Text = aa.SerialNumber + &H183F9FF 'Hex(aa.SerialNumber) ' - aa.SerialNumber / 2 ^ 2

'注册申请号

Text2.Text = aa.SerialNumber + &H183F9FF - &H3449DF + Asc(Mid(Text4.Text, 1, 1))

Set bb = Nothing

For x = 1 To 9

v = Asc(Mid("359264856", x, 1))

For i = 1 To Len(Text2.Text)

v = v Xor Asc(Mid(Text2.Text, i, 1))

Next i

f = f + Chr(v)

Next x

'以上是第一段算法

For x = 1 To 9

v = Asc(Mid(f, x, 1))

For i = 1 To Len(Text1.Text)

v = v Xor Asc(Mid(Text1.Text, i, 1))

Next i

n = n + Chr(v)

Next x

'以上是第二段算法

Text3.Text = Mid(n, 1, 4)

Text5.Text = Mid(n, 5, 5)

End Sub

如果转载请保持完整.有错误请指教.谢谢

fnila Cracked by 20002.7.2

（出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net