键盘鼠标发声器算法分析

:00406AF8 0F84F5010000 je 00406CF3

:00406AFE 8D45FC lea eax, dword ptr [ebp-04]

:00406B01 E866C1FFFF call 00402C6C

:00406B06 83F818 cmp eax, 00000018 (比较注册码长度是否等于18h)

:00406B09 0F8596000000 jne 00406BA5

* Possible StringData Ref from Data Obj ->"kzeh+saon-ugny*da0n|"

|

:00406B0F BE6D954900 mov esi, 0049956D (载入固定字符串kzeh+saon-ugny*da0n|)

:00406B14 8DBD74FFFFFF lea edi, dword ptr [ebp+FFFFFF74]

* Possible Reference to String Resource ID=00005: "Cannot Remove System Shell Notification Icon"

|

:00406B1A B905000000 mov ecx, 00000005

:00406B1F F3 repz

:00406B20 A5 movsd

:00406B21 A4 movsb

:00406B22 66C745C41400 mov [ebp-3C], 0014

:00406B28 8D45FC lea eax, dword ptr [ebp-04]

:00406B2B E8F0AFFFFF call 00401B20

:00406B30 50 push eax

:00406B31 8D558C lea edx, dword ptr [ebp-74]

:00406B34 52 push edx

:00406B35 E842600800 call 0048CB7C

:00406B3A 83C408 add esp, 00000008

:00406B3D C6053E95490001 mov byte ptr [0049953E], 01

:00406B44 33C9 xor ecx, ecx

:00406B46 894DAC mov dword ptr [ebp-54], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00406BA3(C)

|

:00406B49 8B45AC mov eax, dword ptr [ebp-54]

:00406B4C 40 inc eax

* Possible Reference to String Resource ID=00005: "Cannot Remove System Shell Notification Icon"

|

:00406B4D B905000000 mov ecx, 00000005 (此处是表示不比较第5,10,15,20位注册码)

:00406B52 99 cdq

:00406B53 F7F9 idiv ecx

:00406B55 85D2 test edx, edx

:00406B57 7443 je 00406B9C

:00406B59 8B45AC mov eax, dword ptr [ebp-54]

:00406B5C 8A90447C4A00 mov dl, byte ptr [eax+004A7C44] (在EAX+004A7C44处可看见机器码前20位)

:00406B62 8B4DAC mov ecx, dword ptr [ebp-54]

:00406B65 32940D74FFFFFF xor dl, byte ptr [ebp+ecx-0000008C] (在此处ebp-ecx-8c处可看见固定字符串)

:00406B6C 0FBEC2 movsx eax, dl (将对应位置机器码和固定字符串XOR值移入EAX)

:00406B6F 50 push eax

:00406B70 E833EBFFFF call 004056A8

:00406B75 59 pop ecx

:00406B76 69C0411F0000 imul eax, 00001F41 (EAX乘以1F41h)

:00406B7C B91A000000 mov ecx, 0000001A

:00406B81 99 cdq

:00406B82 F7F9 idiv ecx (除以1A)

:00406B84 83C241 add edx, 00000041 (EDX值+41为对应位注册码)

:00406B87 8B45AC mov eax, dword ptr [ebp-54]

:00406B8A 0FBE4C058C movsx ecx, byte ptr [ebp+eax-74]

:00406B8F 3BD1 cmp edx, ecx (ECX为对应位假码)

:00406B91 7409 je 00406B9C (不等到下面跳注册不成功)

:00406B93 C6053E95490000 mov byte ptr [0049953E], 00

:00406B9A EB09 jmp 00406BA5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00406B57(C), :00406B91(C)

|

:00406B9C FF45AC inc [ebp-54] (等跳这里)

:00406B9F 837DAC14 cmp dword ptr [ebp-54], 00000014 (比较前20位)

:00406BA3 7CA4 jl 00406B49

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00406B09(C), :00406B9A(U)

|

:00406BA5 803D3E95490000 cmp byte ptr [0049953E], 00

:00406BAC 0F84ED000000 je 00406C9F

:00406BB2 66C745C43800 mov [ebp-3C], 0038

* Possible StringData Ref from Data Obj ->"注册成功！谢谢！

出现问题请查询：xtzy@163.com "

|

:00406BB8 BA9B9E4900 mov edx, 00499E9B

:00406BBD 8D45EC lea eax, dword ptr [ebp-14]

:00406BC0 E80F020900 call 00496DD4

:00406BC5 FF45D0 inc [ebp-30]

:00406BC8 8B00 mov eax, dword ptr [eax]

:00406BCA E8915B0500 call 0045C760

:00406BCF FF4DD0 dec [ebp-30]

算法就是:

将机器码与对应位置的固定字符串XOR=a

(a*1F41) MOD 1A)+41转为字符就是对应注册码.

最后四位可随意填入.

（出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net