网页特效咖啡豆V2.0算法分析

进入注册窗口后，可以输入注册用户名及注册码，系统自动还生成了一个注册申请码，我输入用户名：hoto ,注册码：78787878，然后按“注册认证”按钮，发现软件没有提示，那就从HMEMCPY这个万能断点开始吧。

打开TRW2000后，按CTRL+N后，下断点BPX HMEMCPY，然后按“注册认证”按钮，程序被断后，下命令PMODULE后，再按N次F12后就来到这里：

0187:0049A114 MOV EAX,[EBP-08]<--EAX指向用户名

0187:0049A117 LEA EDX,[EBP-04]

0187:0049A11A CALL 0040888C

0187:0049A11F CMP DWORD [EBP-04],BYTE +00<--有没有输入用户名,没有输入就会有提示

0187:0049A123 JNZ 0049A141

0187:0049A125 MOV EAX,0049A1F0

0187:0049A12A PUSH BYTE +10

0187:0049A12C MOV ECX,0049A208

0187:0049A131 MOV EDX,[004A5BAC]

0187:0049A137 MOV EDX,[EDX]

0187:0049A139 XCHG EAX,EDX

0187:0049A13A CALL 00459A34

0187:0049A13F JMP SHORT 0049A198

0187:0049A141 LEA EDX,[EBP-10]

0187:0049A144 MOV EAX,[EBX+0310]

0187:0049A14A CALL 00439784

0187:0049A14F MOV EAX,[EBP-10]<--指向输入的注册码

0187:0049A152 LEA EDX,[EBP-0C]

0187:0049A155 CALL 0040888C

0187:0049A15A CMP DWORD [EBP-0C],BYTE +00<--比较有没有输入注册码,没有输入就提示

0187:0049A15E JNZ 0049A17C

0187:0049A160 MOV EAX,0049A210

0187:0049A165 PUSH BYTE +10

0187:0049A167 MOV ECX,0049A208

0187:0049A16C MOV EDX,[004A5BAC]

0187:0049A172 MOV EDX,[EDX]

0187:0049A174 XCHG EAX,EDX

0187:0049A175 CALL 00459A34

0187:0049A17A JMP SHORT 0049A198

0187:0049A17C MOV EAX,EBX

0187:0049A17E CALL 0049A494<--这是关键CALL,内有注册码的计算过程.

0187:0049A183 TEST AL,AL<--如果返回0,就跳走,注册就失败

0187:0049A185 JZ 0049A190

0187:0049A187 MOV EAX,EBX

0187:0049A189 CALL 0049A224<--不跳走,就会提示注册成功.

--------------进入关键CALL后,分析注册算法-----------

0187:0049A494 PUSH EBP

0187:0049A495 MOV EBP,ESP

0187:0049A497 ADD ESP,BYTE -18

0187:0049A49A PUSH EBX

0187:0049A49B PUSH ESI

0187:0049A49C XOR EDX,EDX

0187:0049A49E MOV [EBP-18],EDX<--存输入注册码的变量,记 char *key;

0187:0049A4A1 MOV [EBP-14],EDX

0187:0049A4A4 MOV [EBP-0C],EDX<--存用户名的局部变量,记 char *name;

0187:0049A4A7 MOV [EBP-04],EAX

0187:0049A4AA XOR EAX,EAX

0187:0049A4AC PUSH EBP

0187:0049A4AD PUSH DWORD 0049A593

0187:0049A4B2 PUSH DWORD [FS:EAX]

0187:0049A4B5 MOV [FS:EAX],ESP

0187:0049A4B8 XOR EBX,EBX

0187:0049A4BA LEA EDX,[EBP-0C]

0187:0049A4BD MOV EAX,[EBP-04]

0187:0049A4C0 MOV EAX,[EAX+02FC]

0187:0049A4C6 CALL 00439784

0187:0049A4CB MOV EAX,[EBP-0C]<--取用户名地址到EAX

0187:0049A4CE CALL 004046BC<--取用户名的长度

0187:0049A4D3 MOV ESI,EAX

0187:0049A4D5 TEST ESI,ESI

0187:0049A4D7 JNG 0049A511

0187:0049A4D9 MOV DWORD [EBP-10],01

0187:0049A4E0 LEA EAX,[EBP-14]

0187:0049A4E3 PUSH EAX

0187:0049A4E4 MOV ECX,01

0187:0049A4E9 MOV EDX,[EBP-10]

0187:0049A4EC MOV EAX,[EBP-0C]

0187:0049A4EF CALL 00404914

0187:0049A4F4 MOV EAX,[EBP-14]

0187:0049A4F7 CALL 004048B4

0187:0049A4FC MOV AL,[EAX]<--取出用户名的一个字节,我输入"hoto",第一次就取出'h'

0187:0049A4FE AND EAX,FF

0187:0049A503 ADD EBX,EAX

0187:0049A505 XOR EBX,000BFA05 <--上面3句是对取出的字节进行变换.

0187:0049A50B INC DWORD [EBP-10]

0187:0049A50E DEC ESI

0187:0049A50F JNZ 0049A4E0<--所有的用户名都处理完了吗?

0187:0049A511 MOV EAX,[004A6D38]<--取出注册申请码(即机器码)

0187:0049A516 MOV EDX,EAX

0187:0049A518 SHL EAX,04

0187:0049A51B ADD EAX,EDX<--对注册申请码进入变换

0187:0049A51D ADD EBX,EAX<--将注册申请码变换后累加到用户名的处理值上

0187:0049A51F ADD EBX,0013A3D4

0187:0049A525 XOR EBX,0059ED8D<--再进入一次处理

0187:0049A52B LEA EDX,[EBP-18]

0187:0049A52E MOV EAX,[EBP-04]

0187:0049A531 MOV EAX,[EAX+0310]

0187:0049A537 CALL 00439784

0187:0049A53C MOV EAX,[EBP-18]<--取出注册码，即"78787878"

0187:0049A53F CALL 00408AF0<--此CALL将注册码转化DWORD值.

0187:0049A544 MOV ESI,EBX

0187:0049A546 XOR ESI,00C473240<--将用户名处理的值再一次变化,得到真正的注册码,(如果将此值转化为十进制字符串形式,就是注册码)

0187:0049A54C CMP EAX,ESI<--比较两个注册码

0187:0049A54E JNZ 0049A569<--不相等就会返回0,注册失败

0187:0049A550 MOV BYTE [EBP-05],01<--如果相等就返回1,注册成功

0187:0049A554 MOV EAX,004A6D30

0187:0049A559 MOV EDX,[EBP-0C]

0187:0049A55C CALL 00404458

0187:0049A561 MOV [004A6D34],ESI

0187:0049A567 JMP SHORT 0049A56D

0187:0049A569 MOV BYTE [EBP-05],00

0187:0049A56D XOR EAX,EAX

0187:0049A56F POP EDX

0187:0049A570 POP ECX

0187:0049A571 POP ECX

0187:0049A572 MOV [FS:EAX],EDX

0187:0049A575 PUSH DWORD 0049A59A

0187:0049A57A LEA EAX,[EBP-18]

0187:0049A57D CALL 00404404

0187:0049A582 LEA EAX,[EBP-14]

0187:0049A585 CALL 00404404

0187:0049A58A LEA EAX,[EBP-0C]

0187:0049A58D CALL 00404404

0187:0049A592 RET

注册成功后，软件在注册表中写入信息

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\DiskMenu]

------------------VC 6.0 注册机 -------------------

this->UpdateData(true);

if(this->m_input == "")

{

this->m_output = "请输入注册用户名";

this->m_edit2.SetWindowText(this->m_output);

return;

}

if(this->m_input2 == "")

{

this->m_output = "请输入注册申请码";

this->m_edit2.SetWindowText(this->m_output);

return;

}

//this->m_input 是输入的用户名，this->m_input1 是机器码，this->m_output 是输出用的注册码。

char name[256];

unsigned long reg,reg1;

int i,len;

strcpy(name,this->m_input);

len = strlen(name);

reg = 0;

reg1 = atoi(this->m_input2);

for(i=0;i