windows tools 1.8 算法分析

目标软件： windows tools 1.8

软件大小： 689 KB

软件语言： 简体中文

软件类别： 国产软件 / 共享版 / 系统设置

应用平台： Win9x/NT/2000/XP

开 发 商： http://www.freewebs.com/lgsoft/

软件介绍：

一款Windows操作系统下的工具软件，主要功能如下：1.加密隐藏，2.文件清理，3.注册表清理，4.启动管理，5.系统设置，6.网络设置，7.内存整理，8.其它功能等。

主要工具：TRW2000 W32DASM Language2000 AspackDie v1.4

用Language2000监测windowstools.exe,发现加了Aspack的壳.用AspackDie脱壳。运行脱壳后的程序，点注册输入：nightstar/987654321 点确定，提示失败，退出，用w32dasm加载主程序，串式查找"对不起，注册未被认证！请检查“注册确认码”。" 代码如下:

:004E1A94 8D55F4 lea edx, dword ptr [ebp-0C]

:004E1A97 8B8320030000 mov eax, dword ptr [ebx+00000320]

:004E1A9D E8BADFF5FF call 0043FA5C

:004E1AA2 8B45F4 mov eax, dword ptr [ebp-0C] //把机器码送入EAX

:004E1AA5 8D55F8 lea edx, dword ptr [ebp-08]

:004E1AA8 E8FBFDFFFF call 004E18A8 //计算注册码,进入

:004E1AAD 8B55F8 mov edx, dword ptr [ebp-08] //D EDX=注册码

:004E1AB0 58 pop eax //EAX=假注册码

:004E1AB1 E8CE31F2FF call 00404C84 //比较注册码是否相等

:004E1AB6 0F851D010000 jne 004E1BD9 //不等跳死

:004E1ABC B201 mov dl, 01

* Possible StringData Ref from Data Obj ->""

|

:004E1ABE A1581F4600 mov eax, dword ptr [00461F58]

:004E1AC3 E89005F8FF call 00462058

:004E1AC8 8BF0 mov esi, eax

:004E1ACA BA01000080 mov edx, 80000001

:004E1ACF 8BC6 mov eax, esi

:004E1AD1 E82206F8FF call 004620F8

:004E1AD6 B101 mov cl, 01

* Possible StringData Ref from Data Obj ->"\SOFTWARE\LGTools"

|

:004E1AD8 BA501C4E00 mov edx, 004E1C50

:004E1ADD 8BC6 mov eax, esi

:004E1ADF E85807F8FF call 0046223C

:004E1AE4 8D55F0 lea edx, dword ptr [ebp-10]

:004E1AE7 8B8314030000 mov eax, dword ptr [ebx+00000314]

:004E1AED E86ADFF5FF call 0043FA5C

:004E1AF2 8B4DF0 mov ecx, dword ptr [ebp-10]

* Possible StringData Ref from Data Obj ->"Name"

|

:004E1AF5 BA6C1C4E00 mov edx, 004E1C6C

:004E1AFA 8BC6 mov eax, esi

:004E1AFC E8B70CF8FF call 004627B8

:004E1B01 8D55EC lea edx, dword ptr [ebp-14]

:004E1B04 8B8328030000 mov eax, dword ptr [ebx+00000328]

:004E1B0A E84DDFF5FF call 0043FA5C

:004E1B0F 8B4DEC mov ecx, dword ptr [ebp-14]

* Possible StringData Ref from Data Obj ->"SN"

|

:004E1B12 BA7C1C4E00 mov edx, 004E1C7C

:004E1B17 8BC6 mov eax, esi

:004E1B19 E89A0CF8FF call 004627B8

:004E1B1E 8BC6 mov eax, esi

:004E1B20 E8A305F8FF call 004620C8

:004E1B25 8BC6 mov eax, esi

:004E1B27 E8F01FF2FF call 00403B1C

:004E1B2C B201 mov dl, 01

* Possible StringData Ref from Data Obj ->""

|

:004E1B2E A1581F4600 mov eax, dword ptr [00461F58]

:004E1B33 E82005F8FF call 00462058

:004E1B38 8BF0 mov esi, eax

:004E1B3A BA01000080 mov edx, 80000001

:004E1B3F 8BC6 mov eax, esi

:004E1B41 E8B205F8FF call 004620F8

:004E1B46 B101 mov cl, 01

* Possible StringData Ref from Data Obj ->"\Software\Microsoft\Windows\CurrentVersion\Exp"

->"lorer"

|

:004E1B48 BA881C4E00 mov edx, 004E1C88

:004E1B4D 8BC6 mov eax, esi

:004E1B4F E8E806F8FF call 0046223C

* Possible StringData Ref from Data Obj ->"MyGroups"

|

:004E1B54 BAC41C4E00 mov edx, 004E1CC4

:004E1B59 8BC6 mov eax, esi

:004E1B5B E80008F8FF call 00462360

:004E1B60 8BC6 mov eax, esi

:004E1B62 E86105F8FF call 004620C8

:004E1B67 8BC6 mov eax, esi

:004E1B69 E8AE1FF2FF call 00403B1C

:004E1B6E 8D45E4 lea eax, dword ptr [ebp-1C]

:004E1B71 E852FEFFFF call 004E19C8

:004E1B76 FF75E4 push [ebp-1C]

* Possible StringData Ref from Data Obj ->"\System\"

|

:004E1B79 68D81C4E00 push 004E1CD8

* Possible StringData Ref from Data Obj ->"SYS.DRV"

|

:004E1B7E 68EC1C4E00 push 004E1CEC

:004E1B83 8D45E8 lea eax, dword ptr [ebp-18]

:004E1B86 BA03000000 mov edx, 00000003

:004E1B8B E87030F2FF call 00404C00

:004E1B90 8B45E8 mov eax, dword ptr [ebp-18]

:004E1B93 E8A87BF2FF call 00409740

:004E1B98 C6835C03000001 mov byte ptr [ebx+0000035C], 01

:004E1B9F 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"Windows Tools 注册提示:"

|

:004E1BA1 68F41C4E00 push 004E1CF4

:004E1BA6 8D55E0 lea edx, dword ptr [ebp-20]

:004E1BA9 8B8314030000 mov eax, dword ptr [ebx+00000314]

:004E1BAF E8A8DEF5FF call 0043FA5C

:004E1BB4 8D45E0 lea eax, dword ptr [ebp-20]

* Possible StringData Ref from Data Obj ->", 您的注册通过,谢谢支持！"

|

:004E1BB7 BA141D4E00 mov edx, 004E1D14

:004E1BBC E8872FF2FF call 00404B48

:004E1BC1 8B45E0 mov eax, dword ptr [ebp-20]

:004E1BC4 E86F31F2FF call 00404D38

:004E1BC9 50 push eax

:004E1BCA 8BC3 mov eax, ebx

:004E1BCC E8FF45F6FF call 004461D0

:004E1BD1 50 push eax

* Reference To: user32.MessageBoxA, Ord:0000h

|

:004E1BD2 E87D5CF2FF Call 00407854

:004E1BD7 EB20 jmp 004E1BF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004E1AB6(C)

|

:004E1BD9 C6835C03000000 mov byte ptr [ebx+0000035C], 00

:004E1BE0 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"Windows Tools 注册提示:"

|

:004E1BE2 68F41C4E00 push 004E1CF4

* Possible StringData Ref from Data Obj ->"对不起，注册未被认证！请检查“注册确认码”。"

|

:004E1BE7 68301D4E00 push 004E1D30

下面进入004E1AA8的call，看看算法

* Referenced by a CALL at Address:

|:004E1AA8

|

:004E18A8 55 push ebp

:004E18A9 8BEC mov ebp, esp

:004E18AB 83C4F8 add esp, FFFFFFF8

:004E18AE 53 push ebx

:004E18AF 56 push esi

:004E18B0 57 push edi

:004E18B1 8BFA mov edi, edx

:004E18B3 8945FC mov dword ptr [ebp-04], eax

:004E18B6 8B45FC mov eax, dword ptr [ebp-04]

:004E18B9 E86A34F2FF call 00404D28

:004E18BE 33C0 xor eax, eax

:004E18C0 55 push ebp

:004E18C1 6821194E00 push 004E1921

:004E18C6 64FF30 push dword ptr fs:[eax]

:004E18C9 648920 mov dword ptr fs:[eax], esp

:004E18CC 8B45FC mov eax, dword ptr [ebp-04]

:004E18CF E86C32F2FF call 00404B40

:004E18D4 84C0 test al, al

:004E18D6 7629 jbe 004E1901

:004E18D8 8845FB mov byte ptr [ebp-05], al //把机器码的长度值送入ebp-05

:004E18DB B301 mov bl, 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004E18FF(C)

|

:004E18DD 8D45FC lea eax, dword ptr [ebp-04] //把机器码的字符串送到EAX

:004E18E0 E8AB34F2FF call 00404D90

:004E18E5 8BF3 mov esi, ebx

:004E18E7 81E6FF000000 and esi, 000000FF

:004E18ED 8B55FC mov edx, dword ptr [ebp-04]

:004E18F0 8A5432FF mov dl, byte ptr [edx+esi-01]//依次把机器码字符串的ASCII值送到BL

:004E18F4 80F207 xor dl, 07 //BL^07h

:004E18F7 885430FF mov byte ptr [eax+esi-01], dl //把结果送回EAX

:004E18FB 43 inc ebx //EBX加1

:004E18FC FE4DFB dec [ebp-05] //ebp-05减1

:004E18FF 75DC jne 004E18DD //机器码未取完，继续循环！

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004E18D6(C)

|

:004E1901 8BC7 mov eax, edi //到这里注册码计算结束,D EAX＝注册码

:004E1903 8B55FC mov edx, dword ptr [ebp-04]

:004E1906 E8D12FF2FF call 004048DC

:004E190B 33C0 xor eax, eax

:004E190D 5A pop edx

:004E190E 59 pop ecx

:004E190F 59 pop ecx

:004E1910 648910 mov dword ptr fs:[eax], edx

:004E1913 6828194E00 push 004E1928

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004E1926(U)

|

:004E1918 8D45FC lea eax, dword ptr [ebp-04]

:004E191B E8682FF2FF call 00404888

:004E1920 C3 ret

总结：

这个软件的注册码计算很简单，依次将机器码字符串的ASCII值与07h异或，即可得到，与注册名无关。

内存注册机制作：

中断地址：4E1AAD

中断次数：1

第一字节：8B

指令长度：3

内存方式：EDX

生成即可。

（出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net