[转载]ScreenHunter 4.2 Pro 注册算法分析
<P>文章作者:ForEver</P><P><FONT face=宋体>【软件名称】ScreenHunter4.2Pro<BR>【破文作者】forever[RCT]<BR>【编程语言】VC<BR>【保护方式】简单运算<BR>【使用工具】peid0.93,exescope6.5,ida4.6,ollydbg1.1<BR>【软件简介】ScreenHunter是一个非常好的屏幕抓取工具，除了基本常见的功能外，他还可以抓取椭圆的选取区，抓取Word文件，还可以自动产生文件名称，定时抓取屏幕，抓取DirectX游戏及屏幕保护程序的屏幕，转存JPEG、GIF、PNG、BMP文件。<BR>【下载地址】[url]http://www4.skycn.com/soft/5021.html[/url]<BR>【破文正文】<BR>首先声明一下，这篇帖子是写给新手的。:)<BR>突然发现，写破文其实是一件很辛苦的事，尤其是想把整个过程写清楚的时候。向那些写了大量破文的前辈们道声辛苦吧。;)<BR>我尽量把过程写的易懂些，不过我还是假定你会使用基本的工具，懂得编程的基本知识。关于MFC的消息处理函数的查找过程<BR>我前面有过一篇帖子<从对话框的构造函数找到消息处理过程>，如果你不太清楚下面的过程可以参考一下前面的帖子。下面我只写<BR>下整个过程。我不在这里对代码做逆向分析了，我只是在注释里尽量写的清楚些。这样可以省掉很多时间:)<BR><BR>首先检查软件的编程语言，peid侦测出是VC，大多数情况下这是可信的。用od和ida载入也证实确实是VC的。<BR>软件启动时有个NAP窗口提示输入注册码，我用exescope找到这个窗口的资源id是1797h,ok按钮的id是1d4h。了解这些信息是有用的。<BR>现在用ida载入软件分析。我以前做过一个mfc4.2的sig，如果你使用这个sig，会检测出更多的函数名。<BR>在Name窗口里查找"CDialog::CDialog(unsignedint,classCWnd*)",来到下面，<BR><BR>.text:0054A50Fpublic:__thiscallCDialog::CDialog(unsignedint,classCWnd*)procnear<BR>.text:0054A50F<BR>.text:0054A50Farg_0=dwordptr0Ch<BR>.text:0054A50Farg_4=dwordptr10h<BR>.text:0054A50F<BR>.text:0054A50Fpushesi<BR>.text:0054A510pushedi<BR>.text:0054A511movesi,ecx<BR>.text:0054A513callCWnd::CWnd(void)<BR>.text:0054A518leaedi,[esi+3Ch]<BR>.text:0054A51Bpush20h;size_t<BR>.text:0054A51Dpush0;int<BR>.text:0054A51Fpushedi;void*<BR>.text:0054A520movdwordptr[esi],offsetoff_5838D4<BR>.text:0054A526call_memset<BR>.text:0054A52Bmoveax,[esp+0Ch+arg_4]<BR>.text:0054A52Faddesp,0Ch<BR>.text:0054A532mov[esi+50h],eax<BR>.text:0054A535moveax,[esp+arg_0]<BR>.text:0054A539movzxecx,ax<BR>.text:0054A53Cmov[edi],eax<BR>.text:0054A53Emov[esi+40h],ecx<BR>.text:0054A541moveax,esi<BR>.text:0054A543popedi<BR>.text:0054A544popesi<BR>.text:0054A545retn8<BR>.text:0054A545public:__thiscallCDialog::CDialog(unsignedint,classCWnd*)endp<BR>;=================================================================================<BR>为什么要找这个函数呢？因为这个函数是对话框类的构造函数，自定义对话框在初始化时肯定要调用这个函数。<BR><BR>在名字CDialog::CDialog上右击，选择菜单Jumptoxreftooperand，来到下面，<BR>Uppsub_40E7A7+CcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_411987+1BcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_414C64+1BcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_437218+1BcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_43F20C+1BcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_4460F4+1BcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_44D3FD+1AcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_46F72B+CcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_486E87+1BcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_4A89B6+1DcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_4AF524+1BcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_4BC73F+1BcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_4C0301+1AcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_4C2F1A+1AcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_4C5B16+1AcallCDialog::CDialog(uint,CWnd*)<BR>Uppsub_4C8639+1AcallCDialog::CDialog(uint,CWnd*)<BR>UppCFileDialog::CFileDialog(int,charconst*,charconst*,ulong,charconst*,CWnd*)+19callCDialog::CDia<BR>UppCFontDialog::CFontDialog(tagLOGFONTA*,ulong,CDC*,CWnd*)+19callCDialog::CDialog(uint,CWnd*)<BR>UppCFontDialog::CFontDialog(_charformatconst&,ulong,CDC*,CWnd*)+19callCDialog::CDialog(uint,CWnd*)<BR>UppCColorDialog::CColorDialog(ulong,ulong,CWnd*)+17callCDialog::CDialog(uint,CWnd*)<BR>UppCPageSetupDialog::CPageSetupDialog(ulong,CWnd*)+17callCDialog::CDialog(uint,CWnd*)<BR>UppCPrintDialog::CPrintDialog(int,ulong,CWnd*)+18callCDialog::CDialog(uint,CWnd*)<BR>UppCPrintDialog::CPrintDialog(tagPDA&)+7callCDialog::CDialog(uint,CWnd*)<BR>UppCFindReplaceDialog::CFindReplaceDialog(void)+17callCDialog::CDialog(uint,CWnd*)<BR>DownpCDocManager::OnFileNew(void)+3DcallCDialog::CDialog(uint,CWnd*)<BR><BR>;=================================================================================<BR><BR>这里就是对CDialog::CDialog引用的地方了。注意找对话框资源号为1797h的函数。（使用exescope查看注册对话框资源）<BR>来到下面：<BR>.text:0043F20Csub_43F20Cprocnear;CODEXREF:sub_46973F+31p<BR>.text:0043F20Cmoveax,offsetunknown_libname_1324<BR>.text:0043F211call__EH_prolog<BR>.text:0043F216pushecx<BR>.text:0043F217pushebx<BR>.text:0043F218pushesi<BR>.text:0043F219pushedi<BR>.text:0043F21Amovesi,ecx<BR>.text:0043F21Cpushdwordptr[ebp+8]<BR>.text:0043F21Fmov[ebp-10h],esi<BR>.text:0043F222push1797h;注册对话框<BR>.text:0043F227callCDialog::CDialog(uint,CWnd*)//构造注册对话框的地方，这就是<BR>.text:0043F22Canddwordptr[ebp-4],0//从CDialog::CDialog下手的原因<BR>.text:0043F230leaebx,[esi+5Ch]<BR>.text:0043F233movecx,ebx<BR>.text:0043F235callCWnd::CWnd(void)<BR>.text:0043F23Amovedi,offsetoff_584E04<BR>.text:0043F23Fmov[ebx],edi<BR>.text:0043F241leaebx,[esi+98h]<BR>.text:0043F247movbyteptr[ebp-4],1<BR>.text:0043F24Bmovecx,ebx<BR>.text:0043F24DcallCWnd::CWnd(void)<BR>.text:0043F252mov[ebx],edi<BR>.text:0043F254leaebx,[esi+0D4h]<BR>.text:0043F25Amovbyteptr[ebp-4],2<BR>.text:0043F25Emovecx,ebx<BR>.text:0043F260callCWnd::CWnd(void)<BR>.text:0043F265mov[ebx],edi<BR>.text:0043F267leaebx,[esi+110h]<BR>.text:0043F26Dmovbyteptr[ebp-4],3<BR>.text:0043F271movecx,ebx<BR>.text:0043F273callCWnd::CWnd(void)<BR>.text:0043F278mov[ebx],edi<BR>.text:0043F27Aleaebx,[esi+14Ch]<BR>.text:0043F280movbyteptr[ebp-4],4<BR>.text:0043F284movecx,ebx<BR>.text:0043F286callCWnd::CWnd(void)<BR>.text:0043F28Bmov[ebx],edi<BR>.text:0043F28Dmoveax,dword_5D537C<BR>.text:0043F292leaebx,[esi+188h]<BR>.text:0043F298mov[ebx],eax<BR>.text:0043F29Amoveax,dword_5D537C<BR>.text:0043F29Fmov[esi+18Ch],eax<BR>.text:0043F2A5moveax,dword_5D537C<BR>.text:0043F2AAmov[esi+190h],eax<BR>.text:0043F2B0moveax,dword_5D537C<BR>.text:0043F2B5mov[esi+194h],eax<BR>.text:0043F2BBmoveax,dword_5D537C<BR>.text:0043F2C0mov[esi+198h],eax<BR>.text:0043F2C6leaecx,[esi+19Ch]<BR>.text:0043F2CCmovbyteptr[ebp-4],0Ah<BR>.text:0043F2D0callsub_5430CA<BR>.text:0043F2D5movedi,offsetWindowName<BR>.text:0043F2DAmovecx,ebx<BR>.text:0043F2DCpushedi<BR>.text:0043F2DDmovbyteptr[ebp-4],0Bh<BR>.text:0043F2E1movdwordptr[esi],offsetoff_57AEE0//这个地址里对话框的虚函数表<BR>.text:0043F2E7callCString::operator=(charconst*)//一般都是在ESI或者EDI里<BR>.text:0043F2ECpushedi<BR>.text:0043F2EDleaecx,[esi+18Ch]<BR>.text:0043F2F3callCString::operator=(charconst*)<BR>.text:0043F2F8pushedi<BR>.text:0043F2F9leaecx,[esi+190h]<BR>.text:0043F2FFcallCString::operator=(charconst*)<BR>.text:0043F304pushedi<BR>.text:0043F305leaecx,[esi+194h]<BR>.text:0043F30BcallCString::operator=(charconst*)<BR>.text:0043F310pushedi<BR>.text:0043F311leaecx,[esi+198h]<BR>.text:0043F317callCString::operator=(charconst*)//上面连续5个字符串应该是保存<BR>.text:0043F31Cpush0FFFFFFFFh//注册码用的<BR>.text:0043F31Epush5<BR>.text:0043F320leaecx,[esi+19Ch]<BR>.text:0043F326callCStringArray::SetSize(int,int)<BR>.text:0043F32Bmovecx,[ebp-0Ch]<BR>.text:0043F32Emoveax,esi<BR>.text:0043F330popedi<BR>.text:0043F331popesi<BR>.text:0043F332popebx<BR>.text:0043F333movlargefs:0,ecx<BR>.text:0043F33Aleave<BR>.text:0043F33Bretn4<BR>.text:0043F33Bsub_43F20Cendp;sp=4<BR>;=================================================================================<BR>跟踪对话框的虚函数表地址57AEE0，来到下面：<BR><BR>.rdata:0057AEE0off_57AEE0ddoffsetsub_563B94;DATAXREF:sub_43F20C+D5o<BR>.rdata:0057AEE4ddoffsetsub_43F33E<BR>.rdata:0057AEE8ddoffsetnullsub_50<BR>.rdata:0057AEECddoffsetunknown_libname_12862;?OnCmdMsg@CPropertySheet@@UAEHIHPAXPAUAFX_CMDHANDLERINFO@@@Z<BR>.rdata:0057AEEC;doubtfulname<BR>.rdata:0057AEF0ddoffsetCWnd::OnFinalRelease(void)<BR>.rdata:0057AEF4ddoffsetunknown_libname_884<BR>.rdata:0057AEF8ddoffsetunknown_libname_885<BR>.rdata:0057AEFCddoffsetsub_54B286<BR>.rdata:0057AF00ddoffsetsub_54B289<BR>.rdata:0057AF04ddoffsetCCmdTarget::GetTypeLib(ulong,ITypeLib**)<BR>.rdata:0057AF08ddoffsetsub_43F4E4//消息映射函数,继续跟踪这里<BR>.rdata:0057AF0Cddoffsetsub_54B336<BR>.rdata:0057AF10ddoffsetsub_54B2D9<BR>.rdata:0057AF14ddoffsetsub_54B326<BR>.rdata:0057AF18ddoffsetsub_54B2E5<BR>.rdata:0057AF1Cddoffsetsub_54B2DF<BR>.rdata:0057AF20ddoffsetsub_54B31D<BR>.rdata:0057AF24ddoffsetunknown_libname_886<BR>.rdata:0057AF28ddoffsetunknown_libname_888<BR>.rdata:0057AF2Cddoffsetunknown_libname_887<BR>.rdata:0057AF30ddoffsetnullsub_24<BR>.rdata:0057AF34ddoffsetCWnd::Create(charconst*,charconst*,ulong,tagRECTconst&,CWnd*,uint,CCreateContext*)<BR>.rdata:0057AF38ddoffsetCWnd::DestroyWindow(void)<BR>.rdata:0057AF3CddoffsetCWnd::PreCreateWindow(tagCREATESTRUCTA&)<BR>.rdata:0057AF40ddoffsetCWnd::CalcWindowRect(tagRECT*,uint)<BR>.rdata:0057AF44ddoffsetCWnd::OnToolHitTest(CPoint,tagTOOLINFOA*)<BR>.rdata:0057AF48ddoffsetunknown_libname_880<BR>.rdata:0057AF4CddoffsetCWnd::WinHelpA(ulong,uint)<BR>.rdata:0057AF50ddoffsetCWnd::ContinueModal(void)<BR>.rdata:0057AF54ddoffsetCWnd::EndModalLoop(int)<BR>.rdata:0057AF58ddoffsetCWnd::OnCommand(uint,long)<BR>.rdata:0057AF5CddoffsetCWnd::OnNotify(uint,long,long*)<BR>.rdata:0057AF60ddoffsetsub_546855<BR>.rdata:0057AF64ddoffsetsub_43F428<BR>.rdata:0057AF68ddoffsetCWnd::BeginModalState(void)<BR>.rdata:0057AF6CddoffsetCWnd::EndModalState(void)<BR>.rdata:0057AF70ddoffsetCDialog::PreTranslateMessage(tagMSG*)<BR>.rdata:0057AF74ddoffsetCWnd::OnAmbientProperty(COleControlSite*,long,tagVARIANT*)<BR>.rdata:0057AF78ddoffsetCWnd::WindowProc(uint,uint,long)<BR>.rdata:0057AF7CddoffsetCWnd::OnWndMsg(uint,uint,long,long*)<BR>.rdata:0057AF80ddoffsetCWnd::DefWindowProcA(uint,uint,long)<BR>.rdata:0057AF84ddoffsetnullsub_25<BR>.rdata:0057AF88ddoffsetCWnd::OnChildNotify(uint,uint,long,long*)<BR>.rdata:0057AF8CddoffsetCDialog::CheckAutoCenter(void)<BR>.rdata:0057AF90ddoffsetsub_548E97<BR>.rdata:0057AF94ddoffsetCDialog::SetOccDialogInfo(_AFX_OCC_DIALOG_INFO*)<BR>.rdata:0057AF98ddoffsetCDialog::DoModal(void)<BR>.rdata:0057AF9Cddoffsetsub_43F4EA<BR>.rdata:0057AFA0ddoffsetnullsub_52<BR>.rdata:0057AFA4ddoffsetCDialog::OnOK(void)<BR>.rdata:0057AFA8ddoffsetCDialog::OnCancel(void)<BR>.rdata:0057AFACddoffsetnullsub_53<BR>;=================================================================================<BR><BR>注意CCmdTarget::GetTypeLib，跟踪这个函数下面的那个函数的地址43F4E4，可以找到处理这个对话框消息的函数。<BR><BR>.text:0043F4E4sub_43F4E4procnear;DATAXREF:.rdata:0057AF08o<BR>.text:0043F4E4moveax,offsetoff_57AE30<BR>.text:0043F4E9retn<BR>.text:0043F4E9sub_43F4E4endp<BR>;=================================================================================<BR>继续跟踪地址57AE30,来到下面：<BR>.rdata:0057AE30off_57AE30ddoffsetoff_5837E8//指向父类的消息处理函数<BR>.rdata:0057AE34ddoffsetdword_57AE38//本对话框的消息处理函数<BR>.rdata:0057AE38dword_57AE38dd111h<BR>.rdata:0057AE3Cdd0<BR>.rdata:0057AE40dd627h<BR>.rdata:0057AE44dd627h<BR>.rdata:0057AE48dd0Ch<BR>.rdata:0057AE4Cdd43F682h<BR>.rdata:0057AE50dd111h<BR>.rdata:0057AE54dd0<BR>.rdata:0057AE58dd1D3h<BR>.rdata:0057AE5Cdd1D3h<BR>.rdata:0057AE60dd0Ch<BR>.rdata:0057AE64dd43F6A0h<BR>.rdata:0057AE68dd111h//WM_COMMAND消息<BR>.rdata:0057AE6Cdd0<BR>.rdata:0057AE70dd1D4h<BR>.rdata:0057AE74dd1D4h//ok按钮id<BR>.rdata:0057AE78dd0Ch<BR>.rdata:0057AE7Cdd43F6B7h//ok按钮的处理函数<BR>.rdata:0057AE80dd111h<BR>.rdata:0057AE84dd0<BR>.rdata:0057AE88dd7D6h<BR>.rdata:0057AE8Cdd7D6h<BR>.rdata:0057AE90dd0Ch<BR>.rdata:0057AE94dd43F7A4h<BR>.rdata:0057AE98dd19h<BR>.rdata:0057AE9Cdd0<BR>.rdata:0057AEA0dd0<BR>.rdata:0057AEA4dd0<BR>.rdata:0057AEA8dd4<BR>.rdata:0057AEACdd43F7ADh<BR>.rdata:0057AEB0dd111h<BR>.rdata:0057AEB4dd0<BR>.rdata:0057AEB8dd623h<BR>.rdata:0057AEBCdd623h<BR>.rdata:0057AEC0dd0Ch<BR>.rdata:0057AEC4dd43F867h<BR>.rdata:0057AEC8dd0<BR>.rdata:0057AECCdd0<BR>.rdata:0057AED0dd0<BR>.rdata:0057AED4dd0<BR>.rdata:0057AED8dd0<BR>.rdata:0057AEDCdd0<BR>;=================================================================================<BR><BR>好了，现在找到了注册对话框中的ok按钮的处理函数，看一下这个函数：<BR>.text:0043F6B7sub_43F6B7procnear<BR>.text:0043F6B7moveax,offsetunknown_libname_1327<BR>.text:0043F6BCcall__EH_prolog<BR>.text:0043F6C1pushecx<BR>.text:0043F6C2pushesi<BR>.text:0043F6C3movesi,ecx<BR>.text:0043F6C5push1<BR>.text:0043F6C7callCWnd::UpdateData(int)<BR>.text:0043F6CCmovecx,[esi+1A0h]<BR>.text:0043F6D2leaeax,[esi+188h]<BR>.text:0043F6D8pusheax<BR>.text:0043F6D9callCString::operator=(CStringconst&)<BR>.text:0043F6DEmovecx,[esi+1A0h]<BR>.text:0043F6E4leaeax,[esi+18Ch]<BR>.text:0043F6EApusheax<BR>.text:0043F6EBaddecx,4<BR>.text:0043F6EEcallCString::operator=(CStringconst&)<BR>.text:0043F6F3movecx,[esi+1A0h]<BR>.text:0043F6F9leaeax,[esi+190h]<BR>.text:0043F6FFpusheax<BR>.text:0043F700addecx,8<BR>.text:0043F703callCString::operator=(CStringconst&)<BR>.text:0043F708movecx,[esi+1A0h]<BR>.text:0043F70Eleaeax,[esi+194h]<BR>.text:0043F714pusheax<BR>.text:0043F715addecx,0Ch<BR>.text:0043F718callCString::operator=(CStringconst&)<BR>.text:0043F71Dmovecx,[esi+1A0h]<BR>.text:0043F723leaeax,[esi+198h]<BR>.text:0043F729pusheax<BR>.text:0043F72Aaddecx,10h<BR>.text:0043F72DcallCString::operator=(CStringconst&)<BR>.text:0043F732leaeax,[esi+19Ch]<BR>.text:0043F738push0<BR>.text:0043F73Apusheax<BR>.text:0043F73Bmovecx,offsetunk_5ECE48<BR>.text:0043F740callsub_46CB82//这里是关键函数，下面着重分析<BR>.text:0043F745testeax,eax<BR>.text:0043F747jzshortloc_43F750//返回0就失败了<BR>.text:0043F749movecx,esi<BR>.text:0043F74BcallCDialog::OnOK(void)<BR>.text:0043F750<BR>.text:0043F750loc_43F750:<BR>.text:0043F750moveax,dword_5D537C//到这里就是注册失败提示了<BR>.text:0043F755mov[ebp-10h],eax<BR>.text:0043F758anddwordptr[ebp-4],0<BR>.text:0043F75Cpush0Dh;InvalidLicenseKey.PleasetryagainorcontactWisdomSoftware<BR>.text:0043F75Eleaecx,[ebp-10h]<BR>.text:0043F761callCString::LoadStringA(uint)<BR>.text:0043F766push1037h<BR>.text:0043F76Bmovecx,esi<BR>.text:0043F76DcallCWnd::GetDlgItem(int)<BR>.text:0043F772testeax,eax<BR>.text:0043F774jzshortloc_43F780<BR>.text:0043F776pushdwordptr[ebp-10h]<BR>.text:0043F779movecx,eax<BR>.text:0043F77BcallCWnd::SetWindowTextA(charconst*)<BR>.text:0043F780<BR>.text:0043F780loc_43F780:<BR>.text:0043F780leaecx,[esi+14Ch]<BR>.text:0043F786callCWnd::SetFocus(void)<BR>.text:0043F78Bordwordptr[ebp-4],0FFFFFFFFh<BR>.text:0043F78Fleaecx,[ebp-10h]<BR>.text:0043F792callCString::~CString(void)<BR>.text:0043F797movecx,[ebp-0Ch]<BR>.text:0043F79Apopesi<BR>.text:0043F79Bmovlargefs:0,ecx<BR>.text:0043F7A2leave<BR>.text:0043F7A3retn<BR>.text:0043F7A3sub_43F6B7endp;sp=4<BR>;=================================================================================<BR><BR>跟进关键函数46CB82:<BR><BR>.text:0046CB82sub_46CB82procnear<BR>.text:0046CB82moveax,offsetunknown_libname_1421<BR>.text:0046CB87call__EH_prolog<BR>.text:0046CB8Cpushecx<BR>.text:0046CB8Dpushebx<BR>.text:0046CB8Exorebx,ebx<BR>.text:0046CB90pushesi<BR>.text:0046CB91pushedi<BR>.text:0046CB92movesi,ecx<BR>.text:0046CB94mov[ebp-10h],ebx<BR>.text:0046CB97pushebx<BR>.text:0046CB98pushebx<BR>.text:0046CB99push0F003Fh<BR>.text:0046CB9Epushebx<BR>.text:0046CB9Fpushebx<BR>.text:0046CBA0leaecx,[ebp-10h]<BR>.text:0046CBA3pushdword_5F0CC8<BR>.text:0046CBA9mov[ebp-4],ebx<BR>.text:0046CBACpush80000001h<BR>.text:0046CBB1callsub_466121<BR>.text:0046CBB6cmpeax,ebx<BR>.text:0046CBB8jlloc_46CCFE<BR>.text:0046CBBEpushdwordptr[ebp+0Ch]<BR>.text:0046CBC1movedi,[ebp+8]<BR>.text:0046CBC4pushedi<BR>.text:0046CBC5callfun1_422C8E//检验函数1*****<BR>.text:0046CBCApopecx<BR>.text:0046CBCBtesteax,eax<BR>.text:0046CBCDpopecx<BR>.text:0046CBCEjzloc_46CCFC<BR>.text:0046CBD4<BR>.text:0046CBD4loc_46CBD4:<BR>.text:0046CBD4moveax,ebx<BR>.text:0046CBD6movecx,ebx<BR>.text:0046CBD8addeax,[edi+4]<BR>.text:0046CBDBaddecx,[esi+120h]<BR>.text:0046CBE1pusheax<BR>.text:0046CBE2callCString::operator=(CStringconst&)<BR>.text:0046CBE7addebx,4<BR>.text:0046CBEAcmpebx,20//把5组注册码拷贝到[esi+120h]处<BR>.text:0046CBEDjlshortloc_46CBD4<BR>.text:0046CBEFpush1<BR>.text:0046CBF1leaeax,[esi+11Ch]<BR>.text:0046CBF7popebx<BR>.text:0046CBF8pusheax<BR>.text:0046CBF9mov[esi+130h],ebx<BR>.text:0046CBFFcallfun2_422EF1//检验函数2*****<BR>.text:0046CC04testeax,eax<BR>.text:0046CC06popecx<BR>.text:0046CC07jzshortloc_46CC0F<BR>.text:0046CC09mov[esi+134h],ebx<BR>.text:0046CC0F<BR>.text:0046CC0Floc_46CC0F:<BR>.text:0046CC0Fmovecx,[esi+120h]<BR>.text:0046CC15leaeax,[ebp+0Ch]<BR>.text:0046CC18pushebx;1<BR>.text:0046CC19pusheax<BR>.text:0046CC1Aaddecx,8<BR>.text:0046CC1DcallCString::Left(int)//取第三组注册码左边一个字符<BR>.text:0046CC22pusheax<BR>.text:0046CC23leaecx,[esi+4C4h]//保存到这里<BR>.text:0046CC29mov[ebp-4],bl<BR>.text:0046CC2CcallCString::operator=(CStringconst&)<BR>.text:0046CC31andbyteptr[ebp-4],0<BR>.text:0046CC35leaecx,[ebp+0Ch]<BR>.text:0046CC38callCString::~CString(void)<BR>.text:0046CC3Dmovecx,[esi+120h]<BR>.text:0046CC43leaeax,[ebp+0Ch]<BR>.text:0046CC46push2<BR>.text:0046CC48pusheax<BR>.text:0046CC49addecx,4<BR>.text:0046CC4CcallCString::Left(int)//取第二组注册码左边2个字符<BR>.text:0046CC51pusheax<BR>.text:0046CC52leaecx,[esi+4C8h]//保存到这里<BR>.text:0046CC58movbyteptr[ebp-4],2<BR>.text:0046CC5CcallCString::operator=(CStringconst&)<BR>.text:0046CC61andbyteptr[ebp-4],0<BR>.text:0046CC65leaecx,[ebp+0Ch]<BR>.text:0046CC68callCString::~CString(void)<BR>.text:0046CC6Dxoredi,edi<BR>.text:0046CC6F<BR>.text:0046CC6Floc_46CC6F:<BR>.text:0046CC6Fmoveax,edi<BR>.text:0046CC71pushebx;1<BR>.text:0046CC72addeax,[esi+120h]<BR>.text:0046CC78pusheax<BR>.text:0046CC79callsub_4230E4;对字符串加密处理<BR>.text:0046CC7Eaddedi,4<BR>.text:0046CC81popecx<BR>.text:0046CC82cmpedi,14h<BR>.text:0046CC85popecx<BR>.text:0046CC86jlshortloc_46CC6F<BR>.text:0046CC88moveax,[esi+120h]<BR>.text:0046CC8Eleaecx,[ebp-10h]<BR>.text:0046CC91pushdwordptr[eax];以下5个函数保存注册码到注册表<BR>.text:0046CC93pushkey_5F0F5C<BR>.text:0046CC99callsub_466387<BR>.text:0046CC9Emoveax,[esi+120h]<BR>.text:0046CCA4leaecx,[ebp-10h]<BR>.text:0046CCA7pushdwordptr[eax+4]<BR>.text:0046CCAApushkey_5F0F58<BR>.text:0046CCB0callsub_466387<BR>.text:0046CCB5moveax,[esi+120h]<BR>.text:0046CCBBleaecx,[ebp-10h]<BR>.text:0046CCBEpushdwordptr[eax+8]<BR>.text:0046CCC1pushkey_5F0F54<BR>.text:0046CCC7callsub_466387<BR>.text:0046CCCCmoveax,[esi+120h]<BR>.text:0046CCD2leaecx,[ebp-10h]<BR>.text:0046CCD5pushdwordptr[eax+0Ch]<BR>.text:0046CCD8pushkey_5F0F50<BR>.text:0046CCDEcallsub_466387<BR>.text:0046CCE3moveax,[esi+120h]<BR>.text:0046CCE9leaecx,[ebp-10h]<BR>.text:0046CCECpushdwordptr[eax+10h]<BR>.text:0046CCEFpushkey_5F0F4C<BR>.text:0046CCF5callsub_466387<BR>.text:0046CCFAjmpshortloc_46CCFE<BR>.text:0046CCFC;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:0046CCFC<BR>.text:0046CCFCloc_46CCFC:<BR>.text:0046CCFCxorebx,ebx<BR>.text:0046CCFE<BR>.text:0046CCFEloc_46CCFE:<BR>.text:0046CCFE<BR>.text:0046CCFEordwordptr[ebp-4],0FFFFFFFFh<BR>.text:0046CD02leaecx,[ebp-10h]<BR>.text:0046CD05callsub_46610A<BR>.text:0046CD0Amovecx,[ebp-0Ch]<BR>.text:0046CD0Dpopedi<BR>.text:0046CD0Emoveax,ebx<BR>.text:0046CD10popesi<BR>.text:0046CD11popebx<BR>.text:0046CD12movlargefs:0,ecx<BR>.text:0046CD19leave<BR>.text:0046CD1Aretn8<BR>.text:0046CD1Asub_46CB82endp;sp=4<BR><BR>可以看出,上面共有2个验证的函数,下面分别分析:<BR>先看fun1_422C8E:<BR>=================================================================<BR>text:00422C8Efun1_422C8Eprocnear<BR>.text:00422C8E<BR>.text:00422C8Emoveax,offsetunknown_libname_1253<BR>.text:00422C93call__EH_prolog<BR>.text:00422C98subesp,44h<BR>.text:00422C9Bpushebx<BR>.text:00422C9Cpushesi<BR>.text:00422C9Dmovesi,[ebp+8]<BR>.text:00422CA0pushedi<BR>.text:00422CA1moveax,[esi+8]<BR>.text:00422CA4cmpeax,5<BR>.text:00422CA7jnzloc_422E62<BR>.text:00422CADmoveax,[esi+4]<BR>.text:00422CB0xorebx,ebx<BR>.text:00422CB2xorecx,ecx<BR>.text:00422CB4<BR>.text:00422CB4loc_422CB4:<BR>.text:00422CB4movedx,[eax]<BR>.text:00422CB6cmpdwordptr[edx-8],4<BR>.text:00422CBAjnzloc_422E64<BR>.text:00422CC0incecx<BR>.text:00422CC1addeax,4<BR>.text:00422CC4cmpecx,5;检查5组注册码是否都是4个字符<BR>.text:00422CC7jlshortloc_422CB4<BR>.text:00422CC9xoredi,edi<BR>.text:00422CCB<BR>.text:00422CCBloc_422CCB:<BR>.text:00422CCBmoveax,[esi+4]<BR>.text:00422CCEpushdwordptr[edi+eax];char*<BR>.text:00422CD1leaeax,[ebp-28h]<BR>.text:00422CD4pusheax;char*<BR>.text:00422CD5call_strcpy;拷贝一组注册码到[ebp-28]<BR>.text:00422CDAmovzxeax,byteptr[ebp-26h];取第三个字符到eax<BR>.text:00422CDEpopecx<BR>.text:00422CDFpopecx<BR>.text:00422CE0movzxecx,byteptr[ebp-27h];取第二个字符到ecx<BR>.text:00422CE4addeax,ecx;第三个字符和第二个字符相加，和到eax<BR>.text:00422CE6push26<BR>.text:00422CE8movzxecx,byteptr[ebp-28h];取第一个字符到ecx<BR>.text:00422CECaddeax,ecx;上面的和和第一个字符相加，和到eax<BR>.text:00422CEEpopecx<BR>.text:00422CEFcdq<BR>.text:00422CF0idivecx;和模上26<BR>.text:00422CF2adddl,40h;加上40h<BR>.text:00422CF5cmpdl,40h<BR>.text:00422CF8jnzshortloc_422CFD<BR>.text:00422CFAadddl,26;结果为40h则再加上26<BR>.text:00422CFD<BR>.text:00422CFDloc_422CFD:<BR>.text:00422CFDcmpdl,[ebp-25h];和第四个字符比较，不等则失败<BR>.text:00422D00jnzloc_422E64<BR>.text:00422D06addedi,4<BR>.text:00422D09cmpedi,10h;依次处理前4组<BR>.text:00422D0Cjlshortloc_422CCB<BR>.text:00422D0Emov[ebp-10h],ebx;索引初始化为0<BR>.text:00422D11movebx,offsetasc_5C8424;"------"<BR>.text:00422D16<BR>.text:00422D16loc_422D16:<BR>.text:00422D16movesi,ebx<BR>.text:00422D18leaedi,[ebp-48h];[ebp-48]填充6个"-"字符<BR>.text:00422D1Bmovsd<BR>.text:00422D1Cpush1<BR>.text:00422D1Eleaeax,[ebp-14h]<BR>.text:00422D21pushdwordptr[ebp-10h];索引<BR>.text:00422D24movsw<BR>.text:00422D26pusheax<BR>.text:00422D27moveax,[ebp+8]<BR>.text:00422D2Amovsb<BR>.text:00422D2Bmovecx,[eax+4];第一组注册码<BR>.text:00422D2EcallCString::Mid(int,int)<BR>.text:00422D33pushdwordptr[eax];char*;取第一组注册码索引处一个字符<BR>.text:00422D35leaeax,[ebp-48h]<BR>.text:00422D38pusheax;char*<BR>.text:00422D39call_strcpy;拷贝到[ebp-48]<BR>.text:00422D3Epopecx<BR>.text:00422D3Fpopecx<BR>.text:00422D40leaecx,[ebp-14h]<BR>.text:00422D43callCString::~CString(void)<BR>.text:00422D48movesi,ebx<BR>.text:00422D4Aleaedi,[ebp-40h]<BR>.text:00422D4Dpush1<BR>.text:00422D4Fleaeax,[ebp-18h]<BR>.text:00422D52pushdwordptr[ebp-10h];索引<BR>.text:00422D55movsd<BR>.text:00422D56pusheax<BR>.text:00422D57moveax,[ebp+8]<BR>.text:00422D5Amovsw<BR>.text:00422D5Cmovecx,[eax+4]<BR>.text:00422D5Faddecx,4;第二组注册码<BR>.text:00422D62movsb<BR>.text:00422D63callCString::Mid(int,int)<BR>.text:00422D68pushdwordptr[eax];char*;取第二组注册码索引处一个字符<BR>.text:00422D6Aleaeax,[ebp-40h]<BR>.text:00422D6Dpusheax;char*<BR>.text:00422D6Ecall_strcpy;拷贝到[ebp-40]<BR>.text:00422D73popecx<BR>.text:00422D74popecx<BR>.text:00422D75leaecx,[ebp-18h]<BR>.text:00422D78callCString::~CString(void)<BR>.text:00422D7Dmovesi,ebx<BR>.text:00422D7Fleaedi,[ebp-38h]<BR>.text:00422D82push1<BR>.text:00422D84leaeax,[ebp-1Ch]<BR>.text:00422D87pushdwordptr[ebp-10h];索引<BR>.text:00422D8Amovsd<BR>.text:00422D8Bpusheax<BR>.text:00422D8Cmoveax,[ebp+8]<BR>.text:00422D8Fmovsw<BR>.text:00422D91movecx,[eax+4]<BR>.text:00422D94addecx,8;第三组注册码<BR>.text:00422D97movsb<BR>.text:00422D98callCString::Mid(int,int);取第三组注册码索引处一个字符<BR>.text:00422D9Dpushdwordptr[eax];char*<BR>.text:00422D9Fleaeax,[ebp-38h]<BR>.text:00422DA2pusheax;char*<BR>.text:00422DA3call_strcpy;拷贝到[ebp-38]<BR>.text:00422DA8popecx<BR>.text:00422DA9popecx<BR>.text:00422DAAleaecx,[ebp-1Ch]<BR>.text:00422DADcallCString::~CString(void)<BR>.text:00422DB2movesi,ebx<BR>.text:00422DB4leaedi,[ebp-30h]<BR>.text:00422DB7push1<BR>.text:00422DB9leaeax,[ebp-20h]<BR>.text:00422DBCpushdwordptr[ebp-10h];索引<BR>.text:00422DBFmovsd<BR>.text:00422DC0pusheax<BR>.text:00422DC1moveax,[ebp+8]<BR>.text:00422DC4movsw<BR>.text:00422DC6movecx,[eax+4]<BR>.text:00422DC9addecx,0Ch;第四组注册码<BR>.text:00422DCCmovsb<BR>.text:00422DCDcallCString::Mid(int,int);取第四组注册码索引处一个字符<BR>.text:00422DD2pushdwordptr[eax];char*<BR>.text:00422DD4leaeax,[ebp-30h]<BR>.text:00422DD7pusheax;char*<BR>.text:00422DD8call_strcpy;拷贝到[ebp-30]<BR>.text:00422DDDpopecx<BR>.text:00422DDEpopecx<BR>.text:00422DDFleaecx,[ebp-20h]<BR>.text:00422DE2callCString::~CString(void)<BR>.text:00422DE7movesi,ebx<BR>.text:00422DE9leaedi,[ebp-50h]<BR>.text:00422DECpush1<BR>.text:00422DEEleaeax,[ebp-28h]<BR>.text:00422DF1pushdwordptr[ebp-10h];索引<BR>.text:00422DF4movsd<BR>.text:00422DF5pusheax<BR>.text:00422DF6moveax,[ebp+8]<BR>.text:00422DF9movsw<BR>.text:00422DFBmovecx,[eax+4]<BR>.text:00422DFEaddecx,10h;第五组注册码<BR>.text:00422E01movsb<BR>.text:00422E02callCString::Mid(int,int);取第五组注册码索引处一个字符<BR>.text:00422E07pushdwordptr[eax];char*<BR>.text:00422E09leaeax,[ebp-50h]<BR>.text:00422E0Cpusheax;char*<BR>.text:00422E0Dcall_strcpy;拷贝到[ebp-50]<BR>.text:00422E12popecx<BR>.text:00422E13popecx<BR>.text:00422E14leaecx,[ebp-28h]<BR>.text:00422E17callCString::~CString(void)<BR>.text:00422E1Cmovzxeax,byteptr[ebp-30h]<BR>.text:00422E20movzxecx,byteptr[ebp-38h]<BR>.text:00422E24addeax,ecx<BR>.text:00422E26push36<BR>.text:00422E28movzxecx,byteptr[ebp-40h]<BR>.text:00422E2Caddeax,ecx<BR>.text:00422E2Emovzxecx,byteptr[ebp-48h]<BR>.text:00422E32addeax,ecx;前4个字符相加<BR>.text:00422E34popecx<BR>.text:00422E35cdq<BR>.text:00422E36idivecx;和模上36<BR>.text:00422E38adddl,64;加上64<BR>.text:00422E3Bcmpdl,'Z'<BR>.text:00422E3Ejbeshortloc_422E43;结果大于字符'Z'则减去42<BR>.text:00422E40adddl,-42<BR>.text:00422E43<BR>.text:00422E43loc_422E43:<BR>.text:00422E43cmpdl,[ebp-50h];和第五个字符比较<BR>.text:00422E46jnzshortloc_422E62<BR>.text:00422E48incdwordptr[ebp-10h];索引加1<BR>.text:00422E4Bcmpdwordptr[ebp-10h],4<BR>.text:00422E4Fjlloc_422D16<BR>.text:00422E55pushdwordptr[ebp+8];注册码压入堆栈<BR>.text:00422E58callfun3_42306F;调用验证函数42306F<BR>.text:00422E5Dtesteax,eax<BR>.text:00422E5Fpopecx<BR>.text:00422E60jnzshortloc_422EDF;验证函数42306F返回非零值则本函数返回1<BR>.text:00422E62<BR>.text:00422E62loc_422E62:<BR>.text:00422E62<BR>.text:00422E62xorebx,ebx;跳到这里就验证失败了<BR>.text:00422E64<BR>.text:00422E64loc_422E64:<BR>.text:00422E64<BR>.text:00422E64cmp[ebp+0Ch],ebx<BR>.text:00422E67jzshortloc_422EDB<BR>.text:00422E69moveax,dword_5D537C<BR>.text:00422E6Emov[ebp+0Ch],eax<BR>.text:00422E71push0Dh;InvalidLicenseKey.PleasetryagainorcontactWisdomSoftware.<BR>.text:00422E73leaecx,[ebp+0Ch]<BR>.text:00422E76mov[ebp-4],ebx<BR>.text:00422E79callCString::LoadStringA(uint)<BR>.text:00422E7Emoveax,dword_5D537C<BR>.text:00422E83mov[ebp+8],eax<BR>.text:00422E86push0Eh;ScreenHunterMessage<BR>.text:00422E88leaecx,[ebp+8]<BR>.text:00422E8Bmovbyteptr[ebp-4],1<BR>.text:00422E8FcallCString::LoadStringA(uint)<BR>.text:00422E94pushdwordptr[ebp+8];lpWindowName<BR>.text:00422E97pushebx;lpClassName<BR>.text:00422E98callds:FindWindowA<BR>.text:00422E9Ecmpeax,ebx<BR>.text:00422EA0moveax,[ebp+8]<BR>.text:00422EA3jzshortloc_422EAA<BR>.text:00422EA5cmp[eax-8],ebx<BR>.text:00422EA8jgshortloc_422EC3<BR>.text:00422EAA<BR>.text:00422EAAloc_422EAA:<BR>.text:00422EAAcmpdword_5ED0C4,6<BR>.text:00422EB1jzshortloc_422EC3<BR>.text:00422EB3push40010h;uType<BR>.text:00422EB8pusheax;lpCaption<BR>.text:00422EB9pushdwordptr[ebp+0Ch];lpText<BR>.text:00422EBCpushebx;hWnd<BR>.text:00422EBDcallds:MessageBoxA<BR>.text:00422EC3<BR>.text:00422EC3loc_422EC3:<BR>.text:00422EC3<BR>.text:00422EC3andbyteptr[ebp-4],0<BR>.text:00422EC7leaecx,[ebp+8]<BR>.text:00422ECAcallCString::~CString(void)<BR>.text:00422ECFordwordptr[ebp-4],0FFFFFFFFh<BR>.text:00422ED3leaecx,[ebp+0Ch]<BR>.text:00422ED6callCString::~CString(void)<BR>.text:00422EDB<BR>.text:00422EDBloc_422EDB:<BR>.text:00422EDBxoreax,eax<BR>.text:00422EDDjmpshortloc_422EE2<BR>.text:00422EDF;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:00422EDF<BR>.text:00422EDFloc_422EDF:<BR>.text:00422EDFpush1<BR>.text:00422EE1popeax<BR>.text:00422EE2<BR>.text:00422EE2loc_422EE2:<BR>.text:00422EE2movecx,[ebp-0Ch]<BR>.text:00422EE5popedi<BR>.text:00422EE6popesi<BR>.text:00422EE7popebx<BR>.text:00422EE8movlargefs:0,ecx<BR>.text:00422EEFleave<BR>.text:00422EF0retn<BR>.text:00422EF0fun1_422C8Eendp;sp=4<BR><BR>;=================================================================================<BR>fun1_422C8E里还调用到了函数fun3_42306F,来到下面看看:<BR><BR>.text:0042306Ffun3_42306Fprocnear<BR>.text:0042306F<BR>.text:0042306F<BR>.text:0042306F<BR>.text:0042306Farg_0=dwordptr8<BR>.text:0042306F<BR>.text:0042306Fpushebp<BR>.text:00423070movebp,esp<BR>.text:00423072pushesi<BR>.text:00423073movesi,[ebp+arg_0]<BR>.text:00423076pushedi<BR>.text:00423077leaeax,[ebp+arg_0]<BR>.text:0042307Amovecx,[esi+4];第一组注册码<BR>.text:0042307Dpush3<BR>.text:0042307Fpusheax<BR>.text:00423080callCString::Left(int);取前3位<BR>.text:00423085pushdwordptr[eax];char*<BR>.text:00423087pushdword_5DFEA0;"SH4"<BR>.text:0042308Dcall_strcmp;比较是否是"SH4"<BR>.text:00423092popecx<BR>.text:00423093movedi,eax<BR>.text:00423095popecx<BR>.text:00423096leaecx,[ebp+arg_0]<BR>.text:00423099callCString::~CString(void)<BR>.text:0042309Etestedi,edi<BR>.text:004230A0jnzshortloc_4230D2;不等则跳<BR>.text:004230A2movecx,[esi+4]<BR>.text:004230A5push1<BR>.text:004230A7leaeax,[ebp+arg_0]<BR>.text:004230AApush2<BR>.text:004230ACpusheax<BR>.text:004230ADaddecx,4;第二组注册码<BR>.text:004230B0callCString::Mid(int,int);取第三个字符<BR>.text:004230B5pushdwordptr[eax];char*<BR>.text:004230B7pushdword_5DFE9C;"9"<BR>.text:004230BDcall_strcmp;比较是否是"9"<BR>.text:004230C2popecx<BR>.text:004230C3movesi,eax<BR>.text:004230C5popecx<BR>.text:004230C6leaecx,[ebp+arg_0]<BR>.text:004230C9callCString::~CString(void)<BR>.text:004230CEtestesi,esi<BR>.text:004230D0jzshortloc_4230DD<BR>.text:004230D2<BR>.text:004230D2loc_4230D2:<BR>.text:004230D2anddword_5ECF7C,0;置全局注册失败标志<BR>.text:004230D9xoreax,eax;失败则返回0<BR>.text:004230DBjmpshortloc_4230E0<BR>.text:004230DD;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:004230DD<BR>.text:004230DDloc_4230DD:<BR>.text:004230DDpush1<BR>.text:004230DFpopeax<BR>.text:004230E0<BR>.text:004230E0loc_4230E0:<BR>.text:004230E0popedi<BR>.text:004230E1popesi<BR>.text:004230E2popebp<BR>.text:004230E3retn<BR>.text:004230E3fun3_42306Fendp<BR><BR>=================================================================<BR>下面开始看fun2_422EF1:<BR><BR>.text:00422EF1fun2_422EF1procnear<BR>.text:00422EF1<BR>.text:00422EF1<BR>.text:00422EF1var_30=byteptr-30h<BR>.text:00422EF1var_28=byteptr-28h<BR>.text:00422EF1var_20=byteptr-20h<BR>.text:00422EF1var_18=dwordptr-18h<BR>.text:00422EF1var_14=dwordptr-14h<BR>.text:00422EF1var_10=dwordptr-10h<BR>.text:00422EF1var_C=dwordptr-0Ch<BR>.text:00422EF1var_8=dwordptr-8<BR>.text:00422EF1var_1=byteptr-1<BR>.text:00422EF1arg_0=dwordptr8<BR>.text:00422EF1<BR>.text:00422EF1pushebp<BR>.text:00422EF2movebp,esp<BR>.text:00422EF4subesp,30h<BR>.text:00422EF7pushebx<BR>.text:00422EF8pushesi<BR>.text:00422EF9xoresi,esi<BR>.text:00422EFBpushedi<BR>.text:00422EFCcmpdword_5ECF88,esi<BR>.text:00422F02jleloc_423054<BR>.text:00422F08cmpdword_5ECF8C,esi<BR>.text:00422F0Ejleloc_423054<BR>.text:00422F14cmpdword_5ECF90,esi<BR>.text:00422F1Ajleloc_423054<BR>.text:00422F20leaeax,[ebp+var_C]<BR>.text:00422F23pusheax<BR>.text:00422F24callCTime::GetTickCount(void)<BR>.text:00422F29push0FFFFFFFFh<BR>.text:00422F2Bpushesi<BR>.text:00422F2Cpushesi<BR>.text:00422F2Dpushesi<BR>.text:00422F2Epushdword_5ECF90<BR>.text:00422F34leaecx,[ebp+var_8]<BR>.text:00422F37pushdword_5ECF8C<BR>.text:00422F3Dpushdword_5ECF88<BR>.text:00422F43callCTime::CTime(int,int,int,int,int,int,int)<BR>.text:00422F48pushecx<BR>.text:00422F49movecx,[ebp+var_8]<BR>.text:00422F4Cmoveax,esp<BR>.text:00422F4Emov[ebp+var_18],esp<BR>.text:00422F51mov[eax],ecx<BR>.text:00422F53leaeax,[ebp+var_18]<BR>.text:00422F56pusheax<BR>.text:00422F57leaecx,[ebp+var_C]<BR>.text:00422F5Acallsub_423060<BR>.text:00422F5Fmoveax,[eax]<BR>.text:00422F61movecx,15180h<BR>.text:00422F66cdq<BR>.text:00422F67idivecx<BR>.text:00422F69cmpeax,7;随即检查<BR>.text:00422F6Cjlloc_423054<BR>.text:00422F72moveax,dwordptra815;"815"<BR>.text:00422F77mov[ebp+var_8],esi;索引清零<BR>.text:00422F7Amov[ebp+var_14],eax<BR>.text:00422F7Dmovebx,offsetasc_5C8424;"------"<BR>.text:00422F82<BR>.text:00422F82loc_422F82:<BR>.text:00422F82movesi,ebx<BR>.text:00422F84leaedi,[ebp+var_28]<BR>.text:00422F87push1<BR>.text:00422F89leaeax,[ebp+var_C]<BR>.text:00422F8Cpush[ebp+var_8];索引<BR>.text:00422F8Fmovsd<BR>.text:00422F90pusheax<BR>.text:00422F91moveax,[ebp+arg_0]<BR>.text:00422F94movsw<BR>.text:00422F96movecx,[eax+4]<BR>.text:00422F99addecx,4;第二组注册码<BR>.text:00422F9Cmovsb<BR>.text:00422F9DcallCString::Mid(int,int);取索引处一个字符<BR>.text:00422FA2pushdwordptr[eax];char*<BR>.text:00422FA4leaeax,[ebp+var_28]<BR>.text:00422FA7pusheax;char*<BR>.text:00422FA8call_strcpy;拷贝到var_28<BR>.text:00422FADpopecx<BR>.text:00422FAEpopecx<BR>.text:00422FAFleaecx,[ebp+var_C]<BR>.text:00422FB2callCString::~CString(void)<BR>.text:00422FB7movesi,ebx<BR>.text:00422FB9leaedi,[ebp+var_20]<BR>.text:00422FBCmovsd<BR>.text:00422FBDmovsw<BR>.text:00422FBFmovsb<BR>.text:00422FC0movesi,[ebp+var_8];索引<BR>.text:00422FC3push1<BR>.text:00422FC5leaeax,[ebp+var_10]<BR>.text:00422FC8pushesi<BR>.text:00422FC9pusheax<BR>.text:00422FCAmoveax,[ebp+arg_0]<BR>.text:00422FCDmovecx,[eax+4]<BR>.text:00422FD0addecx,8;第三组注册码<BR>.text:00422FD3callCString::Mid(int,int);取索引处一个字符<BR>.text:00422FD8pushdwordptr[eax];char*<BR>.text:00422FDAleaeax,[ebp+var_20]<BR>.text:00422FDDpusheax;char*<BR>.text:00422FDEcall_strcpy;拷贝到var_20<BR>.text:00422FE3popecx<BR>.text:00422FE4popecx<BR>.text:00422FE5leaecx,[ebp+var_10]<BR>.text:00422FE8callCString::~CString(void)<BR>.text:00422FEDmovzxeax,byteptr[ebp+esi+var_14];取字符串"815"索引处一个字符<BR>.text:00422FF2movzxecx,[ebp+var_20]<BR>.text:00422FF6addeax,ecx;加上第三组注册码一个字符<BR>.text:00422FF8push10<BR>.text:00422FFAmovzxecx,[ebp+var_28]<BR>.text:00422FFEaddeax,ecx;加上第二组注册码一个字符<BR>.text:00423000popecx<BR>.text:00423001cdq<BR>.text:00423002idivecx;模上10<BR>.text:00423004movesi,ebx<BR>.text:00423006leaedi,[ebp+var_30]<BR>.text:00423009push1<BR>.text:0042300Bleaeax,[ebp+var_18]<BR>.text:0042300Epush[ebp+var_8];索引<BR>.text:00423011movsd<BR>.text:00423012pusheax<BR>.text:00423013moveax,[ebp+arg_0]<BR>.text:00423016movsw<BR>.text:00423018movecx,[eax+4]<BR>.text:0042301Baddecx,12;第四组注册码<BR>.text:0042301Emovsb<BR>.text:0042301Fadddl,'0';模加上'0'<BR>.text:00423022mov[ebp+var_1],dl<BR>.text:00423025callCString::Mid(int,int);取索引处一个字符<BR>.text:0042302Apushdwordptr[eax];char*<BR>.text:0042302Cleaeax,[ebp+var_30]<BR>.text:0042302Fpusheax;char*<BR>.text:00423030call_strcpy;拷贝到var_30<BR>.text:00423035popecx<BR>.text:00423036popecx<BR>.text:00423037leaecx,[ebp+var_18]<BR>.text:0042303AcallCString::~CString(void)<BR>.text:0042303Fmoval,[ebp+var_1]<BR>.text:00423042cmpal,[ebp+var_30];比较<BR>.text:00423045jnzshortloc_42305C<BR>.text:00423047inc[ebp+var_8];索引加1<BR>.text:0042304Acmp[ebp+var_8],3;共比较3次<BR>.text:0042304Ejlloc_422F82<BR>.text:00423054<BR>.text:00423054loc_423054:<BR>.text:00423054<BR>.text:00423054push1<BR>.text:00423056popeax<BR>.text:00423057<BR>.text:00423057loc_423057:<BR>.text:00423057popedi<BR>.text:00423058popesi<BR>.text:00423059popebx<BR>.text:0042305Aleave<BR>.text:0042305Bretn<BR>.text:0042305C;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:0042305C<BR>.text:0042305Cloc_42305C:<BR>.text:0042305Cxoreax,eax<BR>.text:0042305Ejmpshortloc_423057<BR>.text:0042305Efun2_422EF1endp<BR><BR>===================================================================<BR><BR>跟踪对话框的调用过程，可以来到下面，这里是取协议到多少用户的。<BR>第三组注册码第一个字符决定协议类型。<BR>如果协议类型是'G'则第二组注册码前两个字符是协议用户数。<BR><BR>.text:00423130sub_423130procnear<BR>.text:00423130<BR>.text:00423130pushesi<BR>.text:00423131xoresi,esi<BR>.text:00423133pushmy_5ED30C;char*<BR>.text:00423139pushq_5DFE94_D;char*<BR>.text:0042313Fcall_strcmp<BR>.text:00423144popecx<BR>.text:00423145testeax,eax<BR>.text:00423147popecx<BR>.text:00423148jnzshortloc_423152<BR>.text:0042314Apush1<BR>.text:0042314C<BR>.text:0042314Cloc_42314C:<BR>.text:0042314Cpopesi<BR>.text:0042314Djmploc_42329A<BR>.text:00423152;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:00423152<BR>.text:00423152loc_423152:<BR>.text:00423152pushmy_5ED30C;char*<BR>.text:00423158pushq_5DFE8C_M;char*<BR>.text:0042315Ecall_strcmp<BR>.text:00423163popecx<BR>.text:00423164testeax,eax<BR>.text:00423166popecx<BR>.text:00423167jnzshortloc_42316D<BR>.text:00423169push5<BR>.text:0042316Bjmpshortloc_42314C<BR>.text:0042316D;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:0042316D<BR>.text:0042316Dloc_42316D:<BR>.text:0042316Dpushmy_5ED30C;char*<BR>.text:00423173pushq_5DFE88_P;char*<BR>.text:00423179call_strcmp<BR>.text:0042317Epopecx<BR>.text:0042317Ftesteax,eax<BR>.text:00423181popecx<BR>.text:00423182jnzshortloc_423188<BR>.text:00423184push10<BR>.text:00423186jmpshortloc_42314C<BR>.text:00423188;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:00423188<BR>.text:00423188loc_423188:<BR>.text:00423188pushmy_5ED30C;char*<BR>.text:0042318Epushq_5DFE84_Q;char*<BR>.text:00423194call_strcmp<BR>.text:00423199popecx<BR>.text:0042319Atesteax,eax<BR>.text:0042319Cpopecx<BR>.text:0042319Djnzshortloc_4231A3<BR>.text:0042319Fpush20<BR>.text:004231A1jmpshortloc_42314C<BR>.text:004231A3;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:004231A3<BR>.text:004231A3loc_4231A3:<BR>.text:004231A3pushmy_5ED30C;char*<BR>.text:004231A9pushq_5DFE80_R;char*<BR>.text:004231AFcall_strcmp<BR>.text:004231B4popecx<BR>.text:004231B5testeax,eax<BR>.text:004231B7popecx<BR>.text:004231B8jnzshortloc_4231BE<BR>.text:004231BApush50<BR>.text:004231BCjmpshortloc_42314C<BR>.text:004231BE;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:004231BE<BR>.text:004231BEloc_4231BE:<BR>.text:004231BEpushmy_5ED30C;char*<BR>.text:004231C4pushq_5DFE7C_S;char*<BR>.text:004231CAcall_strcmp<BR>.text:004231CFpopecx<BR>.text:004231D0testeax,eax<BR>.text:004231D2popecx<BR>.text:004231D3jnzshortloc_4231DC<BR>.text:004231D5push100<BR>.text:004231D7jmploc_42314C<BR>.text:004231DC;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:004231DC<BR>.text:004231DCloc_4231DC:<BR>.text:004231DCpushmy_5ED30C;char*<BR>.text:004231E2pushq_5DFE78_T;char*<BR>.text:004231E8call_strcmp<BR>.text:004231EDpopecx<BR>.text:004231EEtesteax,eax<BR>.text:004231F0popecx<BR>.text:004231F1jnzshortloc_4231FD<BR>.text:004231F3movesi,200<BR>.text:004231F8jmploc_42329A<BR>.text:004231FD;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:004231FD<BR>.text:004231FDloc_4231FD:<BR>.text:004231FDpushmy_5ED30C;char*<BR>.text:00423203pushq_5DFE74_U;char*<BR>.text:00423209call_strcmp<BR>.text:0042320Epopecx<BR>.text:0042320Ftesteax,eax<BR>.text:00423211popecx<BR>.text:00423212jnzshortloc_42321B<BR>.text:00423214movesi,500<BR>.text:00423219jmpshortloc_42329A<BR>.text:0042321B;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:0042321B<BR>.text:0042321Bloc_42321B:<BR>.text:0042321Bpushmy_5ED30C;char*<BR>.text:00423221pushq_5DFE70_V;char*<BR>.text:00423227call_strcmp<BR>.text:0042322Cpopecx<BR>.text:0042322Dtesteax,eax<BR>.text:0042322Fpopecx<BR>.text:00423230jnzshortloc_423239<BR>.text:00423232movesi,1000<BR>.text:00423237jmpshortloc_42329A<BR>.text:00423239;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:00423239<BR>.text:00423239loc_423239:<BR>.text:00423239pushmy_5ED30C;char*<BR>.text:0042323Fpushq_5DFE6C_W;char*<BR>.text:00423245call_strcmp<BR>.text:0042324Apopecx<BR>.text:0042324Btesteax,eax<BR>.text:0042324Dpopecx<BR>.text:0042324Ejnzshortloc_423257<BR>.text:00423250movesi,2000<BR>.text:00423255jmpshortloc_42329A<BR>.text:00423257;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:00423257<BR>.text:00423257loc_423257:<BR>.text:00423257pushmy_5ED30C;char*<BR>.text:0042325Dpushq_5DFE68_X;char*<BR>.text:00423263call_strcmp<BR>.text:00423268popecx<BR>.text:00423269testeax,eax<BR>.text:0042326Bpopecx<BR>.text:0042326Cjnzshortloc_423275<BR>.text:0042326Emovesi,5000<BR>.text:00423273jmpshortloc_42329A<BR>.text:00423275;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪<BR>.text:00423275<BR>.text:00423275loc_423275:<BR>.text:00423275pushmy_5ED30C;char*<BR>.text:0042327Bpushq_5DFE90_G;char*<BR>.text:00423281call_strcmp<BR>.text:00423286popecx<BR>.text:00423287testeax,eax<BR>.text:00423289popecx<BR>.text:0042328Ajnzshortloc_42329A<BR>.text:0042328Cpushmy_5ED310;char*<BR>.text:00423292call_atoi<BR>.text:00423297popecx<BR>.text:00423298movesi,eax<BR>.text:0042329A<BR>.text:0042329Aloc_42329A:<BR>.text:0042329Amoveax,esi<BR>.text:0042329Cpopesi<BR>.text:0042329Dretn<BR>.text:0042329Dsub_423130endp<BR><BR>GetUserCnt(void)<BR>{<BR>charUserCnt;//第三组注册码左边一个字符<BR>charcount[3];//第二组注册码左边两个字符<BR><BR>if(UserCnt=='D')return1;<BR>if(UserCnt=='M')return5;<BR>if(UserCnt=='P')return10;<BR>if(UserCnt=='Q')return20;<BR>if(UserCnt=='R')return50;<BR>if(UserCnt=='S')return100;<BR>if(UserCnt=='T')return200;<BR>if(UserCnt=='U')return500;<BR>if(UserCnt=='V')return1000;<BR>if(UserCnt=='W')return2000;<BR>if(UserCnt=='X')return5000;<BR>if(UserCnt=='G')reutrnatoi(count);<BR>return0;<BR>}<BR>======================================================================<BR>好了,该总结一下了:<BR><BR>先看看注册码的格式:XXXX-XXXX-XXXX-XXXX-XXXX<BR>这里注册码分了5组，每组4位。为了方便表示，我把5组注册码简称key[0],key[1],key[2],key[3],key[4],<BR>并且把每组注册码中的一个字符简称key[0][0],key[0][1]...。<BR>key[0]的前3位是固定的，为"SH4"。<BR>key[1][2]也是固定的，为'9'。<BR>key[3]的前3个字符由key[1],key[2]和字符串"815"决定。<BR>每组的第4个字符由前面的3个字符决定。<BR>第5组的4个字符由前面的4组决定。<BR>第三组注册码前一个字符决定协议类型。<BR>第二组注册码和协议用户数有关。<BR><BR>下面给出注册机的源代码：<BR>{<BR>SYSTEMTIMEtm;<BR>unsignedlongseed;<BR>charkey[5][5];<BR>inti;<BR>intsum;<BR>chartmp[4]="815";<BR>charlk[25];<BR><BR>GetSystemTime(&tm);<BR>seed=tm.wDay+tm.wDayOfWeek+tm.wHour+tm.wMilliseconds<BR>+tm.wMinute+tm.wMonth+tm.wSecond+tm.wYear;<BR>srand(seed);<BR><BR>memset(key,0,sizeof(key)/sizeof(char));<BR>strcpy(key[0],"SH4Y");<BR><BR>key[1][0]=rand()%9+'1';<BR>key[1][1]=rand()%10+'0';<BR>key[1][2]='9';<BR><BR>key[2][0]='X';<BR>key[2][1]=rand()%26+'A';<BR>key[2][2]=rand()%26+'A';<BR><BR>for(i=0;i<3;i++)<BR>{<BR>sum=tmp[i]+key[1][i]+key[2][i];<BR>sum=sum%10+'0';<BR>key[3][i]=sum;<BR>}<BR><BR>for(i=1;i<4;i++)<BR>{<BR>sum=key[i][0]+key[i][1]+key[i][2];<BR>sum=sum%26+0x40;<BR>if(sum==0x40)sum+=26;<BR>key[i][3]=sum;<BR>}<BR>for(i=0;i<4;i++)<BR>{<BR>sum=key[0][i]+key[1][i]+key[2][i]+key[3][i];<BR>sum=sum%36+64;<BR>if(sum>'Z')sum-=42;<BR>key[4][i]=sum;<BR>}<BR><BR>sprintf(lk,"%s-%s-%s-%s-%s",key[0],key[1],key[2],key[3],key[4]);<BR>m_key=lk;<BR>UpdateData(false);<BR>}</FONT><BR></P>
页:
[1]