菜鳥破解錄自之 Dialup Constructor
軟體名稱： Dialup Constructor
軟體版本： 3.70
軟體大小： 1914KB
軟體授權： 共享軟體
使用平臺： Win95/98/NT
釋出公司： http://www.grv.com.au/
軟體簡介： 這個工具軟體，你可以在一個視窗下完成如DUN、TCP/IP、Modem等的設定；並且可以對你所用的IE或網景瀏覽器進行起始頁設定；設定MSOutlookExpress和MSMailandNews。可以說和網路有關的所有設定都可以用這個軟體來完成。它也支援代理伺服器，它內建撥號器，你直接可以用它來撥號上網。
作 者：xiA Qin
級 別：很菜....很菜.....
解密日前：2000年9月11日
解密工具：Trw2000 1.22
說 明：
本文是在我的軟體破解記錄上整理出來的。如若有紕漏，請各位大俠多指教！
首先執行程式，輸入註冊資訊。
Code Entry No:315788015 //軟體自動生成的
Code Entry Key:833632 //軟體自動生成的
Licence No:1234567890
Licenced To:Chinese xia
Organisation:[CCG]
................................
015F:0040B24D MOV EAX,[0044A61C]
015F:0040B252 PUSH DWORD 0044A50C
015F:0040B257 PUSH BYTE +09
015F:0040B259 PUSH EAX
015F:0040B25A CALL `DCV3!_pp_getvarnum@12`
015F:0040B25F MOV ECX,[0044A61C]
015F:0040B265 PUSH DWORD 0044A440
015F:0040B26A PUSH BYTE +0A
015F:0040B26C PUSH ECX
015F:0040B26D CALL `DCV3!_pp_getvarnum@12`
015F:0040B272 MOV EDX,[0044A440]
//? EDX Code key 16進位制
015F:0040B278 MOV EAX,[0044A50C]
//? EAX Code No 16進位制
015F:0040B27D MOV ECX,[0044A768]
//? ECX 輸入的註冊碼 16進位制
015F:0040B283 PUSH DWORD 000F4EBE
015F:0040B288 PUSH EDX
015F:0040B289 PUSH EAX
015F:0040B28A PUSH ECX
015F:0040B28B CALL `DCV3!_pp_tcode@16` //按F8進入。
015F:0040B290 DEC EAX
015F:0040B291 JZ 0040B2B2
015F:0040B293 PUSH BYTE +00
015F:0040B295 PUSH DWORD 004437B0
015F:0040B29A PUSH DWORD 00443780
015F:0040B29F PUSH ESI
015F:0040B2A0 CALL `USER32!MessageBoxA` //註冊失敗對話方塊。
015F:0040B2A6 XOR EAX,EAX
015F:0040B2A8 POP ESI
015F:0040B2A9 MOV [0044A7A0],EAX
015F:0040B2AE ADD ESP,BYTE +68
015F:0040B2B1 RET
。。。。。。。。。。。。。。。。。。。
按F8進入0040B28B CALL `DCV3!_pp_tcode@16`
015F:0041E965 PUSH EBP
015F:0041E966 MOV EDX,[ESP+10]
015F:0041E96A MOV EBP,ESP
015F:0041E96C PUSH ESI
015F:0041E96D PUSH EDI
015F:0041E96E ADD DWORD [EBP+14],BYTE +34
015F:0041E972 CMP EDX,BYTE +01
015F:0041E975 JNL 0041E97C
015F:0041E977 MOV EDX,01
015F:0041E97C MOV EDI,[EBP+0C]
//將Code No移入暫存器EDI
015F:0041E97F MOV ECX,EDI
//移入ECX
015F:0041E981 MOV EAX,EDI
//移入EAX
015F:0041E983 AND ECX,1F00
//ECX=ECX AND 1F00
015F:0041E989 AND EAX,0007E000
//EAX=EAX AND 7E000
015F:0041E98E SHR ECX,08
//ECX邏輯右移08
015F:0041E991 IMUL ECX,ECX,F3
//ECX=ECX*F3
015F:0041E997 SHR EAX,0D
//EAX邏輯右移0D
015F:0041E99A ADD EAX,07BC
//EAX=EAX+7BC
015F:0041E99F IMUL EAX,EAX,BYTE +44 //EAX=EAX*44
015F:0041E9A2 ADD ECX,EAX
//ECX=ECX+EAX
015F:0041E9A4 MOV EAX,EDI
//將EDI移入暫存器EAX
015F:0041E9A6 AND EAX,00780000
//EAX=EAX AND 780000
015F:0041E9AB SHR EAX,13
//EAX邏輯右移19
015F:0041E9AE IMUL EAX,EAX,0108 //EAX=EAX*108
015F:0041E9B4 LEA ESI,[ECX+EAX] //ESI=ECX+EAX
015F:0041E9B7 MOV ECX,EDI
//將EDI移入暫存器ECX
015F:0041E9B9 AND ECX,7F800000
//ECX=ECX*7F800000
015F:0041E9BF AND EDI,FF
//EDI=EDI AND FF
015F:0041E9C5 SHR ECX,0F
//ECX邏輯右移16
015F:0041E9C8 MOV EAX,[EBP+14]
//[EBP+14]移入暫存器EAX
015F:0041E9CB IMUL EAX,EAX,BYTE +07 //EAX=EAX*07
015F:0041E9CE ADD ECX,EDI
//ECX=ECX+EDI
015F:0041E9D0 IMUL ECX,ECX,BYTE +03 //ECX=ECX*03
015F:0041E9D3 ADD ECX,EAX
//ECX=ECX+EAX
015F:0041E9D5 MOV EAX,01
//01移入暫存器EAX
015F:0041E9DA LEA ECX,[ECX+EDX*2] //ECX=ECX+EDX*2
015F:0041E9DD MOV EDX,ESI
//將esi移入edx
015F:0041E9DF IMUL EDX,EDX,BYTE +1F //EDX=EDX*1F
015F:0041E9E2 ADD EDX,ECX
//EDX=EDX ADD ECX
015F:0041E9E4 LEA ECX,[ESI*2+00] //ECX=ESI*2
015F:0041E9EB MOV ESI,EDX
//EDX移入ESI
015F:0041E9ED AND ESI,7FFFFFFF
015F:0041E9F3 CMP ESI,[EBP+08] //真假註冊碼比較。?
[EBP+08]是輸入的註冊嗎。
015F:0041E9F6 JZ 0041EA02
? ESI是正確的註冊碼。
015F:0041E9F8 ADD EDX,ECX
015F:0041E9FA INC EAX
015F:0041E9FB CMP EAX,BYTE +32 //有50個註冊碼?!?@#
015F:0041E9FE JNG 0041E9EB
015F:0041EA00 XOR EAX,EAX
015F:0041EA02 POP EDI
015F:0041EA03 POP ESI
015F:0041EA04 POP EBP
015F:0041EA05 RET 10
.....................................
根據以上分析，我們就可以推出程式註冊計算公式，如下：
假設：Code No=A1、Code key=B1
{[(A1 AND 1F00) SHR 08]*F3+{[(A1 AND 7E000) SHR D]+7BC}*44}+{[(A1 AND 780000)
SHR 13]*108}=B
[((A1 AND 7F800000) SHR 16)+(A1 AND FF)]*3+[F4EF2*07]+B1*2=C
B*1F+C=D
將D轉換成10進位制，就是正確的註冊碼。
舉例說明：
Code No=315788015
Code key=833632
{[(315788015 AND 1F00) SHR 08]*F3+{[(315788015 AND 7E000) SHR D]+7BC}*44}+{[(315788015
AND 780000) SHR 13]*108}
={(A00 SHR 08)*F3+[(28000 SHR D)+7BC]*44}+[(500000 SHR 13)*108]
=A*f3+(14+7BC)*44+(A*108)
=97E+7D0*44+A50
=97E+21340+A50
=2270E
[((315788015 AND 7F800000) SHR 16)+(315788015 AND FF)]*3+[F4EF2*07]+833632*2
=[(12800000 SHR 16)+EF]*3+6B9A6B+1970C0
=(2500+EF)*3+850B2B
=25EF*3+850B2B
=42BAB2
2270E*1F+42BAB2=C7C5DD
C7C5DD轉換成10進位制是13092317
整理一下：(註冊碼與註冊名和註冊組織無關!!)
Code Entry No:315788015 //軟體自動生成的
Code Entry Key:833632 //軟體自動生成的
Licence No:13092317
Licenced To:xiA Qin
Organisation:[CCG]