破解QQ圖形留言器3.0（不是OICQ圖形留言系統)及序號產生器編寫！！ (6千字)

目標軟體：QQ圖形留言器3.0（不是OICQ圖形留言系統）
保護方式：註冊碼
破解方式：算碼，做序號產生器
破解人：TAE! [CCG、BCG、FCG]

唉！現在的軟體科隆、抄襲現象越來越嚴重了，怪不得中國的軟體沒多大發展，缺乏創意！
比方這個軟體和OICQ圖形留言系統極其相似，但是註冊碼演算法比後者煩的多！

前面的基本步驟我就不重複了。關鍵的地方是。。。

下面就是程式算註冊碼的地方，很長的一段：

***************************************************************************
:00493169 0FB64C11FF movzx ecx, byte ptr [ecx+edx-01]
:0049316E 03D9 add ebx, ecx
:00493170 42 inc edx
:00493171 48 dec eax
:00493172 75F2 jne 00493166

*********上面是將姓名的每個字元相加再加上0x7BB。******************

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049315F(C)
|
:00493174 8BC3 mov eax, ebx
:00493176 B917180000 mov ecx, 00001817
:0049317B 99 cdq
:0049317C F7F9 idiv ecx
:0049317E 69C84A030000 imul ecx, eax, 0000034A
:00493184 81C12B020000 add ecx, 0000022B
:0049318A 8BC3 mov eax, ebx
:0049318C BB3E000000 mov ebx, 0000003E
:00493191 99 cdq
:00493192 F7FB idiv ebx
:00493194 03CA add ecx, edx
:00493196 8BD9 mov ebx, ecx
:00493198 8B45F8 mov eax, dword ptr [ebp-08]
:0049319B E8040EF7FF call 00403FA4
:004931A0 8B55F8 mov edx, dword ptr [ebp-08]
:004931A3 0FB64402FF movzx eax, byte ptr [edx+eax-01]
:004931A8 8B55F8 mov edx, dword ptr [ebp-08]
:004931AB 0FB612 movzx edx, byte ptr [edx]
:004931AE 03C2 add eax, edx
:004931B0 83C003 add eax, 00000003
:004931B3 8BD0 mov edx, eax
:004931B5 C1E003 shl eax, 03
:004931B8 2BC2 sub eax, edx
:004931BA B94F000000 mov ecx, 0000004F
:004931BF 33D2 xor edx, edx
:004931C1 F7F1 div ecx
:004931C3 8BF0 mov esi, eax
:004931C5 81C673020000 add esi, 00000273
:004931CB 8B45F8 mov eax, dword ptr [ebp-08]
:004931CE E8D10DF7FF call 00403FA4
:004931D3 6BC05D imul eax, 0000005D
:004931D6 B9B3000000 mov ecx, 000000B3
:004931DB 99 cdq
:004931DC F7F9 idiv ecx
:004931DE 8BF8 mov edi, eax
:004931E0 83C709 add edi, 00000009
:004931E3 8B45F8 mov eax, dword ptr [ebp-08]
:004931E6 E8B90DF7FF call 00403FA4
:004931EB 8BD0 mov edx, eax
:004931ED C1E007 shl eax, 07
:004931F0 2BC2 sub eax, edx
:004931F2 B931030000 mov ecx, 00000331
:004931F7 99 cdq
:004931F8 F7F9 idiv ecx
:004931FA 03FA add edi, edx
:004931FC 8D55E0 lea edx, dword ptr [ebp-20]
:004931FF 8BC3 mov eax, ebx
:00493201 E89A66F7FF call 004098A0
:00493206 FF75E0 push [ebp-20]
:00493209 8D55DC lea edx, dword ptr [ebp-24]
:0049320C 8BC6 mov eax, esi
:0049320E E88D66F7FF call 004098A0
:00493213 FF75DC push [ebp-24]
:00493216 8D55D8 lea edx, dword ptr [ebp-28]
:00493219 8BC7 mov eax, edi

***************************************************************************
*上面這段程式是分三段計算註冊碼，每段是3位，下面是將三段註冊碼連線起來形成*
*一個數，但這並沒有完，最後還得減去0x00030512,就得到了正確的註冊碼了！ *
***************************************************************************

:0049321B E88066F7FF call 004098A0
:00493220 FF75D8 push [ebp-28]
:00493223 8D45E4 lea eax, dword ptr [ebp-1C]
:00493226 BA03000000 mov edx, 00000003
:0049322B E8340EF7FF call 00404064
:00493230 8B45E4 mov eax, dword ptr [ebp-1C]
:00493233 E89866F7FF call 004098D0
:00493238 8BD8 mov ebx, eax
:0049323A 81EB12050300 sub ebx, 00030512 //****最後的運算*****
:00493240 8D55F4 lea edx, dword ptr [ebp-0C]
:00493243 8BC3 mov eax, ebx
:00493245 E85666F7FF call 004098A0
:0049324A 8D55D4 lea edx, dword ptr [ebp-2C]
:0049324D 8B45F4 mov eax, dword ptr [ebp-0C]
:00493250 E89763F7FF call 004095EC
:00493255 8B45D4 mov eax, dword ptr [ebp-2C]
:00493258 50 push eax
:00493259 8D55D0 lea edx, dword ptr [ebp-30]
:0049325C 8B45EC mov eax, dword ptr [ebp-14]
:0049325F E88863F7FF call 004095EC
:00493264 8B55D0 mov edx, dword ptr [ebp-30]
:00493267 58 pop eax
:00493268 E8470EF7FF call 004040B4
:0049326D 7504 jne 00493273 //想辦法讓這裡別跳眩。
:0049326F C645FF01 mov [ebp-01], 01 //看到這個了吧？？
***************************************************************************

註冊碼演算法：

姓名以 TAE！為例
==================================================================
前三位：
a="T"+"A"+"E"+"!"+0x7BB=0x8b6
b=a/0x1817*0x034A+0x22B
sn1=a%0x3e+b=615
==================================================================
中間三位：
"T"+"!"=0x75
sn2=((0x75+0x3)*8-0x78)/0x4f+0x273=637
==================================================================
最後三位：
姓名個數為4
c=4*0x5D/0xB3+0x9
d=(0x200-4)%0x331
sn3=c+d=519
==================================================================
將以上三組數連線得到615637519，用這個數減0x00030512即可得到註冊碼！
==================================================================

下面是這個軟體的序號產生器：

#include<stdio.h>
#include<string.h>
#include<math.h>
void main()
{
char name[99];
int d=0,l=0,i=0,a=0,b=0,c=0;
long sn1=0,sn2=0,sn3=0;
long f=0,e=0,sn=0;
printf(" *********************\n *KeyGen by TAE![CCG]*\n *********************\n\n");
printf("Please input your name:");
gets(name);
l=strlen(name);
for (i=0;i<l;i++)
a+=name[i];
a+=0x7bb;
b=a/0x1817*0x034a+0x22b;
c=a%0x3e;
sn1=b+c;
sn2=((name[0]+name[l-1])*8-(name[0]+name[l-1]+3))/0x4F+0x0273;
d=l*0x5d/0xb3+0x09;
sn3=(l*0x80-l)%0x331+d;
e=sn1*1000000;
f=sn2*1000;
sn=(e+f+sn3)-197906;
printf("Your registration code:%ld\n",sn);
}

___________________ __ ______ ______ ______
/ / \_ ____/ / / / ____// ____// ____/
\_ _/ /\ \ __)_ / / / / / / / / __
| |/ __ / \ /_/ / /___ / /___ / /_/ /
|__/__/ \_______/(_) \____/ \____/ \____/

破解QQ圖形留言器3.0（不是OICQ圖形留言系統)及序號產生器編寫！！ (6千字)

相關文章