敏思硬碟衛士1.0 (網路版客戶端)的註冊分析(簡單級) (7千字)

敏思硬碟衛士1.0 (網路版客戶端)的註冊分析(簡單級)
by Fpc[CCG] & 6767[BCG]       @2001/08

tools: sI, WdaSm
level: 1/5

主要功能：硬碟保護，訪問限制，個人空間，文件中心，病毒防範，遠端管理
作者主頁：http://www.globalmediastar.com/

有人要這個，所以追一下了。因為是一機一號，沒辦法，只有作出序號產生器或破解版，好在這個簡單，能作序號產生器。

:004A6866 8B45F4 mov eax, dword ptr [ebp-0C]         <- 硬體號
:004A6869 8D4DF8 lea ecx, dword ptr [ebp-08]         <- 註冊碼存放位置
:004A686C 66BA1300 mov dx, 0013               <- 參與運算
:004A6870 E8A3F8FFFF call 004A6118               <- 生成註冊碼

:004A6875 8B55F8 mov edx, dword ptr [ebp-08]       <- 真碼
:004A6878 58 pop eax               <- 假碼
:004A6879 E836D7F5FF call 00403FB4               <- 比較了
:004A687E 7423 je 004A68A3

:004A6880 6A30 push 00000030

* Possible StringData Ref from Code Obj ->" 敏思硬碟衛士"
|
:004A6882 6814694A00 push 004A6914

* Possible StringData Ref from Code Obj ->"輸入的註冊碼無效，請重新輸入。"
|
:004A6887 6824694A00 push 004A6924
:004A688C 6A00 push 00000000

* Reference To: user32.MessageBoxA, Ord:0000h
|
:004A688E E85509F6FF Call 004071E8

顯然在:004A6870 call 004A6118是關鍵追進去看它是怎麼算的：

* Referenced by a CALL at Addresses:
|:004A66B4 , :004A6870 , :004CF984 , :004CFFA4 , :004D04B4
|:004D07C0 , :004D0B98 , :004D0DBC , :004D108F , :004D17C0
|:004D2728
|
:004A6118 55 push ebp
:004A6119 8BEC mov ebp, esp

... ...

:004A6125 8BDA mov ebx, edx               <- ebx=0x13
:004A6127 8945FC mov dword ptr [ebp-04], eax

... ...

:004A6140 8D55F4 lea edx, dword ptr [ebp-0C]       <- 存放的位置
:004A6143 8B45FC mov eax, dword ptr [ebp-04]       <- 硬體號
:004A6146 E88524F6FF call 004085D0               <- 硬體號中的字母小寫轉大寫，請看

>>>>>>

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408604(C)
|
  :004085F1 8A02 mov al, byte ptr [edx]
  :004085F3 3C61 cmp al, 61
  :004085F5 7206 jb 004085FD
  :004085F7 3C7A cmp al, 7A
  :004085F9 7702 ja 004085FD
  :004085FB 2C20 sub al, 20             <- 這一句

  * Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
  |:004085F5(C), :004085F9(C)
  |
  :004085FD 8806 mov byte ptr [esi], al
  :004085FF 42 inc edx
  :00408600 46 inc esi
  :00408601 4B dec ebx
  :00408602 85DB test ebx, ebx
  :00408604 75EB jne 004085F1

<<<<<<

:004A614B 8B45F4 mov eax, dword ptr [ebp-0C]         <- 硬體號(已轉換為大寫)
:004A614E 8D4DF8 lea ecx, dword ptr [ebp-08]
:004A6151 0FB7D3 movzx edx, bx

:004A6154 E8037AFEFF call 0048DB5C               <- 這個的作用是將硬體號的各位置加上一個數
                                  <- 規則是：奇數位置加0x14，偶數位置加0x13

>>>>>>

  * Referenced by a CALL at Addresses:
  |:0048E5BF , :004A6154 , :004C40F3 , :004C410D , :004C4127
  |
  :0048DB5C 55 push ebp
  :0048DB5D 8BEC mov ebp, esp
  :0048DB5F 83C4EC add esp, FFFFFFEC
  :0048DB62 53 push ebx
  :0048DB63 56 push esi
  :0048DB64 57 push edi
  :0048DB65 33DB xor ebx, ebx
  :0048DB67 895DEC mov dword ptr [ebp-14], ebx
  :0048DB6A 894DF4 mov dword ptr [ebp-0C], ecx
  :0048DB6D 8955F8 mov dword ptr [ebp-08], edx   <- [ebp-8]=0x13
  :0048DB70 8945FC mov dword ptr [ebp-04], eax

  ... ...

  :0048DB91 8B45F8 mov eax, dword ptr [ebp-08]
  :0048DB94 40 inc eax
  :0048DB95 8945F0 mov dword ptr [ebp-10], eax   <- [ebp-10]=0x14

  ... ...

  :0048DBA6 BE01000000 mov esi, 00000001

  * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  |:0048DBDB(C)
  |
  :0048DBAB 8B45FC mov eax, dword ptr [ebp-04]
  :0048DBAE 33DB xor ebx, ebx
  :0048DBB0 8A5C30FF mov bl, byte ptr [eax+esi-01]
  :0048DBB4 F7C601000000 test esi, 00000001         <- 相當於對2取模
  :0048DBBA 7505 jne 0048DBC1           <- 在奇數位置上則向下跳

  :0048DBBC 035DF8 add ebx, dword ptr [ebp-08]   <- bl+=0x13
  :0048DBBF EB03 jmp 0048DBC4

  * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  |:0048DBBA(C)
  |
  :0048DBC1 035DF0 add ebx, dword ptr [ebp-10]   <- bl+=0x14

  * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  |:0048DBBF(U)
  |
  :0048DBC4 8D45EC lea eax, dword ptr [ebp-14]
  :0048DBC7 8BD3 mov edx, ebx
  :0048DBC9 E8FE61F7FF call 00403DCC           <- 這兩個Call只是在記憶體中複製
  :0048DBCE 8B55EC mov edx, dword ptr [ebp-14]
  :0048DBD1 8B45F4 mov eax, dword ptr [ebp-0C]
  :0048DBD4 E8E3A9F7FF call 004085BC
  :0048DBD9 46 inc esi
  :0048DBDA 4F dec edi
  :0048DBDB 75CE jne 0048DBAB           <- 未完成則處理下一字元

  ... ...

  :0048DC08 C3 ret

<<<<<<

:004A6159 8BD6 mov edx, esi
:004A615B 8B45F8 mov eax, dword ptr [ebp-08]
:004A615E E889010000 call 004A62EC               <- 這個是對字串的運算，求出一個和，再列印成無符號數，就是註冊碼

>>>>>>

  :004A6317 BB611E0000 mov ebx, 00001E61           <- 初始化：ebx=7777

  ... ...

  :004A632A B801000000 mov eax, 00000001           <- i=1

  * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  |:004A6340(C)
  |
  :004A632F 8B4DFC mov ecx, dword ptr [ebp-04]
  :004A6332 0FB64C01FF movzx ecx, byte ptr [ecx+eax-01]   <- ecx=Code[i]
  :004A6337 03C8 add ecx, eax               <- ecx+=i (這裡i從一開始)
  :004A6339 0FAFCB imul ecx, ebx               <- ecx*=ebx
  :004A633C 8BD9 mov ebx, ecx               <- ebx=ecx
  :004A633E 40 inc eax                 <- i++
  :004A633F 4A dec edx
  :004A6340 75ED jne 004A632F               <- 未處理完則繼續

  * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  |:004A6328(C)
  |
  :004A6342 8B45F8 mov eax, dword ptr [ebp-08]       <- 列印的目標地址
  :004A6345 50 push eax
  :004A6346 895DF0 mov dword ptr [ebp-10], ebx       <- 儲存結果
  :004A6349 C645F400 mov [ebp-0C], 00
  :004A634D 8D55F0 lea edx, dword ptr [ebp-10]
  :004A6350 33C9 xor ecx, ecx

  * Possible StringData Ref from Code Obj ->"%.10u"           <- 很明確
|
  :004A6352 B888634A00 mov eax, 004A6388
  :004A6357 E85036F6FF call 004099AC           <- 列印字串

<<<<<<

... ...

:004A6189 5D pop ebp
:004A618A C3 ret                   <- 註冊碼生成完畢，則返回

註冊資訊在：
REGEDIT4

[HKEY_CURRENT_USER\Software\MediaStar\HddGuard]
"RegCode"="Your SN is here"

結束。

敏思硬碟衛士1.0 (網路版客戶端)的註冊分析(簡單級) (7千字)

相關文章