破解心得之CHMMaker（耶圃歟┢ (11千字)
看雪資料發表於2002-01-27
使用工具：W32DASM漢化版黃金版、TRW2000 v1.22、UPX v1.20W
軟體名稱：CHMMaker（耶圃歟
軟體版本：v2.87中文版
這個軟體使用了UPX加殼，所以我們用UPX脫殼。然後用TRW2000載入它，隨便輸入幾個數字後，按CTRL+N啟用TRW2000，
設定斷點BPX HMEMCPY，按F5回到程式，點選按鈕“註冊”，會被攔下，然後按F10經過幾個DELPHI或者C++ BUILDER程式的
幾個固定的RET後會來到如下的地方：
* Possible StringData Ref from Code Obj ->"Q2lA5rM6zI7sK8eO9aL2wP3q3pZ4mW5V5vT6gG7y9iC2bR"
->"3hF4uB8cY9fH2tN3kS6oX7nE8jDxU4dJ" <--注意這個字串，設它為s
|
:0048EB72 BA3CF44800 mov edx, 0048F43C
:0048EB77 E8DC50F7FF call 00403C58
:0048EB7C 8D45F0 lea eax, dword ptr [ebp-10]
:0048EB7F BA94F44800 mov edx, 0048F494
:0048EB84 E8CF50F7FF call 00403C58
:0048EB89 8D45F0 lea eax, dword ptr [ebp-10]
:0048EB8C E8FFFEFFFF call 0048EA90
:0048EB91 8BD8 mov ebx, eax
:0048EB93 8BC3 mov eax, ebx
:0048EB95 E8928AF7FF call 0040762C
:0048EB9A 0FB7C0 movzx eax, ax
:0048EB9D 8BF0 mov esi, eax
:0048EB9F C1E602 shl esi, 02
:0048EBA2 0FB7C3 movzx eax, bx
:0048EBA5 8BF8 mov edi, eax
:0048EBA7 03FF add edi, edi
:0048EBA9 8D3C7F lea edi, dword ptr [edi+2*edi]
:0048EBAC 81C70D260000 add edi, 0000260D
:0048EBB2 8D95C8FEFFFF lea edx, dword ptr [ebp+FFFFFEC8]
:0048EBB8 8BC7 mov eax, edi
:0048EBBA E8419FF7FF call 00408B00
:0048EBBF FFB5C8FEFFFF push dword ptr [ebp+FFFFFEC8]
:0048EBC5 8BC3 mov eax, ebx
:0048EBC7 33D2 xor edx, edx
:0048EBC9 52 push edx
:0048EBCA 50 push eax
:0048EBCB 8D85C4FEFFFF lea eax, dword ptr [ebp+FFFFFEC4]
:0048EBD1 E85A9FF7FF call 00408B30
:0048EBD6 FFB5C4FEFFFF push dword ptr [ebp+FFFFFEC4]
:0048EBDC 8D95C0FEFFFF lea edx, dword ptr [ebp+FFFFFEC0]
:0048EBE2 8BC6 mov eax, esi
:0048EBE4 E8179FF7FF call 00408B00
:0048EBE9 FFB5C0FEFFFF push dword ptr [ebp+FFFFFEC0]
:0048EBEF 8D45F0 lea eax, dword ptr [ebp-10]
:0048EBF2 BA03000000 mov edx, 00000003
:0048EBF7 E80453F7FF call 00403F00
:0048EBFC C745D401000000 mov [ebp-2C], 00000001
:0048EC03 8D95B8FEFFFF lea edx, dword ptr [ebp+FFFFFEB8]
:0048EC09 8BC7 mov eax, edi
:0048EC0B E8F09EF7FF call 00408B00
:0048EC10 FFB5B8FEFFFF push dword ptr [ebp+FFFFFEB8]
:0048EC16 68A0F44800 push 0048F4A0
:0048EC1B 8BC3 mov eax, ebx
:0048EC1D 33D2 xor edx, edx
:0048EC1F 52 push edx
:0048EC20 50 push eax
:0048EC21 8D85B4FEFFFF lea eax, dword ptr [ebp+FFFFFEB4]
:0048EC27 E8049FF7FF call 00408B30
:0048EC2C FFB5B4FEFFFF push dword ptr [ebp+FFFFFEB4]
:0048EC32 68A0F44800 push 0048F4A0
:0048EC37 8D95B0FEFFFF lea edx, dword ptr [ebp+FFFFFEB0]
:0048EC3D 8BC6 mov eax, esi
:0048EC3F E8BC9EF7FF call 00408B00
:0048EC44 FFB5B0FEFFFF push dword ptr [ebp+FFFFFEB0]
:0048EC4A 8D85BCFEFFFF lea eax, dword ptr [ebp+FFFFFEBC]
:0048EC50 BA05000000 mov edx, 00000005
:0048EC55 E8A652F7FF call 00403F00
:0048EC5A 8B95BCFEFFFF mov edx, dword ptr [ebp+FFFFFEBC]
:0048EC60 A1E81F4900 mov eax, dword ptr [00491FE8]
:0048EC65 8B00 mov eax, dword ptr [eax]
:0048EC67 8B8098060000 mov eax, dword ptr [eax+00000698]
:0048EC6D E8CA31FAFF call 00431E3C
:0048EC72 8B45F0 mov eax, dword ptr [ebp-10] <--會停在這裡
:0048EC75 E8C651F7FF call 00403E40 <--取出去掉字元"-"的機器碼字串的長度放到eax中
:0048EC7A 83F804 cmp eax, 00000004 <--長度與4進行比較
:0048EC7D 0F8C4C010000 jl 0048EDCF <--長度小於4的話跳轉，一般不會跳轉
:0048EC83 8945D8 mov dword ptr [ebp-28], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048EDC9(C)
|
:0048EC86 8D85ACFEFFFF lea eax, dword ptr [ebp+FFFFFEAC]
:0048EC8C 50 push eax
:0048EC8D B901000000 mov ecx, 00000001
:0048EC92 8B55D8 mov edx, dword ptr [ebp-28] <--edx為偏移量
:0048EC95 8B45F0 mov eax, dword ptr [ebp-10] <--eax中為存放去掉"-"的機器碼字串的首地址
:0048EC98 E8AB53F7FF call 00404048 <--取[eax+edx]中的一個字元
:0048EC9D FFB5ACFEFFFF push dword ptr [ebp+FFFFFEAC]
:0048ECA3 8D85A8FEFFFF lea eax, dword ptr [ebp+FFFFFEA8]
:0048ECA9 50 push eax
:0048ECAA 8B55D8 mov edx, dword ptr [ebp-28] <--edx為偏移量
:0048ECAD 4A dec edx
:0048ECAE B901000000 mov ecx, 00000001
:0048ECB3 8B45F0 mov eax, dword ptr [ebp-10] <--eax中為存放去掉"-"的機器碼字串
:0048ECB6 E88D53F7FF call 00404048 <--取[eax+edx]中的一個字元
:0048ECBB FFB5A8FEFFFF push dword ptr [ebp+FFFFFEA8]
:0048ECC1 8D85A4FEFFFF lea eax, dword ptr [ebp+FFFFFEA4]
:0048ECC7 50 push eax
:0048ECC8 8B55D8 mov edx, dword ptr [ebp-28] <--edx為偏移量
:0048ECCB 83EA02 sub edx, 00000002
:0048ECCE B901000000 mov ecx, 00000001
:0048ECD3 8B45F0 mov eax, dword ptr [ebp-10] <--eax中為存放去掉"-"的機器碼字串
:0048ECD6 E86D53F7FF call 00404048 <--取[eax+edx]中的一個字元
:0048ECDB FFB5A4FEFFFF push dword ptr [ebp+FFFFFEA4]
:0048ECE1 8D85A0FEFFFF lea eax, dword ptr [ebp+FFFFFEA0]
:0048ECE7 50 push eax
:0048ECE8 8B55D8 mov edx, dword ptr [ebp-28] <--edx為偏移量
:0048ECEB 83EA03 sub edx, 00000003
:0048ECEE B901000000 mov ecx, 00000001
:0048ECF3 8B45F0 mov eax, dword ptr [ebp-10] <--eax中為存放去掉"-"的機器碼字串
:0048ECF6 E84D53F7FF call 00404048 <--取[eax+edx]中的一個字元
:0048ECFB FFB5A0FEFFFF push dword ptr [ebp+FFFFFEA0]
:0048ED01 8D45EC lea eax, dword ptr [ebp-14]
:0048ED04 BA04000000 mov edx, 00000004
:0048ED09 E8F251F7FF call 00403F00 <--把上面4次取的4個字元連起來
:0048ED0E 33C0 xor eax, eax
:0048ED10 55 push ebp
:0048ED11 6831ED4800 push 0048ED31
:0048ED16 64FF30 push dword ptr fs:[eax]
:0048ED19 648920 mov dword ptr fs:[eax], esp
:0048ED1C 8B45EC mov eax, dword ptr [ebp-14]
:0048ED1F E8809EF7FF call 00408BA4 <--把上面連起來的字串轉化成十六進位制數
:0048ED24 8945D4 mov dword ptr [ebp-2C], eax <--這裡如果用指令? eax看的話，就可看到eax中的值為上面字串的數字表示
:0048ED27 33C0 xor eax, eax
:0048ED29 5A pop edx
:0048ED2A 59 pop ecx
:0048ED2B 59 pop ecx
:0048ED2C 648910 mov dword ptr fs:[eax], edx
:0048ED2F EB14 jmp 0048ED45 <--跳轉
:0048ED31 E96E46F7FF jmp 004033A4
:0048ED36 E8C549F7FF call 00403700
:0048ED3B E982000000 jmp 0048EDC2
:0048ED40 E8BB49F7FF call 00403700
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048ED2F(U)
|
:0048ED45 8B45D4 mov eax, dword ptr [ebp-2C]
:0048ED48 B94F000000 mov ecx, 0000004F
:0048ED4D 99 cdq
:0048ED4E F7F9 idiv ecx
:0048ED50 8955D4 mov dword ptr [ebp-2C], edx <--將餘數送[ebp-2c]
:0048ED53 837DD400 cmp dword ptr [ebp-2C], 00000000 <--比對餘數是否為0
:0048ED57 7506 jne 0048ED5F
:0048ED59 8B45D8 mov eax, dword ptr [ebp-28]
:0048ED5C 8945D4 mov dword ptr [ebp-2C], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048ED57(C)
|
:0048ED5F 8D45E8 lea eax, dword ptr [ebp-18]
:0048ED62 50 push eax
:0048ED63 B901000000 mov ecx, 00000001
:0048ED68 8B55D4 mov edx, dword ptr [ebp-2C]
:0048ED6B 8B45DC mov eax, dword ptr [ebp-24] <--eax為存放字串s的首地址
:0048ED6E E8D552F7FF call 00404048 <--取[eax+edx]中的一個字元
:0048ED73 8B45E4 mov eax, dword ptr [ebp-1C] <--eax為正確的註冊碼當前的長度
:0048ED76 E8C550F7FF call 00403E40
:0048ED7B 8BC8 mov ecx, eax
:0048ED7D 85C9 test ecx, ecx
:0048ED7F 750D jne 0048ED8E
:0048ED81 8D45E4 lea eax, dword ptr [ebp-1C]
:0048ED84 8B55E8 mov edx, dword ptr [ebp-18]
:0048ED87 E8CC4EF7FF call 00403C58
:0048ED8C EB34 jmp 0048EDC2
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048ED7F(C)
|
:0048ED8E 8D4101 lea eax, dword ptr [ecx+01]
:0048ED91 B905000000 mov ecx, 00000005
:0048ED96 99 cdq
:0048ED97 F7F9 idiv ecx
:0048ED99 85D2 test edx, edx <--比對註冊碼當前長度是否能整除5
:0048ED9B 751A jne 0048EDB7 <--不是的話就跳轉
:0048ED9D FF75E4 push [ebp-1C]
:0048EDA0 68A0F44800 push 0048F4A0
:0048EDA5 FF75E8 push [ebp-18]
:0048EDA8 8D45E4 lea eax, dword ptr [ebp-1C]
:0048EDAB BA03000000 mov edx, 00000003
:0048EDB0 E84B51F7FF call 00403F00
:0048EDB5 EB0B jmp 0048EDC2 <--往註冊碼中插入字元"-"
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048ED9B(C)
|
:0048EDB7 8D45E4 lea eax, dword ptr [ebp-1C]
:0048EDBA 8B55E8 mov edx, dword ptr [ebp-18]
:0048EDBD E88650F7FF call 00403E48
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048ED3B(U), :0048ED8C(U), :0048EDB5(U)
|
:0048EDC2 FF4DD8 dec [ebp-28] <--偏移量-1
:0048EDC5 837DD803 cmp dword ptr [ebp-28], 00000003
:0048EDC9 0F85B7FEFFFF jne 0048EC86
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048EC7D(C)
|
:0048EDCF 8D45E0 lea eax, dword ptr [ebp-20]
:0048EDD2 8B55E4 mov edx, dword ptr [ebp-1C] <--在這裡下指令d edx就可看到正確的註冊碼了
:0048EDD5 E87E4EF7FF call 00403C58
:0048EDDA 8D45D0 lea eax, dword ptr [ebp-30]
:0048EDDD 50 push eax
至此，我們對該軟體的註冊演算法進行了比較完整的分析，下面我來總結一下注冊演算法：
我的機器碼為"240927-1009227395-61596"，軟體先對該字串作處理――去掉該字串中的兩個"-"，得到字串"240927100922739561596"，
第一次依次從最後取4個字元"6"、"9"、"5"、"1"，然後把它們連起來，再轉化為十六進位制數，接著把該十六進位制數對0x4F進行求模，把求得的結果
作為偏移量，取出字串s中處於該偏移量位置的字元，從而得到正確的註冊碼的第一個字元；然後第二次從倒數第二個字元開始取4個字元"9"、"5"、
"1"、"9"，重複上面的步驟……直到取完最後4個字元。最後註冊碼中偏移量為5的倍數的位置插入字元"-"就可得到正確的註冊碼了.
現在剩下的事就是寫序號產生器了。
軟體名稱：CHMMaker（耶圃歟
軟體版本：v2.87中文版
這個軟體使用了UPX加殼，所以我們用UPX脫殼。然後用TRW2000載入它，隨便輸入幾個數字後，按CTRL+N啟用TRW2000，
設定斷點BPX HMEMCPY，按F5回到程式，點選按鈕“註冊”，會被攔下，然後按F10經過幾個DELPHI或者C++ BUILDER程式的
幾個固定的RET後會來到如下的地方：
* Possible StringData Ref from Code Obj ->"Q2lA5rM6zI7sK8eO9aL2wP3q3pZ4mW5V5vT6gG7y9iC2bR"
->"3hF4uB8cY9fH2tN3kS6oX7nE8jDxU4dJ" <--注意這個字串，設它為s
|
:0048EB72 BA3CF44800 mov edx, 0048F43C
:0048EB77 E8DC50F7FF call 00403C58
:0048EB7C 8D45F0 lea eax, dword ptr [ebp-10]
:0048EB7F BA94F44800 mov edx, 0048F494
:0048EB84 E8CF50F7FF call 00403C58
:0048EB89 8D45F0 lea eax, dword ptr [ebp-10]
:0048EB8C E8FFFEFFFF call 0048EA90
:0048EB91 8BD8 mov ebx, eax
:0048EB93 8BC3 mov eax, ebx
:0048EB95 E8928AF7FF call 0040762C
:0048EB9A 0FB7C0 movzx eax, ax
:0048EB9D 8BF0 mov esi, eax
:0048EB9F C1E602 shl esi, 02
:0048EBA2 0FB7C3 movzx eax, bx
:0048EBA5 8BF8 mov edi, eax
:0048EBA7 03FF add edi, edi
:0048EBA9 8D3C7F lea edi, dword ptr [edi+2*edi]
:0048EBAC 81C70D260000 add edi, 0000260D
:0048EBB2 8D95C8FEFFFF lea edx, dword ptr [ebp+FFFFFEC8]
:0048EBB8 8BC7 mov eax, edi
:0048EBBA E8419FF7FF call 00408B00
:0048EBBF FFB5C8FEFFFF push dword ptr [ebp+FFFFFEC8]
:0048EBC5 8BC3 mov eax, ebx
:0048EBC7 33D2 xor edx, edx
:0048EBC9 52 push edx
:0048EBCA 50 push eax
:0048EBCB 8D85C4FEFFFF lea eax, dword ptr [ebp+FFFFFEC4]
:0048EBD1 E85A9FF7FF call 00408B30
:0048EBD6 FFB5C4FEFFFF push dword ptr [ebp+FFFFFEC4]
:0048EBDC 8D95C0FEFFFF lea edx, dword ptr [ebp+FFFFFEC0]
:0048EBE2 8BC6 mov eax, esi
:0048EBE4 E8179FF7FF call 00408B00
:0048EBE9 FFB5C0FEFFFF push dword ptr [ebp+FFFFFEC0]
:0048EBEF 8D45F0 lea eax, dword ptr [ebp-10]
:0048EBF2 BA03000000 mov edx, 00000003
:0048EBF7 E80453F7FF call 00403F00
:0048EBFC C745D401000000 mov [ebp-2C], 00000001
:0048EC03 8D95B8FEFFFF lea edx, dword ptr [ebp+FFFFFEB8]
:0048EC09 8BC7 mov eax, edi
:0048EC0B E8F09EF7FF call 00408B00
:0048EC10 FFB5B8FEFFFF push dword ptr [ebp+FFFFFEB8]
:0048EC16 68A0F44800 push 0048F4A0
:0048EC1B 8BC3 mov eax, ebx
:0048EC1D 33D2 xor edx, edx
:0048EC1F 52 push edx
:0048EC20 50 push eax
:0048EC21 8D85B4FEFFFF lea eax, dword ptr [ebp+FFFFFEB4]
:0048EC27 E8049FF7FF call 00408B30
:0048EC2C FFB5B4FEFFFF push dword ptr [ebp+FFFFFEB4]
:0048EC32 68A0F44800 push 0048F4A0
:0048EC37 8D95B0FEFFFF lea edx, dword ptr [ebp+FFFFFEB0]
:0048EC3D 8BC6 mov eax, esi
:0048EC3F E8BC9EF7FF call 00408B00
:0048EC44 FFB5B0FEFFFF push dword ptr [ebp+FFFFFEB0]
:0048EC4A 8D85BCFEFFFF lea eax, dword ptr [ebp+FFFFFEBC]
:0048EC50 BA05000000 mov edx, 00000005
:0048EC55 E8A652F7FF call 00403F00
:0048EC5A 8B95BCFEFFFF mov edx, dword ptr [ebp+FFFFFEBC]
:0048EC60 A1E81F4900 mov eax, dword ptr [00491FE8]
:0048EC65 8B00 mov eax, dword ptr [eax]
:0048EC67 8B8098060000 mov eax, dword ptr [eax+00000698]
:0048EC6D E8CA31FAFF call 00431E3C
:0048EC72 8B45F0 mov eax, dword ptr [ebp-10] <--會停在這裡
:0048EC75 E8C651F7FF call 00403E40 <--取出去掉字元"-"的機器碼字串的長度放到eax中
:0048EC7A 83F804 cmp eax, 00000004 <--長度與4進行比較
:0048EC7D 0F8C4C010000 jl 0048EDCF <--長度小於4的話跳轉，一般不會跳轉
:0048EC83 8945D8 mov dword ptr [ebp-28], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048EDC9(C)
|
:0048EC86 8D85ACFEFFFF lea eax, dword ptr [ebp+FFFFFEAC]
:0048EC8C 50 push eax
:0048EC8D B901000000 mov ecx, 00000001
:0048EC92 8B55D8 mov edx, dword ptr [ebp-28] <--edx為偏移量
:0048EC95 8B45F0 mov eax, dword ptr [ebp-10] <--eax中為存放去掉"-"的機器碼字串的首地址
:0048EC98 E8AB53F7FF call 00404048 <--取[eax+edx]中的一個字元
:0048EC9D FFB5ACFEFFFF push dword ptr [ebp+FFFFFEAC]
:0048ECA3 8D85A8FEFFFF lea eax, dword ptr [ebp+FFFFFEA8]
:0048ECA9 50 push eax
:0048ECAA 8B55D8 mov edx, dword ptr [ebp-28] <--edx為偏移量
:0048ECAD 4A dec edx
:0048ECAE B901000000 mov ecx, 00000001
:0048ECB3 8B45F0 mov eax, dword ptr [ebp-10] <--eax中為存放去掉"-"的機器碼字串
:0048ECB6 E88D53F7FF call 00404048 <--取[eax+edx]中的一個字元
:0048ECBB FFB5A8FEFFFF push dword ptr [ebp+FFFFFEA8]
:0048ECC1 8D85A4FEFFFF lea eax, dword ptr [ebp+FFFFFEA4]
:0048ECC7 50 push eax
:0048ECC8 8B55D8 mov edx, dword ptr [ebp-28] <--edx為偏移量
:0048ECCB 83EA02 sub edx, 00000002
:0048ECCE B901000000 mov ecx, 00000001
:0048ECD3 8B45F0 mov eax, dword ptr [ebp-10] <--eax中為存放去掉"-"的機器碼字串
:0048ECD6 E86D53F7FF call 00404048 <--取[eax+edx]中的一個字元
:0048ECDB FFB5A4FEFFFF push dword ptr [ebp+FFFFFEA4]
:0048ECE1 8D85A0FEFFFF lea eax, dword ptr [ebp+FFFFFEA0]
:0048ECE7 50 push eax
:0048ECE8 8B55D8 mov edx, dword ptr [ebp-28] <--edx為偏移量
:0048ECEB 83EA03 sub edx, 00000003
:0048ECEE B901000000 mov ecx, 00000001
:0048ECF3 8B45F0 mov eax, dword ptr [ebp-10] <--eax中為存放去掉"-"的機器碼字串
:0048ECF6 E84D53F7FF call 00404048 <--取[eax+edx]中的一個字元
:0048ECFB FFB5A0FEFFFF push dword ptr [ebp+FFFFFEA0]
:0048ED01 8D45EC lea eax, dword ptr [ebp-14]
:0048ED04 BA04000000 mov edx, 00000004
:0048ED09 E8F251F7FF call 00403F00 <--把上面4次取的4個字元連起來
:0048ED0E 33C0 xor eax, eax
:0048ED10 55 push ebp
:0048ED11 6831ED4800 push 0048ED31
:0048ED16 64FF30 push dword ptr fs:[eax]
:0048ED19 648920 mov dword ptr fs:[eax], esp
:0048ED1C 8B45EC mov eax, dword ptr [ebp-14]
:0048ED1F E8809EF7FF call 00408BA4 <--把上面連起來的字串轉化成十六進位制數
:0048ED24 8945D4 mov dword ptr [ebp-2C], eax <--這裡如果用指令? eax看的話，就可看到eax中的值為上面字串的數字表示
:0048ED27 33C0 xor eax, eax
:0048ED29 5A pop edx
:0048ED2A 59 pop ecx
:0048ED2B 59 pop ecx
:0048ED2C 648910 mov dword ptr fs:[eax], edx
:0048ED2F EB14 jmp 0048ED45 <--跳轉
:0048ED31 E96E46F7FF jmp 004033A4
:0048ED36 E8C549F7FF call 00403700
:0048ED3B E982000000 jmp 0048EDC2
:0048ED40 E8BB49F7FF call 00403700
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048ED2F(U)
|
:0048ED45 8B45D4 mov eax, dword ptr [ebp-2C]
:0048ED48 B94F000000 mov ecx, 0000004F
:0048ED4D 99 cdq
:0048ED4E F7F9 idiv ecx
:0048ED50 8955D4 mov dword ptr [ebp-2C], edx <--將餘數送[ebp-2c]
:0048ED53 837DD400 cmp dword ptr [ebp-2C], 00000000 <--比對餘數是否為0
:0048ED57 7506 jne 0048ED5F
:0048ED59 8B45D8 mov eax, dword ptr [ebp-28]
:0048ED5C 8945D4 mov dword ptr [ebp-2C], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048ED57(C)
|
:0048ED5F 8D45E8 lea eax, dword ptr [ebp-18]
:0048ED62 50 push eax
:0048ED63 B901000000 mov ecx, 00000001
:0048ED68 8B55D4 mov edx, dword ptr [ebp-2C]
:0048ED6B 8B45DC mov eax, dword ptr [ebp-24] <--eax為存放字串s的首地址
:0048ED6E E8D552F7FF call 00404048 <--取[eax+edx]中的一個字元
:0048ED73 8B45E4 mov eax, dword ptr [ebp-1C] <--eax為正確的註冊碼當前的長度
:0048ED76 E8C550F7FF call 00403E40
:0048ED7B 8BC8 mov ecx, eax
:0048ED7D 85C9 test ecx, ecx
:0048ED7F 750D jne 0048ED8E
:0048ED81 8D45E4 lea eax, dword ptr [ebp-1C]
:0048ED84 8B55E8 mov edx, dword ptr [ebp-18]
:0048ED87 E8CC4EF7FF call 00403C58
:0048ED8C EB34 jmp 0048EDC2
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048ED7F(C)
|
:0048ED8E 8D4101 lea eax, dword ptr [ecx+01]
:0048ED91 B905000000 mov ecx, 00000005
:0048ED96 99 cdq
:0048ED97 F7F9 idiv ecx
:0048ED99 85D2 test edx, edx <--比對註冊碼當前長度是否能整除5
:0048ED9B 751A jne 0048EDB7 <--不是的話就跳轉
:0048ED9D FF75E4 push [ebp-1C]
:0048EDA0 68A0F44800 push 0048F4A0
:0048EDA5 FF75E8 push [ebp-18]
:0048EDA8 8D45E4 lea eax, dword ptr [ebp-1C]
:0048EDAB BA03000000 mov edx, 00000003
:0048EDB0 E84B51F7FF call 00403F00
:0048EDB5 EB0B jmp 0048EDC2 <--往註冊碼中插入字元"-"
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048ED9B(C)
|
:0048EDB7 8D45E4 lea eax, dword ptr [ebp-1C]
:0048EDBA 8B55E8 mov edx, dword ptr [ebp-18]
:0048EDBD E88650F7FF call 00403E48
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048ED3B(U), :0048ED8C(U), :0048EDB5(U)
|
:0048EDC2 FF4DD8 dec [ebp-28] <--偏移量-1
:0048EDC5 837DD803 cmp dword ptr [ebp-28], 00000003
:0048EDC9 0F85B7FEFFFF jne 0048EC86
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048EC7D(C)
|
:0048EDCF 8D45E0 lea eax, dword ptr [ebp-20]
:0048EDD2 8B55E4 mov edx, dword ptr [ebp-1C] <--在這裡下指令d edx就可看到正確的註冊碼了
:0048EDD5 E87E4EF7FF call 00403C58
:0048EDDA 8D45D0 lea eax, dword ptr [ebp-30]
:0048EDDD 50 push eax
至此，我們對該軟體的註冊演算法進行了比較完整的分析，下面我來總結一下注冊演算法：
我的機器碼為"240927-1009227395-61596"，軟體先對該字串作處理――去掉該字串中的兩個"-"，得到字串"240927100922739561596"，
第一次依次從最後取4個字元"6"、"9"、"5"、"1"，然後把它們連起來，再轉化為十六進位制數，接著把該十六進位制數對0x4F進行求模，把求得的結果
作為偏移量，取出字串s中處於該偏移量位置的字元，從而得到正確的註冊碼的第一個字元；然後第二次從倒數第二個字元開始取4個字元"9"、"5"、
"1"、"9"，重複上面的步驟……直到取完最後4個字元。最後註冊碼中偏移量為5的倍數的位置插入字元"-"就可得到正確的註冊碼了.
現在剩下的事就是寫序號產生器了。
相關文章
- 我的破解心得(11) (9千字)2001-03-13
- 破解心得之WinImage篇 (15千字)2001-07-01
- 破解心得之eXeScope篇 (9千字)2001-07-01
- 破解心得之CDRWin 4.0A BETA篇 (18千字)2001-04-24
- 我的破解心得(1) (3千字)2001-03-13
- 我的破解心得(5) (16千字)2001-03-13
- 我的破解心得(6) (3千字)2001-03-13
- 我的破解心得(8) (2千字)2001-03-13
- 我的破解心得(9) (4千字)2001-03-13
- 我的破解心得(12) (1千字)2001-03-13
- 破解心得之eXeScope篇2015-11-15
- 破解心得之3DMark2001篇 (10千字)2001-04-183D
- 登陸奇兵3.0破解心得 (5千字)2001-05-02
- Readbook 1.31破解心得
(3千字)2000-03-01
- unix軟體ncftpd 2.7.1之破解(11千字)2002-04-07FTP
- BrickShooter 2.1破解心得（新手看看吧） (18千字)2001-03-09
- 耶書製造 CHMmaker 2.85版 增加轉換HPJ工程到HHP工程的功能。 (轉)2007-12-08HMM
- 《chm幫助編輯器V2.61》註冊碼破解心得： (11千字)2001-02-17
- 輕鬆提取資源1.45破解心得
(7千字)2015-11-15
- 菜鳥破解錄(11)之 WinGlobe2.0 (7千字)2000-07-24
- 《漂葉網咖管理系統4.0》破解心得： (9千字)2001-01-14
- 破解心得之Windows優化大師篇2015-11-15Windows優化
- 再次湊湊熱鬧：破解心得之ChinaZip 5.0（中華壓縮）篇
(8千字)2001-04-10
- FINDITNOW!1.25 or 102 中文版 破解心得 (14千字)2002-02-09
- 初學者請進（一篇破解javagirl的心得） (2千字)2000-05-09Java
- 神奇登錄檔0.6破解 (11千字)2001-07-27
- 《TxEdit 4.6》的註冊碼破解 (11千字)2001-07-28
- SuperCleaner2.30破解過程 (11千字)2002-02-04
- 破解 最新 SWF scanner V2.6.2 (11千字)2002-03-24
- 爆笑破解之-----ACDSEE 3.0 (4千字)2001-03-18
- 菜鳥破解錄之 The Cleaner (4千字)2000-08-12
- 菜鳥破解錄之 DlgXRSizer (4千字)2000-08-17
- 鸚鵡螺網路助手1.70破解 (11千字)2001-02-01
- IconToy 3.1 註冊碼快速破解 (11千字)2001-03-02
- 破解 開機小精靈 2.11 (7千字)2001-11-12
- winimp1.11註冊碼破解 (2千字)2000-07-16
- KeyGhost V3.2 破解實錄 (11千字)2000-08-17
- 菜鳥破解錄之 Animated Screen (4千字)2000-08-13