珠聯跳棋2.27之註冊分析

珠聯跳棋2.27之註冊分析
作者：HAILDUZ[CCG]

軟體名稱：珠聯跳棋享版 2.27
整理日期：2003.6.8
檔案大小：178KB
軟體授權：共享軟體
使用平臺：Win9x/Me/NT/2000/XP
個人網址：http://bmzhao.wx-e.com
軟體簡介：“跳棋”是一種流行於全國棋類遊戲，玩法簡單，易於學習。

加密方式：註冊碼
功能限制：未註冊資訊提示
難度：容易
破解工具：TRW2000，W32Dasm，PEiD 0.8

作者宣告：只是學習轉貼請保持完整。

PEiD 0.8 檢查可知，VC++編寫且無殼。TRW2000栽入，BPX HMEMCPY，BC*,PMODULE，F10後,

/////////part 1///////////////////
* Possible Ref to Menu: MenuID_0080, Item: ""
|
:00402FE7 6A01 push 00000001
:00402FE9 E8FF330100 call 004163ED
:00402FEE 8D9E9C000000 lea ebx, dword ptr [esi+0000009C] /停在這裡，（d*ebx=輸入註冊碼）
:00402FF4 8BCB mov ecx, ebx
:00402FF6 E86FFF0000 call 00412F6A
:00402FFB 6A00 push 00000000
:00402FFD 8BCB mov ecx, ebx
:00402FFF E8CFFE0000 call 00412ED3
:00403004 6A0A push 0000000A
:00403006 8BF8 mov edi, eax
:00403008 6A00 push 00000000
:0040300A 6A00 push 00000000
:0040300C 8D44241C lea eax, dword ptr [esp+1C]
:00403010 6A00 push 00000000
:00403012 50 push eax
:00403013 6A0C push 0000000C
:00403015 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"c:\"
|
:00403017 6888114200 push 00421188

* Reference To: KERNEL32.GetVolumeInformationA, Ord:0177h /取硬碟C:的資訊。
|
:0040301C FF1560B14100 Call dword ptr [0041B160]
:00403022 8B4C2410 mov ecx, dword ptr [esp+10] /ecx=硬碟c:的serial number
:00403026 85C9 test ecx, ecx
:00403028 752F jne 00403059

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403057(C)
|
:0040302A 8BC1 mov eax, ecx
:0040302C 33D2 xor edx, edx
:0040302E BD1A000000 mov ebp, 0000001A
:00403033 F7F5 div ebp /硬碟serial number 除以0x1a
:00403035 0FBE07 movsx eax, byte ptr [edi] /依次取取註冊碼位1位....進eax
:00403038 8B1495C0104200 mov edx, dword ptr [4*edx+004210C0]/依據前面餘數查表（見part2)得到檢驗初碼
:0040303F 83C241 add edx, 00000041 /檢驗初碼加0x41得到檢驗碼
:00403042 47 inc edi
:00403043 3BD0 cmp edx, eax /比較註冊碼與檢驗碼
:00403045 7559 jne 004030A0 //不等則失敗
:00403047 B84FECC44E mov eax, 4EC4EC4F
:0040304C F7E1 mul ecx
:0040304E C1EA03 shr edx, 03
:00403051 8BCA mov ecx, edx
:00403053 894C2410 mov dword ptr [esp+10], ecx /還原上面的商
:00403057 75D1 jne 0040302A /商為0結束成功

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403028(C)
|
:00403059 E841650100 call 0041959F
:0040305E 8B0B mov ecx, dword ptr [ebx]
:00403060 8B1524294200 mov edx, dword ptr [00422924]
:00403066 8B4004 mov eax, dword ptr [eax+04]
:00403069 51 push ecx
:0040306A 8B0D28294200 mov ecx, dword ptr [00422928]
:00403070 52 push edx
:00403071 51 push ecx
:00403072 8BC8 mov ecx, eax
:00403074 E888560100 call 00418701
:00403079 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"註冊成功"
|
:0040307B 6850124200 push 00421250

* Possible StringData Ref from Data Obj ->"恭喜你，註冊成功!"
|
:00403080 683C124200 push 0042123C
:00403085 8BCE mov ecx, esi
:00403087 E8052C0100 call 00415C91
:0040308C 8BCE mov ecx, esi

* Possible Ref to Menu: MenuID_0080, Item: ""
|
:0040308E C7465C01000000 mov [esi+5C], 00000001
:00403095 E82C110100 call 004141C6
:0040309A 5F pop edi
:0040309B 5E pop esi
:0040309C 5D pop ebp
:0040309D 5B pop ebx
:0040309E 59 pop ecx
:0040309F C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403045(C)
|
:004030A0 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"註冊失敗"
|
:004030A2 6830124200 push 00421230

* Possible StringData Ref from Data Obj ->"註冊碼不對!"
|
:004030A7 6824124200 push 00421224
:004030AC 8BCE mov ecx, esi
:004030AE E8DE2B0100 call 00415C91
:004030B3 8BCE mov ecx, esi
:004030B5 E80C110100 call 004141C6
:004030BA 5F pop edi
:004030BB 5E pop esi
:004030BC 5D pop ebp
:004030BD 5B pop ebx
:004030BE 59 pop ecx
:004030BF C3 ret

/////////part 2///////////////////
資料表
0030:004210C0h:0C 00 00 00 10 00 00 00 05 00 00 00 11 00 00 00
0030:004210D0h:06 00 00 00 15 00 00 00 19 00 00 00 09 00 00 00
0030:004210E0h:03 00 00 00 0F 00 00 00 0B 00 00 00 18 00 00 00
0030:004210F0h:0A 00 00 00 04 00 00 00 0E 00 00 00 02 00 00 00
0030:00421100h:17 00 00 00 08 00 00 00 01 00 00 00 16 00 00 00
0030:00421110h:12 00 00 00 13 00 00 00 07 00 00 00 00 00 00 00
0030:00421120h:0D 00 00 00 14
///////////////////////////////////////////////
小結：
該軟體是將使用者的c:盤序列號作為引數計算並查表得到檢驗碼，逐位與註冊碼比較。

HAILDUZ[CCG] 2003.6.8
HAILDUZ@HOTMAIL.COM

珠聯跳棋2.27之註冊分析

相關文章