與RC加密演算法的第一次親密接觸

軟體資訊
========
軟體名稱:Internet Download Manager
軟體版本:3.15
軟體大小:833KB
應用平臺:Windows 9x/Me/2k/XP
下載地址:http://www.internetdownloadmanager.com/idman315.exe

填入註冊碼部分的演算法比較簡單，考慮篇幅這裡就不說了，只說它的重啟和RC加密演算法
1、
[HKEY_CURRENT_USER\Software\DownloadManager]
"idmvers"="3.16 Trial" <===體驗版，意思是說不是正式版了
"Serial"="ABCDE-GHIJK-MNOPQ-STUVW"

2、軟體一見到登錄檔裡的Serial鍵值，立馬就報是60天試用版，肯定有問題(估計只是在體驗版里加的)
"Serial"="ABCDE-GHIJK-MNOPQ-STUVW"

3、但是，程式裡依然有核心校驗部分(而且用的是RC的加密演算法)
0041249F . 68 A0674C00 PUSH IDMAN.004C67A0 ; |valueName = "Serial"
004124A4 . 897D FC MOV DWORD PTR SS:[EBP-4],EDI ; |
004124A7 . 52 PUSH EDX ; |hKey => 0
004124A8 . 897D EC MOV DWORD PTR SS:[EBP-14],EDI ; |
004124AB . C645 FC 01 MOV BYTE PTR SS:[EBP-4],1 ; |
004124AF . C685 5CFFFFFF >MOV BYTE PTR SS:[EBP-A4],0 ; |
004124B6 . C645 B0 00 MOV BYTE PTR SS:[EBP-50],0 ; |
004124BA . 895D E8 MOV DWORD PTR SS:[EBP-18],EBX ; |
004124BD . FFD6 CALL ESI ; \RegQueryvalueExA
004124BF . 85C0 TEST EAX,EAX
004124C1 . 75 1D JNZ SHORT IDMAN.004124E0
004124C3 . 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4] <===在這裡可以看到註冊碼
004124C9 . 50 PUSH EAX ; /Arg1
004124CA . E8 21050000 CALL IDMAN.004129F0 <===跟進 ; \IDMAN.004129F0
004124CF . 83C4 04 ADD ESP,4
004124D2 . 84C0 TEST AL,AL <===要想成功，則AL必須為0
004124D4 . 75 0A JNZ SHORT IDMAN.004124E0
004124D6 . C745 EC 010000>MOV DWORD PTR SS:[EBP-14],1
004124DD . 8B7D EC MOV EDI,DWORD PTR SS:[EBP-14]
004124E0 > A1 9CB74D00 MOV EAX,DWORD PTR DS:[4DB79C]

---------------004124CA CALL IDMAN.004129F0 跟進----------------
004129F0 /$ 55 PUSH EBP
004129F1 |. 8BEC MOV EBP,ESP
004129F3 |. 6A FF PUSH -1
004129F5 |. 68 F8CD4900 PUSH IDMAN.0049CDF8 ; SE handler installation
004129FA |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
00412A00 |. 50 PUSH EAX
00412A01 |. 64:8925 000000>MOV DWORD PTR FS:[0],ESP
00412A08 |. 83EC 58 SUB ESP,58
00412A0B |. 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
00412A0E |. 53 PUSH EBX
00412A0F |. 56 PUSH ESI
00412A10 |. 57 PUSH EDI
00412A11 |. 8BFA MOV EDI,EDX
00412A13 |. 83C9 FF OR ECX,FFFFFFFF
00412A16 |. 33C0 XOR EAX,EAX
00412A18 |. 33DB XOR EBX,EBX
00412A1A |. F2:AE REPNE SCAS BYTE PTR ES:[EDI]
00412A1C |. F7D1 NOT ECX
00412A1E |. 49 DEC ECX
00412A1F |. 8965 F0 MOV DWORD PTR SS:[EBP-10],ESP
00412A22 |. 83F9 32 CMP ECX,32
00412A25 |. 895D FC MOV DWORD PTR SS:[EBP-4],EBX
00412A28 |. 0F87 B0010000 JA IDMAN.00412BDE
00412A2E |. B9 0D000000 MOV ECX,0D
00412A33 |. 8D7D 9C LEA EDI,DWORD PTR SS:[EBP-64]
00412A36 |. F3:AB REP STOS DWORD PTR ES:[EDI]
00412A38 |. 8BFA MOV EDI,EDX
00412A3A |. 83C9 FF OR ECX,FFFFFFFF
00412A3D |. F2:AE REPNE SCAS BYTE PTR ES:[EDI]
00412A3F |. F7D1 NOT ECX
00412A41 |. 8D75 9C LEA ESI,DWORD PTR SS:[EBP-64]
00412A44 |. 2BF9 SUB EDI,ECX
00412A46 |. 8BD6 MOV EDX,ESI
00412A48 |. 8BC1 MOV EAX,ECX
00412A4A |. 8BF7 MOV ESI,EDI
00412A4C |. 8BFA MOV EDI,EDX
00412A4E |. C1E9 02 SHR ECX,2
00412A51 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
00412A53 |. 8BC8 MOV ECX,EAX
00412A55 |. 83E1 03 AND ECX,3
00412A58 |. F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]
00412A5A |. 8D4D EC LEA ECX,DWORD PTR SS:[EBP-14]
00412A5D |. E8 AE9B0200 CALL IDMAN.0043C610
00412A62 |. BF 64734C00 MOV EDI,IDMAN.004C7364 ; ASCII "506938841"
00412A67 |. 83C9 FF OR ECX,FFFFFFFF
00412A6A |. 33C0 XOR EAX,EAX
00412A6C |. C645 FC 01 MOV BYTE PTR SS:[EBP-4],1
00412A70 |. F2:AE REPNE SCAS BYTE PTR ES:[EDI]
00412A72 |. 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
00412A75 |. F7D1 NOT ECX
00412A77 |. 49 DEC ECX
00412A78 |. 51 PUSH ECX
00412A79 |. 83C9 FF OR ECX,FFFFFFFF
00412A7C |. F2:AE REPNE SCAS BYTE PTR ES:[EDI]
00412A7E |. F7D1 NOT ECX
00412A80 |. 49 DEC ECX
00412A81 |. 68 64734C00 PUSH IDMAN.004C7364 ; ASCII "506938841"(估計就是金鑰)
00412A86 |. 8D45 9C LEA EAX,DWORD PTR SS:[EBP-64]
00412A89 |. 51 PUSH ECX
00412A8A |. 50 PUSH EAX <===EAX="ABCDE-GHIJK-MNOPQ-STUVW"(假註冊碼)
00412A8B |. 8D4D EC LEA ECX,DWORD PTR SS:[EBP-14]
00412A8E |. E8 0D9F0200 CALL IDMAN.0043C9A0 <===一個很關鍵的CALL，對資料加密的CALL(用的RC2的加密方式)
00412A93 |. B2 C6 MOV DL,0C6
00412A95 |. B9 11000000 MOV ECX,11
00412A9A |. 8D7D D8 LEA EDI,DWORD PTR SS:[EBP-28]
00412A9D |. 8D75 9C LEA ESI,DWORD PTR SS:[EBP-64] <===ESI為加密後的資料
00412AA0 |. 33C0 XOR EAX,EAX
00412AA2 |. C645 D8 2B MOV BYTE PTR SS:[EBP-28],2B
00412AA6 |. C645 D9 52 MOV BYTE PTR SS:[EBP-27],52
00412AAA |. C645 DA D1 MOV BYTE PTR SS:[EBP-26],0D1
00412AAE |. C645 DB 9E MOV BYTE PTR SS:[EBP-25],9E
00412AB2 |. C645 DC 8A MOV BYTE PTR SS:[EBP-24],8A
00412AB6 |. C645 DD 82 MOV BYTE PTR SS:[EBP-23],82
00412ABA |. C645 DE DE MOV BYTE PTR SS:[EBP-22],0DE
00412ABE |. C645 DF EB MOV BYTE PTR SS:[EBP-21],0EB
00412AC2 |. C645 E0 EE MOV BYTE PTR SS:[EBP-20],0EE
00412AC6 |. C645 E1 62 MOV BYTE PTR SS:[EBP-1F],62
00412ACA |. C645 E2 A4 MOV BYTE PTR SS:[EBP-1E],0A4
00412ACE |. 8855 E3 MOV BYTE PTR SS:[EBP-1D],DL
00412AD1 |. C645 E4 84 MOV BYTE PTR SS:[EBP-1C],84
00412AD5 |. C645 E5 99 MOV BYTE PTR SS:[EBP-1B],99
00412AD9 |. C645 E6 8F MOV BYTE PTR SS:[EBP-1A],8F
00412ADD |. C645 E7 1F MOV BYTE PTR SS:[EBP-19],1F
00412AE1 |. 885D E8 MOV BYTE PTR SS:[EBP-18],BL
00412AE4 |. F3:A6 REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]
<===ESI為我們註冊碼加密後的結果，EDI就是上面的內定列表：(兩者要相等)
********************************************
0074DDD4 2B 52 D1 9E 8A 82 DE EB +R揠
0074DDDC EE 62 A4 C6 84 99 8F 1F bて?
********************************************
00412AE6 |. 0F84 E7000000 JE IDMAN.00412BD3
00412AEC |. B0 BE MOV AL,0BE
00412AEE |. 8855 E1 MOV BYTE PTR SS:[EBP-1F],DL
00412AF1 |. B9 19000000 MOV ECX,19
00412AF6 |. 8D7D D0 LEA EDI,DWORD PTR SS:[EBP-30]
00412AF9 |. 8D75 9C LEA ESI,DWORD PTR SS:[EBP-64]
00412AFC |. 33D2 XOR EDX,EDX
00412AFE |. C645 D0 92 MOV BYTE PTR SS:[EBP-30],92
00412B02 |. C645 D1 F5 MOV BYTE PTR SS:[EBP-2F],0F5
00412B06 |. C645 D2 25 MOV BYTE PTR SS:[EBP-2E],25
00412B0A |. C645 D3 CD MOV BYTE PTR SS:[EBP-2D],0CD
00412B0E |. C645 D4 78 MOV BYTE PTR SS:[EBP-2C],78
00412B12 |. 8845 D5 MOV BYTE PTR SS:[EBP-2B],AL
00412B15 |. C645 D6 4A MOV BYTE PTR SS:[EBP-2A],4A
00412B19 |. C645 D7 04 MOV BYTE PTR SS:[EBP-29],4
00412B1D |. C645 D8 6A MOV BYTE PTR SS:[EBP-28],6A
00412B21 |. C645 D9 FF MOV BYTE PTR SS:[EBP-27],0FF
00412B25 |. C645 DA A3 MOV BYTE PTR SS:[EBP-26],0A3
00412B29 |. C645 DB 2C MOV BYTE PTR SS:[EBP-25],2C
00412B2D |. C645 DC 9C MOV BYTE PTR SS:[EBP-24],9C
00412B31 |. C645 DD 96 MOV BYTE PTR SS:[EBP-23],96
00412B35 |. C645 DE 28 MOV BYTE PTR SS:[EBP-22],28
00412B39 |. C645 DF B0 MOV BYTE PTR SS:[EBP-21],0B0
00412B3D |. C645 E0 26 MOV BYTE PTR SS:[EBP-20],26
00412B41 |. C645 E2 A6 MOV BYTE PTR SS:[EBP-1E],0A6
00412B45 |. C645 E3 D5 MOV BYTE PTR SS:[EBP-1D],0D5
00412B49 |. C645 E4 D8 MOV BYTE PTR SS:[EBP-1C],0D8
00412B4D |. C645 E5 E3 MOV BYTE PTR SS:[EBP-1B],0E3
00412B51 |. C645 E6 EF MOV BYTE PTR SS:[EBP-1A],0EF
00412B55 |. C645 E7 07 MOV BYTE PTR SS:[EBP-19],7
00412B59 |. 885D E8 MOV BYTE PTR SS:[EBP-18],BL
00412B5C |. F3:A6 REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]
<===ESI為我們註冊碼加密後的結果，EDI就是上面的內定列表：(兩者要相等)
********************************************
0074DDCC 92 F5 25 CD 78 BE 4A 04 %xJ
0074DDD4 6A FF A3 2C 9C 96 28 B0 j?(
0074DDDC 26 C6 A6 D5 D8 E3 EF 07 &痞肇泔
********************************************
00412B5E |. 74 73 JE SHORT IDMAN.00412BD3
00412B60 |. B1 58 MOV CL,58
00412B62 |. 8845 DB MOV BYTE PTR SS:[EBP-25],AL
00412B65 |. 884D DE MOV BYTE PTR SS:[EBP-22],CL
00412B68 |. B2 9D MOV DL,9D
00412B6A |. 8845 E0 MOV BYTE PTR SS:[EBP-20],AL
00412B6D |. 884D E5 MOV BYTE PTR SS:[EBP-1B],CL
00412B70 |. B9 19000000 MOV ECX,19
00412B75 |. 8D7D D0 LEA EDI,DWORD PTR SS:[EBP-30]
00412B78 |. 8D75 9C LEA ESI,DWORD PTR SS:[EBP-64]
00412B7B |. 33C0 XOR EAX,EAX
00412B7D |. C645 D0 7B MOV BYTE PTR SS:[EBP-30],7B
00412B81 |. C645 D1 B3 MOV BYTE PTR SS:[EBP-2F],0B3
00412B85 |. C645 D2 42 MOV BYTE PTR SS:[EBP-2E],42
00412B89 |. C645 D3 79 MOV BYTE PTR SS:[EBP-2D],79
00412B8D |. C645 D4 65 MOV BYTE PTR SS:[EBP-2C],65
00412B91 |. C645 D5 CE MOV BYTE PTR SS:[EBP-2B],0CE
00412B95 |. C645 D6 2D MOV BYTE PTR SS:[EBP-2A],2D
00412B99 |. C645 D7 B8 MOV BYTE PTR SS:[EBP-29],0B8
00412B9D |. C645 D8 5E MOV BYTE PTR SS:[EBP-28],5E
00412BA1 |. C645 D9 13 MOV BYTE PTR SS:[EBP-27],13
00412BA5 |. C645 DA DF MOV BYTE PTR SS:[EBP-26],0DF
00412BA9 |. C645 DC F0 MOV BYTE PTR SS:[EBP-24],0F0
00412BAD |. C645 DD 61 MOV BYTE PTR SS:[EBP-23],61
00412BB1 |. 8855 DF MOV BYTE PTR SS:[EBP-21],DL
00412BB4 |. C645 E1 66 MOV BYTE PTR SS:[EBP-1F],66
00412BB8 |. C645 E2 52 MOV BYTE PTR SS:[EBP-1E],52
00412BBC |. C645 E3 75 MOV BYTE PTR SS:[EBP-1D],75
00412BC0 |. C645 E4 C9 MOV BYTE PTR SS:[EBP-1C],0C9
00412BC4 |. C645 E6 B6 MOV BYTE PTR SS:[EBP-1A],0B6
00412BC8 |. C645 E7 C8 MOV BYTE PTR SS:[EBP-19],0C8
00412BCC |. 885D E8 MOV BYTE PTR SS:[EBP-18],BL
00412BCF |. F3:A6 REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]
<===ESI為我們註冊碼加密後的結果，EDI就是上面的內定列表：(兩者要相等)，這裡是第3次機會
********************************************
0074DDCC 7B B3 42 79 65 CE 2D B8 {Bye
0074DDD4 5E 13 DF BE F0 61 58 9D ^呔aX
0074DDDC BE 66 52 75 C9 58 B6 C8 fRuX度
********************************************
00412BD1 | 74 1E JNZ SHORT IDMAN.00412BF1
00412BD3 |> 8D4D EC LEA ECX,DWORD PTR SS:[EBP-14]
00412BD6 |. 885D FC MOV BYTE PTR SS:[EBP-4],BL
00412BD9 |. E8 629A0200 CALL IDMAN.0043C640
00412BDE |> 32C0 XOR AL,AL
00412BE0 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
00412BE3 |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
00412BEA |. 5F POP EDI
00412BEB |. 5E POP ESI
00412BEC |. 5B POP EBX
00412BED |. 8BE5 MOV ESP,EBP
00412BEF |. 5D POP EBP
00412BF0 |. C3 RETN

------------------------RC2加密CALL---------------------------------
0043C9A0 $ 55 PUSH EBP
0043C9A1 . 8BEC MOV EBP,ESP
0043C9A3 . 6A FF PUSH -1
0043C9A5 . 68 B0074A00 PUSH IDMAN.004A07B0 ; SE handler installation
0043C9AA . 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0043C9B0 . 50 PUSH EAX
0043C9B1 . 64:8925 000000>MOV DWORD PTR FS:[0],ESP
0043C9B8 . 81EC 84010000 SUB ESP,184
0043C9BE . 53 PUSH EBX
0043C9BF . 56 PUSH ESI
0043C9C0 . 57 PUSH EDI
0043C9C1 . 8D85 70FEFFFF LEA EAX,DWORD PTR SS:[EBP-190]
0043C9C7 . 8965 F0 MOV DWORD PTR SS:[EBP-10],ESP
0043C9CA . 33F6 XOR ESI,ESI
0043C9CC . 8BD9 MOV EBX,ECX
0043C9CE . 50 PUSH EAX
0043C9CF . 8975 FC MOV DWORD PTR SS:[EBP-4],ESI
0043C9D2 . E8 79FCFFFF CALL IDMAN.0043C650
0043C9D7 . 8B45 14 MOV EAX,DWORD PTR SS:[EBP+14]
0043C9DA . 8D8D 70FEFFFF LEA ECX,DWORD PTR SS:[EBP-190]
0043C9E0 . 8D95 70FFFFFF LEA EDX,DWORD PTR SS:[EBP-90]
0043C9E6 . 51 PUSH ECX
0043C9E7 . 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10] <==="506938841"為內定的金鑰
0043C9EA . 52 PUSH EDX
0043C9EB . 50 PUSH EAX
0043C9EC . 51 PUSH ECX
0043C9ED . 8BCB MOV ECX,EBX
0043C9EF . E8 9CFCFFFF CALL IDMAN.0043C690 <===跟進
0043C9F4 . 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8] <==="ABCDE-GHIJK-MNOPQ-STUVW"
0043C9F7 > 3B75 0C CMP ESI,DWORD PTR SS:[EBP+C]
0043C9FA . 7D 2A JGE SHORT IDMAN.0043CA26 <===迴圈結束就這裡跳出
0043C9FC . 8D95 70FFFFFF LEA EDX,DWORD PTR SS:[EBP-90]
0043CA02 . 8BCB MOV ECX,EBX
0043CA04 . 52 PUSH EDX
0043CA05 . 57 PUSH EDI
0043CA06 . E8 F5FCFFFF CALL IDMAN.0043C700 <===加密CALL
0043CA0B . 83C6 08 ADD ESI,8 <===可以看得出，在這裡是每8位一處理
0043CA0E . 83C7 08 ADD EDI,8
0043CA11 .^EB E4 JMP SHORT IDMAN.0043C9F7 <===從這裡向上跳構成一個迴圈結構，主要每8位加密：
**************這裡就是登錄檔加密後的列表********************
0074DD98 A1 A3 4B 70 DB C5 05 22 。Kp叟"
0074DDA0 DE 26 A7 BB 53 3E A9 9D ?ЩS>
0074DDA8 24 3D 45 42 91 B3 9D 06 $=EB?
************************************************************

0043CA13 . 68 E4064D00 PUSH IDMAN.004D06E4
<===CProtection::rrc2_encrypt(byte* data,int length_of_data, char* key, int length_of_key)很明顯這就是一個加密演算法的CALL(RC2加密演算法)
0043CA18 . E8 D37AFEFF CALL IDMAN.004244F0
0043CA1D . 83C4 04 ADD ESP,4
0043CA20 . B8 26CA4300 MOV EAX,IDMAN.0043CA26
0043CA25 . C3 RETN
0043CA26 > 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] <===直接就跳到這裡了
0043CA29 . 5F POP EDI
0043CA2A . 5E POP ESI
0043CA2B . 64:890D 000000>MOV DWORD PTR FS:[0],ECX
0043CA32 . 5B POP EBX
0043CA33 . 8BE5 MOV ESP,EBP
0043CA35 . 5D POP EBP
0043CA36 . C2 1000 RETN 10

---------------0043C9EF CALL IDMAN.0043C690 跟進(對"506938841"金鑰的預處理)-------------------
0043C690 /$ 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
0043C694 |. 56 PUSH ESI
0043C695 |. 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+C]
0043C699 |. 57 PUSH EDI
0043C69A |. 85F6 TEST ESI,ESI
0043C69C |. 7E 15 JLE SHORT IDMAN.0043C6B3
0043C69E |. 8B7C24 0C MOV EDI,DWORD PTR SS:[ESP+C] <===EDI="506938841"
0043C6A2 |. 55 PUSH EBP
0043C6A3 |. 8BC1 MOV EAX,ECX
0043C6A5 |. 2BF9 SUB EDI,ECX
0043C6A7 |. 8BEE MOV EBP,ESI
0043C6A9 |> 8A1407 /MOV DL,BYTE PTR DS:[EDI+EAX] <===依次取金鑰的字元ASC值
0043C6AC |. 8810 |MOV BYTE PTR DS:[EAX],DL
0043C6AE |. 40 |INC EAX
0043C6AF |. 4D |DEC EBP
0043C6B0 |.^75 F7 \JNZ SHORT IDMAN.0043C6A9 <===這裡構成迴圈，實現的功能是將金鑰在記憶體中再複製一份出來
0043C6B2 |. 5D POP EBP
0043C6B3 |> 8B7C24 18 MOV EDI,DWORD PTR SS:[ESP+18]
0043C6B7 |. 83FE 7F CMP ESI,7F
0043C6BA |. 8BC6 MOV EAX,ESI
0043C6BC |. 7F 2F JG SHORT IDMAN.0043C6ED
0043C6BE |. 53 PUSH EBX
0043C6BF |> 8BD0 /MOV EDX,EAX <===迴圈開始
0043C6C1 |. 33DB |XOR EBX,EBX
0043C6C3 |. 2BD6 |SUB EDX,ESI
0043C6C5 |. 8A1C0A |MOV BL,BYTE PTR DS:[EDX+ECX] <===依次取金鑰"506938841"的字元ASC值
0043C6C8 |. 33D2 |XOR EDX,EDX
0043C6CA |. 8A5408 FF |MOV DL,BYTE PTR DS:[EAX+ECX-1] <===依次反向取金鑰"506938841"的字元ASC值
0043C6CE |. 03DA |ADD EBX,EDX <===相加
0043C6D0 |. 81E3 FF000080 |AND EBX,800000FF <===再作與運算
0043C6D6 |. 79 08 |JNS SHORT IDMAN.0043C6E0
0043C6D8 |. 4B |DEC EBX
0043C6D9 |. 81CB 00FFFFFF |OR EBX,FFFFFF00
0043C6DF |. 43 |INC EBX
0043C6E0 |> 8A143B |MOV DL,BYTE PTR DS:[EBX+EDI] <===EDI裡是一個很大的列表，根據EBX的不同決定DL的取值
****************天大的列表*******************************
0074DBE4 D9 78 F9 C4 19 DD B5 ED 28 E9 FD 79 4A A0 D8 9D
0074DBF4 C6 7E 37 83 2B 76 53 8E 62 4C 64 88 44 8B FB A2
0074DC04 17 9A 59 F5 87 B3 4F 13 61 45 6D 09 81 7D 32
0074DC14 BD 8F 40 EB 86 B7 7B 0B F0 95 21 22 5C 6B 4E 82
0074DC24 54 D6 65 93 CE 60 B2 1C 73 56 C0 14 A7 8C F1 DC
0074DC34 12 75 CA 1F 3B BE E4 D1 42 3D D4 30 A3 3C B6 26
0074DC44 6F BF 0E DA 46 69 07 57 27 F2 1D 9B BC 94 43 03
0074DC54 F8 11 C7 F6 90 EF 3E E7 06 C3 D5 2F C8 66 1E D7
0074DC64 08 E8 EA DE 80 52 EE F7 84 AA 72 AC 35 4D 6A 2A
0074DC74 96 1A D2 71 5A 15 49 74 4B 9F D0 5E 04 18 A4 EC
0074DC84 C2 E0 41 6E 0F 51 CB CC 24 91 AF 50 A1 F4 70 39
0074DC94 99 7C 3A 85 23 B8 B4 7A FC 02 36 5B 25 55 97 31
0074DCA4 2D 5D FA 98 E3 8A 92 AE 05 DF 29 10 67 6C BA C9
0074DCB4 D3 00 E6 CF E1 9E A8 2C 63 16 01 3F 58 E2 89 A9
0074DCC4 0D 38 34 1B AB 33 FF B0 BB 48 0C 5F B9 B1 CD 2E
0074DCD4 C5 F3 DB 47 E5 A5 9C 77 0A A6 20 68 FE 7F C1 AD
*********************************************************
0043C6E3 |. 881408 |MOV BYTE PTR DS:[EAX+ECX],DL <===得出的來的再接在金鑰"506938841"的後面
0043C6E6 |. 40 |INC EAX
0043C6E7 |. 83F8 7F |CMP EAX,7F <===因為EAX的初始值為9，所以這裡將構成一個新的128位的數值群(呵呵，典型的RC加密演算法的風格)
0043C6EA |.^7E D3 \JLE SHORT IDMAN.0043C6BF
*********************新的128位加密群***************************************
0074DCE4 35 30 36 39 33 38 38 34 31 07 0B D6 9D D3 79 7C 506938841 y|
0074DCF4 99 29 BD 05 3F 58 B5 8F 61 72 32 0B C0 62 2E ???Xar2 b.
0074DD04 1B AF C6 F0 59 46 B5 8E 25 54 C4 72 0E 57 18 6C YF%TrWl
0074DD14 20 60 23 B0 59 57 70 84 C5 33 71 5A FD E4 22 D2 `#YWp3qZ"
0074DD24 E4 91 E3 3B 15 37 88 AF E8 67 0A B1 B9 BA F3 2F ?7g.憊後/
0074DD34 89 11 06 C6 E7 C2 C8 5B 72 68 C3 DF 51 F0 3A F9 ?歧氯[rh眠Q?
0074DD44 3B F4 A3 07 FF 12 F9 EB AB FF 47 0C 83 EA FE 77 ;簦?G.掰w
0074DD54 0E 02 78 31 6B CD 7A 06 66 90 D2 C0 F3 B6 DE 42 x1kzf依蠖B
***************************************************************************
0043C6EC |. 5B POP EBX
0043C6ED |> 33C0 XOR EAX,EAX
0043C6EF |. 8A01 MOV AL,BYTE PTR DS:[ECX]
0043C6F1 |. 8A1438 MOV DL,BYTE PTR DS:[EAX+EDI]
0043C6F4 |. 5F POP EDI
0043C6F5 |. 8811 MOV BYTE PTR DS:[ECX],DL <===又對最前面的值進行變換
0043C6F7 |. 5E POP ESI
0043C6F8 \. C2 1000 RETN 10

---------------0043CA06 CALL IDMAN.0043C700 對註冊碼進行加密(共進行3次)-------------------
0043C700 /$ 51 PUSH ECX
0043C701 |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
0043C705 |. 53 PUSH EBX
0043C706 |. 55 PUSH EBP
0043C707 |. 56 PUSH ESI
0043C708 |. 66:8B08 MOV CX,WORD PTR DS:[EAX]
0043C70B |. 66:8B50 02 MOV DX,WORD PTR DS:[EAX+2]
0043C70F |. 66:8B70 04 MOV SI,WORD PTR DS:[EAX+4]
0043C713 |. 57 PUSH EDI
0043C714 |. 66:8B78 06 MOV DI,WORD PTR DS:[EAX+6]
0043C718 |. 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C]
0043C71C |. C74424 10 0000>MOV DWORD PTR SS:[ESP+10],0
0043C724 |. 8D58 04 LEA EBX,DWORD PTR DS:[EAX+4]
0043C727 |> 8BC7 /MOV EAX,EDI
0043C729 |. 8BEF |MOV EBP,EDI
0043C72B |. F7D0 |NOT EAX
0043C72D |. 23C2 |AND EAX,EDX
0043C72F |. 23EE |AND EBP,ESI
0043C731 |. 03C5 |ADD EAX,EBP
0043C733 |. 8BEF |MOV EBP,EDI
0043C735 |. 66:0343 FC |ADD AX,WORD PTR DS:[EBX-4]
0043C739 |. 03C8 |ADD ECX,EAX
0043C73B |. 66:8BC1 |MOV AX,CX
0043C73E |. 03C9 |ADD ECX,ECX
0043C740 |. 66:C1E8 0F |SHR AX,0F
0043C744 |. 0BC8 |OR ECX,EAX
0043C746 |. 8BC1 |MOV EAX,ECX
0043C748 |. 23E9 |AND EBP,ECX
0043C74A |. F7D0 |NOT EAX
0043C74C |. 23C6 |AND EAX,ESI
0043C74E |. 03C5 |ADD EAX,EBP
0043C750 |. 66:0343 FE |ADD AX,WORD PTR DS:[EBX-2]
0043C754 |. 03D0 |ADD EDX,EAX
0043C756 |. 66:8BC2 |MOV AX,DX
0043C759 |. 66:C1E8 0E |SHR AX,0E
0043C75D |. C1E2 02 |SHL EDX,2
0043C760 |. 0BD0 |OR EDX,EAX
0043C762 |. 8BEA |MOV EBP,EDX
0043C764 |. 8BC2 |MOV EAX,EDX
0043C766 |. F7D5 |NOT EBP
0043C768 |. 23EF |AND EBP,EDI
0043C76A |. 23C1 |AND EAX,ECX
0043C76C |. 03F5 |ADD ESI,EBP
0043C76E |. 03C6 |ADD EAX,ESI
0043C770 |. 66:0303 |ADD AX,WORD PTR DS:[EBX]
0043C773 |. 66:8BF0 |MOV SI,AX
0043C776 |. 66:C1EE 0D |SHR SI,0D
0043C77A |. C1E0 03 |SHL EAX,3
0043C77D |. 0BF0 |OR ESI,EAX
0043C77F |. 8BC6 |MOV EAX,ESI
0043C781 |. 8BEE |MOV EBP,ESI
0043C783 |. F7D0 |NOT EAX
0043C785 |. 23C1 |AND EAX,ECX
0043C787 |. 23EA |AND EBP,EDX
0043C789 |. 03C5 |ADD EAX,EBP
0043C78B |. 66:0343 02 |ADD AX,WORD PTR DS:[EBX+2]
0043C78F |. 03C7 |ADD EAX,EDI
0043C791 |. 8BF8 |MOV EDI,EAX
0043C793 |. C1E7 05 |SHL EDI,5
0043C796 |. 66:C1E8 0B |SHR AX,0B
0043C79A |. 0BF8 |OR EDI,EAX
0043C79C |. 8B4424 10 |MOV EAX,DWORD PTR SS:[ESP+10]
0043C7A0 |. 83F8 04 |CMP EAX,4
0043C7A3 |. 74 05 |JE SHORT IDMAN.0043C7AA
0043C7A5 |. 83F8 0A |CMP EAX,0A
0043C7A8 |. 75 34 |JNZ SHORT IDMAN.0043C7DE
0043C7AA |> 8B4424 1C |MOV EAX,DWORD PTR SS:[ESP+1C]
0043C7AE |. 8BEF |MOV EBP,EDI
0043C7B0 |. 83E5 3F |AND EBP,3F
0043C7B3 |. 66:8B2C68 |MOV BP,WORD PTR DS:[EAX+EBP*2]
0043C7B7 |. 03CD |ADD ECX,EBP
0043C7B9 |. 8BE9 |MOV EBP,ECX
0043C7BB |. 83E5 3F |AND EBP,3F
0043C7BE |. 66:8B2C68 |MOV BP,WORD PTR DS:[EAX+EBP*2]
0043C7C2 |. 03D5 |ADD EDX,EBP
0043C7C4 |. 8BEA |MOV EBP,EDX
0043C7C6 |. 83E5 3F |AND EBP,3F
0043C7C9 |. 66:8B2C68 |MOV BP,WORD PTR DS:[EAX+EBP*2]
0043C7CD |. 03F5 |ADD ESI,EBP
0043C7CF |. 8BEE |MOV EBP,ESI
0043C7D1 |. 83E5 3F |AND EBP,3F
0043C7D4 |. 66:8B0468 |MOV AX,WORD PTR DS:[EAX+EBP*2]
0043C7D8 |. 03F8 |ADD EDI,EAX
0043C7DA |. 8B4424 10 |MOV EAX,DWORD PTR SS:[ESP+10]
0043C7DE |> 40 |INC EAX
0043C7DF |. 83C3 08 |ADD EBX,8
0043C7E2 |. 83F8 0F |CMP EAX,0F
0043C7E5 |. 894424 10 |MOV DWORD PTR SS:[ESP+10],EAX
0043C7E9 |.^0F8E 38FFFFFF \JLE IDMAN.0043C727
0043C7EF |. 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18]
0043C7F3 |. 66:8978 06 MOV WORD PTR DS:[EAX+6],DI
0043C7F7 |. 66:8970 04 MOV WORD PTR DS:[EAX+4],SI
0043C7FB |. 5F POP EDI
0043C7FC |. 5E POP ESI
0043C7FD |. 5D POP EBP
0043C7FE |. 66:8908 MOV WORD PTR DS:[EAX],CX
0043C801 |. 66:8950 02 MOV WORD PTR DS:[EAX+2],DX
0043C805 |. 5B POP EBX
0043C806 |. 59 POP ECX
0043C807 \. C2 0800 RETN 8

--------------------------------------------------------------------------------
4、附上RC4加密演算法的VB原始碼(和上面的有點類似,只是我們這裡的金鑰是固定的，但碼錶開始又是亂序)
Public Sub main()
Dim key As String
For i = 1 To 16
Randomize '每次都隨機給個種子值
'對最初給定的種子都會生成相同的數列，因為每一次呼叫 Rnd 函式都用數列中的前一個數作為下一個
'數的種子。在呼叫 Rnd 之前，先使用無引數的 Randomize 語句初始化隨機數生成器，該生成器具有根
'據系統計時器得到的種子。

key = key & Chr(Rnd * 255) '隨機得到一個長16位的字串(金鑰)，串中每個字元的ASC值被限制在(0~255之間)
Next i
MsgBox RC4(RC4("Welcome To Plindge Studio!", key), key) '這裡又進行兩次RC4運算
End Sub

Public Function RC4(inp As String, key As String) As String
Dim S(0 To 255) As Byte, K(0 To 255) As Byte, i As Long
Dim j As Long, temp As Byte, Y As Byte, t As Long, x As Long
Dim Outp As String
For i = 0 To 255
S(i) = i
Next
j = 1
For i = 0 To 255
If j > Len(key) Then j = 1
K(i) = Asc(Mid(key, j, 1))
j = j + 1
Next i
j = 0
For i = 0 To 255
j = (j + S(i) + K(i)) Mod 256
temp = S(i)
S(i) = S(j)
S(j) = temp
Next i
i = 0
j = 0
For x = 1 To Len(inp)
i = (i + 1) Mod 256
j = (j + S(i)) Mod 256
temp = S(i)
S(i) = S(j)
S(j) = temp
t = (S(i) + (S(j) Mod 256)) Mod 256
Y = S(t)
Outp = Outp & Chr(Asc(Mid(inp, x, 1)) Xor Y)
Next
RC4 = Outp
End Function

5、得出註冊碼的可能性
　　因為作者內定RC加密後的值有三個，必須在金鑰"506938841"可知的情況下，解密RC演算法逆推出可能的註冊碼，然後再找到符合填入註冊碼時符合要求的註冊碼。

與RC加密演算法的第一次親密接觸

相關文章