東聯維修站管理系統V9.0註冊分析

物件：東聯維修站管理系統V9.0
作者：lordor[CCG][BCG][DFCG]
Mail:lordor@sina.com
QQ：88378557
目的：屬技術交流，無其它目的，請不要任意散佈或用用商業用途。初學破解,如有不對的地方歡迎批評指出。
工具：ollydbg1.09C,fi301,w32Dasm

假設：
序列號：7588-4657-2694-5264
註冊碼：1111-2222-3333-4444

一開始執行時，程式出現“系統檔案出錯”提示，然後非法操作退出，看來先得修補一下它。
用w32Dasm載入程式，查詢“系統檔案出錯”提示(有好幾處)，看從那裡跳來的，在ollyDbg中在關鍵跳處下斷。

004837BE LEA EDX,DWORD PTR SS:[ESP+18]
004837C2 PUSH kl.005658E4 ; ASCII "temp.adtg"
004837C7 LEA EAX,DWORD PTR SS:[ESP+18]
004837CB PUSH EDX
004837CC PUSH EAX
004837CD CALL kl.004F4038
004837D2 PUSH EAX
004837D3 LEA ECX,DWORD PTR SS:[ESP+1C]
004837D7 MOV BYTE PTR SS:[ESP+190],4
004837DF CALL kl.004F3EDC
004837E4 LEA ECX,DWORD PTR SS:[ESP+14]
004837E8 MOV BYTE PTR SS:[ESP+18C],2
004837F0 CALL kl.004F3DA3
004837F5 MOV ECX,DWORD PTR SS:[ESP+10]
004837F9 PUSH kl.0056437C ; ASCII "rb"
004837FE PUSH ECX
004837FF CALL kl.004DD357
00483804 MOV EDI,EAX
00483806 ADD ESP,8
00483809 TEST EDI,EDI
0048380B JE SHORT kl.00483827
0048380D MOV EDX,DWORD PTR SS:[ESP+18]
00483811 PUSH kl.005658E0 ; ASCII "wb"
00483816 PUSH EDX
00483817 CALL kl.004DD357
0048381C MOV EBP,EAX
0048381E ADD ESP,8
00483821 TEST EBP,EBP
00483823 JNZ SHORT kl.00483839 ===>程式停在這裡，改成跳走即可。
00483825 JMP SHORT kl.0048382B
00483827 MOV EBP,DWORD PTR SS:[ESP+24]
0048382B PUSH 0 ; /Arg3 = 00000000
0048382D PUSH 0 ; |Arg2 = 00000000
0048382F PUSH kl.005658D0 ; |Arg1 = 005658D0

程式正常執行後，查詢“註冊成功”，定位下面註冊部分，用ollyDbg動態分析：

0049EBE1 PUSH kl.0056A464 ; ASCII "0000"
0049EBE6 LEA ECX,DWORD PTR SS:[ESP+14]
0049EBEA CALL kl.004F3F2C
0049EBEF MOV EDI,DWORD PTR SS:[ESP+24]
0049EBF3 LEA ECX,DWORD PTR SS:[ESP+10] ==>在這下斷
0049EBF7 LEA EDX,DWORD PTR SS:[ESP+14]
0049EBFB PUSH ECX
0049EBFC LEA EAX,DWORD PTR SS:[ESP+28]
0049EC00 PUSH EDX
0049EC01 PUSH EAX
0049EC02 CALL kl.004F3FD2 ==>取得的註冊碼，形成串1111222233334444
0049EC07 PUSH EAX
0049EC08 LEA ECX,DWORD PTR SS:[ESP+18]
0049EC0C MOV BYTE PTR SS:[ESP+50],6
0049EC11 CALL kl.004F3EDC
0049EC16 LEA ECX,DWORD PTR SS:[ESP+24]
0049EC1A MOV BYTE PTR SS:[ESP+4C],BL
0049EC1E CALL kl.004F3DA3
0049EC23 MOV EDX,DWORD PTR SS:[ESP+1C] ==>串2入edx,edx=000008AE
0049EC27 MOV EAX,DWORD PTR SS:[ESP+18] ==>串1入eax,eax=00000457
0049EC2B LEA ECX,DWORD PTR DS:[EDI+EBP] ==>串3及串4各位相加值，即ecx=00001E61
0049EC2E ADD ECX,EDX ==>
0049EC30 ADD ECX,EAX ==>
0049EC32 JE SHORT kl.0049ECA6 ==>為0則出錯
0049EC34 CALL kl.0047EDA0 ==>關鍵call(1)
0049EC39 CMP EAX,DWORD PTR SS:[ESP+18] ==>運算值與串1比較，eax=0000023A
0049EC3D JNZ SHORT kl.0049ECA6 ==>不等則跳
0049EC3F CALL DWORD PTR SS:[ESP+28] ==>關鍵call(2)
0049EC43 CMP EAX,DWORD PTR SS:[ESP+1C] ==>運算值與串2比較，eax=00001CFE
0049EC47 JNZ SHORT kl.0049ECA6 ==>不等則跳
0049EC49 CALL DWORD PTR SS:[ESP+2C] ==>關鍵call(3),得到eax=FFFFEC63
0049EC4D NOT EBP ==>ebp為串2的值，即為00000D05，此處not運算，得ebp=FFFFF2FA
0049EC4F CMP EAX,EBP==>串3比較
0049EC51 JNZ SHORT kl.0049ECA6==>不等則跳
0049EC53 CALL DWORD PTR SS:[ESP+30] ==>關鍵call(3)，得到eax=00001A5F
0049EC57 CMP EAX,EDI ==>與串4比較
0049EC59 JNZ SHORT kl.0049ECA6 ==>不等則跳
0049EC5B CALL kl.0050BA9E ==>後面為儲存註冊資訊
0049EC60 MOV EAX,DWORD PTR DS:[EAX+4]
0049EC63 PUSH ECX
0049EC64 LEA EDX,DWORD PTR SS:[ESP+18]
0049EC68 MOV ECX,ESP
0049EC6A MOV EDI,DWORD PTR DS:[EAX+1C]
0049EC6D MOV DWORD PTR SS:[ESP+34],ESP
0049EC71 PUSH EDX
0049EC72 CALL kl.004F3B18
0049EC77 PUSH ECX
0049EC78 MOV BYTE PTR SS:[ESP+54],7
0049EC7D MOV ECX,ESP
0049EC7F MOV DWORD PTR SS:[ESP+34],ESP
0049EC83 PUSH kl.0056221C ; ASCII "RegFiles"
0049EC88 CALL kl.004F3E11
0049EC8D MOV ECX,EDI ; |
0049EC8F MOV BYTE PTR SS:[ESP+54],BL ; |
0049EC93 CALL kl.0040C9D0 ; \kl.0040C9D0
0049EC98 PUSH 0 ; /Arg3 = 00000000
0049EC9A PUSH 0 ; |Arg2 = 00000000
0049EC9C PUSH kl.0056A458 ; |Arg1 = 0056A458 ==>“註冊成功”
0049ECA1 CALL kl.004FC1B2 ; \kl.004FC1B2

---------------
關鍵call(1)

-----------------------------------
關鍵call(2)

System_1.>PUSH EBP
02A520E2 MOV EBP,ESP
02A520E4 PUSH ECX
02A520E5 CALL System_1.Serial ==>取序列號串2，得eax=00001231
02A520EA MOV DWORD PTR SS:[EBP-4],EAX
02A520ED MOV EAX,DWORD PTR SS:[EBP-4]
02A520F0 NOT EAX ==>not運算，eax=FFFFEDCE
02A520F2 MOV DWORD PTR SS:[EBP-4],EAX
02A520F5 MOV ECX,DWORD PTR SS:[EBP-4]
02A520F8 XOR ECX,72020120 ==>not運算，ecx=8DFDECEE
02A520FE MOV DWORD PTR SS:[EBP-4],ECX
02A52101 MOV EDX,DWORD PTR SS:[EBP-4]
02A52104 XOR EDX,90109010
02A5210A MOV DWORD PTR SS:[EBP-4],EDX
02A5210D MOV EAX,DWORD PTR SS:[EBP-4]
02A52110 AND EAX,1FFF
02A52115 MOV ESP,EBP
02A52117 POP EBP
02A52118 RETN

----------------------------------
關鍵call(3)

System_1.>PUSH EBP
02A52192 MOV EBP,ESP
02A52194 PUSH ECX
02A52195 CALL System_1.Serial2, ==>取序列號串3，得eax=00000A86
02A5219A MOV DWORD PTR SS:[EBP-4],EAX
02A5219D MOV EAX,DWORD PTR SS:[EBP-4]
02A521A0 NOT EAX
02A521A2 MOV DWORD PTR SS:[EBP-4],EAX
02A521A5 MOV ECX,DWORD PTR SS:[EBP-4]
02A521A8 XOR ECX,72020120
02A521AE MOV DWORD PTR SS:[EBP-4],ECX
02A521B1 MOV EDX,DWORD PTR SS:[EBP-4]
02A521B4 XOR EDX,90109010
02A521BA MOV DWORD PTR SS:[EBP-4],EDX
02A521BD MOV EAX,DWORD PTR SS:[EBP-4]
02A521C0 AND EAX,1FFF0000
02A521C5 MOV DWORD PTR SS:[EBP-4],EAX
02A521C8 CMP DWORD PTR SS:[EBP-4],2710 ==>與10000比較
02A521CF JBE SHORT System_1.02A521E2 ==>如果小於，則跳到後面，否則除10
02A521D1 MOV EAX,DWORD PTR SS:[EBP-4]
02A521D4 XOR EDX,EDX
02A521D6 MOV ECX,0A
02A521DB DIV ECX
02A521DD MOV DWORD PTR SS:[EBP-4],EAX
02A521E0 JMP SHORT System_1.02A521C8
02A521E2 MOV EAX,DWORD PTR SS:[EBP-4]
02A521E5 NOT EAX
02A521E7 MOV ESP,EBP
02A521E9 POP EBP
02A521EA RETN

-------------------------------------------
關鍵call(4)

System_1.>PUSH EBP
02A5156B MOV EBP,ESP
02A5156D PUSH ECX
02A5156E CALL System_1.GetSerialNo ==>取序列號串4，eax=00001490
02A51573 MOV DWORD PTR SS:[EBP-4],EAX
02A51576 MOV EAX,DWORD PTR SS:[EBP-4]
02A51579 NOT EAX
02A5157B MOV DWORD PTR SS:[EBP-4],EAX
02A5157E MOV ECX,DWORD PTR SS:[EBP-4]
02A51581 XOR ECX,72020120
02A51587 MOV DWORD PTR SS:[EBP-4],ECX
02A5158A MOV EDX,DWORD PTR SS:[EBP-4]
02A5158D XOR EDX,90109010
02A51593 MOV DWORD PTR SS:[EBP-4],EDX
02A51596 MOV EAX,DWORD PTR SS:[EBP-4]
02A51599 AND EAX,1FFF
02A5159E MOV ESP,EBP
02A515A0 POP EBP
02A515A1 RETN

-------------------------------------

總結：

四個關鍵call,並不複雜，只是作一些簡單的xor,not,and運算。

一個可能的註冊碼：
序列號：7588-4657-2694-5264
註冊碼：0570-7422-5020-6751

cracked by lordor
03.7.6

東聯維修站管理系統V9.0註冊分析

相關文章