Theme Builder註冊碼分析

Theme Builder(V 4.01),是一款類似於資源管理器的軟體,功能是十分強大的!它是一個共享軟體,它會提供你30天的試用和10次的儲存功能!如果你感興趣的話,你可以到www.themetech.net去下載!
  察看,是ASPack v2.001加的殼,脫之!Borland Delphi寫的DeDe檢視!
  檢視註冊視窗的OkButtonClick事件!

004981C4   53                     push    ebx
004981C5   8BD8                   mov     ebx, eax
004981C7   8BC3                   mov     eax, ebx

* Reference to : TRegForm.ProcessReg() ;註冊的過程,關鍵進入
|
004981C9   E826000000             call    004981F4
004981CE   3D8D030000             cmp     eax, $0000038D
004981D3   7509                   jnz     004981DE
004981D5   8BC3                   mov     eax, ebx

* Reference to : TRegForm.InComplete()
|
004981D7   E898030000             call    00498574
004981DC   EB0A                   jmp     004981E8
004981DE   48                     dec     eax
004981DF   7507                   jnz     004981E8
004981E1   8BC3                   mov     eax, ebx

* Reference to : TRegForm.Complete()
|
004981E3   E8E0010000             call    004983C8

* Reference to RegForm
|
004981E8   A1588B4F00             mov     eax, dword ptr [$004F8B58]

* Reference to : TApplication._PROC_0044CB90()
|
004981ED   E89E49FBFF             call    0044CB90
004981F2   5B                     pop     ebx
004981F3   C3                     ret


我們進入004981C9處的Call

004981F4   55                     push    ebp
004981F5   8BEC                   mov     ebp, esp
004981F7   6A00                   push    $00
004981F9   6A00                   push    $00
004981FB   6A00                   push    $00
004981FD   53                     push    ebx
004981FE   56                     push    esi
004981FF   8BD8                   mov     ebx, eax
00498201   33C0                   xor     eax, eax
00498203   55                     push    ebp

* Possible String Reference to: '[傣脬^[]U(?S3???
|                                UU??3UhII'
|
00498204   68B8834900             push    $004983B8

***** TRY
|
00498209   64FF30                 push    dword ptr fs:[eax]
0049820C   648920                 mov     fs:[eax], esp
0049820F   685C8B4F00             push    $004F8B5C
00498214   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TRegForm.mynae : TEdit
|
00498217   8B83CC020000           mov     eax, [ebx+$02CC]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
0049821D   E802B7F9FF             call    00433924
00498222   8B45FC                 mov     eax, [ebp-$04]
00498225   B901000000             mov     ecx, $00000001
0049822A   BA01000000             mov     edx, $00000001

* Reference to: System.Proc_004041D8
|
0049822F   E8A4BFF6FF             call    004041D8
00498234   68608B4F00             push    $004F8B60
00498239   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TRegForm.mynae : TEdit
|
0049823C   8B83CC020000           mov     eax, [ebx+$02CC]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
00498242   E8DDB6F9FF             call    00433924
00498247   8B45FC                 mov     eax, [ebp-$04]
0049824A   B901000000             mov     ecx, $00000001
0049824F   BA04000000             mov     edx, $00000004

* Reference to: System.Proc_004041D8
|
00498254   E87FBFF6FF             call    004041D8
00498259   68648B4F00             push    $004F8B64
0049825E   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TRegForm.mynae : TEdit
|
00498261   8B83CC020000           mov     eax, [ebx+$02CC]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
00498267   E8B8B6F9FF             call    00433924
0049826C   8B45FC                 mov     eax, [ebp-$04]
0049826F   B901000000             mov     ecx, $00000001
00498274   BA07000000             mov     edx, $00000007

* Reference to: System.Proc_004041D8
|
00498279   E85ABFF6FF             call    004041D8
0049827E   A15C8B4F00             mov     eax, dword ptr [$004F8B5C]

* Reference to: Unit_00408224.Proc_004091B4
|
00498283   E82C0FF7FF             call    004091B4;取得第一部分的第1個數字

* Reference to GlobalVar_004F8B68
|
00498288   A3688B4F00             mov     dword ptr [$004F8B68], eax;儲存
0049828D   A1608B4F00             mov     eax, dword ptr [$004F8B60]

* Reference to: Unit_00408224.Proc_004091B4
|
00498292   E81D0FF7FF             call    004091B4;取得第一部分的第4個數字

* Reference to GlobalVar_004F8B6C
|
00498297   A36C8B4F00             mov     dword ptr [$004F8B6C], eax;儲存
0049829C   A1648B4F00             mov     eax, dword ptr [$004F8B64]

* Reference to: Unit_00408224.Proc_004091B4
|
004982A1   E80E0FF7FF             call    004091B4;取得第一部分的第7個數字

* Reference to GlobalVar_004F8B70
|
004982A6   A3708B4F00             mov     dword ptr [$004F8B70], eax;儲存
004982AB   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TRegForm.mynae : TEdit
|
004982AE   8B83CC020000           mov     eax, [ebx+$02CC]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
004982B4   E86BB6F9FF             call    00433924 ;取得第一部分的數字
004982B9   8D45FC                 lea     eax, [ebp-$04]
004982BC   50                     push    eax ;儲存
004982BD   8D55F8                 lea     edx, [ebp-$08]

* Reference to control TRegForm.doty : TEdit
|
004982C0   8B83D0020000           mov     eax, [ebx+$02D0]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
004982C6   E859B6F9FF             call    00433924
004982CB   8B55F8                 mov     edx, [ebp-$08] ;第二部分數字
004982CE   58                     pop     eax ;取出儲存的

* Reference to: System.Proc_00403FDC
|
004982CF   E808BDF6FF             call    00403FDC;第一部分和第二部分連線
004982D4   8B45FC                 mov     eax, [ebp-$04]

* Reference to: System.Proc_00403FD4
|
004982D7   E8F8BCF6FF             call    00403FD4;取得連線字串的個數
004982DC   83F80A                 cmp     eax, +$0A ;是否為10個
004982DF   0F85AE000000           jnz     00498393
004982E5   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TRegForm.doty : TEdit
|
004982E8   8B83D0020000           mov     eax, [ebx+$02D0]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
004982EE   E831B6F9FF             call    00433924
004982F3   8B45FC                 mov     eax, [ebp-$04]
004982F6   8A10                   mov     dl, byte ptr [eax] ;取出1個給bl
004982F8   8D45F4                 lea     eax, [ebp-$0C]

* Reference to: System.Proc_00403EFC
|
004982FB   E8FCBBF6FF             call    00403EFC
00498300   8B45F4                 mov     eax, [ebp-$0C] 

* Reference to: Unit_00408224.Proc_004091B4
|
00498303   E8AC0EF7FF             call    004091B4;把輸入的1個字元'4'=34H轉換為10進位制的1個數字4
00498308   50                     push    eax ;結果儲存
00498309   A1688B4F00             mov     eax, dword ptr [$004F8B68] ;取出第一部分的第1位
0049830E   5A                     pop     edx ;彈出給edx
0049830F   8BCA                   mov     ecx, edx ;送給ecx
00498311   99                     cdq ;擴充套件,即edx清0
00498312   F7F9                   idiv    ecx ;相除
00498314   83FA03                 cmp     edx, +$03 ;關鍵1,餘數是否為3
00498317   7571                   jnz     0049838A
00498319   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TRegForm.doty : TEdit
|
0049831C   8B83D0020000           mov     eax, [ebx+$02D0]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
00498322   E8FDB5F9FF             call    00433924
00498327   8B45FC                 mov     eax, [ebp-$04]

* Reference to field TEdit.OFFS_0001
|
0049832A   8A5001                 mov     dl, byte ptr [eax+$01] ;取第二部分的第二個字元
0049832D   8D45F4                 lea     eax, [ebp-$0C]

* Reference to: System.Proc_00403EFC
|
00498330   E8C7BBF6FF             call    00403EFC
00498335   8B45F4                 mov     eax, [ebp-$0C]

* Reference to: Unit_00408224.Proc_004091B4
|
00498338   E8770EF7FF             call    004091B4 ;轉換
0049833D   50                     push    eax ;結果存入eax,壓棧儲存
0049833E   A16C8B4F00             mov     eax, dword ptr [$004F8B6C] ;取出第一部分第4位值
00498343   5A                     pop     edx ;彈出結果
00498344   8BCA                   mov     ecx, edx
00498346   99                     cdq
00498347   F7F9                   idiv    ecx 
00498349   83FA03                 cmp     edx, +$03 ;關鍵2,餘數是否為3
0049834C   753C                   jnz     0049838A
0049834E   8D55FC                 lea     edx, [ebp-$04]

* Reference to control TRegForm.doty : TEdit
|
00498351   8B83D0020000           mov     eax, [ebx+$02D0]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
00498357   E8C8B5F9FF             call    00433924
0049835C   8B45FC                 mov     eax, [ebp-$04]

* Reference to field TEdit.OFFS_0002
|
0049835F   8A5002                 mov     dl, byte ptr [eax+$02] ;取出第2部分的第3個字元
00498362   8D45F4                 lea     eax, [ebp-$0C]

* Reference to: System.Proc_00403EFC
|
00498365   E892BBF6FF             call    00403EFC
0049836A   8B45F4                 mov     eax, [ebp-$0C]

* Reference to: Unit_00408224.Proc_004091B4
|
0049836D   E8420EF7FF             call    004091B4 ;轉換儲存
00498372   50                     push    eax
00498373   A1708B4F00             mov     eax, dword ptr [$004F8B70];取出第一部分第7位值
00498378   5A                     pop     edx
00498379   8BCA                   mov     ecx, edx
0049837B   99                     cdq
0049837C   F7F9                   idiv    ecx 
0049837E   83FA02                 cmp     edx, +$02 ;關鍵3,餘數是否為2
00498381   7507                   jnz     0049838A
00498383   BE01000000             mov     esi, $00000001 ;置成功標誌
00498388   EB0B                   jmp     00498395
0049838A   8BC3                   mov     eax, ebx

* Reference to : TRegForm.checkOther()
|
0049838C   E8D3030000             call    00498764
00498391   EB02                   jmp     00498395
00498393   33F6                   xor     esi, esi
00498395   33C0                   xor     eax, eax
00498397   5A                     pop     edx
00498398   59                     pop     ecx
00498399   59                     pop     ecx
0049839A   648910                 mov     fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: '^[]U(?S3??UU?
|                                ,?3UhII'
|
0049839D   68BF834900             push    $004983BF
004983A2   8D45F4                 lea     eax, [ebp-$0C]

* Reference to: System.Proc_00403D58
|
004983A5   E8AEB9F6FF             call    00403D58
004983AA   8D45F8                 lea     eax, [ebp-$08]
004983AD   BA02000000             mov     edx, $00000002

* Reference to: System.Proc_00403D7C
|
004983B2   E8C5B9F6FF             call    00403D7C
004983B7   C3                     ret


* Reference to: System.Proc_00403818
|
004983B8   E95BB4F6FF             jmp     00403818
004983BD   EBE3                   jmp     004983A2

****** END
|
004983BF   8BC6                   mov     eax, esi
004983C1   5E                     pop     esi
004983C2   5B                     pop     ebx
004983C3   8BE5                   mov     esp, ebp
004983C5   5D                     pop     ebp
004983C6   C3                     ret

  經過以上分析,我想對程式的註冊演算法應該差不多都清楚了,下面在總結
一下:先是把第一部分和第二部分連線起來,判斷總的個數是否為10個,考慮
到後面要依靠到第二部分的3個數字,第一部分就應該是7位,而第二部分應該
是3位,好了,完了以後,程式將會取出第一部分的1,4,7位的數值,儲存到全域性
變數中去!接著取出第二部分的每個字元,轉換成10近制的值,即'3'=34H,轉
換為4,然後儲存,接著是用第一部分的第1個數字除以第二部分的的第1個數字如果餘數為3則成功,接著比較第二關鍵部分,同理第一部分的第4個字元除以第二部分的第2個字元,看餘數是否為3,接著比較第三關鍵部分,這回是把第一部分的第7為的值除以第糠值牡?個字元的值,餘數為2則成功!而第一部分的其他2,3,5,6位則任意,註冊碼第三部分則任意!
  註冊碼為如下形式:
3xx3xx2-yyz-mmmn ;x為任意,y為大於3的整數,z為大於2的整數,第三部分任意
7xx7xx5-443-mmmn
9xx9xx5-663-mmmn
9xx9xx9-667-mmmn
當第一部分的第1,4位為7,9時,第二部分的前兩位4,6,而第一部分的第7位
和第二部分的第3位,則可以是2,z(z>2)或者5,3或者7,5或者9,7的組合,
這樣都可以註冊成功,這樣註冊碼太多了!
  我又試了一下第一部分第7位,除以第二部分第3位餘數為3的情況,也註冊
成功了,例如:
7xx7xx7-444-mmmn
  這是程式上沒有反映出來的,不知道為什麼?也懶得跟了,這麼多註冊碼
夠我們用的了!


Made By dengkeng
E-mail:shellc0de@sohu.com
歡迎轉載,請保持文章的完整性