Publish-iT v2.4b -超級印刷工廠

軟體名稱： Publish-iT v2.4b -超級印刷工廠

軟體語言：英文
介面預覽：
軟體型別：精品軟體 / 圖形處理 / 影像處理
執行環境： WinXP, Win2000, WinME
授權方式：
軟體大小： 1.62 MB
軟體等級：
整理時間： 2003-4-4
開發商：

軟體簡介
這程式能幫助你製作專業級的報紙、宣傳冊、廣告單等等出版品，它結合了文書處理器、圖形編輯軟體、以及所有排版軟體的優點於一身。你可以輕易的編排你的文字，加入任意的圖片。「主頁」的功能能讓你的出版品有著一致性的外觀。

下載地址: http://www.ttdown.com/SoftView_3663.ht

【破解工具】：Ollydbg1.09 中文版
【過程】：

呵呵，我們開工吧！唉！^-^我的水平很低，許多地方表達的有問題，煩請各位指教！
用ollydbg載入執行 ,在註冊框中填註冊試驗碼:789456 (軟體提示只要5~6位數字)後下
bpx GetDlgItemTextA 後按OK鍵後不久就能來到這裡:

00453AF4 CALL DWORD PTR DS:[<&USER32.GetDlgIt>

; \GetDlgItemTextA <---斷點

00453AFA PUSH Publish.00495BD0 ; ASCII "FARKEL"
00453AFF LEA EAX, [LOCAL.20] ; EAX<--0012E47C,(ASCII "789456")
00453B02 PUSH EAX
00453B03 CALL Publish.0047CB30 <---是否是死亡註冊碼 "FARKEL"

F8 ----------->
|
0047CB30 MOV EDX, DWORD PTR SS:[ESP+4]

; EDX<--0012E47C,(ASCII "789456")

0047CB34 MOV ECX, DWORD PTR SS:[ESP+8] ; 00495BD0 ASCII "FARKEL"
0047CB38 TEST EDX, 3
0047CB3E JNZ SHORT Publish.0047CB7C
0047CB40 /MOV EAX, DWORD PTR DS:[EDX]
0047CB42 |CMP AL, BYTE PTR DS:[ECX]
0047CB44 |JNZ SHORT Publish.0047CB74
0047CB46 |OR AL, AL
0047CB48 |JE SHORT Publish.0047CB70
0047CB4A |CMP AH, BYTE PTR DS:[ECX+1]
0047CB4D |JNZ SHORT Publish.0047CB74
0047CB4F |OR AH, AH
0047CB51 |JE SHORT Publish.0047CB70
0047CB53 |SHR EAX, 10
0047CB56 |CMP AL, BYTE PTR DS:[ECX+2]
0047CB59 |JNZ SHORT Publish.0047CB74
0047CB5B |OR AL, AL
0047CB5D |JE SHORT Publish.0047CB70
0047CB5F |CMP AH, BYTE PTR DS:[ECX+3]
0047CB62 |JNZ SHORT Publish.0047CB74
0047CB64 |ADD ECX, 4
0047CB67 |ADD EDX, 4
0047CB6A |OR AH, AH
0047CB6C \JNZ SHORT Publish.0047CB40 ; 以上逐位比較
0047CB6E MOV EAX, EAX
0047CB70 XOR EAX, EAX <--設標誌為0
0047CB72 RETN
0047CB73 NOP
0047CB74 SBB EAX, EAX
0047CB76 SHL EAX, 1
0047CB78 INC EAX <--設標誌為非0
0047CB79 RETN
返回<-----------------

|
00453B08 ADD ESP, 8
00453B0B TEST EAX, EAX <--判斷
00453B0D JNZ SHORT Publish.00453B35
00453B0F MOV WORD PTR DS:[49E280], 0
00453B18 MOV BYTE PTR DS:[49E2F8], 0
00453B1F PUSH 0 ; /Result = 0
00453B21 MOV ECX, [ARG.1] ; |
00453B24 PUSH ECX ; |hWnd
00453B25 CALL DWORD PTR DS:[<&USER32.EndDialog>] ; \EndDialog
00453B2B MOV EAX, 1
00453B30 JMP Publish.00453D24
00453B35 XOR EDX, EDX
00453B37 MOV DL, BYTE PTR DS:[49E2F8]
00453B3D TEST EDX, EDX
00453B3F JE SHORT Publish.00453B62
00453B41 MOVSX EAX, WORD PTR DS:[49E280]
00453B48 TEST EAX, EAX
00453B4A JE SHORT Publish.00453B62
00453B4C PUSH 0 ; /Result = 0
00453B4E MOV ECX, [ARG.1] ; |
00453B51 PUSH ECX ; |hWnd
00453B52 CALL DWORD PTR DS:[<&USER32.EndDialog>] ; \EndDialog
00453B58 MOV EAX, 1
00453B5D JMP Publish.00453D24
00453B62 CMP DWORD PTR DS:[4A00B4], 8
00453B69 JLE SHORT Publish.00453BA3
00453B6B MOV EDX, DWORD PTR DS:[4A00B4]
00453B71 ADD EDX, 1
00453B74 MOV DWORD PTR DS:[4A00B4], EDX
00453B7A PUSH 0AF ; /Arg2 = 000000AF
00453B7F MOV EAX, DWORD PTR DS:[49F0F4] ; |
00453B84 PUSH EAX ; |Arg1 => 01310236
00453B85 CALL Publish.00461D70 ; \Publish.00461D70
00453B8A ADD ESP, 8
00453B8D PUSH 0 ; /Result = 0
00453B8F MOV ECX, [ARG.1] ; |
00453B92 PUSH ECX ; |hWnd
00453B93 CALL DWORD PTR DS:[<&USER32.EndDialog>] ; \EndDialog
00453B99 MOV EAX, 1
00453B9E JMP Publish.00453D24
00453BA3 MOV BYTE PTR SS:[EBP-56], 0

以上會跳到這裡:
|
00453BA7 LEA EDX, [LOCAL.23]
00453BAA PUSH EDX
00453BAB LEA EAX, [LOCAL.20] ; EAX<--0012E47C,(ASCII "789456")
00453BAE PUSH EAX
00453BAF CALL Publish.00453EC2 ; 用試驗碼在表中取值 "789456"-->"6i56bm"
//我不知道這個字串的作用,請大家看看.
F8 --------->
|
00453F3B MOV EDX, [ARG.1] ; EDX<--0012E47C,(ASCII "789456")
00453F3E MOVSX EAX, BYTE PTR DS:[EDX+3] ; EAX<--DS:[EDX+3]=34 ('4') 第四位3]
00453F42 MOVSX ECX, BYTE PTR DS:[EAX+495930]; ECX=DS:[EAX+495930]=39 ('9')
00453F49 SUB ECX, 3
00453F4C MOV EDX, [ARG.2]
00453F4F MOV BYTE PTR DS:[EDX], CL ; CL=36 ('6')
00453F51 MOV EAX, [ARG.1] ; EAX<--0012E47C,(ASCII "789456")
00453F54 MOVSX ECX, BYTE PTR DS:[EAX] ; ECX<--DS:[EAX]=37 ('7') 第一位X]
00453F57 MOVSX EDX, BYTE PTR DS:[ECX+495900] ; EDX=DS:[ECX+495900]=68 ('h')
00453F5E ADD EDX, 1
00453F61 MOV EAX, [ARG.2]
00453F64 MOV BYTE PTR DS:[EAX+1], DL ; DL=69 ('i')
00453F67 MOV ECX, [ARG.1] ; ECX<--0012E47C,(ASCII "789456")
00453F6A MOVSX EDX, BYTE PTR DS:[ECX+1] ; EDX=DS:[ECX+1]=38 ('8')
00453F6E MOVSX EAX, BYTE PTR DS:[EDX+495910] ; EAX=DS:[EDX+495910]=34 ('4')
00453F75 ADD EAX, 1
00453F78 MOV ECX, [ARG.2]
00453F7B MOV BYTE PTR DS:[ECX+2], AL ; AL=35 ('5')
00453F7E MOV EDX, [ARG.1] ; EDX<--0012E47C,(ASCII "789456")
00453F81 MOVSX EAX, BYTE PTR DS:[EDX+2] ; EAX=DS:[EDX+2]=39 ('9')
00453F85 MOVSX ECX, BYTE PTR DS:[EAX+495920] ; ECX=DS:[EAX+495920]=32 ('2')
00453F8C ADD ECX, 4
00453F8F MOV EDX, [ARG.2]
00453F92 MOV BYTE PTR DS:[EDX+3], CL ; CL=36 ('6')
00453F95 MOV EAX, [ARG.1] ; EAX<--0012E47C,(ASCII "789456")
00453F98 MOVSX ECX, BYTE PTR DS:[EAX+5] ; ECX=DS:[EAX+5]=36 ('6')
00453F9C MOVSX EDX, BYTE PTR DS:[ECX+495950]; EDX=DS:[ECX+495950]=64 ('d')
00453FA3 SUB EDX, 2
00453FA6 MOV EAX, [ARG.2]
00453FA9 MOV BYTE PTR DS:[EAX+4], DL ; DL=62 ('b')
00453FAC MOV ECX, [ARG.1] ; ECX<--0012E47C,(ASCII "789456")
00453FAF MOVSX EDX, BYTE PTR DS:[ECX+4] ; EDX=DS:[ECX+4]=35 ('5')
00453FB3 MOVSX EAX, BYTE PTR DS:[EDX+495940]; EAX=DS:[EDX+495940]=68 ('h')
00453FBA ADD EAX, 5
00453FBD MOV ECX, [ARG.2]
00453FC0 MOV BYTE PTR DS:[ECX+5], AL ; AL=6D ('m')
00453FC3 POP EBP
00453FC4 RETN

--------------
|
記憶體資料:

00495930 61 7A 78 62 6B 69 67 68 azxbkigh
00495938 73 71 62 00 00 00 00 00 sqb.....
00495940 73 68 65 69 70 79 35 33 sheipy53
00495948 34 67 78 00 00 00 00 00 4gx.....
00495950 6C 6B 6A 76 64 71 64 72 lkjvdqdr
00495958 62 32 36 00 00 00 00 00 b26.....
00495960 77 69 78 35 39 71 61 63 wix59qac
00495968 66 67 65 00 00 00 00 00 fge.....
00495970 70 34 63 6B 71 68 62 6F p4ckqhbo
00495978 62 62 79 00 00 00 00 00 bby.....
00495980 38 32 6E 63 74 71 64 61 82nctqda
00495988 76 69 64 00 52 63 00 00 vid.Rc..

返回<-----------------

|
00453BB4 ADD ESP, 8
00453BB7 LEA ECX, [LOCAL.20] ; ECX<--0012E47C,(ASCII "789456")
00453BBA PUSH ECX
00453BBB CALL Publish.0047E160 <---把它變成16進位制lish.0

; CL=DS:[EDI]=37 ('7')<--試驗碼的第一位

0047E0EC |MOV AL, BYTE PTR DS:[EDX+ECX*2]

; AL=DS:[EDX+ECX*2]=84 EDX=49A462* ECX=37

0047E0EF |AND EAX, 8
0047E0F2 |TEST EAX, EAX
0047E0F4 |JE SHORT Publish.0047E0F9
0047E0F6 |INC EDI
0047E0F7 \JMP SHORT Publish.0047E0C8
0047E0F9 XOR EAX, EAX
0047E0FB MOV AL, BYTE PTR DS:[EDI] ; AL=DS:[EDI]=37 ('7')
0047E0FD INC EDI
0047E0FE MOV ESI, EAX
0047E100 CMP ESI, 2D
0047E103 MOV EBP, ESI
0047E105 JE SHORT Publish.0047E10C
0047E107 CMP ESI, 2B
0047E10A JNZ SHORT Publish.0047E113
0047E10C XOR ECX, ECX
0047E10E MOV CL, BYTE PTR DS:[EDI]
0047E110 INC EDI
0047E111 MOV ESI, ECX
0047E113 XOR EBX, EBX
0047E115 /CMP DWORD PTR DS:[49A664], 1
0047E11C |JLE SHORT Publish.0047E12B
0047E11E |PUSH 4
0047E120 |PUSH ESI
0047E121 |CALL Publish.00485230
0047E126 |ADD ESP, 8
0047E129 |JMP SHORT Publish.0047E137
0047E12B |MOV EDX, DWORD PTR DS:[49A458] ; Publish.0049A462
0047E131 |MOV AL, BYTE PTR DS:[EDX+ESI*2]
0047E134 |AND EAX, 4
0047E137 |TEST EAX, EAX
0047E139 |JE SHORT Publish.0047E14B ; 保證註冊碼是數字
0047E13B |LEA EAX, DWORD PTR DS:[EBX+EBX*4]
0047E13E |XOR ECX, ECX
0047E140 |MOV CL, BYTE PTR DS:[EDI] ; CL=DS:[EDI]=38 ('8')
0047E142 |INC EDI
0047E143 |LEA EBX, DWORD PTR DS:[ESI+EAX*2-30]; EBX=DS:[ESI+EAX*2-30]=07...|==C0BD0
0047E147 |MOV ESI, ECX // 把它變成16進位制
0047E149 \JMP SHORT Publish.0047E115 // 轉變的方式是:前位*A+後一位
0047E14B CMP EBP, 2D
0047E14E MOV EAX, EBX
0047E150 JNZ SHORT Publish.0047E154
0047E152 NEG EAX
0047E154 POP EDI
0047E155 POP ESI
0047E156 POP EBP
0047E157 POP EBX
0047E158 RETN

Publish.0049A462 記憶體值：
|
0049A460 20 00 20 00 20 00 . . .
0049A468 20 00 20 00 20 00 20 00 . . . .
0049A470 20 00 20 00 28 00 28 00 . .(.(.
0049A478 28 00 28 00 28 00 20 00 (.(.(. .
0049A480 20 00 20 00 20 00 20 00 . . . .
0049A488 20 00 20 00 20 00 20 00 . . . .
0049A490 20 00 20 00 20 00 20 00 . . . .
0049A498 20 00 20 00 20 00 20 00 . . . .
0049A4A0 20 00 48 00 10 00 10 00 .H...
0049A4A8 10 00 10 00 10 00 10 00 ....
0049A4B0 10 00 10 00 10 00 10 00 ....
0049A4B8 10 00 10 00 10 00 10 00 ....
0049A4C0 10 00 84 00 84 00 84 00 .???
0049A4C8 84 00 84 00 84 00 84 00 ????
0049A4D0 84 00 84 00 84 00 10 00 ???.
0049A4D8 10 00 10 00 10 00 10 00 ....
0049A4E0 10 00 10 00 81 00 81 00 ..??
0049A4E8 81 00 81 00 81 00 81 00 ????
0049A4F0 01 00 01 00 01 00 01 00 ....
0049A4F8 01 00 01 00 01 00 01 00 ....
0049A500 01 00 01 00 01 00 01 00 ....
0049A508 01 00 01 00 01 00 01 00 ....
0049A510 01 00 01 00 01 00 01 00 ....
0049A518 10 00 10 00 10 00 10 00 ....
0049A520 10 00 10 00 82 00 82 00 ..??
0049A528 82 00 82 00 82 00 82 00 ????
0049A530 02 00 02 00 02 00 02 00 ....
0049A538 02 00 02 00 02 00 02 00 ....
0049A540 02 00 02 00 02 00 02 00 ....
0049A548 02 00 02 00 02 00 02 00 ....
0049A550 02 00 02 00 02 00 02 00 ....
0049A558 10 00 10 00 10 00 10 00 ....

以上計算的總結：註冊碼取值範圍
1.第一個比較迴圈時用第二次計算的字串的ｈｅｘ值＊２作指標在以　0049A460　開始的記憶體中查表，得到的值　AND 8 ,比較得數如果是０就到第二個比較迴圈．
２．第二個比較迴圈用第二次計算的字串的ｈｅｘ值＊２作指標在以　0049A460　開始的記憶體中查表，得到的值　AND 4 ,比較得數如果是０就OVER.即查表得到的值　AND 4 不能＝０
經過計算可以知道表中　0049A460 開始的十個值－'84 '符合條件，第一個８４的偏移量＝60ｈ那麼第二次計算的字串的ｈｅｘ值的範圍是60／２＝30到3A即第二次計算的字串的範圍是0～9．

(以上是一個定式)

這樣就能保證註冊碼是數字 .

返回<------------
|
00453BC0 ADD ESP, 4
00453BC3 MOV [LOCAL.24], EAX ; EAX=C0BD0 <--試驗碼變成的16進位制
00453BC6 MOV EDX, [LOCAL.24] ; EDX=C0BD0 <--試驗碼變成的16進位制
00453BC9 ADD EDX, 3D0C09

; EDX=C0BD0+3D0C09=4917D9 (註冊碼的第一次變換)

00453BCF PUSH EDX
00453BD0 CALL Publish.00453D2A <---第1部分比較(去掉21天限制的比較)
00453BD5 ADD ESP, 4
00453BD8 AND EAX, 0FF <---取低位
00453BDD TEST EAX, EAX <---根據標誌判斷跳轉
00453BDF JE SHORT Publish.00453C20
00453BE1 CALL Publish.00453FC5
00453BE6 ADD EAX, 15B30
00453BEB MOV DWORD PTR DS:[49EFF8], EAX
00453BF0 MOV WORD PTR DS:[49E280], 1
00453BF9 PUSH 8167
00453BFE MOV EAX, [ARG.1]
00453C01 PUSH EAX
00453C02 CALL Publish.00461D8E <---去除21天限制的提示
00453C07 ADD ESP, 8
00453C0A PUSH 0
00453C0C MOV ECX, [ARG.1]
00453C0F PUSH ECX
00453C10 CALL DWORD PTR DS:[<&USER32.EndDialog>]
00453C16 MOV EAX, 1
00453C1B JMP Publish.00453D24
00453C20 MOV EDX, [LOCAL.24] ; EDX=C0BD0<--試驗碼變成的16進位制
00453C23 ADD EDX, 3D0A43

; EDX=C0BD0+3D0A43= (註冊碼的第二次變換)

00453C29 PUSH EDX ; EDX= 491613
00453C2A CALL Publish.00453D2A <---第二部分比較(去掉21天限制的比較)
00453C2F ADD ESP, 4
00453C32 AND EAX, 0FF <---取低位
00453C37 TEST EAX, EAX <---根據標誌判斷跳轉
00453C39 JE SHORT Publish.00453C81
00453C3B MOV BYTE PTR DS:[49E2F8], 1
00453C42 CALL Publish.00453FC5
00453C47 ADD EAX, 15194
00453C4C MOV DWORD PTR DS:[49EFF8], EAX
00453C51 MOV WORD PTR DS:[49E280], 1
00453C5A PUSH 8168
00453C5F MOV EAX, [ARG.1]
00453C62 PUSH EAX
00453C63 CALL Publish.00461D8E <---註冊成功正確的提示框
00453C68 ADD ESP, 8
00453C6B PUSH 0
00453C6D MOV ECX, [ARG.1]
00453C70 PUSH ECX
00453C71 CALL DWORD PTR DS:[<&USER32.EndDialog>]
00453C77 MOV EAX, 1
00453C7C JMP Publish.00453D24
00453C81 MOV EDX, [LOCAL.24] ; EDX=C0BD0<--試驗碼變成的16進位制
00453C84 ADD EDX, 3D09A7

; EDX=C0BD0+3D09A7 (註冊碼的第三次變換)

00453C8A PUSH EDX ; EDX= 00491577
00453C8B CALL Publish.00453D2A <---第3部分比較(Pro版的比較)
00453C90 ADD ESP, 4
00453C93 AND EAX, 0FF <---取低位
00453C98 TEST EAX, EAX <---根據標誌判斷跳轉
00453C9A JE SHORT Publish.00453D03
00453C9C MOVSX EAX, WORD PTR DS:[49E280]
00453CA3 CMP EAX, 1
00453CA6 JE SHORT Publish.00453CC0 <---根據標誌判斷跳轉
00453CA8 PUSH 8169
00453CAD MOV ECX, [ARG.1]
00453CB0 PUSH ECX
00453CB1 CALL Publish.00461D8E <---OVER
00453CB6 ADD ESP, 8
00453CB9 MOV EAX, 1
00453CBE JMP SHORT Publish.00453D24
00453CC0 MOV BYTE PTR DS:[49E2F8], 1
00453CC7 CALL Publish.00453FC5
00453CCC ADD EAX, 15194
00453CD1 MOV DWORD PTR DS:[49EFF8], EAX
00453CD6 MOV WORD PTR DS:[49E280], 1
00453CDF PUSH 8168
00453CE4 MOV EDX, [ARG.1]
00453CE7 PUSH EDX
00453CE8 CALL Publish.00461D8E <---Pro版註冊成功正確的提示框
00453CED ADD ESP, 8
00453CF0 PUSH 0
00453CF2 MOV EAX, [ARG.1]
00453CF5 PUSH EAX
00453CF6 CALL DWORD PTR DS:[<&USER32.EndDialog>]
00453CFC MOV EAX, 1
00453D01 JMP SHORT Publish.00453D24
00453D03 PUSH 0AF
00453D08 MOV ECX, DWORD PTR DS:[49F0F4]
00453D0E PUSH ECX
00453D0F CALL Publish.00461D70 <---OVER
00453D14 ADD ESP, 8
00453D17 MOV EAX, 1
00453D1C JMP SHORT Publish.00453D24
00453D1E XOR EAX, EAX
00453D20 JMP SHORT Publish.00453D24
00453D22 XOR EAX, EAX
00453D24 MOV ESP, EBP
00453D26 POP EBP
00453D27 RETN 10

====================================================
CALL Publish.00453D2A <---重要部分計算和註冊碼比較的地方
|
00453D2A PUSH EBP
00453D2B MOV EBP, ESP
00453D2D SUB ESP, 14
00453D30 CALL Publish.00453DF2

F8 ---------->
|
00453DF2 PUSH EBP
00453DF3 MOV EBP, ESP
00453DF5 SUB ESP, 10
00453DF8 MOV [LOCAL.4], 0
00453DFF MOV [LOCAL.3], 0
00453E06 JMP SHORT Publish.00453E11
00453E08 /MOV EAX, [LOCAL.3]
00453E0B |ADD EAX, 1
00453E0E |MOV [LOCAL.3], EAX
00453E11 CMP [LOCAL.3], 0C
00453E15 |JGE SHORT Publish.00453E49
00453E17 |PUSH 3
00453E19 |MOV ECX, [LOCAL.3]
00453E1C |MOV EDX, DWORD PTR DS:[ECX*4+495BD8]
00453E23 |PUSH EDX
00453E24 |PUSH Publish.004958E8 ; ASCII "Apr 8 2003"
00453E29 |CALL Publish.0047B4A0
00453E2E |ADD ESP, 0C
00453E31 |TEST EAX, EAX
00453E33 |JNZ SHORT Publish.00453E37
00453E35 |JMP SHORT Publish.00453E49
00453E37 |MOV EAX, [LOCAL.3]
00453E3A |MOV ECX, [LOCAL.4]
00453E3D |ADD ECX, DWORD PTR DS:[EAX*4+495900]
00453E44 |MOV [LOCAL.4], ECX
00453E47 \JMP SHORT Publish.00453E08
00453E49 PUSH Publish.004958EC ; ASCII " 8 2003"
00453E4E CALL Publish.0047E160 ; EAX=8 EBX=68CA38
00453E53 ADD ESP, 4
00453E56 MOV EDX, [LOCAL.4] ; EDX=5A
00453E59 ADD EDX, EAX ; EDX=5A+8=62
00453E5B MOV [LOCAL.4], EDX
00453E5E PUSH Publish.004958EE ; ASCII " 2003"
00453E63 CALL Publish.0047E160 ; 把"2003"變成16進位制
00453E68 ADD ESP, 4
00453E6B SUB EAX, 7B2 ; EAX=7D3-7B2=21
00453E70 MOV [LOCAL.1], EAX ; EAX=21
00453E73 MOV EAX, [LOCAL.1] ; EAX=21
00453E76 IMUL EAX, EAX, 16D ; EAX=21*16D=2F0D
00453E7C MOV ECX, [LOCAL.4] ; ECX=62
00453E7F ADD ECX, EAX ; ECX=2F0D+62=2F6F
00453E81 MOV EAX, [LOCAL.1] ; EAX=21
00453E84 CDQ
00453E85 AND EDX, 3
00453E88 ADD EAX, EDX
00453E8A SAR EAX, 2 ; EAX=8
00453E8D ADD ECX, EAX ; ECX=2F6F+8=2F77
00453E8F MOV [LOCAL.4], ECX ; ECX=2F6F+8=2F77
00453E92 MOV EDX, [LOCAL.4] ; EDX=2F6F+8=2F77
00453E95 SUB EDX, 1
00453E98 IMUL EDX, EDX, 18 ; EDX=2F76*18=
00453E9B IMUL EDX, EDX, 0E10 ; EDX=47310*E10=
00453EA1 MOV [LOCAL.4], EDX ; EDX=3E92110
00453EA4 LEA EAX, [LOCAL.2]
00453EA7 PUSH EAX
00453EA8 CALL Publish.0047C6A0
00453EAD ADD ESP, 4
00453EB0 MOV ECX, [LOCAL.2] ; ECX=3E96D071
00453EB3 CMP ECX, [LOCAL.4] ; SS:[12E42C]=3E921100
00453EB6 JGE SHORT Publish.00453EBC
00453EB8 XOR AL, AL
00453EBA JMP SHORT Publish.00453EBE
00453EBC MOV AL, 1
00453EBE MOV ESP, EBP
00453EC0 POP EBP
00453EC1 RETN

這個call是把字元 ASCII "Apr 8 2003"計算

返回<-----------
|
00453D35 AND EAX, 0FF
00453D3A TEST EAX, EAX
00453D3C JNZ SHORT Publish.00453D45
00453D3E XOR AL, AL
00453D40 JMP Publish.00453DEE
00453D45 LEA EAX, [LOCAL.1]
00453D48 PUSH EAX
00453D49 CALL Publish.0047C6A0 <----計算引數並傳送到記憶體特定的地址中
00453D4E ADD ESP, 4
00453D51 LEA ECX, [LOCAL.1]
00453D54 PUSH ECX
00453D55 CALL Publish.0047E170 <----計算引數並傳送到記憶體特定的地址中
00453D5A ADD ESP, 4
00453D5D MOV [LOCAL.4], EAX ; EAX=4A1EC0
00453D60 MOV EDX, [LOCAL.4] ; EDX=4A1EC0
00453D63 MOV EAX, DWORD PTR DS:[EDX+1C]
00453D66 CDQ
00453D67 MOV ECX, 7
00453D6C IDIV ECX
00453D6E ADD EAX, 1
00453D71 MOV [LOCAL.3], EAX
00453D74 MOV EDX, [LOCAL.4]
00453D77 MOV EAX, DWORD PTR DS:[EDX+14] ; EAX=67 ('g')
00453D7A MOV ECX, [LOCAL.3]
00453D7D LEA EDX, DWORD PTR DS:[EAX+ECX*4+76C]

; EDX=80F <---計算的基本引數(透過上面計算得到的)

00453D84 MOV [LOCAL.2], EDX
00453D87 MOV EAX, [LOCAL.2]
00453D8A IMUL EAX, [LOCAL.2]
00453D8E MOV [LOCAL.5], EAX ; EAX=40F0E1
00453D91 MOV ECX, [LOCAL.2] ; ECX=80F
00453D94 IMUL ECX, [LOCAL.2] ; ECX=ECX*ECX
00453D98 CMP [ARG.1], ECX

; SS:[12E460]=4917D9 <--試驗碼計算的值 ECX=40F0E1(第一固定值)

00453D9B JNZ SHORT Publish.00453DA1
00453D9D MOV AL, 1 <---設成功標誌
00453D9F JMP SHORT Publish.00453DEE
00453DA1 MOV EDX, [LOCAL.2]
00453DA4 ADD EDX, 4 ; EDX=80F+4=813
00453DA7 MOV [LOCAL.2], EDX
00453DAA MOV EAX, [LOCAL.2]
00453DAD IMUL EAX, [LOCAL.2] ; EAX=EAX*EAX
00453DB1 CMP [ARG.1], EAX

; SS:[12E460]=4917D9 <--試驗碼計算的值 EAX=413169(第二固定值)

00453DB4 JNZ SHORT Publish.00453DBA
00453DB6 MOV AL, 1 <---設成功標誌
00453DB8 JMP SHORT Publish.00453DEE
00453DBA MOV ECX, [LOCAL.2]
00453DBD SUB ECX, 8 ; ECX=813-8=80B
00453DC0 MOV [LOCAL.2], ECX
00453DC3 MOV EDX, [LOCAL.2]
00453DC6 IMUL EDX, [LOCAL.2] ; EDX=EDX*EDX
00453DCA CMP [ARG.1], EDX

; SS:[12E460]=4917D9 <--試驗碼計算的值 EDX=40B079(第三固定值)

00453DCD JNZ SHORT Publish.00453DD3
00453DCF MOV AL, 1 <---設成功標誌
00453DD1 JMP SHORT Publish.00453DEE
00453DD3 MOV EAX, [LOCAL.2]
00453DD6 SUB EAX, 4 ; EAX=80D-4=809
00453DD9 MOV [LOCAL.2], EAX
00453DDC MOV ECX, [LOCAL.2]
00453DDF IMUL ECX, [LOCAL.2] ; ECX=ECX*ECX
00453DE3 CMP [ARG.1], ECX

; SS:[12E460]=4917D9 <--試驗碼計算的值 ECX=407031(第四固定值)

00453DE6 JNZ SHORT Publish.00453DEC
00453DE8 MOV AL, 1 <---設成功標誌
00453DEA JMP SHORT Publish.00453DEE
00453DEC XOR AL, AL
00453DEE MOV ESP, EBP
00453DF0 POP EBP
00453DF1 RETN

****************************************

====================================================

到這裡註冊碼的演算法跟蹤完成,下面來分析註冊碼的計算方法.
(按照提示長度是5~6位數字)

經過分析可以知道,註冊碼分三種情況.每種有4個符合條件的註冊碼

1.去除21天限制版,價值$12.
計算方法:
1.)註冊碼的16進位制值+3D0C09 = 40F0E1
可逆的計算是註冊碼=40F0E1-3D0C09=3E4D8(H)==> 255192
2.)註冊碼的16進位制值+3D0C09 = 413169
可逆的計算是註冊碼=413169-3D0C09=4258D(H)==> 271757
3.)註冊碼的16進位制值+3D0C09 = 40B079
可逆的計算是註冊碼=40B079-3D0C09=3A470(H)==> 238704
4.)註冊碼的16進位制值+3D0C09 = 407031
可逆的計算是註冊碼=407031-3D0C09=36428(H)==> 222248

2.去除21天限制版,價值$15.
計算方法:
1.)註冊碼的16進位制值+3D0A43 = 40F0E1
可逆的計算是註冊碼=40F0E1-3D0A43=3E69E(H)==> 255646
2.)註冊碼的16進位制值+3D0C09 = 413169
可逆的計算是註冊碼=413169-3D0A43=42726(H)==> 272166
3.)註冊碼的16進位制值+3D0C09 = 40B079
可逆的計算是註冊碼=40B079-3D0A43=3A636(H)==> 239158
4.)註冊碼的16進位制值+3D0C09 = 407031
可逆的計算是註冊碼=407031-3D0A43=365EE(H)==> 222702

3.PRO版,價值$200.
計算方法:
1.)註冊碼的16進位制值+3D09A7 = 40F0E1
可逆的計算是註冊碼=40F0E1-3D09A7=3E73A(H)==> 255802
2.)註冊碼的16進位制值+3D0C09 = 413169
可逆的計算是註冊碼=413169-3D09A7=427C2(H)==> 272322
3.)註冊碼的16進位制值+3D0C09 = 40B079
可逆的計算是註冊碼=40B079-3D09A7=3A6D2(H)==> 239314
4.)註冊碼的16進位制值+3D0C09 = 407031
可逆的計算是註冊碼=407031-3D09A7=3668A(H)==> 222858

Cracded fxyang[OCN]

2003.4.12

Publish-iT v2.4b -超級印刷工廠

相關文章