簡單演算法――ChinaRen校友錄伴侶(v2.01 build 20807)

標題:簡單演算法——ChinaRen校友錄伴侶(v2.01 build 20807)

發信人:fly

時間:2003/03/18 07:40pm

詳細資訊:

下載頁面：http://regcrap.yeah.net （最新版是v2.02 build 20821）
軟體大小：932KB
軟體語言：簡體中文
軟體類別：共享
應用平臺：Win9x/2000/xp

【軟體簡介】：ChinaRen校友錄伴侶（以下簡稱CRAP）是一款專門針對ChinaRen校友錄設計的共享軟體。您或許曾因為ChinaRen的速度太慢而無法瀏覽自己班級的最新留言；您或許想看看班級以往的留言，但由於一頁一頁的翻閱太麻煩而苦苦等待；您或許想查詢以往的某一條留言，但由於留言太多而無從下手；您或許為由於ChinaRen伺服器癱瘓所造成的班級留言的丟失而遺憾；您或許……你還是試試吧。

【軟體限制】：功能限制。每一個使用者名稱進行一次註冊。

【作者宣告】：初學Crack，只是感興趣，沒有其它目的。失誤之處敬請諸位大俠賜教！

【破解工具】：TRW2000娃娃修改版、Ollydbg1.09、FI2.5、W32Dasm8.93黃金版

―――――――――――――――――――――――――――――――――
【過程】：

Crap.exe無殼。DELPHI編寫。反彙編，查詢出錯提示，很容易找到核心。
偽裝者[CCG]大俠曾寫過v1.01 build 10717 的序號產生器，2.01版的演算法還是差不多一樣的。
有些分支判斷就沒寫了，如果自己追一下就知道了。

使用者名稱：fly
試煉碼：13572468
―――――――――――――――――――――――――――――――――
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004D61CD(C)
|
:004D61C8 6A00 push 00000000
:004D61CA 6A00 push 00000000
:004D61CC 49 dec ecx
:004D61CD 75F9 jne 004D61C8
:004D61CF 51 push ecx
:004D61D0 53 push ebx
:004D61D1 56 push esi
:004D61D2 8BD8 mov ebx, eax
:004D61D4 33C0 xor eax, eax
:004D61D6 55 push ebp
:004D61D7 68C6644D00 push 004D64C6
:004D61DC 64FF30 push dword ptr fs:[eax]
:004D61DF 648920 mov dword ptr fs:[eax], esp
:004D61E2 8D55FC lea edx, dword ptr [ebp-04]
:004D61E5 8B8300030000 mov eax, dword ptr [ebx+00000300]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004D6184(C)
|
:004D61EB E8A06EF7FF call 0044D090
:004D61F0 837DFC00 cmp dword ptr [ebp-04], 00000000
:004D61F4 751C jne 004D6212

* Possible StringData Ref from Code Obj ->"請輸入使用者名稱。"
|
:004D61F6 B8DC644D00 mov eax, 004D64DC
:004D61FB E8DCFCF6FF call 00445EDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004D6195(C)
|
:004D6200 8B9300030000 mov edx, dword ptr [ebx+00000300]
:004D6206 8BC3 mov eax, ebx
:004D6208 E81F1CF9FF call 00467E2C
:004D620D E95A020000 jmp 004D646C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004D61F4(C)
|
:004D6212 8D55F8 lea edx, dword ptr [ebp-08]
:004D6215 8B8300030000 mov eax, dword ptr [ebx+00000300]
:004D621B E8706EF7FF call 0044D090
:004D6220 837DF800 cmp dword ptr [ebp-08], 00000000
:004D6224 751C jne 004D6242

* Possible StringData Ref from Code Obj ->"請輸入使用者名稱。"
|
:004D6226 B8DC644D00 mov eax, 004D64DC
:004D622B E8ACFCF6FF call 00445EDC
:004D6230 8B9300030000 mov edx, dword ptr [ebx+00000300]
:004D6236 8BC3 mov eax, ebx
:004D6238 E8EF1BF9FF call 00467E2C
:004D623D E92A020000 jmp 004D646C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004D6224(C)
|
:004D6242 8D55F0 lea edx, dword ptr [ebp-10]
:004D6245 8B8300030000 mov eax, dword ptr [ebx+00000300]
:004D624B E8406EF7FF call 0044D090
:004D6250 8B45F0 mov eax, dword ptr [ebp-10]
====>EAX=fly

:004D6253 8D55F4 lea edx, dword ptr [ebp-0C]
:004D6256 E8A9DF0000 call 004E4204
====>演算法CALL！進入！

:004D625B 8B45F4 mov eax, dword ptr [ebp-0C]
====>EAX=434349016219029972

:004D625E 50 push eax
:004D625F 8D55EC lea edx, dword ptr [ebp-14]
:004D6262 8B8304030000 mov eax, dword ptr [ebx+00000304]
:004D6268 E8236EF7FF call 0044D090
:004D626D 8B55EC mov edx, dword ptr [ebp-14]
:004D6270 58 pop eax
:004D6271 E8F2E8F2FF call 00404B68
====>比較CALL！進入！

:004D6276 7416 je 004D628E
====>不跳則OVER！

* Possible StringData Ref from Code Obj ->"您輸入的使用者註冊碼不正確。"
====>BAD BOY！

:004D6278 B8F4644D00 mov eax, 004D64F4
:004D627D E85AFCF6FF call 00445EDC
:004D6282 8BC3 mov eax, ebx
:004D6284 E80335F9FF call 0046978C
:004D6289 E9DE010000 jmp 004D646C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004D6276(C)
|
:004D628E 8D55E8 lea edx, dword ptr [ebp-18]
:004D6291 8B8300030000 mov eax, dword ptr [ebx+00000300]
:004D6297 E8F46DF7FF call 0044D090
:004D629C 8B55E8 mov edx, dword ptr [ebp-18]
:004D629F 8B83F0020000 mov eax, dword ptr [ebx+000002F0]
:004D62A5 8B8018020000 mov eax, dword ptr [eax+00000218]
:004D62AB 8B08 mov ecx, dword ptr [eax]
:004D62AD FF5154 call [ecx+54]
:004D62B0 40 inc eax
:004D62B1 741C je 004D62CF

* Possible StringData Ref from Code Obj ->"請已經註冊過該使用者名稱。"
|
:004D62B3 B818654D00 mov eax, 004D6518
:004D62B8 E81FFCF6FF call 00445EDC
:004D62BD 8B9300030000 mov edx, dword ptr [ebx+00000300]
:004D62C3 8BC3 mov eax, ebx
:004D62C5 E8621BF9FF call 00467E2C
:004D62CA E99D010000 jmp 004D646C

…… …… 省略 …… ……

* Possible StringData Ref from Code Obj ->"註冊成功！感謝您的註冊。"
====>呵呵，勝利女神！

:004D640D 68A8654D00 push 004D65A8
------------------------------------------------------------------

★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★
進入演算法CALL：4D6256 call 004E4204

* Referenced by a CALL at Addresses:
|:004D60FC , :004D6256 , :004E3E92
|
:004E4204 55 push ebp
:004E4205 8BEC mov ebp, esp
:004E4207 83C4C0 add esp, FFFFFFC0
:004E420A 56 push esi
:004E420B 57 push edi
:004E420C 33C9 xor ecx, ecx
:004E420E 894DC0 mov dword ptr [ebp-40], ecx
:004E4211 894DC4 mov dword ptr [ebp-3C], ecx
:004E4214 894DC8 mov dword ptr [ebp-38], ecx
:004E4217 894DCC mov dword ptr [ebp-34], ecx
:004E421A 894DF4 mov dword ptr [ebp-0C], ecx
:004E421D 894DF0 mov dword ptr [ebp-10], ecx
:004E4220 894DEC mov dword ptr [ebp-14], ecx
:004E4223 894DE8 mov dword ptr [ebp-18], ecx
:004E4226 8955F8 mov dword ptr [ebp-08], edx
:004E4229 8945FC mov dword ptr [ebp-04], eax
:004E422C 8B45FC mov eax, dword ptr [ebp-04]
:004E422F E8D809F2FF call 00404C0C
:004E4234 33C0 xor eax, eax
:004E4236 55 push ebp
:004E4237 6888444E00 push 004E4488
:004E423C 64FF30 push dword ptr fs:[eax]
:004E423F 648920 mov dword ptr fs:[eax], esp
:004E4242 8D55CC lea edx, dword ptr [ebp-34]
:004E4245 8B45FC mov eax, dword ptr [ebp-04]
:004E4248 E8374BF2FF call 00408D84
====>如果使用者名稱是大寫字母則轉化為小寫字母

:004E424D 8B55CC mov edx, dword ptr [ebp-34]
====>EDX=fly

:004E4250 8D45FC lea eax, dword ptr [ebp-04]
:004E4253 E8AC05F2FF call 00404804
:004E4258 8B45FC mov eax, dword ptr [ebp-04]
:004E425B E8C407F2FF call 00404A24
:004E4260 8B55FC mov edx, dword ptr [ebp-04]
:004E4263 0FB612 movzx edx, byte ptr [edx]
:004E4266 83E201 and edx, 00000001
:004E4269 85D2 test edx, edx
:004E426B 0F9445D3 sete byte ptr [ebp-2D]
:004E426F 8B55FC mov edx, dword ptr [ebp-04]
:004E4272 0FB65402FF movzx edx, byte ptr [edx+eax-01]
:004E4277 83E201 and edx, 00000001
:004E427A 85D2 test edx, edx
:004E427C 0F9445D2 sete byte ptr [ebp-2E]
:004E4280 807DD301 cmp byte ptr [ebp-2D], 01
:004E4284 751B jne 004E42A1
:004E4286 807DD201 cmp byte ptr [ebp-2E], 01
:004E428A 7515 jne 004E42A1
:004E428C C745E43B000000 mov [ebp-1C], 0000003B
:004E4293 C745E017000000 mov [ebp-20], 00000017
:004E429A BE07000000 mov esi, 00000007
:004E429F EB55 jmp 004E42F6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004E4284(C), :004E428A(C)
|
:004E42A1 807DD301 cmp byte ptr [ebp-2D], 01
:004E42A5 751B jne 004E42C2
:004E42A7 807DD200 cmp byte ptr [ebp-2E], 00
:004E42AB 7515 jne 004E42C2
:004E42AD C745E43B000000 mov [ebp-1C], 0000003B
====>[ebp-1C]=3B

:004E42B4 C745E007000000 mov [ebp-20], 00000007
====>[ebp-20]=07

:004E42BB BE17000000 mov esi, 00000017
====>ESI=17

:004E42C0 EB34 jmp 004E42F6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004E42A5(C), :004E42AB(C)
|
:004E42C2 807DD300 cmp byte ptr [ebp-2D], 00
:004E42C6 751B jne 004E42E3
:004E42C8 807DD201 cmp byte ptr [ebp-2E], 01
:004E42CC 7515 jne 004E42E3
:004E42CE C745E417000000 mov [ebp-1C], 00000017
:004E42D5 C745E03B000000 mov [ebp-20], 0000003B
:004E42DC BE07000000 mov esi, 00000007
:004E42E1 EB13 jmp 004E42F6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004E42C6(C), :004E42CC(C)
|
:004E42E3 C745E417000000 mov [ebp-1C], 00000017
:004E42EA C745E007000000 mov [ebp-20], 00000007
:004E42F1 BE3B000000 mov esi, 0000003B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004E429F(U), :004E42C0(U), :004E42E1(U)
|
:004E42F6 33D2 xor edx, edx
:004E42F8 8955DC mov dword ptr [ebp-24], edx
:004E42FB 33D2 xor edx, edx
:004E42FD 8955D8 mov dword ptr [ebp-28], edx
:004E4300 33D2 xor edx, edx
:004E4302 8955D4 mov dword ptr [ebp-2C], edx
:004E4305 8BC8 mov ecx, eax
:004E4307 85C9 test ecx, ecx
:004E4309 7E17 jle 004E4322
:004E430B BF01000000 mov edi, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E4320(C)
|
:004E4310 8B55FC mov edx, dword ptr [ebp-04]
====>EDX=fly

:004E4313 0FB6543AFF movzx edx, byte ptr [edx+edi-01]
====>依次取使用者名稱的HEX值
1、 ====>EDX=66
2、 ====>EDX=6C
3、 ====>EDX=79

:004E4318 0355E4 add edx, dword ptr [ebp-1C]
1、 ====>EDX=66 + 3B=A1
2、 ====>EDX=6C + 3B=A7
3、 ====>EDX=79 + 3B=B4

:004E431B 0155DC add dword ptr [ebp-24], edx
1、 ====>[EBP-24]=00 + A1=A1
2、 ====>[EBP-24]=A1 + A7=148
3、 ====>[EBP-24]=148 + B4=1FC
迴圈結果 ====>[ebp-24]=1FC

:004E431E 47 inc edi
====>EDI依次增1 計數器
:004E431F 49 dec ecx
:004E4320 75EE jne 004E4310
====>迴圈使用者名稱的位數次

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E4309(C)
|
:004E4322 8BC8 mov ecx, eax
:004E4324 85C9 test ecx, ecx
:004E4326 7E18 jle 004E4340
:004E4328 BF01000000 mov edi, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E433E(C)
|
:004E432D 8B55FC mov edx, dword ptr [ebp-04]
====>EDX=fly

:004E4330 0FB6543AFF movzx edx, byte ptr [edx+edi-01]
====>依次取使用者名稱的HEX值
1、 ====>EDX=66
2、 ====>EDX=6C
3、 ====>EDX=79

:004E4335 0FAF55E0 imul edx, dword ptr [ebp-20]
1、 ====>EDX=66 * 07=2CA
2、 ====>EDX=6C * 07=2F4
3、 ====>EDX=79 * 07=34F

:004E4339 0155D8 add dword ptr [ebp-28], edx
1、 ====>[EBP-28]=00 + 2CA=2CA
2、 ====>[EBP-28]=2CA + 2F4=5BE
3、 ====>[EBP-28]=5BE + 34F=90D
迴圈結果 ====>[ebp-28]=90D

:004E433C 47 inc edi
====>EDI依次增1 計數器

:004E433D 49 dec ecx
:004E433E 75ED jne 004E432D
====>迴圈使用者名稱的位數次

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E4326(C)
|
:004E4340 8BC8 mov ecx, eax
:004E4342 85C9 test ecx, ecx
:004E4344 7E21 jle 004E4367
:004E4346 BF01000000 mov edi, 00000001
====>EDI=01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E4365(C)
|
:004E434B 8B45FC mov eax, dword ptr [ebp-04]
====>EAX=fly

:004E434E 0FB64438FF movzx eax, byte ptr [eax+edi-01]
====>依次取使用者名稱的HEX值
1、 ====>EAX=66
2、 ====>EAX=6C
3、 ====>EAX=79

:004E4353 99 cdq
:004E4354 F7FE idiv esi
====>ESI=17
1、 ====>EAX=66 / 17=04
2、 ====>EAX=6C / 17=04
3、 ====>EAX=79 / 17=05

:004E4356 0345D4 add eax, dword ptr [ebp-2C]
1、 ====>EAX=04 + 00=04
2、 ====>EAX=04 + 1B=1F
3、 ====>EAX=05 + 4D=52

:004E4359 8BD7 mov edx, edi
====>EDX=EDI=1 （依次增1）

:004E435B 0FAFD6 imul edx, esi
1、 ====>EDX=01 * 17=17
2、 ====>EDX=02 * 17=2E
3、 ====>EDX=03 * 17=45

:004E435E 03C2 add eax, edx
1、 ====>EAX=04 + 17=1B
2、 ====>EAX=1F + 2E=4D
3、 ====>EAX=52 + 45=97

:004E4360 8945D4 mov dword ptr [ebp-2C], eax
====>[ebp-2C]=EAX
迴圈結果 ====>[ebp-2C]=97

:004E4363 47 inc edi
====>EDI依次增1 計數器

:004E4364 49 dec ecx
:004E4365 75E4 jne 004E434B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E4344(C)
|
:004E4367 8D55C8 lea edx, dword ptr [ebp-38]
:004E436A 8B45DC mov eax, dword ptr [ebp-24]
====>EAX=[EBP-24]=1FC

:004E436D 0FAF45E4 imul eax, dword ptr [ebp-1C]
====>EAX=1FC * 3B=7514（H）=29972（D）

:004E4371 E83E4FF2FF call 004092B4
====>將7514（H）轉化為10進位制值29972

:004E4376 8B45C8 mov eax, dword ptr [ebp-38]
====>EAX=29972

:004E4379 8D4DF4 lea ecx, dword ptr [ebp-0C]
:004E437C BA06000000 mov edx, 00000006
:004E4381 E8D2FDFFFF call 004E4158
====>整理CALL。上面所得＜6位則前面加0；若＞6位則只取後6位
====>29972－->029972

:004E4386 8D55C4 lea edx, dword ptr [ebp-3C]
:004E4389 8B45D8 mov eax, dword ptr [ebp-28]
====>EAX=[EBP-28]=90D

:004E438C 0FAF45E0 imul eax, dword ptr [ebp-20]
====>EAX=90D * 07=3F5B（H）=16219（D）

:004E4390 E81F4FF2FF call 004092B4
====>將3F5B（H）轉化為10進位制值16219

:004E4395 8B45C4 mov eax, dword ptr [ebp-3C]
====>EAX=16219

:004E4398 8D4DF0 lea ecx, dword ptr [ebp-10]
:004E439B BA06000000 mov edx, 00000006
:004E43A0 E8B3FDFFFF call 004E4158
====>整理CALL。上面所得＜6位則前面加0；若＞6位則只取後6位
====>16219 －->01629

:004E43A5 8D55C0 lea edx, dword ptr [ebp-40]
:004E43A8 8B45D4 mov eax, dword ptr [ebp-2C]
====>EAX=[EBP-2C]=97

:004E43AB 0FAF45E4 imul eax, dword ptr [ebp-1C]
====>EAX=97 * 3B=22CD

:004E43AF 0FAF45E0 imul eax, dword ptr [ebp-20]
====>EAX=22CD * 07=F39B

:004E43B3 0FAFC6 imul eax, esi
====>EAX=F39B * 17=15E2ED（H）=1434349（D）

:004E43B6 E8F94EF2FF call 004092B4
====>將15E2ED（H）轉化為10進位制值1434349

:004E43BB 8B45C0 mov eax, dword ptr [ebp-40]
====>EAX=1434349

:004E43BE 8D4DEC lea ecx, dword ptr [ebp-14]
:004E43C1 BA06000000 mov edx, 00000006
:004E43C6 E88DFDFFFF call 004E4158
====>整理CALL。上面所得＜6位則前面加0；若＞6位則只取後6位
====>1434339－->434349

:004E43CB 807DD301 cmp byte ptr [ebp-2D], 01
:004E43CF 751E jne 004E43EF
:004E43D1 807DD201 cmp byte ptr [ebp-2E], 01
:004E43D5 7518 jne 004E43EF
:004E43D7 FF75F0 push [ebp-10]
:004E43DA FF75EC push [ebp-14]
:004E43DD FF75F4 push [ebp-0C]
:004E43E0 8D45E8 lea eax, dword ptr [ebp-18]
:004E43E3 BA03000000 mov edx, 00000003
:004E43E8 E8F706F2FF call 00404AE4
:004E43ED EB5E jmp 004E444D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004E43CF(C), :004E43D5(C)
|
:004E43EF 807DD301 cmp byte ptr [ebp-2D], 01
:004E43F3 751E jne 004E4413
:004E43F5 807DD200 cmp byte ptr [ebp-2E], 00
:004E43F9 7518 jne 004E4413
:004E43FB FF75EC push [ebp-14]
====>[ebp-14]=434349 壹

:004E43FE FF75F0 push [ebp-10]
====>[ebp-10]=016219 貳

:004E4401 FF75F4 push [ebp-0C]
====>[ebp-0C]=029972 叄

:004E4404 8D45E8 lea eax, dword ptr [ebp-18]
:004E4407 BA03000000 mov edx, 00000003
:004E440C E8D306F2FF call 00404AE4
====>將上面所得的壹貳叄連線起來

:004E4411 EB3A jmp 004E444D

…… …… 省略 …… ……

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004E43ED(U), :004E4411(U), :004E4435(U)
|
:004E444D 8B45F8 mov eax, dword ptr [ebp-08]
:004E4450 8B55E8 mov edx, dword ptr [ebp-18]
====>EDX=434349016219029972

★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★

進入整理CALL：

* Referenced by a CALL at Addresses:
|:004E4381 , :004E43A0 , :004E43C6
|
:004E4158 55 push ebp
:004E4159 8BEC mov ebp, esp
:004E415B 51 push ecx
:004E415C 53 push ebx
:004E415D 56 push esi
:004E415E 8BF1 mov esi, ecx
:004E4160 8BDA mov ebx, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E40FB(C)
|
:004E4162 8945FC mov dword ptr [ebp-04], eax
:004E4165 8B45FC mov eax, dword ptr [ebp-04]
:004E4168 E89F0AF2FF call 00404C0C
:004E416D 33C0 xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E4108(C)
|
:004E416F 55 push ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E4102(C)
|
:004E4170 68EB414E00 push 004E41EB
:004E4175 64FF30 push dword ptr fs:[eax]
:004E4178 648920 mov dword ptr fs:[eax], esp
:004E417B 8B45FC mov eax, dword ptr [ebp-04]
:004E417E E8A108F2FF call 00404A24
====>求位數

:004E4183 3BD8 cmp ebx, eax
====>與6比較

:004E4185 7C29 jl 004E41B0
:004E4187 8B45FC mov eax, dword ptr [ebp-04]
:004E418A E89508F2FF call 00404A24
:004E418F 50 push eax
:004E4190 8BC3 mov eax, ebx
:004E4192 5A pop edx
:004E4193 2BC2 sub eax, edx
:004E4195 8BD8 mov ebx, eax
:004E4197 85DB test ebx, ebx
:004E4199 7E30 jle 004E41CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E41AC(C)
|
:004E419B 8D45FC lea eax, dword ptr [ebp-04]
:004E419E 8B4DFC mov ecx, dword ptr [ebp-04]
:004E41A1 BA00424E00 mov edx, 004E4200
:004E41A6 E8C508F2FF call 00404A70
:004E41AB 4B dec ebx
:004E41AC 75ED jne 004E419B
:004E41AE EB1B jmp 004E41CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E4185(C)
|
:004E41B0 8D45FC lea eax, dword ptr [ebp-04]
:004E41B3 50 push eax
:004E41B4 8B45FC mov eax, dword ptr [ebp-04]
:004E41B7 E86808F2FF call 00404A24
:004E41BC 8BD0 mov edx, eax
:004E41BE 2BD3 sub edx, ebx
:004E41C0 42 inc edx
:004E41C1 8BCB mov ecx, ebx
:004E41C3 8B45FC mov eax, dword ptr [ebp-04]
:004E41C6 E8B10AF2FF call 00404C7C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004E4199(C), :004E41AE(U)
|
:004E41CB 8BC6 mov eax, esi
:004E41CD 8B55FC mov edx, dword ptr [ebp-04]
1、 ====>EDX=022972
2、 ====>EDX=016219
3、 ====>EDX=434349

:004E41D0 E8EB05F2FF call 004047C0
:004E41D5 33C0 xor eax, eax
:004E41D7 5A pop edx
:004E41D8 59 pop ecx
:004E41D9 59 pop ecx
:004E41DA 648910 mov dword ptr fs:[eax], edx
:004E41DD 68F2414E00 push 004E41F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E41F0(U)
|
:004E41E2 8D45FC lea eax, dword ptr [ebp-04]
:004E41E5 E88205F2FF call 0040476C
:004E41EA C3 ret

――――――――――――――――――――――――――――――――――――
進入比較CALL：4D6271 call 00404B68

:00404B68 53 push ebx
:00404B69 56 push esi
:00404B6A 57 push edi
:00404B6B 89C6 mov esi, eax
:00404B6D 89D7 mov edi, edx
:00404B6F 39D0 cmp eax, edx
====>EAX=434349016219029972
====>EDX=13572468

―――――――――――――――――――――――――――――――――
【KeyMake之{48th}記憶體序號產生器】：

中斷地址：4D625E
中斷次數：1
第一位元組：50
指令長度：1

記憶體方式：EAX

―――――――――――――――――――――――――――――――――
【註冊資訊儲存】：

\CRAP\Data資料夾下的Alumni.mdb中：

UserInfo

―――――――――――――――――――――――――――――――――
【整理】：

使用者名稱：fly
註冊碼：434349016219029972

―――――――――――――――――――――――――――――――――

Cracked By 巢水工作坊――fly【OCN】

2003-03-18 19:41:48

簡單演算法――ChinaRen校友錄伴侶(v2.01 build 20807)

相關文章