《DesktopX v1.0》PJ 記錄 + 序號產生器原始碼 (13千字)
標 題:《DesktopX v1.0》PJ 記錄 + 序號產生器原始碼 (13千字)
發信人:fengma
時 間:2003-4-4 22:14:54
詳細資訊:
目標軟體: DesktopX v1.0
下載地址: http://qiuyong.x168.net/image/talismandesktop/desktopx_1.0.htm
軟體簡介: DesktopX是一套革命性的桌面設定工具,使用者可以往桌面上新增物件,它以物件的方式可完全的自定桌面,包括一切如:我的電腦、執行、開關機、垃圾箱、開啟程式或資料夾等。透過這些物件的使用,使用者可以創造一個非常活潑的獨特的桌面。父母可以為孩子建立一個非常可愛活潑的適於孩子學習的桌面環境。
使用工具: TRW2000,FengMa's Toy Beta1
破解過程:
在某期封面酷酷的《軟體王》光碟上找到一個挺有意思的軟體,一試之下,覺得還挺不錯的~~~
可是,軟體每次啟動的時候,總是拿屁股對著我!就算我唱“7654321歌”她都不買俺的帳,所以便有了下文:
Hmemcpy 設斷,易來到:
LEA
ECX,[ESP+74]
PUSH BYTE +64
PUSH ECX
PUSH
DWORD 05B1
PUSH ESI
CALL EDI
LEA
EDX,[ESP+0C]
PUSH EDX
PUSH
DWORD 000F003F
PUSH BYTE +00
PUSH DWORD 00450580
PUSH
DWORD 80000002
CALL `ADVAPI32!RegOpenKeyExA`
//準備將註冊資訊寫入登錄檔。
MOV EDI,[0044B140]
LEA
EAX,[ESP+10]
PUSH EAX
CALL
EDI
MOV EBX,[0044B000]
INC EAX
MOV
EDX,[ESP+0C]
LEA ECX,[ESP+10]
PUSH
EAX
PUSH ECX
PUSH BYTE +01
PUSH
BYTE +00
PUSH DWORD 00450E7C
PUSH
EDX
CALL EBX
LEA EAX,[ESP+74]
PUSH
EAX
CALL EDI
INC EAX
LEA
ECX,[ESP+74]
MOV EDX,[ESP+0C]
PUSH
EAX
PUSH ECX
PUSH BYTE +01
PUSH
BYTE +00
PUSH DWORD 00450E74
PUSH
EDX
CALL EBX
MOV EAX,[ESP+0C]
PUSH
EAX
CALL `ADVAPI32!RegCloseKey`
//關閉登錄檔。
CALL 0040DED0
//關鍵CALL,進入。
POP
EDI
POP EBX
TEST EAX,EAX
PUSH
BYTE +00
JZ 0040E0B9
PUSH
BYTE +01
PUSH DWORD 119E
PUSH ESI
CALL
`USER32!SendMessageA` //God job!
MOV
ECX,[0045AF44]
PUSH BYTE +01
PUSH
BYTE +00
PUSH DWORD 040D
PUSH ECX
CALL
`USER32!PostMessageA`
PUSH BYTE +01
PUSH
ESI
CALL `USER32!EndDialog`
XOR EAX,EAX
POP
ESI
ADD ESP,CC
RET
10
PUSH BYTE +02
PUSH DWORD 119E
PUSH
ESI
CALL `USER32!SendMessageA`
//Bad Cracker!
XOR EAX,EAX
POP
ESI
ADD ESP,CC
RET 10
SUB
ESP,D4
MOV AL,[00458E70]
PUSH
ESI
PUSH EDI
MOV [ESP+78],AL
MOV
ECX,18
XOR EAX,EAX
LEA
EDI,[ESP+79]
PUSH DWORD 004505C4
REP STOSD
STOSW
LEA ECX,[ESP+18]
PUSH ECX
STOSB
CALL `KERNEL32!lstrcpyA`
XOR ECX,ECX
MOV
EDX,ECX
AND EDX,80000001
JNS
0040DF12
DEC EDX
OR
EDX,BYTE -02
INC EDX
MOV AL,[ESP+ECX+14]
JZ
0040DF1C
ADD AL,0B
JMP
SHORT 0040DF1E
ADD AL,F9
MOV [ESP+ECX+14],AL
MOV
EAX,ECX
CDQ
MOV ESI,03
IDIV
ESI
MOV AL,[ESP+ECX+14]
ADD
AL,DL
MOV [ESP+ECX+14],AL
INC ECX
CMP
ECX,BYTE +06
JL 0040DF03
LEA
EAX,[ESP+08]
PUSH EAX
PUSH BYTE
+01
PUSH BYTE +00
PUSH DWORD 00450580
PUSH
DWORD 80000002
CALL `ADVAPI32!RegOpenKeyExA`
LEA
ECX,[ESP+10]
LEA EDX,[ESP+78]
PUSH
ECX
LEA EAX,[ESP+10]
PUSH
EDX
MOV EDX,[ESP+10]
PUSH EAX
LEA
ECX,[ESP+20]
PUSH BYTE +00
PUSH
ECX
PUSH EDX
MOV DWORD [ESP+28],64
MOV
DWORD [ESP+24],01
CALL `ADVAPI32!RegQueryvalueExA`
MOV
EAX,[ESP+08]
PUSH EAX
CALL
`ADVAPI32!RegCloseKey`
LEA ECX,[ESP+78]
PUSH
ECX
CALL 0040DC50
//進入。
ADD ESP,BYTE
+04
POP EDI
POP ESI
ADD
ESP,D4
RET
MOV
EAX,[ESP+04]
SUB ESP,A4
LEA
ECX,[ESP+3C]
PUSH EBX
PUSH EBP
PUSH
ESI
PUSH EAX
PUSH ECX
CALL
`KERNEL32!lstrcpyA`
LEA EDX,[ESP+48]
PUSH
EDX
CALL `MSVCRT!_strlwr`
//將序列號中的大寫字元轉換為小寫。
MOV AL,[ESP+4C]
ADD
ESP,BYTE +04
CMP AL,64
JNZ
NEAR 0040DEBE
//序列號第一位不為“d”則 Game Over !
CMP BYTE [ESP+49],78
JNZ
NEAR 0040DEBE
//序列號第一位不為“x”則 Game Over !
MOV AL,[ESP+4A]
MOV
CL,[ESP+4B]
LEA EDX,[ESP+7C]
PUSH
EDI
PUSH EDX
MOV [ESP+84],AL
MOV
[ESP+85],CL
MOV BYTE [ESP+86],00
CALL
`MSVCRT!atoi`
//將序列號第三和第四位轉換為十進位制。
MOV CL,[ESP+56]
MOV
DL,[ESP+57]
MOV [ESP+4C],EAX
MOV
AL,[ESP+55]
MOV [ESP+41],CL
MOV
CL,[ESP+5A]
MOV [ESP+40],AL
MOV
AL,[ESP+58]
MOV [ESP+1C],CL
MOV
CL,[ESP+5D]
MOV [ESP+42],DL
MOV
DL,[ESP+5B]
MOV [ESP+43],AL
MOV
AL,[ESP+5C]
MOV [ESP+1F],CL
MOV
CL,[ESP+61]
MOV [ESP+1D],DL
MOV
DL,[ESP+5F]
MOV [ESP+1E],AL
MOV
AL,[ESP+60]
MOV EDI,[0044B140]
MOV
[ESP+2A],CL
MOV CL,[ESP+65]
MOV
[ESP+28],DL
MOV DL,[ESP+62]
MOV
[ESP+29],AL
MOV AL,[ESP+64]
ADD
ESP,BYTE +04
MOV [ESP+31],CL
MOV
[ESP+27],DL
MOV DL,[ESP+62]
MOV
[ESP+30],AL
MOV AL,[ESP+63]
LEA
ECX,[ESP+3C]
PUSH ECX
MOV BYTE [ESP+44],00
MOV
BYTE [ESP+20],00
MOV BYTE [ESP+2C],00
MOV
[ESP+36],DL
MOV [ESP+37],AL
MOV
BYTE [ESP+38],00
XOR EBP,EBP
XOR
ESI,ESI
CALL EDI
//迴圈的次數。
TEST
EAX,EAX
JNG 0040DD8B
MOVSX EAX,BYTE
[ESP+ESI+3C] //SN1的 Hex 依次送入 EAX。
SUB
EAX,BYTE +30 //減去0x30。
CMP
EAX,BYTE +09
//結果是否大於0x9.
JNG 0040DD78
//是就不做處理。
SUB
EAX,BYTE +27
//否則減 0x27。
LEA EDX,[EBP+EBP*8+00]
//EDX=EBP+EBP*8+0x0。
INC ESI
//ESI++。
LEA EBP,[EAX+EDX*2]
//EBP=EAX+EDX*2。
LEA EAX,[ESP+3C]
PUSH
EAX
CALL EDI
CMP ESI,EAX
JL
0040DD68
//沒取完則向上迴圈。
LEA ECX,[ESP+18]
XOR
EBX,EBX
PUSH ECX
MOV [ESP+14],EBX
XOR
ESI,ESI
CALL EDI
TEST EAX,EAX
JNG
0040DDCA
JMP SHORT 0040DDA4
MOV
EBX,[ESP+10]
//ESP+0x10 處的值送回 EBX。
MOVSX EAX,BYTE [ESP+ESI+18]
//SN2的 Hex 依次送入 EAX。
SUB EAX,BYTE
+30 //減去0x30。
CMP
EAX,BYTE +09
//結果是否大於0x9.
JNG 0040DDB4
//是就不做處理。
SUB
EAX,BYTE +27
//否則減 0x27。
LEA EDX,[EBX+EBX*8]
//EDX=EBX+EBX*8。
LEA ECX,[ESP+18]
PUSH
ECX
INC ESI
//ESI++。
LEA
EAX,[EAX+EDX*2]
//EAX+=EDX*2。
MOV [ESP+14],EAX
//結果送到 ESP+0X14 處。
CALL EDI
CMP
ESI,EAX
JL 0040DDA0
//沒取完則向上迴圈。
LEA
EDX,[ESP+24]
(下面還有幾處類似的計算,略)
XOR EBX,EBX
PUSH
EDX
MOV [ESP+18],EBX
XOR ESI,ESI
CALL
EDI
TEST EAX,EAX
JNG 0040DE09
JMP
SHORT 0040DDE3
MOV EBX,[ESP+14]
MOVSX
EAX,BYTE [ESP+ESI+24]
SUB EAX,BYTE +30
CMP
EAX,BYTE +09
JNG 0040DDF3
SUB
EAX,BYTE +27
LEA ECX,[EBX+EBX*8]
INC
ESI
LEA EDX,[EAX+ECX*2]
LEA
EAX,[ESP+24]
PUSH EAX
MOV [ESP+18],EDX
CALL
EDI
CMP ESI,EAX
JL
0040DDDF
LEA ECX,[ESP+30]
XOR EBX,EBX
PUSH
ECX
XOR ESI,ESI
CALL EDI
TEST
EAX,EAX
JNG 0040DE3A
MOVSX EAX,BYTE
[ESP+ESI+30]
SUB EAX,BYTE +30
CMP EAX,BYTE
+09
JNG 0040DE28
SUB EAX,BYTE +27
LEA
EDX,[EBX+EBX*8]
INC ESI
LEA
EBX,[EAX+EDX*2]
LEA EAX,[ESP+30]
PUSH
EAX
CALL EDI
CMP ESI,EAX
JL
0040DE18
MOV EAX,[ESP+48]
//ESP+0x48 (即SN1 前兩位的 ASC) 值送入 EAX。
MOV
ESI,[ESP+10] //ESP+0x10
處的值送入 ESI。
MOV ECX,[ESP+14]
//ESP+0x14 處的值送入 ECX。
SUB EBP,EAX
//EBP-=EAX。
SUB
ESI,EAX
//ESI-=EAX。
SUB ECX,EAX
//ECX-=EEAX。
SUB EBX,EAX
//EBX-=EAX。
MOV
EAX,EBP
//將 EBP 送入 EAX。
CDQ
MOV EDI,06
IDIV
EDI
//除以 0x6。
POP EDI
TEST EDX,EDX
JNZ
0040DEBE
//餘數不為零就 Game Over !
AND ESI,80000003
//將 ESI 和 0x80000003 做與運算。
JNS
0040DE6A
//結果不為零就 Game Over !
DEC ESI
OR
ESI,BYTE -04
INC ESI
JNZ 0040DEBE
MOV
EAX,ECX
//ECX的值送入EAX。
MOV ESI,03
CDQ
IDIV
ESI
//除以 0x3。
TEST EDX,EDX
JNZ 0040DEBE
//餘數不為零就 Game Over
!
MOV EAX,EBX
//將 EBX 的值 送入 EAX。
MOV ESI,05
CDQ
IDIV ESI
//除以 0x5。
TEST EDX,EDX
JNZ
0040DEBE
//餘數不為零就 Game Over !
SHL EBP,10
//EBP<<=0x10。
MOV
ESI,03
LEA EAX,[ECX+EBP]
//EAX=ECX+EBP。
DIV ESI
//除以
0x3。
TEST EDX,EDX
JNZ 0040DEBE
//餘數不為零就 Game Over !
TEST
BL,01
//BL 和 0x1 做與運算。
JNZ 0040DEBE
//結果不為零就 Game Over !
TEST
CL,03 //CL
和 0x3 做與運算。
JNZ 0040DEBE
//結果不為零就 Game Over !
LEA EAX,[EBX+EBP]
//EAX=EBX+EBP。
MOV
ECX,06
DIV ECX
//除以 0x6。
POP ESI
POP
EBP
POP EBX
MOV EAX,EDX
NEG
EAX
//餘數不為零就 Game Over !
SBB EAX,EAX
INC
EAX
ADD ESP,A4
RET
POP ESI
POP EBP
XOR
EAX,EAX
POP EBX
ADD ESP,A4
RET
總結一下:
合法的序列號應滿足如下條件:
(1):序列號和使用者名稱無關;
(2):序列號至少為 24 位,且前兩位必須為“dx”,記為:dxPQ*SN1*SN2*SN3*SN4;
(3):(SN1 - PQ) MOD 6 = 0;
(4):(SN2 - PQ) AND &H80000003& = 0;
(5):(SN3 - PQ)MOD 3 = 0;
(6):((SN1 * 2^16)+(SN3 - PQ)) MOD 3 = 0;
(7):(SN3 MOD 256)AND 3 = 0;
(8):(SN4 - PQ) MOD 5= 0;
(9):((SN1 * 2^16)+(SN4 - PQ))MOD 6= 0;
(A):(SN4 MOD 256) AND 1 = 0;
寫完破解紀錄之後用 Fengma's Toy beta1 刪掉前面的地址,這樣初學者朋友看破文就不會偷懶了~~:)
然後據此寫出序號產生器:
Dim
EAX1 As Integer
Dim EAX2 As Integer
Dim EAX3 As Integer
Dim EAX4 As Integer
Dim
EBX2 As Integer
Dim EBX3 As Integer
Dim EBX4 As Integer
Dim ECX3 As Integer
Dim
EDX1 As Integer
Dim EDX2 As Integer
Dim EDX4 As Integer
Dim EBP1 As Integer
Dim
Temp_A As Integer
Dim Temp_B As Integer
Dim Condition_A As Integer
Dim
Condition_B As Integer
Dim Condition_C As Integer
Dim Condition_D As Integer
Dim
Condition_E As Integer
Dim Condition_F As Integer
Dim Condition_G As Integer
Dim
SN_A As String
Dim SN_B As String
Dim SN_C As String
Dim SN_D As String
Dim
SHL As Double
Dim EAX31 As Double
Dim EAX41 As Double
Private
Sub Command1_Click()
About_message = MsgBox("This keygen made by
fengma(fengma@2911.net) !", 4096 + vbExclamation, "About...")
End
Sub
Private Sub Command2_Click()
If
Len(Text1.Text) < 2 Then
message_enter_name = MsgBox("Use a
name at least 2 Chars long , please !", 4096 + vbExclamation, "Information")
Exit Sub
End If
If Command2.Caption = "Get Now !" Then
Randomize
Dim
Data()
Dim SN1_(4), SN2_(4), SN3_(4), SN4_(4) As String
Data = Array("1",
"2", "3", "4", "5", "6", "7",
"8", "9", "0", "q", "w", "e",
"r", "t", "y", "u", "i", "o",
"p", "a", "s", "d", "f", "g",
"h", "j", "k", "l", "z", "x",
"c", "v", "b", "n", "m")
Do
SN_B
= ""
EBX2 = 0
For i = 1 To 4
SN2_(i) = Data(Int(Rnd
* 36))
EAX2 = Asc(SN2_(i)) - 48
If EAX2 > 9 Then
EAX2 = EAX2 - 39
End If
EDX2 =
EBX2 + EBX2 * 8
EBX2 = EAX2 + EDX2 * 2
SN_B = SN_B & SN2_(i)
Next
i
Condition_B = (EBX2 - 10) And &H80000003
Loop While Condition_B <>
0
Do
SN_A = ""
EBP1
= 0
For i = 1 To 4
SN1_(i) = Data(Int(Rnd * 36))
EAX1 =
Asc(SN1_(i)) - 48
If EAX1 > 9 Then
EAX1
= EAX1 - 39
End If
EDX1 = EBP1 + EBP1 * 8
EBP1
= EAX1 + EDX1 * 2
SN_A = SN_A & SN1_(i)
Next i
Condition_A
= (EBP1 - 10) Mod 6
SN_C
= ""
EBX3 = 0
For i = 1 To 4
SN3_(i) = Data(Int(Rnd
* 36))
EAX3 = Asc(SN3_(i)) - 48
If EAX3 > 9 Then
EAX3 = EAX3 - 39
End If
ECX3 =
EBX3 + EBX3 * 8
EBX3 = EAX3 + ECX3 * 2
SN_C = SN_C & SN3_(i)
Next
i
Condition_C = (EBX3 - 10) Mod 3
SHL
= (EBP1 - 10) * 2 ^ 16
EAX_31 = SHL + (EBX3 - 10)
Do
If
EAX_31 > 4294967296# Then
EAX_31 = EAX_31 - 4294967296#
End If
Loop
While EAX_31 > 4294967296#
Temp_A
= 0
For i = 1 To Len(EAX_31)
Temp_A = Temp_A + Asc(Mid$(EAX_31, i,
1)) - 48
Next i
Condition_D = Temp_A Mod 3
Condition_E = ((EBX3 - 10) Mod 256) And 3
SN_D
= ""
EBX4 = 0
For i = 1 To 4
SN4_(i) = Data(Int(Rnd
* 36))
EAX4 = Asc(SN4_(i)) - 48
If EAX4 > 9 Then
EAX4 = EAX4 - 39
End If
EDX4 =
EBX4 + EBX4 * 8
EBX4 = EAX4 + EDX4 * 2
SN_D = SN_D & SN4_(i)
Next
i
Condition_F = (EBX4 - 10) Mod 5
EAX_41 = SHL + (EBX4 - 10)
Do
If
EAX_41 >= 4294967296# Then
EAX_41 = EAX_41 - 4294967296#
End If
Loop
While EAX_41 >= 4294967296#
Temp_B
= 0
For i = 1 To Len(EAX_41)
Temp_B = Temp_B + Asc(Mid$(EAX_41, i,
1)) - 48
Next i
Condition_G = Temp_B Mod 2
Condition_H = Temp_B Mod 3
Condition_I = ((EBX4 - 10) Mod 256) And 1
Loop While Condition_A + Condition_C + Condition_D + Condition_E + Condition_F + Condition_G + Condition_H + Condition_I <> 0
Text2.Text = "DX10-" & UCase(SN_A) & "-" & UCase(SN_B) & "-" & UCase(SN_C) & "-" & UCase(SN_D)
With
Command2
.Font = Tahoma
.Caption = "Bye !"
End With
Else
End
End If
End Sub
fengma[FCG]
Cracked
相關文章
- IrfanView 序號產生器分析(初級版)
(13千字)2015-11-15View
- HappyIcon序號產生器TC原始碼 (1千字)2001-04-08APP原始碼
- winzip序號產生器 (1千字)2001-04-12
- 社群遊戲伴侶
V1.0註冊碼的計算,序號產生器 (30千字)2003-05-09遊戲
- 序號產生器制分析: (1千字)2001-11-19
- 《AceReader V4.5》破文+序號產生器原始碼 (12千字)2015-11-15原始碼
- winzip的通用序號產生器 (2千字)2001-12-10
- 序號產生器合集2024-03-17
- 美萍安全衛士V8.45序號產生器制作分析過程,及序號產生器! (11千字)2001-10-28
- Gif2Swf Ver 2.1 TC20序號產生器 && MASM32序號產生器 (4千字)2001-12-10ASM
- mIRC
v 6.16序號產生器C語言原始碼2004-08-17C語言原始碼
- 守財奴1.9註冊分析+序號產生器原始碼2015-11-15原始碼
- Audio compositor註冊碼及序號產生器 (5千字)2002-04-06
- supercapture3.0的版序號產生器!
(4千字)2002-04-23APT
- QuickCD V1.0.4演算法分析+序號產生器原始碼2015-11-15UI演算法原始碼
- Quickness 3.1
註冊演算法分析 + 序號產生器原始碼(tc2) (15千字)2003-04-13UI演算法原始碼
- SysSync Version 1.02簡單演算法分析+VB序號產生器原始碼 (8千字)2015-11-15演算法原始碼
- 製作mIRC6.02序號產生器(給別人寫的初學者序號產生器教材) (14千字)2015-11-15
- 如何製作VB程式記憶體序號產生器--國內某軟體的序號產生器(隱去軟體資訊)
(14千字)2002-08-04記憶體
- EmEditor V3.29和它的序號產生器 (12千字)2015-11-15
- eBook Edit Pro 3.21 演算法分析及序號產生器原始碼2003-03-13演算法原始碼
- Myeclipse 6.5 序號產生器2020-04-06Eclipse
- 餅乾Flash播放器 V1.92-演算法+序號產生器原始碼2015-11-15播放器演算法原始碼
- AntiSpy PRO 1.02
註冊演算法分析 + 序號產生器原始碼(tc2) (12千字)2003-04-11演算法原始碼
- Universe 1.63註冊碼生成分析及序號產生器原碼(上) (2千字)2001-11-12
- NetTalk破解與序號產生器(高手勿進) (10千字)2001-09-20
- 橋牌軟體Deep Finesse的序號產生器 (1千字)2015-11-15
- Advanced
Pic Hunter v1.55 序號產生器C語言原始碼2004-08-18C語言原始碼
- GIF Movie Gear v3.0.2 破解小談(附序號產生器原始碼)2015-11-15原始碼
- 分享一個navicat序號產生器2024-04-02
- 《中華壓縮 6.01》註冊碼破解及序號產生器 (14千字)2001-08-19
- Kalua Cocktails 1.1完全破解,內附彙編序號產生器(用序號產生器編寫器,並有它的使用教程)
(22千字)2002-02-27AI
- win10如何執行序號產生器_win10怎麼執行序號產生器2020-08-28Win10
- NewsReactor 1.0 Build 5009的序號產生器制分析 (16千字)2001-08-07ReactUI
- 另類序號產生器(一MFC程式的改造心得) (3千字)2001-09-10C程式
- 用keymake制序號產生器實戰~高手莫入~~ (1千字)2001-09-30
- Turbo Note+ V4.4序號產生器制分析 (19千字)2001-11-07
- 破解accoustica
2.21(帶序號產生器)----讓高手見笑了:) (11千字)2002-03-31