Disk Chief 1.2 簡單註冊演算法分析

破解目標：Disk Chief 1.2
官方主頁：http://dekasoftware.mastak.com/
軟體簡介：Windows 下類似資源管理器的檔案管理軟體
下載地址：http://dekasoftware.mastak.com/diskchief.zip

作者：炎之川[BCG]
時間：2003.4.29
主頁：http://skipli.yeah.net/

========================================================================
宣告: 本文純屬技術交流，無其他任何目的，轉載請註明作者並保持文章的完整。
========================================================================

簡單分析後用 Ollydbg 載入程式，在 0046FD0C 處下斷點，然後 Ctrl+F2 重新開始，F9 執行程式，在註冊對話方塊中填入註冊名和假註冊碼：
Name: lovefire[BCG]
S/N: 9876543210

按 Register，被 Ollydbg 斷下：
(; 後是 Ollydbg 所分析的內容，// 後是我加的註釋，文中數值均為十六進位制值)

0046FD0C /. 55 PUSH EBP //斷點
0046FD0D |. 8BEC MOV EBP,ESP
0046FD0F |. 6A 00 PUSH 0
0046FD11 |. 6A 00 PUSH 0
0046FD13 |. 53 PUSH EBX
0046FD14 |. 56 PUSH ESI
0046FD15 |. 8BD8 MOV EBX,EAX
0046FD17 |. 33C0 XOR EAX,EAX
0046FD19 |. 55 PUSH EBP
0046FD1A |. 68 1DFE4600 PUSH DiskChie.0046FE1D
0046FD1F |. 64:FF30 PUSH DWORD PTR FS:[EAX]
0046FD22 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
0046FD25 |. 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
0046FD28 |. 8B83 E8010000 MOV EAX,DWORD PTR DS:[EBX+1E8]
0046FD2E |. E8 1D1DFBFF CALL DiskChie.00421A50
0046FD33 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
0046FD36 |. 33D2 XOR EDX,EDX
0046FD38 |. E8 277DF9FF CALL DiskChie.00407A64
0046FD3D |. 8BF0 MOV ESI,EAX
0046FD3F |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
0046FD42 |. 8B83 E0010000 MOV EAX,DWORD PTR DS:[EBX+1E0]
0046FD48 |. E8 031DFBFF CALL DiskChie.00421A50
0046FD4D |. 8BD6 MOV EDX,ESI
0046FD4F |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] //註冊名放入eax
0046FD52 |. E8 85B90500 CALL DiskChie.004CB6DC //演算法，我們跟進去
0046FD57 |. 84C0 TEST AL,AL //al=1 則註冊成功
0046FD59 |. 74 7E JE SHORT DiskChie.0046FDD9
0046FD5B |. 85F6 TEST ESI,ESI
0046FD5D |. 74 7A JE SHORT DiskChie.0046FDD9
0046FD5F |. A1 20464D00 MOV EAX,DWORD PTR DS:[4D4620]
0046FD64 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0046FD67 |. E8 5C3EF9FF CALL DiskChie.00403BC8
0046FD6C |. A1 1C454D00 MOV EAX,DWORD PTR DS:[4D451C]
0046FD71 |. 8930 MOV DWORD PTR DS:[EAX],ESI
0046FD73 |. B9 34FE4600 MOV ECX,DiskChie.0046FE34 ; ASCII "diskchief.ini" //註冊成功就將資訊寫入 dirscan.ini 中
0046FD78 |. B2 01 MOV DL,1
0046FD7A |. A1 88784500 MOV EAX,DWORD PTR DS:[457888]
0046FD7F |. E8 607BFEFF CALL DiskChie.004578E4
0046FD84 |. 8BF0 MOV ESI,EAX
0046FD86 |. A1 20464D00 MOV EAX,DWORD PTR DS:[4D4620]
0046FD8B |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
0046FD8D |. 50 PUSH EAX
0046FD8E |. B9 4CFE4600 MOV ECX,DiskChie.0046FE4C ; ASCII "User"
0046FD93 |. BA 5CFE4600 MOV EDX,DiskChie.0046FE5C ; ASCII "GENERAL"
0046FD98 |. 8BC6 MOV EAX,ESI
0046FD9A |. E8 D97BFEFF CALL DiskChie.00457978
0046FD9F |. A1 1C454D00 MOV EAX,DWORD PTR DS:[4D451C]
0046FDA4 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
0046FDA6 |. 50 PUSH EAX
0046FDA7 |. B9 6CFE4600 MOV ECX,DiskChie.0046FE6C ; ASCII "Number"
0046FDAC |. BA 5CFE4600 MOV EDX,DiskChie.0046FE5C ; ASCII "GENERAL"
0046FDB1 |. 8BC6 MOV EAX,ESI
0046FDB3 |. E8 247DFEFF CALL DiskChie.00457ADC
0046FDB8 |. 8BC6 MOV EAX,ESI
0046FDBA |. E8 8D32F9FF CALL DiskChie.0040304C
0046FDBF |. 6A 00 PUSH 0
0046FDC1 |. B9 74FE4600 MOV ECX,DiskChie.0046FE74 ; ASCII "Disk Chief v. 1.2"
0046FDC6 |. BA 88FE4600 MOV EDX,DiskChie.0046FE88 ; ASCII "Thank you for registering Disk Chief" //註冊成功
0046FDCB |. A1 28464D00 MOV EAX,DWORD PTR DS:[4D4628]
0046FDD0 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
0046FDD2 |. E8 811AFCFF CALL DiskChie.00431858
0046FDD7 |. EB 18 JMP SHORT DiskChie.0046FDF1
0046FDD9 |> 6A 00 PUSH 0
0046FDDB |. B9 74FE4600 MOV ECX,DiskChie.0046FE74 ; ASCII "Disk Chief v. 1.2"
0046FDE0 |. BA B0FE4600 MOV EDX,DiskChie.0046FEB0 ; ASCII "Wrong serial number!" //註冊失敗
0046FDE5 |. A1 28464D00 MOV EAX,DWORD PTR DS:[4D4628]
0046FDEA |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
0046FDEC |. E8 671AFCFF CALL DiskChie.00431858
0046FDF1 |> 8BC3 MOV EAX,EBX
0046FDF3 |. E8 ECF7FBFF CALL DiskChie.0042F5E4
0046FDF8 |. 8BC3 MOV EAX,EBX
0046FDFA |. E8 25FAFBFF CALL DiskChie.0042F824
0046FDFF |. 33C0 XOR EAX,EAX
0046FE01 |. 5A POP EDX
0046FE02 |. 59 POP ECX
0046FE03 |. 59 POP ECX
0046FE04 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
0046FE07 |. 68 24FE4600 PUSH DiskChie.0046FE24
0046FE0C |> 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
0046FE0F |. E8 603DF9FF CALL DiskChie.00403B74
0046FE14 |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0046FE17 |. E8 583DF9FF CALL DiskChie.00403B74
0046FE1C \. C3 RETN

------------------------------------------------------------------------
進入 004CB6DC 的演算法call

004CB732 |> 3B5D F8 CMP EBX,DWORD PTR SS:[EBP-8] //真假註冊碼對比……
004CB735 |. 75 04 JNZ SHORT DiskChie.004CB73B //不一樣就……
004CB737 |. B3 01 MOV BL,1
004CB739 |. EB 02 JMP SHORT DiskChie.004CB73D
004CB73B |> 33DB XOR EBX,EBX
004CB73D |> 33C0 XOR EAX,EAX
004CB73F |. 5A POP EDX
004CB740 |. 59 POP ECX
004CB741 |. 59 POP ECX
004CB742 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
004CB745 |. 68 5AB74C00 PUSH DiskChie.004CB75A
004CB74A |> 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
004CB74D |. E8 2284F3FF CALL DiskChie.00403B74
004CB752 \. C3 RETN
004CB753 .^E9 C07EF3FF JMP DiskChie.00403618
004CB758 .^EB F0 JMP SHORT DiskChie.004CB74A
004CB75A . 8BC3 MOV EAX,EBX
004CB75C . 5E POP ESI
004CB75D . 5B POP EBX
004CB75E . 59 POP ECX
004CB75F . 59 POP ECX
004CB760 . 5D POP EBP
004CB761 . C3 RETN

------------------------------------------------------------------------

演算法總結：
1、具體迴圈次數乘預設的數0D51AE15，再乘逐位取得的註冊名的ASCII值，值放入eax，溢位值放入edx，最後加上ebx的值，ebx初始值為0，第二次迴圈的值由第一次迴圈所得值決定，之後累加；
2、edx清零之後，(eax*edx)-edx，得出的值放入 ebx，供下次迴圈使用；
3、迴圈完成之後，eax中存放的值即註冊碼的16進位制數，轉換為10進位制即為註冊碼。

至此 Disk Chief 1.2 註冊演算法分析完成，一組可用的註冊碼：
Name: lovefire[BCG]
S/N: 1373681969

註冊資訊儲存：
註冊成功後，註冊資訊寫入 windows 安裝目錄下的 diskchief.ini 檔案中。
[GENERAL]
User=lovefire[BCG]
Number=1373681969

------------------------------------------------------------------------
炎之川
屬於中國破解組織BCG (BeGiNnEr'S CrAcKiNg Group)

　　_/_/_/　　　_/_/_/　　 _/_/_/
　 _/　　_/　_/　　　　 _/
　_/_/_/　　_/　　　　 _/　_/_/
_/　　_/　_/　　　　 _/　　_/
_/_/_/　　　_/_/_/　　 _/_/_/

Disk Chief 1.2 簡單註冊演算法分析

相關文章