輝翔房地產中介銷售管理 V1.0.1.3演算法分析

作者： wzh123

軟體大小： 5138 KB
軟體語言：簡體中文
軟體類別：國產軟體 / 共享版 / 其它行業
應用平臺： Win9x/NT/2000/XP
軟體介紹：
〖輝翔房地產中介銷售管理軟體〗是面向於中小型房地產中介機構定製開發的，能全面提高房地產中介機構的工作效率，簡化繁瑣的手工勞動，加強中介機構各部門之間的協同關係。本軟體對於中小型房地產中介公司銷售、租賃業務的資料處理、資料查詢、成交管理、統計報表、系統管理有著非常重要的輔助管理作用，從而提高工作效率，促成更多成交，促進公司檔次的提升！軟體登陸帳號：Admin 密碼：111111。

這個軟體我是在win98＋trw下除錯的，進去後不斷的跳來跳去，好像進了迷魂陣一樣，顯然，軟體的程式碼是動態生成的(我也不知道該怎麼形容，就用了這個詞)，剛開始弄得我頭暈眼花的，真想放棄，還好堅持下來了，於是，用S大法搜尋輸入的假註冊碼，得到了一個地址xxxxxxxx，接著bpm xxxxxxxx，f5，斷下來後，小心跟蹤，終於到了演算法的核心，出人意料的是它的演算法極其簡單，值得注意的是註冊碼跟姓名、公司、申請碼都無關，只與硬碟id有關，下面將核心部分列出來，由於其程式碼動態生成，因此，下面的程式碼是從trw中u出來的，與你的肯定不同，因此，不必在意，我們只要瞭解他的註冊演算法就行了。提醒一下和我一樣是菜鳥的初學者們，在“茫茫"碼"(程式碼)海中”，有時候，bpm這個命令真的很管用。
由於初學crack，錯誤在所難免，寫的也很亂，請各位包涵，也請各位高手指教。

斷下後，小心來到這裡：

017F:00555BAC 55 PUSH EBP
017F:00555BAD 8BEC MOV EBP,ESP
017F:00555BAF B904000000 MOV ECX,04
017F:00555BB4 6A00 PUSH BYTE +00
017F:00555BB6 6A00 PUSH BYTE +00
017F:00555BB8 49 DEC ECX
017F:00555BB9 75F9 JNZ 00555BB4
017F:00555BBB 51 PUSH ECX
017F:00555BBC 53 PUSH EBX
017F:00555BBD 56 PUSH ESI
017F:00555BBE 57 PUSH EDI
017F:00555BBF 8945FC MOV [EBP-04],EAX
017F:00555BC2 8B45FC MOV EAX,[EBP-04]
017F:00555BC5 E81AF3EAFF CALL 00404EE4
017F:00555BCA 33C0 XOR EAX,EAX
017F:00555BCC 55 PUSH EBP
017F:00555BCD 68395D5500 PUSH DWORD 00555D39
017F:00555BD2 64FF30 PUSH DWORD [FS:EAX]
017F:00555BD5 648920 MOV [FS:EAX],ESP
017F:00555BD8 8D45EC LEA EAX,[EBP-14]
017F:00555BDB E8F4FCFFFF CALL 005558D4----------關鍵call,取硬碟ID,並將硬碟ID進行轉換,例

如:我的硬碟ID為6ED363VT,轉換後為5A@050SQ(下面詳細分析演算法)

017F:00555BE0 8B45EC MOV EAX,[EBP-14]
017F:00555BE3 8D55F8 LEA EDX,[EBP-08]
017F:00555BE6 E8BD39EBFF CALL 004095A8
017F:00555BEB 8B45F8 MOV EAX,[EBP-08]
017F:00555BEE E809F1EAFF CALL 00404CFC----------取5A@050SQ的位數
017F:00555BF3 83F804 CMP EAX,BYTE +04
017F:00555BF6 7D23 JNL 00555C1B
017F:00555BF8 B8F0030000 MOV EAX,03F0
017F:00555BFD E8CEEFFFFF CALL `AGENT32!GetInfoString`
017F:00555C02 8BD0 MOV EDX,EAX
017F:00555C04 8D45E8 LEA EAX,[EBP-18]
017F:00555C07 E828F0EAFF CALL 00404C34
017F:00555C0C 8B45E8 MOV EAX,[EBP-18]
017F:00555C0F E8C852EFFF CALL 0044AEDC
017F:00555C14 33DB XOR EBX,EBX
017F:00555C16 E903010000 JMP 00555D1E
017F:00555C1B 8B45F8 MOV EAX,[EBP-08]
017F:00555C1E 33DB XOR EBX,EBX
017F:00555C20 8A5801 MOV BL,[EAX+01] 取"5A@050SQ"第二位A(0x41)-->bl
017F:00555C23 8B45F8 MOV EAX,[EBP-08]
017F:00555C26 0FB64002 MOVZX EAX,BYTE [EAX+02] 取"5A@050SQ"第三位@(0x40)-->bl
017F:00555C2A 03D8 ADD EBX,EAX 相加,ebx=0x81
017F:00555C2C 8B45F8 MOV EAX,[EBP-08]
017F:00555C2F E8C8F0EAFF CALL 00404CFC
017F:00555C34 8B55F8 MOV EDX,[EBP-08]
017F:00555C37 0FB67402FF MOVZX ESI,BYTE [EDX+EAX-01] 取"5A@050SQ"最後一位Q(0x51)-->esi
017F:00555C3C 8B45F8 MOV EAX,[EBP-08]
017F:00555C3F E8B8F0EAFF CALL 00404CFC
017F:00555C44 8B55F8 MOV EDX,[EBP-08]
017F:00555C47 0FB64402FE MOVZX EAX,BYTE [EDX+EAX-02] 取"5A@050SQ"倒數第二位S(0x51)-->esi
017F:00555C4C 03F0 ADD ESI,EAX 相加,esi=0xA4
017F:00555C4E 56 PUSH ESI
017F:00555C4F 8D45F4 LEA EAX,[EBP-0C]
017F:00555C52 50 PUSH EAX
017F:00555C53 8BD3 MOV EDX,EBX
017F:00555C55 6603D6 ADD DX,SI dx=0x81+0xA4=0x125(下面將要用到)
017F:00555C58 8BCB MOV ECX,EBX
017F:00555C5A 8B45F8 MOV EAX,[EBP-08]
017F:00555C5D E886FEFFFF CALL 00555AE8
017F:00555C62 BB02000000 MOV EBX,02
017F:00555C67 8B45F4 MOV EAX,[EBP-0C]
017F:00555C6A E88DF0EAFF CALL 00404CFC
017F:00555C6F 99 CDQ
017F:00555C70 F7FB IDIV EBX
017F:00555C72 8BF8 MOV EDI,EAX
017F:00555C74 85FF TEST EDI,EDI
017F:00555C76 7C4D JL 00555CC5
017F:00555C78 47 INC EDI
017F:00555C79 33F6 XOR ESI,ESI
017F:00555C7B 8D45E0 LEA EAX,[EBP-20]
017F:00555C7E 50 PUSH EAX
017F:00555C7F 8BD6 MOV EDX,ESI
017F:00555C81 0FAFD3 IMUL EDX,EBX
017F:00555C84 42 INC EDX
017F:00555C85 8BCB MOV ECX,EBX
017F:00555C87 8B45F4 MOV EAX,[EBP-0C]
017F:00555C8A E8C5F2EAFF CALL 00404F54
017F:00555C8F 8B45E0 MOV EAX,[EBP-20]
017F:00555C92 8D55E4 LEA EDX,[EBP-1C]
017F:00555C95 E84EEFFFFF CALL `AGENT32!GetStrDeic`------關鍵call,將5A@050SQ進行轉換,在

記憶體中5A@050SQ為35 41 40 30 35 30 53 51,轉換後為34 cb 97 22 31 7d(下面詳細分析演算法)

017F:00555C9A 8B55E4 MOV EDX,[EBP-1C] 以下將34 cb 97 22 31 7d轉成10進位制,兩兩組合
017F:00555C9D 8D45F0 LEA EAX,[EBP-10] 以我的註冊資訊為例:
017F:00555CA0 E85FF0EAFF CALL 00404D04 1. 0x34=52(D),0xcb=203(D)==>52203(第一組)
017F:00555CA5 8B45F4 MOV EAX,[EBP-0C] 2. 0x97=151(D),0x22=34(D)==>15134(第二組)
017F:00555CA8 E84FF0EAFF CALL 00404CFC 3. 0x31=49(D),0x7d=125(D)==>49125(第三組)
017F:00555CAD 99 CDQ 4. 0x7a=122(D),0xb8=184(D)==>122184(第四組)
017F:00555CAE F7FB IDIV EBX 將四組註冊碼用-連起來得到
017F:00555CB0 3BF0 CMP ESI,EAX 52203-15134-49125-122184即為註冊碼
017F:00555CB2 7D0D JNL 00555CC1
017F:00555CB4 8D45F0 LEA EAX,[EBP-10]
017F:00555CB7 BA545D5500 MOV EDX,00555D54
017F:00555CBC E843F0EAFF CALL 00404D04 這個call作用是在求出的註冊碼之間加上"-"
017F:00555CC1 46 INC ESI
017F:00555CC2 4F DEC EDI
017F:00555CC3 75B6 JNZ 00555C7B
017F:00555CC5 8D45DC LEA EAX,[EBP-24]
017F:00555CC8 50 PUSH EAX
017F:00555CC9 8B45F0 MOV EAX,[EBP-10]
017F:00555CCC E82BF0EAFF CALL 00404CFC
017F:00555CD1 8BD0 MOV EDX,EAX
017F:00555CD3 B901000000 MOV ECX,01
017F:00555CD8 8B45F0 MOV EAX,[EBP-10]
017F:00555CDB E874F2EAFF CALL 00404F54
017F:00555CE0 8B45DC MOV EAX,[EBP-24]
017F:00555CE3 BA545D5500 MOV EDX,00555D54
017F:00555CE8 E853F1EAFF CALL 00404E40
017F:00555CED 751C JNZ 00555D0B
017F:00555CEF 8D45F0 LEA EAX,[EBP-10]
017F:00555CF2 50 PUSH EAX
017F:00555CF3 8B45F0 MOV EAX,[EBP-10]
017F:00555CF6 E801F0EAFF CALL 00404CFC
017F:00555CFB 8BC8 MOV ECX,EAX
017F:00555CFD 49 DEC ECX
017F:00555CFE BA01000000 MOV EDX,01
017F:00555D03 8B45F0 MOV EAX,[EBP-10]
017F:00555D06 E849F2EAFF CALL 00404F54
017F:00555D0B 8B45F0 MOV EAX,[EBP-10]
017F:00555D0E 8B55FC MOV EDX,[EBP-04]
017F:00555D11 E82AF1EAFF CALL 00404E40

---------------------將6ED363VT轉為5A@050SQ-------------------------
017F:005559E7 85F6 TEST ESI,ESI
017F:005559E9 7E4C JNG 00555A37
017F:005559EB BF01000000 MOV EDI,01 1->edi
017F:005559F0 8B45F8 MOV EAX,[EBP-08] 硬碟ID "6ED363VT"--->eax
017F:005559F3 8A5C38FF MOV BL,[EAX+EDI-01] 依次取硬碟ID "6ED363VT"->bl
017F:005559F7 8B45F8 MOV EAX,[EBP-08]
017F:005559FA 0FB64438FF MOVZX EAX,BYTE [EAX+EDI-01] 依次取硬碟ID "6ED363VT"->eax
017F:005559FF C1E804 SHR EAX,04
017F:00555A02 32D8 XOR BL,AL
1.(0x36>>4)^0x36=0x35(5)
2.(0x45>>4)^0x45=0x41(A)
3.(0x44>>4)^0x44=0x40(@)
4.(0x33>>4)^0x33=0x30(0)
5.(0x36>>4)^0x36=0x35(5)
6.(0x33>>4)^0x33=0x30(0)
7.(0x56>>4)^0x56=0x53(S)
8.(0x54>>4)^0x54=0x51(Q)
017F:00555A04 80FB7E CMP BL,7E
017F:00555A07 760F JNA 00555A18 bl<=0x7e就跳,我的跳了
017F:00555A09 8D45F4 LEA EAX,[EBP-0C] 否則繼續,我這裡沒跟了

017F:00555A0C BAE45A5500 MOV EDX,00555AE4
017F:00555A11 E8EEF2EAFF CALL 00404D04
017F:00555A16 EB1B JMP SHORT 00555A33
017F:00555A18 8D45E8 LEA EAX,[EBP-18]
017F:00555A1B 8B55F8 MOV EDX,[EBP-08]
017F:00555A1E 8B55F8 MOV EDX,[EBP-08]
017F:00555A21 8BD3 MOV EDX,EBX
017F:00555A23 E8FCF1EAFF CALL 00404C24
017F:00555A28 8B55E8 MOV EDX,[EBP-18]
017F:00555A2B 8D45F4 LEA EAX,[EBP-0C]
017F:00555A2E E8D1F2EAFF CALL 00404D04
017F:00555A33 47 INC EDI
017F:00555A34 4E DEC ESI
017F:00555A35 75B9 jne 005559F0

-------------將指向5A@050SQ的記憶體資料轉為34 cb 97 22 31 7D--------

017F:00555AEE 53 PUSH EBX
017F:00555AEF 56 PUSH ESI
017F:00555AF0 57 PUSH EDI
017F:00555AF1 33DB XOR EBX,EBX
017F:00555AF3 895DF4 MOV [EBP-0C],EBX
017F:00555AF6 894DF8 MOV [EBP-08],ECX
017F:00555AF9 8BF2 MOV ESI,EDX
017F:00555AFB 8945FC MOV [EBP-04],EAX
017F:00555AFE 8B45FC MOV EAX,[EBP-04]
017F:00555B01 E8DEF3EAFF CALL 00404EE4
017F:00555B06 33C0 XOR EAX,EAX
017F:00555B08 55 PUSH EBP
017F:00555B09 68995B5500 PUSH DWORD 00555B99
017F:00555B0E 64FF30 PUSH DWORD [FS:EAX]
017F:00555B11 648920 MOV [FS:EAX],ESP
017F:00555B14 8D45F4 LEA EAX,[EBP-0C]
017F:00555B17 8B55FC MOV EDX,[EBP-04]
017F:00555B1A E8BDEFEAFF CALL 00404ADC
017F:00555B1F 8B45FC MOV EAX,[EBP-04]
017F:00555B22 E8D5F1EAFF CALL 00404CFC
017F:00555B27 84C0 TEST AL,AL
017F:00555B29 7645 JNA 00555B70
017F:00555B2B 8845F3 MOV [EBP-0D],AL
017F:00555B2E B301 MOV BL,01
017F:00555B30 8D45F4 LEA EAX,[EBP-0C]
017F:00555B33 E814F4EAFF CALL 00404F4C
017F:00555B38 8BFB MOV EDI,EBX
017F:00555B3A 81E7FF000000 AND EDI,FF
017F:00555B40 8B55FC MOV EDX,[EBP-04] "5A@050SQ"-->edx
017F:00555B43 8A543AFF MOV DL,[EDX+EDI-01] 依次取 "5A@050SQ"-->dl
017F:00555B47 0FB7CE MOVZX ECX,SI si初始值為0x125(見上)
017F:00555B4A C1E908 SHR ECX,08 0x125>>8=1-->ecx
017F:00555B4D 32D1 XOR DL,CL 1^0x35=0x34-->dl

017F:00555B4F 885438FF MOV [EAX+EDI-01],DL 代替5,得到4A@050SQ

017F:00555B53 8B45F4 MOV EAX,[EBP-0C]
017F:00555B56 0FB64438FF MOVZX EAX,BYTE [EAX+EDI-01] 依次取 "4A@050SQ"-->eax
017F:00555B5B 6603F0 ADD SI,AX 0x125+0x34=0x159-->esi
017F:00555B5E 668B45F8 MOV AX,[EBP-08]
017F:00555B62 6603450C ADD AX,[EBP+0C] ax=0x125(演算法同上)
017F:00555B66 660FAFF0 IMUL SI,AX 0x125*0x159=0x8ADD-->si
017F:00555B6A 43 INC EBX
017F:00555B6B FE4DF3 DEC BYTE [EBP-0D]
017F:00555B6E 75C0 JNZ 00555B30 (JUMP) 迴圈,我只推出第一位,餘下的

數可以依次類推,在我這兒,最終得到 34 cb 97 22 31 7D------->(記憶體中的表示)

017F:00555B70 8B4508 MOV EAX,[EBP+08]
017F:00555B73 8B55F4 MOV EDX,[EBP-0C]
017F:00555B76 E81DEFEAFF CALL 00404A98
017F:00555B7B 33C0 XOR EAX,EAX
017F:00555B7D 5A POP EDX
017F:00555B7E 59 POP ECX
017F:00555B7F 59 POP ECX
017F:00555B80 648910 MOV [FS:EAX],EDX
017F:00555B83 68A05B5500 PUSH DWORD 00555BA0
017F:00555B88 8D45F4 LEA EAX,[EBP-0C]
017F:00555B8B E8B4EEEAFF CALL 00404A44
017F:00555B90 8D45FC LEA EAX,[EBP-04]
017F:00555B93 E8ACEEEAFF CALL 00404A44

演算法總結:

1.取得硬碟id,將硬碟id根據上述演算法轉換得到一箇中間數,記為SN1,
2.將SN1根據上述演算法轉換得到第二個中間數,記為SN2,
3.將SN2的ASCII值轉換為10進位制,兩兩組合,然後用"-"連線起來就得到了最終的註冊碼.
4.註冊碼放在HKEY_LOCAL_MACHINE\Software\Agent\User\SerialNumber 中，攔截這個是不是也能到達核心呢

？，我沒有試，誰有興趣可以試一試。

後記：我發現了一個奇怪的問題，剛開始在win2000下除錯時，錯誤幾次後，註冊申請碼不見了，而且也無法輸入，得到的註冊碼在win98下注冊成功，回到win2000後，卻不能成功，是否還有什麼暗樁嗎，我現在對這篇文章的正確性開始有了懷疑，我太菜了，搞不清楚，希望那位大哥搞定了告訴我。
最後，謝謝你看完這篇爛文！

輝翔房地產中介銷售管理 V1.0.1.3演算法分析

相關文章