破解者：HMILY[CCG][BCG]
軟體名稱：餅乾Flash播放器
V1.92
該軟體是用asprotect v1.23加的殼，是重啟驗證註冊碼
脫殼後反彙編有以下內容：
有兩部分機器碼，在此設第一部分為x1，第二部分為x2
*
Possible StringData Ref from Code Obj ->"Code"
|
:0048D38C B9A0D54800
mov ecx, 0048D5A0
*
Possible StringData Ref from Code Obj ->"Registy"
|
:0048D391 BAB0D54800
mov edx, 0048D5B0
:0048D396 8B18
mov ebx, dword ptr [eax]
:0048D398 FF13
call dword ptr [ebx]
:0048D39A
8B9550FFFFFF mov edx, dword ptr [ebp+FFFFFF50]
:0048D3A0
8B860C030000 mov eax, dword ptr [esi+0000030C]
:0048D3A6
E8A1F0FAFF call 0043C44C
:0048D3AB
8D954CFFFFFF lea edx, dword ptr [ebp+FFFFFF4C]
:0048D3B1
8B860C030000 mov eax, dword ptr [esi+0000030C]
:0048D3B7
E860F0FAFF call 0043C41C
:0048D3BC
8B854CFFFFFF mov eax, dword ptr [ebp+FFFFFF4C]
:0048D3C2
50 push
eax
:0048D3C3 8D9544FFFFFF lea edx,
dword ptr [ebp+FFFFFF44]
:0048D3C9 8B8604030000
mov eax, dword ptr [esi+00000304]
:0048D3CF E848F0FAFF
call 0043C41C
:0048D3D4 8B8544FFFFFF
mov eax, dword ptr [ebp+FFFFFF44]
:0048D3DA
E851B7F7FF call 00408B30 ->把x1轉換為十六進位制
:0048D3DF
8BD8 mov
ebx, eax ->儲存x1到ebx
:0048D3E1 C1E305
shl ebx, 05 ->ebx=ebx<<5
:0048D3E4
2BD8 sub
ebx, eax ->ebx=ebx-x1
:0048D3E6 81EB41010000
sub ebx, 00000141 ->ebx=ebx-0x141
:0048D3EC 8D9540FFFFFF
lea edx, dword ptr [ebp+FFFFFF40]
:0048D3F2
8B8604030000 mov eax, dword ptr [esi+00000304]
:0048D3F8
E81FF0FAFF call 0043C41C
:0048D3FD
8B8540FFFFFF mov eax, dword ptr [ebp+FFFFFF40]
:0048D403
E828B7F7FF call 00408B30 ->再取一次x1到eax
:0048D408
03D8 add
ebx, eax ->ebx=ebx+eax
:0048D40A 8D953CFFFFFF
lea edx, dword ptr [ebp+FFFFFF3C]
:0048D410 8B8608030000
mov eax, dword ptr [esi+00000308]
:0048D416
E801F0FAFF call 0043C41C ->取x2
:0048D41B
8B853CFFFFFF mov eax, dword ptr [ebp+FFFFFF3C]
->x2傳入eax
:0048D421 E80AB7F7FF
call 00408B30
->轉換x2為十六進位制
:0048D426 C1E002
shl eax, 02
->eax=x2<<2
:0048D429 03D8
add ebx, eax
->累加 ebx=ebx+eax
:0048D42B
8D9538FFFFFF lea edx, dword ptr [ebp+FFFFFF38]
:0048D431
8B8608030000 mov eax, dword ptr [esi+00000308]
:0048D437
E8E0EFFAFF call 0043C41C
:0048D43C
8B8538FFFFFF mov eax, dword ptr [ebp+FFFFFF38]
->再取一次x2
:0048D442 E8E9B6F7FF
call 00408B30
->轉換x2為十六進位制
:0048D447 8D0480
lea eax, dword ptr [eax+4*eax] ->取eax+eax*4的地址到eax
:0048D44A
2D86000000 sub eax, 00000086
->eax=eax-0x86
:0048D44F 03D8
add ebx, eax
->ebx的值一直是累加 ebx=ebx+eax
:0048D451
8D045B lea eax,
dword ptr [ebx+2*ebx] ->取ebx+ebx*2的地址到eax
:0048D454 2DE74D0000
sub eax, 00004DE7 ->eax=eax-0x4de7 過這裡下 ?
eax得真碼
:0048D459 8D9548FFFFFF lea
edx, dword ptr [ebp+FFFFFF48]
:0048D45F E868B6F7FF
call 00408ACC
:0048D464 8B9548FFFFFF
mov edx, dword ptr [ebp+FFFFFF48] ->真碼進edx
:0048D46A
58 pop
eax
->假碼棧
:0048D46B E8CC75F7FF
call 00404A3C
->比較註冊碼
:0048D470 754F
jne 0048D4C1
->不相等跳
:0048D472 A168B94900
mov eax, dword ptr [0049B968]
:0048D477
8B00 mov
eax, dword ptr [eax]
:0048D479 8B80D4030000
mov eax, dword ptr [eax+000003D4]
:0048D47F B201
mov dl, 01
:0048D481 8B08
mov ecx, dword ptr
[eax]
:0048D483 FF51FC
call [ecx-04]
:0048D486 C70560CD490001000000 mov dword ptr
[0049CD60], 00000001 ->註冊標記
:0048D490 A190BC4900
mov eax, dword ptr [0049BC90]
:0048D495 8B00
mov eax, dword ptr [eax]
:0048D497
8B80F8020000 mov eax, dword ptr [eax+000002F8]
*
Possible StringData Ref from Code Obj ->"已註冊版本"
|
:0048D49D BAC0D54800
mov edx, 0048D5C0
:0048D4A2 E8A5EFFAFF
call 0043C44C
:0048D4A7 A190BC4900
mov eax, dword ptr [0049BC90]
:0048D4AC 8B00
mov eax, dword ptr
[eax]
:0048D4AE 8B80F8020000 mov eax,
dword ptr [eax+000002F8]
:0048D4B4 8B4068
mov eax, dword ptr [eax+68]
:0048D4B7 BA00800000
mov edx, 00008000
:0048D4BC
E8B73EF9FF call 00421378
該軟體是用：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
下的：RegisteredOwner值做為機器碼的計算基數，即你計算機的安裝名稱！
註冊碼儲存到BGFplayer.ini下的[Registy]
Code=884947
序號產生器原始碼：
//---------------------------------------------------------------------------
void
__fastcall Tform1::OKBtnClick(TObject *Sender)
{
int a1=0,a2=0;unsigned
long e=0,f=0,g=0,h=0;
if(UEdit->Text!=""&&UEdit1->Text!="")
{
a1=StrToInt(UEdit->Text);a2=StrToInt(UEdit1->Text);
e=(a1<<5)-a1-0x141+a1;
f=(a2<<2)+e;
g=a2+a2*4-0x86+f;
h=g+g*2-0x4de7;
CEdit->Text=h;
}
}