屏幕撷取程序Ashampoo SnapYa! v1.53 算法分析
-
屏幕撷取程序Ashampoo SnapYa! v1.53
软件名称：Ashampoo SnapYa!
整理日期：2003.3.7
最新版本：1.53
文件大小：3748KB
软件授权：共享软件/英文
使用平台：Win9x/Me/NT/2000/XP
下载地址: http://xz.onlinedown.net/down/ashampoo_snapya153_se.exe
软件简介：
Ashampoo SnapYa!是个与众不同的屏幕撷取程序，透过Ctrl键跟鼠标点选所要撷取的部位，就可以完成屏幕撷取，然而，更奇妙的是可以实时加入图片特效，撷取完成后，还可以利用内建的邮件传送功能，立即将屏幕撷取图寄给朋友！
【作者声明】：本人是个初学者，只是感兴趣，没有其它目的。失误之处敬请诸位大侠赐教！
【破解工具】：0llydbg_cn v1.09 TRW2000 V1.22
【过 程】：
这个软件没有加壳,但是断点不好下,试了几个常用的API都没有中断.只好用TRW2000跟到
这里,然后再用0llydbg继续跟踪.
填好:试验码 7894561230123456
跟踪过程如下:
00405750 /. 55 PUSH EBP
00405751 |. 8BEC MOV EBP, ESP
00405753 |. B9 07000000 MOV ECX, 7
00405758 |> 6A 00 /PUSH 0
0040575A |. 6A 00 |PUSH 0
0040575C |. 49 |DEC ECX
0040575D |.^ 75 F9 \JNZ SHORT SnapYa!.00405758
0040575F |. 51 PUSH ECX
00405760 |. 53 PUSH EBX
00405761 |. 8BD8 MOV EBX, EAX
00405763 |. 33C0 XOR EAX, EAX
00405765 |. 55 PUSH EBP
00405766 |. 68 E0594000 PUSH SnapYa!.004059E0
0040576B |. 64:FF30 PUSH DWORD PTR FS:[EAX]
0040576E |. 64:8920 MOV DWORD PTR FS:[EAX], ESP
00405771 |. C683 11030000>MOV BYTE PTR DS:[EBX+311], 0
00405778 |. C683 10030000>MOV BYTE PTR DS:[EBX+310], 0
0040577F |. 8D55 FC LEA EDX, [LOCAL.1]
00405782 |. 8B83 FC020000 MOV EAX, DWORD PTR DS:[EBX+2FC>
00405788 |. E8 B7BFFFFF CALL
0040578D |. 8B55 FC MOV EDX, [LOCAL.1]
00405790 |. B8 F4594000 MOV EAX, SnapYa!.004059F4
00405795 |. E8 C6B9FFFF CALL
0040579A |. 85C0 TEST EAX, EAX
0040579C |. 7E 1F JLE SHORT SnapYa!.004057BD
0040579E |> 8D55 FC /LEA EDX, [LOCAL.1]
004057A1 |. B9 01000000 |MOV ECX, 1
004057A6 |. 92 |XCHG EAX, EDX
004057A7 |. E8 ACB9FFFF |CALL
004057AC |. 8B55 FC |MOV EDX, [LOCAL.1]
004057AF |. B8 F4594000 |MOV EAX, SnapYa!.004059F4
004057B4 |. E8 A7B9FFFF |CALL
004057B9 |. 85C0 |TEST EAX, EAX
004057BB |.^ 7F E1 \JG SHORT SnapYa!.0040579E
004057BD |> 8B45 FC MOV EAX, [LOCAL.1]
; EAX <==SS:[12F2BC]=011909E4,(ASCII "7894561230123456")
004057C0 |. E8 37E9FFFF CALL SnapYa!.004040FC ; 计算注册码的地方
004057C5 |. F7D8 NEG EAX
004057C7 |. 1BC0 SBB EAX, EAX
004057C9 |. F7D8 NEG EAX
004057CB |. 84C0 TEST AL, AL ; 关键比较
004057CD |. 75 30 JNZ SHORT SnapYa!.004057FF ; 关键跳转
004057CF |. 6A 00 PUSH 0
004057D1 |. 8D55 F4 LEA EDX, [LOCAL.3]
004057D4 |. B8 A4524000 MOV EAX, SnapYa!.004052A4
004057D9 |. E8 A2B9FFFF CALL
004057DE |. 8B45 F4 MOV EAX, [LOCAL.3]
; EAX <== SS:[12F2B4]=011909BC,(ASCII "Sorry,wrong code! Please validate your input and try again!"
004057E1 |. 8D55 F8 LEA EDX, [LOCAL.2]
004057E4 |. E8 1FD9FFFF CALL
004057E9 |. 8B45 F8 MOV EAX, [LOCAL.2]
004057EC |. 66:8B0D F8594>MOV CX, WORD PTR DS:[4059F8]
004057F3 |. B2 01 MOV DL, 1
004057F5 |. E8 9AC3FFFF CALL
004057FA |. E9 B9010000 JMP SnapYa!.004059B8
================================================================================
CALL SnapYa!.004040FC ; 计算注册码的地方
004040FC /$ 55 PUSH EBP
004040FD |. 8BEC MOV EBP, ESP ; 计算注册码的地方
004040FF |. 83C4 E4 ADD ESP, -1C
00404102 |. 53 PUSH EBX
00404103 |. 56 PUSH ESI
00404104 |. 33D2 XOR EDX, EDX
00404106 |. 8955 EC MOV [LOCAL.5], EDX
00404109 |. 8955 F8 MOV [LOCAL.2], EDX
0040410C |. 8955 F4 MOV [LOCAL.3], EDX
0040410F |. 8945 FC MOV [LOCAL.1], EAX
; SS:[12F268]<==011909E4,(ASCII "7894561230123456")
00404112 |. 8B45 FC MOV EAX, [LOCAL.1]
; EAX <==SS:[12F2BC]=011909E4,(ASCII "7894561230123456")
00404115 |. E8 1ED0FFFF CALL
0040411A |. 33C0 XOR EAX, EAX
0040411C |. 55 PUSH EBP
0040411D |. 68 54434000 PUSH SnapYa!.00404354
00404122 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
00404125 |. 64:8920 MOV DWORD PTR FS:[EAX], ESP
00404128 |. C645 F3 00 MOV BYTE PTR SS:[EBP-D], 0
0040412C |. C645 F1 00 MOV BYTE PTR SS:[EBP-F], 0
00404130 |. C645 F2 00 MOV BYTE PTR SS:[EBP-E], 0
00404134 |. 33DB XOR EBX, EBX
00404136 |. 33C0 XOR EAX, EAX
00404138 |. A3 84C04000 MOV DWORD PTR DS:[40C084], EAX
0040413D |. 8D55 EC LEA EDX, [LOCAL.5]
00404140 |. 8B45 FC MOV EAX, [LOCAL.1]
; EAX <==SS:[12F2BC]=011909E4,(ASCII "7894561230123456")
00404143 |. E8 5CD2FFFF CALL
00404148 |. 8B55 EC MOV EDX, [LOCAL.5]
; EDX <==SS:[12F258]=01190904,(ASCII "7894561230123456")
0040414B |. 8D45 FC LEA EAX, [LOCAL.1]
; (ASCII "7894561230123456") 的地址
0040414E |. E8 ADCFFFFF CALL
00404153 |. 8B45 FC MOV EAX, [LOCAL.1]
; EAX <==SS:[12F258]=01190904,(ASCII "7894561230123456")
00404156 |. E8 B5CFFFFF CALL
0040415B |. 83F8 12 CMP EAX, 12
; EAX =12 (注册码的长度=18),把试验码改为"789456123012345678"继续
0040415E |. 0F85 B3010000 JNZ SnapYa!.00404317
00404164 |. 8B45 FC MOV EAX, [LOCAL.1]
; EAX <==SS:[12F268]=011909BC,(ASCII "789456123012345678")
00404167 |. E8 20020000 CALL SnapYa!.0040438C ; 第一次计算的地方
0040416C |. 8BF0 MOV ESI, EAX ; ESI<==EAX=2A3 (第一次计算的值)
0040416E |. 8D45 F8 LEA EAX, [LOCAL.2]
00404171 |. 50 PUSH EAX
00404172 |. 0FB7C6 MOVZX EAX, SI ; EAX <==2A3
00404175 |. 8945 E4 MOV [LOCAL.7], EAX ; SS:[12F250]<==2A3
00404178 |. C645 E8 00 MOV BYTE PTR SS:[EBP-18], 0
0040417C |. 8D55 E4 LEA EDX, [LOCAL.7]
; EDX <==0012F250 (第一次计算的值的地址)
0040417F |. 33C9 XOR ECX, ECX
00404181 |. B8 6C434000 MOV EAX, SnapYa!.0040436C; format ASCII "%04x"
00404186 |. E8 79D2FFFF CALL
0040418B |. 8D45 F4 LEA EAX, [LOCAL.3]
0040418E |. 50 PUSH EAX
0040418F |. B9 04000000 MOV ECX, 4 ; ECX=4
00404194 |. BA 0F000000 MOV EDX, 0F ; EDX=0F
00404199 |. 8B45 FC MOV EAX, [LOCAL.1]
; EAX <==SS:[12F268]=011909BC,(ASCII "789456123012345678")
0040419C |. E8 AFCFFFFF CALL
; 取试验码的最后四位"5678"
004041A1 |. 8B45 F8 MOV EAX, [LOCAL.2]
; EAX<==SS:[12F264]=0117F40C,(ASCII " 2A3")
004041A4 |. E8 67CFFFFF CALL
004041A9 |. 83F8 04 CMP EAX, 4 ; EAX=4
004041AC |. 7D 10 JGE SHORT SnapYa!.004041BE
004041AE |. 8D45 F8 LEA EAX, [LOCAL.2]
004041B1 |. 8B4D F8 MOV ECX, [LOCAL.2]
004041B4 |. BA 7C434000 MOV EDX, SnapYa!.0040437C
004041B9 |. E8 62CFFFFF CALL
004041BE |> 8B45 F8 MOV EAX, [LOCAL.2]
; EAX<==SS:[12F264]=0117F40C,(ASCII"2A3")
004041C1 |. E8 4ACFFFFF CALL
004041C6 |. 83F8 04 CMP EAX, 4
004041C9 |. 7D 10 JGE SHORT SnapYa!.004041DB
004041CB |. 8D45 F8 LEA EAX, [LOCAL.2]
004041CE |. 8B4D F8 MOV ECX, [LOCAL.2]
004041D1 |. BA 7C434000 MOV EDX, SnapYa!.0040437C
004041D6 |. E8 45CFFFFF CALL
004041DB |> 8B45 F8 MOV EAX, [LOCAL.2]
004041DE |. E8 2DCFFFFF CALL
004041E3 |. 83F8 04 CMP EAX, 4
004041E6 |. 7D 10 JGE SHORT SnapYa!.004041F8
004041E8 |. 8D45 F8 LEA EAX, [LOCAL.2]
004041EB |. 8B4D F8 MOV ECX, [LOCAL.2]
004041EE |. BA 7C434000 MOV EDX, SnapYa!.0040437C
004041F3 |. E8 28CFFFFF CALL
004041F8 |> 8B45 F8 MOV EAX, [LOCAL.2]
004041FB |. E8 10CFFFFF CALL
00404200 |. 83F8 04 CMP EAX, 4
00404203 |. 7D 10 JGE SHORT SnapYa!.00404215
00404205 |. 8D45 F8 LEA EAX, [LOCAL.2]
00404208 |. 8B4D F8 MOV ECX, [LOCAL.2]
0040420B |. BA 7C434000 MOV EDX, SnapYa!.0040437C
00404210 |. E8 0BCFFFFF CALL
00404215 |> 8B45 F8 MOV EAX, [LOCAL.2]
; EAX<==SS:[12F264]=0117F40C,(ASCII"2A3")
00404218 |. 8038 20 CMP BYTE PTR DS:[EAX], 20
0040421B |. 75 0B JNZ SHORT SnapYa!.00404228
0040421D |. 8D45 F8 LEA EAX, [LOCAL.2]
00404220 |. E8 23CFFFFF CALL
00404225 |. C600 30 MOV BYTE PTR DS:[EAX], 30 ; 把得到的值前加0
00404228 |> 8B45 F8 MOV EAX, [LOCAL.2]
; EAX<==SS:[12F264]=0117F40C,(ASCII"02A3")
0040422B |. 8078 01 20 CMP BYTE PTR DS:[EAX+1], 20
0040422F |. 75 0C JNZ SHORT SnapYa!.0040423D
00404231 |. 8D45 F8 LEA EAX, [LOCAL.2]
00404234 |. E8 0FCFFFFF CALL
00404239 |. C640 01 30 MOV BYTE PTR DS:[EAX+1], 30
0040423D |> 8B45 F8 MOV EAX, [LOCAL.2]
; EAX<==SS:[12F264]=0117F40C,(ASCII"02A3")
00404240 |. 8078 02 20 CMP BYTE PTR DS:[EAX+2], 20
00404244 |. 75 0C JNZ SHORT SnapYa!.00404252
00404246 |. 8D45 F8 LEA EAX, [LOCAL.2]
00404249 |. E8 FACEFFFF CALL
0040424E |. C640 02 30 MOV BYTE PTR DS:[EAX+2], 30
00404252 |> 8B45 F8 MOV EAX, [LOCAL.2]
; EAX<==SS:[12F264]=0117F40C,(ASCII"02A3")
00404255 |. 8078 03 20 CMP BYTE PTR DS:[EAX+3], 20
00404259 |. 75 0C JNZ SHORT SnapYa!.00404267
0040425B |. 8D45 F8 LEA EAX, [LOCAL.2]
0040425E |. E8 E5CEFFFF CALL
00404263 |. C640 03 30 MOV BYTE PTR DS:[EAX+3], 30
00404267 |> 8B45 F8 MOV EAX, [LOCAL.2]
; EAX<==SS:[12F264]=0117F40C,(ASCII"02A3")
0040426A |. 8B55 F4 MOV EDX, [LOCAL.3]
; EDX <== SS:[12F260]=011876CC,(ASCII "5678")
0040426D |. E8 BECEFFFF CALL
; 把得到的值与试验码的最后四位比较
00404272 |. 75 04 JNZ SHORT SnapYa!.00404278
00404274 |. C645 F3 01 MOV BYTE PTR SS:[EBP-D], 1 ; 标志
00404278 |> 8D45 F8 LEA EAX, [LOCAL.2]
0040427B |. 50 PUSH EAX
0040427C |. B9 03000000 MOV ECX, 3
00404281 |. BA 01000000 MOV EDX, 1
00404286 |. 8B45 FC MOV EAX, [LOCAL.1]
; EAX <==SS:[12F268]=011909BC,(ASCII "789456123012345678")
00404289 |. E8 C2CEFFFF CALL
0040428E |. 8B45 F8 MOV EAX, [LOCAL.2]
; EAX<==SS:[12F264]=01185298,(ASCII "789") 试验码的前三位
00404291 |. 8B15 68C04000 MOV EDX, DWORD PTR DS:[40C068]
; EDX<==DS:[40C068]=011883EC,(ASCII "SNY")
00404297 |. E8 94CEFFFF CALL
; 注册码的前三位应该是"SNY"
0040429C |. 75 04 JNZ SHORT SnapYa!.004042A2
0040429E |. C645 F1 01 MOV BYTE PTR SS:[EBP-F], 1 ; 标志
004042A2 |> 8D45 F8 LEA EAX, [LOCAL.2]
004042A5 |. 50 PUSH EAX
004042A6 |. B9 01000000 MOV ECX, 1 ; ECX=1
004042AB |. BA 06000000 MOV EDX, 6 ; EDX=6
004042B0 |. 8B45 FC MOV EAX, [LOCAL.1]
EAX <==SS:[12F268]=011909BC,(ASCII "789456123012345678")
004042B3 |. E8 98CEFFFF CALL
004042B8 |. 8B45 F8 MOV EAX, [LOCAL.2]
004042BB |. 8B15 6CC04000 MOV EDX, DWORD PTR DS:[40C06C]
004042C1 |. E8 6ACEFFFF CALL
; 比较计算得到的值的第6位=A
004042C6 |. 75 04 JNZ SHORT SnapYa!.004042CC
004042C8 |. C645 F2 01 MOV BYTE PTR SS:[EBP-E], 1 ; 标志
004042CC |> 8D45 F8 LEA EAX, [LOCAL.2]
004042CF |. 50 PUSH EAX
004042D0 |. B9 02000000 MOV ECX, 2 ; ECX=2 (检查的位数)
004042D5 |. BA 04000000 MOV EDX, 4 ; EDX=4 (检查的位号)
004042DA |. 8B45 FC MOV EAX, [LOCAL.1]
; EAX <==SS:[12F268]=011909BC,(ASCII "789456123012345678")
004042DD |. E8 6ECEFFFF CALL
004042E2 |. 8B45 F8 MOV EAX, [LOCAL.2]
; EAX=SS:[12F264]=0117AC14,(ASCII "45")
004042E5 |. BA 88434000 MOV EDX, SnapYa!.00404388
; EDX <==00404388, ASCII "77"
004042EA |. E8 41CEFFFF CALL
; 注册码的第4,5不应该是77"
004042EF |. 74 0D JE SHORT SnapYa!.004042FE
004042F1 |. 8B45 F8 MOV EAX, [LOCAL.2]
; EAX=SS:[12F264]=0117AC14,(ASCII "45")
004042F4 |. E8 C3D0FFFF CALL
; 注册码的第4,5是不是77 <==如果是77就是完全版 (我的错误之一,现更正)
004042F9 |. A3 84C04000 MOV DWORD PTR DS:[40C084], EAX
; DS:[40C084]<==EAX=2D ('-')
004042FE |> 8B45 F8 MOV EAX, [LOCAL.2]
; EAX=SS:[12F264]=0117AC14,(ASCII "45")
00404301 |. BA 88434000 MOV EDX, SnapYa!.00404388
; EDX <==00404388, ASCII "77"
00404306 |. E8 25CEFFFF CALL
; 注册码的第4,5不是77就是00 <== 如果是00就是30天的限制版 (我的错误之二,现更正)
0040430B |. 75 0A JNZ SHORT SnapYa!.00404317
0040430D |. C705 84C04000>MOV DWORD PTR DS:[40C084], -1
; 标志 (这是一个失败的标志)
00404317 |> 807D F3 01 CMP BYTE PTR SS:[EBP-D], 1
; SS:[EBP-D]=SS:[12F25F]=01 ,(注册码的后四位=第一次计算的值的正确标志)
0040431B |. 75 0E JNZ SHORT SnapYa!.0040432B
0040431D |. 807D F2 01 CMP BYTE PTR SS:[EBP-E], 1
; SS:[EBP-E]=SS:[12F260]=01 ,(注册码的第六位是A 的正确标志)
00404321 |. 75 08 JNZ SHORT SnapYa!.0040432B
00404323 |. 807D F1 01 CMP BYTE PTR SS:[EBP-F], 1
SS:[EBP-F]=SS:[12F261]=01 ,(注册码的前三位是"SNY"的正确标志)
00404327 |. 75 02 JNZ SHORT SnapYa!.0040432B
00404329 |. B3 01 MOV BL, 1 ; 应该是注册码成功的标志
0040432B |> F6DB NEG BL
0040432D |. 1BC0 SBB EAX, EAX
0040432F |. 8BD8 MOV EBX, EAX
00404331 |. 33C0 XOR EAX, EAX
00404333 |. 5A POP EDX
00404334 |. 59 POP ECX
00404335 |. 59 POP ECX
00404336 |. 64:8910 MOV DWORD PTR FS:[EAX], EDX
00404339 |. 68 5B434000 PUSH SnapYa!.0040435B
0040433E |> 8D45 EC LEA EAX, [LOCAL.5]
00404341 |. E8 A2CDFFFF CALL
00404346 |. 8D45 F4 LEA EAX, [LOCAL.3]
00404349 |. BA 03000000 MOV EDX, 3
0040434E |. E8 9DCDFFFF CALL
00404353 \. C3 RETN
==============================================
CALL SnapYa!.0040438C ; 第一次计算的地方
0040438C /$ 55 PUSH EBP ; 第一次计算的地方
0040438D |. 8BEC MOV EBP, ESP
0040438F |. 51 PUSH ECX
00404390 |. 53 PUSH EBX
00404391 |. 8945 FC MOV [LOCAL.1], EAX
00404394 |. 8B45 FC MOV EAX, [LOCAL.1]
; EAX <==SS:[12F268]=011909BC,(ASCII "789456123012345678")
00404397 |. E8 9CCDFFFF CALL
0040439C |. 33C0 XOR EAX, EAX
0040439E |. 55 PUSH EBP
0040439F |. 68 DF434000 PUSH SnapYa!.004043DF
004043A4 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
004043A7 |. 64:8920 MOV DWORD PTR FS:[EAX], ESP
004043AA |. 33C9 XOR ECX, ECX
004043AC |. B8 01000000 MOV EAX, 1 ; EAX<==1 指针赋初值
004043B1 |> 8B55 FC /MOV EDX, [LOCAL.1]
; EAX <==SS:[12F268]=011909BC,(ASCII "789456123012345678")
004043B4 |. 8A5402 FF |MOV DL, BYTE PTR DS:[EDX+EAX->
; DL <== DS:[011909BC]=37 ('7')
004043B8 |. 81E2 FF000000 |AND EDX, 0FF
004043BE |. 66:03CA |ADD CX, DX ; CX=CX+DX=0+37=37
004043C1 |. 40 |INC EAX ; EAX++
004043C2 |. 83F8 0E |CMP EAX, 0E ; 计算的次数=14-1=13
004043C5 |.^ 75 EA \JNZ SHORT SnapYa!.004043B1
; //这段把试验码的前13位的hex值相加==>ECX
004043C7 |. 8BD9 MOV EBX, ECX ; EBX<==ECX=2A3
004043C9 |. 33C0 XOR EAX, EAX
004043CB |. 5A POP EDX
004043CC |. 59 POP ECX
004043CD |. 59 POP ECX
004043CE |. 64:8910 MOV DWORD PTR FS:[EAX], EDX
004043D1 |. 68 E6434000 PUSH SnapYa!.004043E6
004043D6 |> 8D45 FC LEA EAX, [LOCAL.1]
; (ASCII "7894561230123456") 的地址
004043D9 |. E8 0ACDFFFF CALL
004043DE \. C3 RETN
-----------------------------------------------------------------------------
第四,五位如果不是77也不应该是:
40003532 8BC0 MOV EAX, EAX
40003534 > 53 PUSH EBX
40003535 56 PUSH ESI
40003536 57 PUSH EDI
40003537 89C6 MOV ESI, EAX
40003539 50 PUSH EAX
4000353A 85C0 TEST EAX, EAX
4000353C 74 73 JE SHORT Vcl50.400035B1
4000353E 31C0 XOR EAX, EAX
40003540 31DB XOR EBX, EBX
40003542 BF CCCCCC0C MOV EDI, 0CCCCCCC
40003547 8A1E MOV BL, BYTE PTR DS:[ESI]
; BL <== DS:[0117AC14]=34 ('4')
40003549 46 INC ESI
4000354A 80FB 20 CMP BL, 20
4000354D ^ 74 F8 JE SHORT Vcl50.40003547
4000354F B5 00 MOV CH, 0 ; 第四位的条件:
40003551 80FB 2D CMP BL, 2D ; 2D ('-')
40003554 74 69 JE SHORT Vcl50.400035BF
40003556 80FB 2B CMP BL, 2B
40003559 74 66 JE SHORT Vcl50.400035C1
4000355B 80FB 24 CMP BL, 24
4000355E 74 66 JE SHORT Vcl50.400035C6
40003560 80FB 78 CMP BL, 78 ; 78 ('x')
40003563 74 61 JE SHORT Vcl50.400035C6
40003565 80FB 58 CMP BL, 58 ; 58 ('X')
40003568 74 5C JE SHORT Vcl50.400035C6
4000356A 80FB 30 CMP BL, 30
; <==如果是0就不跳,0就正确
4000356D 75 13 JNZ SHORT Vcl50.40003582
4000356F 8A1E MOV BL, BYTE PTR DS:[ESI] ; BL =35 ('5')第五位
40003571 46 INC ESI
40003572 80FB 78 CMP BL, 78 ; 78 ('x')
40003575 74 4F JE SHORT Vcl50.400035C6
40003577 80FB 58 CMP BL, 58 ; 58 ('X')
4000357A 74 4A JE SHORT Vcl50.400035C6
4000357C 84DB TEST BL, BL
4000357E 74 20 JE SHORT Vcl50.400035A0
40003580 EB 04 JMP SHORT Vcl50.40003586
40003582 84DB TEST BL, BL
40003584 74 34 JE SHORT Vcl50.400035BA
40003586 80EB 30 SUB BL, 30
40003589 80FB 09 CMP BL, 9
4000358C 77 2C JA SHORT Vcl50.400035BA
4000358E 39F8 CMP EAX, EDI
40003590 77 28 JA SHORT Vcl50.400035BA
40003592 8D0480 LEA EAX, DWORD PTR DS:[EAX+EAX*4]
40003595 01C0 ADD EAX, EAX
40003597 01D8 ADD EAX, EBX
40003599 8A1E MOV BL, BYTE PTR DS:[ESI]
; BL <== DS:[0117AC15]=35 ('5')
4000359B 46 INC ESI
4000359C 84DB TEST BL, BL
4000359E ^ 75 E6 JNZ SHORT Vcl50.40003586
400035A0 FECD DEC CH
400035A2 74 10 JE SHORT Vcl50.400035B4
400035A4 85C0 TEST EAX, EAX ; EAX=2D ('-')
400035A6 7C 12 JL SHORT Vcl50.400035BA
400035A8 59 POP ECX
400035A9 31F6 XOR ESI, ESI
400035AB 8932 MOV DWORD PTR DS:[EDX], ESI
400035AD 5F POP EDI
400035AE 5E POP ESI
400035AF 5B POP EBX
400035B0 C3 RETN
********************************************************************************
注册码计算的总结: 条件注册码的长度=18位
1.注册码的前三位是: SNY
2.注册码的第六位是: A
3.注册码的第四五位有如下几种限制情况:
1).如果是:77 <== 就是完全版
2).不能是: X 和: x
3).如果是:00 <== 就是30天限制版
4.注册码的第七到第十四位随便
5.注册码的最后四位的计算方法:
1).把前13位的各位hex相加
2).如果不足四位前面加0
一组可以用的注册码: SNY77A789456120321 <== 完全版
SNY00A789456120313 <== 30天限制版
fxyang更正于 2003.3.8-12:00
fxyang
2003.3.7
相关视频
相关阅读 Windows错误代码大全 Windows错误代码查询激活windows有什么用Mac QQ和Windows QQ聊天记录怎么合并 Mac QQ和Windows QQ聊天记录Windows 10自动更新怎么关闭 如何关闭Windows 10自动更新windows 10 rs4快速预览版17017下载错误问题Win10秋季创意者更新16291更新了什么 win10 16291更新内容windows10秋季创意者更新时间 windows10秋季创意者更新内容kb3150513补丁更新了什么 Windows 10补丁kb3150513是什么
- 文章评论
-
热门文章
去除winrar注册框方法
最新文章
比特币病毒怎么破解 比去除winrar注册框方法
华为无线路由器HG522-C破解教程(附超级密码JEB格式文件京东电子书下载和阅读限制破解教UltraISO注册码全集(最新)通过Access破解MSSQL获得数据人气排行 华为无线路由器HG522-C破解教程(附超级密码JEB格式文件京东电子书下载和阅读限制破解教UltraISO注册码全集(最新)qq相册密码破解方法去除winrar注册框方法(适应任何版本)怎么用手机破解收费游戏华为无线猫HG522破解如何给软件脱壳基础教程
查看所有0条评论>>