easyclean 清理工具1.5算法分析 -pc6资讯

您的位置：首页 → 精文荟萃 → 破解文章 → easyclean 清理工具1.5算法分析

easyclean 清理工具1.5算法分析 时间：2004/10/15 0:55:00来源：本站整理作者：蓝点我要评论(0)

Crack by simonyan

注册名： simonyan
注册码： CFC0-C3C1-D7C7-DDC0
此为重启校验的，注册码在注册表内，如运行脱壳程序，则注册码在脱壳程序的项内。
下断点bpx regqueryvalueexa do "d *(esp+8)"
看见userID停下，进入程序跟踪。
到下面地方可看见算法。
算法如下：

:0040C735 8A0C28                 mov cl, byte ptr [eax+ebp]     EBP中为注册名
:0040C738 884C0410               mov byte ptr [esp+eax+10], cl
:0040C73C 40                     inc eax
:0040C73D 83F808                 cmp eax, 00000008
:0040C740 7CF3                   jl 0040C735                 （上面只是个检查注册名长度的动作，小于8就无效）
:0040C742 83FB08                 cmp ebx, 00000008
:0040C745 7E24                   jle 0040C76B               （如长度小于等于8跳转）
:0040C747 BE08000000             mov esi, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C769(C)
|
:0040C74C 8BC6                   mov eax, esi
:0040C74E 2507000080             and eax, 80000007
:0040C753 7905                   jns 0040C75A
:0040C755 48                     dec eax
:0040C756 83C8F8                 or eax, FFFFFFF8
:0040C759 40                     inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C753(C)
|
:0040C75A 8A1428                 mov dl, byte ptr [eax+ebp]
:0040C75D 8A0C2E                 mov cl, byte ptr [esi+ebp]
:0040C760 32CA                   xor cl, dl
:0040C762 46                     inc esi
:0040C763 3BF3                   cmp esi, ebx
:0040C765 884C0410               mov byte ptr [esp+eax+10], cl
:0040C769 7CE1                   jl 0040C74C     (上面为大于8的处理，就是第一位和第9位，第二和第10位异或，类推)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C745(C)
|
:0040C76B 33C0 xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C786(C)
|
:0040C76D 8B4C045C               mov ecx, dword ptr [esp+eax+5C] (EBP+5c中值依次为6,7,2,3,5,1,0,4)
:0040C771 83C004                 add eax, 00000004
:0040C774 0FBE4C0C10             movsx ecx, byte ptr [esp+ecx+10]
:0040C779 81F1AE000000           xor ecx, 000000AE
:0040C77F 83F820                 cmp eax, 00000020 （每次加4，共有8组）
:0040C782 894C0418               mov dword ptr [esp+eax+18], ecx
:0040C786 7CE5                   jl 0040C76D
:0040C788 8B1564564500           mov edx, dword ptr [00455664]
:0040C78E 89542410               mov dword ptr [esp+10], edx
:0040C792 8B442438               mov eax, dword ptr [esp+38]
:0040C796 8B4C2434               mov ecx, dword ptr [esp+34]
:0040C79A 8B542430               mov edx, dword ptr [esp+30]
:0040C79E 50                     push eax
:0040C79F 8B442430               mov eax, dword ptr [esp+30]
:0040C7A3 51                     push ecx
:0040C7A4 8B4C2430               mov ecx, dword ptr [esp+30]
:0040C7A8 52                     push edx
:0040C7A9 8B542430               mov edx, dword ptr [esp+30]
:0040C7AD 50                     push eax
:0040C7AE 8B442430               mov eax, dword ptr [esp+30]
:0040C7B2 51                     push ecx
:0040C7B3 8B4C2430               mov ecx, dword ptr [esp+30]
:0040C7B7 52                     push edx
:0040C7B8 50                     push eax
:0040C7B9 51                     push ecx
:0040C7BA 8D542430               lea edx, dword ptr [esp+30]

* Possible StringData Ref from Data Obj ->"%02X%02X-%02X%02X-%02X%02X-%02X%02X" （注册码格式)
                                |
:0040C7BE 685C444500             push 0045445C
:0040C7C3 52                     push edx
:0040C7C4 C784248C08000000000000 mov dword ptr [esp+0000088C], 00000000
:0040C7CF E8AE020200             call 0042CA82               (将前面所得值转为此格式就OK了)
:0040C7D4 8BB42498080000         mov esi, dword ptr [esp+00000898] （这里可以看见注册码明码了）
:0040C7DB 8B06                   mov eax, dword ptr [esi]
:0040C7DD 50                     push eax
:0040C7DE 8B44243C               mov eax, dword ptr [esp+3C]
:0040C7E2 50                     push eax
:0040C7E3 E859320100             call 0041FA41         （这里开始比较，不等就未注册了）
:0040C7E8 83C430                 add esp, 00000030
:0040C7EB 85C0                   test eax, eax
:0040C7ED 753E                   jne 0040C82D
:0040C7EF 8B8C246C080000         mov ecx, dword ptr [esp+0000086C]
有空再写注册机吧。

文章评论

查看所有0条评论>>

热门文章 去除winrar注册框方法