您的位置：首页 → 精文荟萃 → 破解文章 → 统护卫1.0注册算法分析

统护卫1.0注册算法分析

时间：2004/10/15 0:55:00来源：本站整理作者：蓝点我要评论(0)

　破解工具:dede3.10,trw2000v1.22
破解日期:2002.7.2
得到注册申请码的分析:
* Reference to control NameEdit : TEdit
|
00473DF8   8B8308040000           mov     eax, [ebx+$0408]

* Reference to: controls.TControl.GetText(TControl):System.String;
|
00473DFE   E8D988FBFF             call    0042C6DC
00473E03   8B45EC                 mov     eax, [ebp-$14]
00473E06   8A00                   mov     al, byte ptr [eax]
00473E08   04D0                   add     al, -$30
00473E0A   2C0A                   sub     al, $0A
00473E0C   7316                   jnb     00473E24

* Possible String Reference to: '请输入您的姓名！'
|
00473E0E   B9F83F4700             mov     ecx, $00473FF8
00473E13   B201                   mov     dl, $01
00473E15   A16C774000             mov     eax, dword ptr [$0040776C]

* Reference to: axctrls.TOleStream.Create(TOleStream;boolean;ActiveX.IStream);
|           or: inifiles.TCustomIniFile.Create(TCustomIniFile;boolean;System.AnsiString);
|           or: sysutils.Exception.Create(Exception;boolean;System.AnsiString);
|
00473E1A   E8A977F9FF             call    0040B5C8

* Reference to: system.@RaiseExcept;
|
00473E1F   E888F7F8FF             call    004035AC
00473E24   8D55E8                 lea     edx, [ebp-$18]

* Reference to control NameEdit : TEdit
|
00473E27   8B8308040000           mov     eax, [ebx+$0408]

* Reference to: controls.TControl.GetText(TControl):System.String;
|
00473E2D   E8AA88FBFF             call    0042C6DC
00473E32   8B45E8                 mov     eax, [ebp-$18]
00473E35   8A10                   mov     dl, byte ptr [eax]
00473E37   8D45F4                 lea     eax, [ebp-$0C]

* Reference to: system.@LStrFromChar(String;Char);
|           or: system.@LStrFromWChar(String;WideChar);
|           or: system.@WStrFromChar(WideString;Char);
|           or: system.@WStrFromWChar(WideString;WideChar);
|
00473E3A   E845FEF8FF             call    00403C84
00473E3F   8B45F4                 mov     eax, [ebp-$0C]-------->eax=注册名
00473E42   8A00                   mov     al, byte ptr [eax]----->注册名的第一位asc到al
00473E44   25FF000000             and     eax, $000000FF----->清除高位
00473E49   33D2                   xor     edx, edx
00473E4B   52                     push    edx
00473E4C   50                     push    eax------>压栈
00473E4D   8B8350040000           mov     eax, [ebx+$0450]------>常数183f9ff
00473E53   8B9354040000           mov     edx, [ebx+$0454]
00473E59   038358040000           add     eax, [ebx+$0458]----->常数183f9ff+c盘的序列号
00473E5F   13935C040000           adc     edx, [ebx+$045C]
00473E65   2DDF493400             sub     eax, $003449DF---->(常数183f9ff+c盘的序列号)-3449df
00473E6A   83DA00                 sbb     edx, +$00
00473E6D   030424                 add     eax, [esp]---->(常数183f9ff+c盘的序列号-3449df)+注册名的第一位asc是注册申请码.
00473E70   13542404               adc     edx, [esp+$04]
00473E74   83C408                 add     esp, +$08
00473E77   52                     push    edx
00473E78   50                     push    eax
00473E79   8D45F8                 lea     eax, [ebp-$08]

* Reference to: sysutils.IntToStr(System.Int64):System.AnsiString;overload;
|
00473E7C   E82B48F9FF             call    004086AC---->变成整数字符串
00473E81   6A40                   push    $40
00473E83   8D55E4                 lea     edx, [ebp-$1C]
00473E86   A120604700             mov     eax, dword ptr [$00476020]
00473E8B   8B00                   mov     eax, [eax]

* Reference to: forms.TApplication.GetTitle(TApplication):System.AnsiString;
|
00473E8D   E86E64FDFF             call    0044A300
00473E92   8B45E4                 mov     eax, [ebp-$1C]

* Reference to: system.@LStrToPChar;
|
00473E95   E88600F9FF             call    00403F20
00473E9A   50                     push    eax

* Possible String Reference to: '您好　'
|
00473E9B   6814404700             push    $00474014
00473EA0   8D55DC                 lea     edx, [ebp-$24]

* Reference to control NameEdit : TEdit
|
00473EA3   8B8308040000           mov     eax, [ebx+$0408]

* Reference to: controls.TControl.GetText(TControl):System.String;
|
00473EA9   E82E88FBFF             call    0042C6DC
00473EAE   FF75DC                 push    dword ptr [ebp-$24]
00473EB1   6824404700             push    $00474024
00473EB6   6830404700             push    $00474030
00473EBB   6830404700             push    $00474030

* Possible String Reference to: '谢谢您使用《系统护卫》'
|
00473EC0   683C404700             push    $0047403C
00473EC5   6830404700             push    $00474030
00473ECA   6830404700             push    $00474030

* Possible String Reference to: '您的注册申请码是：'
|
00473ECF   685C404700             push    $0047405C
00473ED4   FF75F8                 push    dword ptr [ebp-$08]
00473ED7   8D45E0                 lea     eax, [ebp-$20]
00473EDA   BA0A000000             mov     edx, $0000000A


得到认证码的分析:

　

004739C2   8B45D4                 mov     eax, [ebp-$2C]
004739C5   85C0                   test    eax, eax
004739C7   7E16                   jle     004739DF
004739C9   BE01000000             mov     esi, $00000001--------->第一段算法
004739CE   8B55E0                 mov     edx, [ebp-$20]----->常数359264856
004739D1   8A5432FF               mov     dl, byte ptr [edx+esi-$01]取1位
004739D5   8B4DD8                 mov     ecx, [ebp-$28]----->常数183f9ff+c盘的序列号
004739D8   301419                 xor     [ecx+ebx], dl----->((常数183f9ff+c盘的序列号)取1位的asc)xor常数359264856取1位的asc

004739DB   46                     inc     esi
004739DC   48                     dec     eax
004739DD   75EF                   jnz     004739CE
004739DF   43                     inc     ebx
004739E0   83FB09                 cmp     ebx, +$09--->考察计数器是否为9
004739E3   75DD                   jnz     004739C2--------->第一段算法
004739E5   8B45E4                 mov     eax, [ebp-$1C]----->ecx中是结果设为m.

* Reference to: system.@LStrLen:Integer;
|           or: system.@DynArrayLength;
|           or: system.DynArraySize(Pointer):Integer;
|
004739E8   E86F03F9FF             call    00403D5C
004739ED   D1F8                   sar     eax, 1
004739EF   7903                   jns     004739F4
004739F1   83D000                 adc     eax, +$00
004739F4   03C0                   add     eax, eax
004739F6   8945D4                 mov     [ebp-$2C], eax
004739F9   33DB                   xor     ebx, ebx
004739FB   8B45D4                 mov     eax, [ebp-$2C]---->第二段算法同第一段算法
004739FE   85C0                   test    eax, eax
00473A00   7E16                   jle     00473A18
00473A02   BE01000000             mov     esi, $00000001
00473A07   8B55E4                 mov     edx, [ebp-$1C]------->申请号
00473A0A   8A5432FF               mov     dl, byte ptr [edx+esi-$01]
00473A0E   8B4DD8                 mov     ecx, [ebp-$28]----->第一段算法的结果m
00473A11   301419                 xor     [ecx+ebx], dl
00473A14   46                     inc     esi
00473A15   48                     dec     eax
00473A16   75EF                   jnz     00473A07
00473A18   43                     inc     ebx
00473A19   83FB09                 cmp     ebx, +$09
00473A1C   75DD                   jnz     004739FB--------->第二段算法
00473A1E   BE01000000             mov     esi, $00000001-->ecx为真认证码
00473A23   33DB                   xor     ebx, ebx
00473A25   8B45D8                 mov     eax, [ebp-$28]
00473A28   8A0418                 mov     al, byte ptr [eax+ebx]
00473A2B   04DF                   add     al, -$21
00473A2D   2C5E                   sub     al, $5E
00473A2F   7312                   jnb     00473A43
00473A31   8D45F0                 lea     eax, [ebp-$10]

* Reference to: system.UniqueString(String);
|
00473A34   E8F304F9FF             call    00403F2C
00473A39   8B55D8                 mov     edx, [ebp-$28]
00473A3C   8A141A                 mov     dl, byte ptr [edx+ebx]
00473A3F   885430FF               mov     [eax+esi-$01], dl
00473A43   46                     inc     esi
00473A44   43                     inc     ebx
00473A45   83FB09                 cmp     ebx, +$09
00473A48   75DB                   jnz     00473A25
00473A4A   8D45DC                 lea     eax, [ebp-$24]
00473A4D   50                     push    eax
00473A4E   8D55A0                 lea     edx, [ebp-$60]
00473A51   8B45FC                 mov     eax, [ebp-$04]

* Reference to control RegistryEdit1 : TEdit
|
00473A54   8B8010040000           mov     eax, [eax+$0410]

* Reference to: controls.TControl.GetText(TControl):System.String;
|
00473A5A   E87D8CFBFF             call    0042C6DC
00473A5F   8B45A0                 mov     eax, [ebp-$60]
00473A62   B903000000             mov     ecx, $00000003
00473A67   BA01000000             mov     edx, $00000001

* Reference to: system.@LStrCopy;
|
00473A6C   E8F304F9FF             call    00403F64
00473A71   8D559C                 lea     edx, [ebp-$64]
00473A74   8B45FC                 mov     eax, [ebp-$04]

* Reference to control RegistryEdit2 : TEdit
|
00473A77   8B8014040000           mov     eax, [eax+$0414]

* Reference to: controls.TControl.GetText(TControl):System.String;
|
00473A7D   E85A8CFBFF             call    0042C6DC
00473A82   8B559C                 mov     edx, [ebp-$64]
00473A85   8D45DC                 lea     eax, [ebp-$24]

* Reference to: system.@LStrCat;
|
00473A88   E8D702F9FF             call    00403D64
00473A8D   8B45DC                 mov     eax, [ebp-$24]---->假认证码
00473A90   8B55F0                 mov     edx, [ebp-$10]----->真认证码

* Reference to: system.@LStrCmp;
|
00473A93   E8D403F9FF             call    00403E6C
00473A98   7462                   jz      00473AFC
00473A9A   6A10                   push    $10
00473A9C   8D5598                 lea     edx, [ebp-$68]
00473A9F   A120604700             mov     eax, dword ptr [$00476020]
00473AA4   8B00                   mov     eax, [eax]

* Reference to: forms.TApplication.GetTitle(TApplication):System.AnsiString;
|
00473AA6   E85568FDFF             call    0044A300
00473AAB   8B4598                 mov     eax, [ebp-$68]

* Reference to: system.@LStrToPChar;
|
00473AAE   E86D04F9FF             call    00403F20
00473AB3   50                     push    eax

* Possible String Reference to: '输入的认证码无效！'
|
00473AB4   68203D4700             push    $00473D20
00473AB9   8B45FC                 mov     eax, [ebp-$04]

* Reference to: controls.TWinControl.GetHandle(TWinControl):Windows.HWND;
|
00473ABC   E8F3ECFBFF             call    004327B4
00473AC1   50                     push    eax

|
00473AC2   E87535F9FF             call    0040703C
00473AC7   8D45D8                 lea     eax, [ebp-$28]
00473ACA   8B159C374700           mov     edx, [$0047379C]

* Reference to: system.@DynArrayClear(Pointer;Pointer);
|
00473AD0   E83319F9FF             call    00405408
00473AD5   8B45FC                 mov     eax, [ebp-$04]

* Reference to control TabSheet1 : TTabSheet
|
00473AD8   8B904C030000           mov     edx, [eax+$034C]
00473ADE   8B45FC                 mov     eax, [ebp-$04]

* Reference to control PageControl1 : TPageControl
|
00473AE1   8B8048030000           mov     eax, [eax+$0348]

* Reference to: comctrls.TPageControl.SetActivePage(TPageControl;TTabSheet);
|
00473AE7   E80830FEFF             call    00456AF4
00473AEC   8B55F8                 mov     edx, [ebp-$08]
00473AEF   8B45FC                 mov     eax, [ebp-$04]

* Reference to : TMainform.PageControl1Change()
|
00473AF2   E879CEFFFF             call    00470970
00473AF7   E943010000             jmp     00473C3F
00473AFC   8D45F0                 lea     eax, [ebp-$10]

* Reference to: system.@LStrClr(String);
|
00473AFF   E8D8FFF8FF             call    00403ADC
00473B04   8D45F0                 lea     eax, [ebp-$10]
00473B07   BA09000000             mov     edx, $00000009

* Reference to: system.@LStrSetLength;
|
00473B0C   E87F05F9FF             call    00404090
00473B11   BE01000000             mov     esi, $00000001
00473B16   33DB                   xor     ebx, ebx
00473B18   8B45D8                 mov     eax, [ebp-$28]
00473B1B   8A0418                 mov     al, byte ptr [eax+ebx]
00473B1E   04DF                   add     al, -$21
00473B20   2C5E                   sub     al, $5E
00473B22   7312                   jnb     00473B36
00473B24   8D45F0                 lea     eax, [ebp-$10]

* Reference to: system.UniqueString(String);
|
00473B27   E80004F9FF             call    00403F2C
00473B2C   8B55D8                 mov     edx, [ebp-$28]
00473B2F   8A141A                 mov     dl, byte ptr [edx+ebx]
00473B32   885430FF               mov     [eax+esi-$01], dl
00473B36   46                     inc     esi
00473B37   43                     inc     ebx
00473B38   83FB09                 cmp     ebx, +$09
00473B3B   75DB                   jnz     00473B18
00473B3D   8D45D8                 lea     eax, [ebp-$28]
00473B40   8B159C374700           mov     edx, [$0047379C]

* Reference to: system.@DynArrayClear(Pointer;Pointer);
|
00473B46   E8BD18F9FF             call    00405408
00473B4B   C645C048               mov     byte ptr [ebp-$40], $48
00473B4F   C645C143               mov     byte ptr [ebp-$3F], $43
00473B53   C645C248               mov     byte ptr [ebp-$3E], $48
00473B57   8D55EC                 lea     edx, [ebp-$14]
00473B5A   8B45FC                 mov     eax, [ebp-$04]

* Reference to control ApplyEdit : TEdit
|
00473B5D   8B800C040000           mov     eax, [eax+$040C]

* Reference to: controls.TControl.GetText(TControl):System.String;
|
00473B63   E8748BFBFF             call    0042C6DC
00473B68   8D45E8                 lea     eax, [ebp-$18]
00473B6B   8B55F0                 mov     edx, [ebp-$10]

* Reference to: system.@LStrLAsg;
|
00473B6E   E80100F9FF             call    00403B74
00473B73   BB04000000             mov     ebx, $00000004
00473B78   8D45C3                 lea     eax, [ebp-$3D]
00473B7B   8B55EC                 mov     edx, [ebp-$14]
00473B7E   8A541AFC               mov     dl, byte ptr [edx+ebx-$04]
00473B82   80F258                 xor     dl, $58
00473B85   8810                   mov     [eax], dl
00473B87   43                     inc     ebx
00473B88   40                     inc     eax
00473B89   83FB0C                 cmp     ebx, +$0C
00473B8C   75ED                   jnz     00473B7B
00473B8E   BB0C000000             mov     ebx, $0000000C
00473B93   8D45CB                 lea     eax, [ebp-$35]
00473B96   8B55E8                 mov     edx, [ebp-$18]
00473B99   8A541AF4               mov     dl, byte ptr [edx+ebx-$0C]
00473B9D   80F258                 xor     dl, $58
00473BA0   8810                   mov     [eax], dl
00473BA2   43                     inc     ebx
00473BA3   40                     inc     eax
00473BA4   83FB15                 cmp     ebx, +$15
00473BA7   75ED                   jnz     00473B96
00473BA9   B201                   mov     dl, $01
00473BAB   A1DCCF4600             mov     eax, dword ptr [$0046CFDC]

|
00473BB0   E82795FFFF             call    0046D0DC
00473BB5   8945F4                 mov     [ebp-$0C], eax
00473BB8   33C0                   xor     eax, eax
00473BBA   55                     push    ebp

* Possible String Reference to: '閉�腓j@hl=G'
|
00473BBB   68123C4700             push    $00473C12

***** TRY
|
00473BC0   64FF30                 push    dword ptr fs:[eax]
00473BC3   648920                 mov     fs:[eax], esp
00473BC6   BA01000080             mov     edx, $80000001
00473BCB   8B45F4                 mov     eax, [ebp-$0C]

* Reference to: registry.TRegistry.SetRootKey(TRegistry;Windows.HKEY);
|
00473BCE   E8A995FFFF             call    0046D17C
00473BD3   B101                   mov     cl, $01

* Possible String Reference to: 'SOFTWARE\系统护卫\2.0.0.0'
|
00473BD5   BA3C3D4700             mov     edx, $00473D3C
00473BDA   8B45F4                 mov     eax, [ebp-$0C]

* Reference to: registry.TRegistry.OpenKey(TRegistry;System.AnsiString;System.Boolean):System.Boolean;
|
00473BDD   E8FE95FFFF             call    0046D1E0
00473BE2   6A14                   push    $14
00473BE4   8D4DC0                 lea     ecx, [ebp-$40]

* Possible String Reference to: 'Registry'
|
00473BE7   BA603D4700             mov     edx, $00473D60
00473BEC   8B45F4                 mov     eax, [ebp-$0C]

|
00473BEF   E87098FFFF             call    0046D464
00473BF4   33C0                   xor     eax, eax
00473BF6   5A                     pop     edx
00473BF7   59                     pop     ecx
00473BF8   59                     pop     ecx
00473BF9   648910                 mov     fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: 'j@hl=G'
|
00473BFC   68193C4700             push    $00473C19
00473C01   8B45F4                 mov     eax, [ebp-$0C]

* Reference to: registry.TRegistry.CloseKey(TRegistry);
|
00473C04   E84395FFFF             call    0046D14C
00473C09   8B45F4                 mov     eax, [ebp-$0C]

* Reference to: system.TObject.Free(TObject);
|
00473C0C   E803F2F8FF             call    00402E14
00473C11   C3                     ret

00473C12   E95DF9F8FF             jmp     00403574
00473C17   EBE8                   jmp     00473C01

****** END
|
00473C19   6A40                   push    $40

* Possible String Reference to: '系统护卫'
|
00473C1B   686C3D4700             push    $00473D6C

* Possible String Reference to: '注册成功！谢谢您注册《系统护卫》！?
|                                肽匦略诵小断低郴の馈罚?
|
00473C20   68783D4700             push    $00473D78
00473C25   8B45FC                 mov     eax, [ebp-$04]

* Reference to: controls.TWinControl.GetHandle(TWinControl):Windows.HWND;
|
00473C28   E887EBFBFF             call    004327B4
00473C2D   50                     push    eax

|
00473C2E   E80934F9FF             call    0040703C
00473C33   A120604700             mov     eax, dword ptr [$00476020]
00473C38   8B00                   mov     eax, [eax]

* Reference to: forms.TApplication.Terminate(TApplication);
|
00473C3A   E8516CFDFF             call    0044A890
00473C3F   33C0                   xor     eax, eax
00473C41   5A                     pop     edx
00473C42   59                     pop     ecx

以下是注册机的VB原码:
Private Sub Command1_Click()
Dim aa As Scripting.Drive
Dim bb As Scripting.FileSystemObject
Dim cc As Long
Set bb = New FileSystemObject
Set aa = bb.GetDrive("c:\")
If Len(Text4.Text) < 2 Then Exit Sub
'c盘序列号++ &H183F9FF
Text1.Text = aa.SerialNumber + &H183F9FF 'Hex(aa.SerialNumber) ' - aa.SerialNumber / 2 ^ 2
'注册申请号
Text2.Text = aa.SerialNumber + &H183F9FF - &H3449DF + Asc(Mid(Text4.Text, 1, 1))
Set bb = Nothing
For x = 1 To 9
v = Asc(Mid("359264856", x, 1))
For i = 1 To Len(Text2.Text)
v = v Xor Asc(Mid(Text2.Text, i, 1))
Next i
f = f + Chr(v)
Next x
'以上是第一段算法
For x = 1 To 9
v = Asc(Mid(f, x, 1))
For i = 1 To Len(Text1.Text)
v = v Xor Asc(Mid(Text1.Text, i, 1))
Next i
n = n + Chr(v)
Next x
'以上是第二段算法
Text3.Text = Mid(n, 1, 4)
Text5.Text = Mid(n, 5, 5)
End Sub

如果转载请保持完整.有错误请指教.谢谢
      fnila Cracked by 20002.7.2


　　　　
　　　　
　　　　　
　　　　
　　　　
　　　　　

相关阅读 Windows错误代码大全 Windows错误代码查询激活windows有什么用Mac QQ和Windows QQ聊天记录怎么合并 Mac QQ和Windows QQ聊天记录Windows 10自动更新怎么关闭 如何关闭Windows 10自动更新windows 10 rs4快速预览版17017下载错误问题Win10秋季创意者更新16291更新了什么 win10 16291更新内容windows10秋季创意者更新时间 windows10秋季创意者更新内容kb3150513补丁更新了什么 Windows 10补丁kb3150513是什么

文章评论
发表评论

热门文章 去除winrar注册框方法

最新文章 比特币病毒怎么破解 比去除winrar注册框方法 华为无线路由器HG522-C破解教程(附超级密码JEB格式文件京东电子书下载和阅读限制破解教UltraISO注册码全集(最新)通过Access破解MSSQL获得数据

人气排行 华为无线路由器HG522-C破解教程(附超级密码JEB格式文件京东电子书下载和阅读限制破解教UltraISO注册码全集(最新)qq相册密码破解方法去除winrar注册框方法(适应任何版本)怎么用手机破解收费游戏华为无线猫HG522破解如何给软件脱壳基础教程