Shine PSP Video Converter 4.00.817的算法分析与Keygen
Shine PSP Video Converter是一款优秀的视频转换软件，帮助你转换你喜爱的影片格式，如AVI, MPEG, WMV, DivX, MOV, RM, VCD, 3GP……软件的下载地址见:http://www.newhua.com/soft/77822.htm
一组可用的注册码:
你的用户名是:VS88T6-Vs86
你的注册码是:134202116
004C8ADC |.68 04010000 push 104 ; /BufSize = 104 (260.)
004C8AE1 |.8D85 F7FEFFFF lea eax,dword ptr ss: ; |
004C8AE7 |.50 push eax ; |Buffer
004C8AE8 |.E8 0FE4F3FF call <jmp.&kernel32.GetSystemDirecto>; \GetSystemDirectoryA
004C8AED |.8D45 FC lea eax,dword ptr ss: ;获取系统路径
004C8AF0 |.8D95 F7FEFFFF lea edx,dword ptr ss:
004C8AF6 |.B9 05010000 mov ecx,105
004C8AFB |.E8 E8BEF3FF call PSP_Vide.004049E8
004C8B00 |.8D45 FC lea eax,dword ptr ss:
004C8B03 |.BA FC8B4C00 mov edx,PSP_Vide.004C8BFC ;ASCII "\softinfo.dat"
004C8B08 |.E8 33BFF3FF call PSP_Vide.00404A40
004C8B0D |.8B45 FC mov eax,dword ptr ss:
004C8B10 |.E8 6F09F4FF call PSP_Vide.00409484 ;在系统下查找softinfo.dat文件
004C8B15 |.84C0 test al,al
004C8B17 |.74 18 je short PSP_Vide.004C8B31 ;没有找到则弹出提示窗口
004A549F |> /8B45 F8 /mov eax,dword ptr ss:
004A54A2 |. |8B16 |mov edx,dword ptr ds:
004A54A4 |. |E8 DBF6F5FF |call PSP_Vide.00404B84 ;比较用户名,只能是ESI指向的字符串数组中的一个
004A54A9 |. |75 09 |jnz short PSP_Vide.004A54B4 ;否则提示错误
004A54AB |. |C605 C44D4D00 00 |mov byte ptr ds:,0
004A54B2 |. |EB 06 |jmp short PSP_Vide.004A54BA
004A54B4 |> |83C6 04 |add esi,4
004A54B7 |. |4B |dec ebx
004A54B8 |.^\75 E5 \jnz short PSP_Vide.004A549F
004A54BA |>803D C44D4D00 00 cmp byte ptr ds:,0
004A54C1 |.74 1A je short PSP_Vide.004A54DD
004A54C3 |.6A 00 push 0 ; /Arg1 = 00000000
004A54C5 |.66:8B0D B0564A00 mov cx,word ptr ds: ; |
004A54CC |.B2 02 mov dl,2 ; |
004A54CE |.B8 BC564A00 mov eax,PSP_Vide.004A56BC ; |ASCII "Invalid register code! Please retry!"
004A54D3 |.E8 0410F9FF call PSP_Vide.004364DC ; \PSP_Vide.004364DC
004A54D8 |.E9 85010000 jmp PSP_Vide.004A5662
Esi指向的数据摘录如下:
004D29F8004A4B50ASCII "VS88T6-Vs86"
004D29FC004A4B64ASCII "TV66P6-TV66"
004D2A00004A4B78ASCII "S1R6P6-SV66"
004D2A04004A4B8CASCII "TDR6p6-SV66"
004D2A08004A4BA0ASCII "TDR6p6-EVS"
004D2A0C004A4BB4ASCII "TDR6p6-ST1"
004D2A10004A4BC8ASCII "Tsf6p6-VB1"
004D2A14004A4BDCASCII "B8sf6p6-VB1"
004D2A18004A4BF0ASCII "B8TDf6p6-VB1"
004D2A1C004A4C08ASCII "BS45f6p6-VB1"
004D2A20004A4C20ASCII "Osrf6p6-VB1"
004D2A24004A4C34ASCII "Ofrg6p6-VB1"
004D2A28004A4C48ASCII "ESrg6p6-VB1"
004D2A2C004A4C5CASCII "IUrg6p6-VB1"
004D2A30004A4C70ASCII "IUDT6-BX1"
004D2A34004A4C84ASCII "DUIT6-tV1"
004D2A38004A4C98ASCII "S1IT6-DV1"
004D2A3C004A4CACASCII "SNMS6-DV1"
004D2A40004A4CC0ASCII "SNWS6-TN1"
004D2A44004A4CD4ASCII "SNWS6-MN3"
004D2A48004A4CE8ASCII "TDVS6-MN3"
004A5534 |> /8B4D F4 /mov ecx,dword ptr ss:
004A5537 |. |0FB64C11 FF |movzx ecx,byte ptr ds:
004A553C |. |83F9 30 |cmp ecx,30
004A553F |. |7C 05 |jl short PSP_Vide.004A5546
004A5541 |. |83F9 39 |cmp ecx,39
004A5544 |. |7E 1A |jle short PSP_Vide.004A5560
004A5546 |> |6A 00 |push 0 ; /Arg1 = 00000000
004A5548 |. |66:8B0D B0564A00 |mov cx,word ptr ds: ; |
004A554F |. |B2 02 |mov dl,2 ; |
004A5551 |. |B8 BC564A00 |mov eax,PSP_Vide.004A56BC ; |ASCII "Invalid register code! Please retry!"
004A5556 |. |E8 810FF9FF |call PSP_Vide.004364DC ; \PSP_Vide.004364DC
004A555B |. |E9 02010000 |jmp PSP_Vide.004A5662
004A5560 |> |42 |inc edx
004A5561 |. |48 |dec eax
004A5562 |.^\75 D0 \jnz short PSP_Vide.004A5534 ;按位比较注册码,必须是9>=RegCode>=0
004A5564 |>33F6 xor esi,esi ;即,必须是数字
004A5577 |> /8B55 F8 /mov edx,dword ptr ss:
004A557A |. |0FB6541A FF |movzx edx,byte ptr ds:
004A557F |. |03F2 |add esi,edx
004A5581 |. |43 |inc ebx
004A5582 |. |48 |dec eax
004A5583 |.^\75 F2 \jnz short PSP_Vide.004A5577 ;求用户名ASCII值的累加和,并保存到ESI,记为nSumName
004A559C |.E8 DBF7F5FF call PSP_Vide.00404D7C
004A55A1 |.85C0 test eax,eax
004A55A3 |.75 27 jnz short PSP_Vide.004A55CC
004A55A5 |.8B15 A0314D00 mov edx,dword ptr ds: ;PSP_Vide.004D4E70
004A55AB |.8B12 mov edx,dword ptr ds:
004A55AD |.8B45 FC mov eax,dword ptr ss:
004A55B0 |.E8 3FF7FFFF call PSP_Vide.004A4CF4 ;返回值EAX
004A55B5 |.8B0485 AC2A4D00 mov eax,dword ptr ds:;以EAX为索引,从4D2AAC指向的数组里取值
;(*4,是因为整数里的元素是4字节长)
004A55BC |.F7EE imul esi ;然后*nSumName
004A55BE |.83C0 20 add eax,20 ;+0x20
004A55C1 |.D1F8 sar eax,1 ;>>1
004A55C3 |.79 03 jns short PSP_Vide.004A55C8
004A55C5 |.83D0 00 adc eax,0
004A55C8 |>8BF0 mov esi,eax ;保存结果到ESI
004A55CA |.EB 25 jmp short PSP_Vide.004A55F1
004A55CC |>8B15 A0314D00 mov edx,dword ptr ds: ;PSP_Vide.004D4E70
004A55D2 |.8B12 mov edx,dword ptr ds:
004A55D4 |.8B45 FC mov eax,dword ptr ss:
004A55D7 |.E8 18F7FFFF call PSP_Vide.004A4CF4
004A55DC |.8B0485 482A4D00 mov eax,dword ptr ds:
004A55E3 |.F7EE imul esi
004A55E5 |.83C0 20 add eax,20
004A55E8 |.D1F8 sar eax,1
004A55EA |.79 03 jns short PSP_Vide.004A55EF
004A55EC |.83D0 00 adc eax,0
004A55EF |>8BF0 mov esi,eax
004A55F1 |>8B45 F4 mov eax,dword ptr ss:
004A55F4 |.E8 7B3AF6FF call PSP_Vide.00409074
004A55F9 |.3BF0 cmp esi,eax
004A55FB |.75 50 jnz short PSP_Vide.004A564D
这里有两种计算方式,其区别仅在于数组的起始地址不同:
1\一个是从4D2A48开始
2\一个是从4D2AAC开始
其判断依据是主程序名里,是否含有"eztoo"字符串,有则从4D2A48开始索引
完整的数组如下:
//004D2A48004A4CE8ASCII "TDVS6-MN3"
004D2A4C000DB0D2
004D2A50000549AF
004D2A54000F0188
004D2A58000D6CCF
004D2A5C000EDDF4
004D2A600003BF80
004D2A64000715C6
004D2A68000DA20D
004D2A6C000548D4
004D2A70000548D4
004D2A74000548D4
004D2A780006994F
004D2A7C000544ED
004D2A80000B7F7E
004D2A8400040886
004D2A8800069A21
004D2A8C0006C380
004D2A9000058AEE
004D2A94000B8442
004D2A98000D0D8A
004D2A9C00074129
004D2AA000041A91
004D2AA4000A857C
004D2AA80003987B
004D2AAC000D349B
004D2AB0000DB0D6
004D2AB4000549B4
004D2AB8000F018E
004D2ABC000D6CD4
004D2AC0000EDDF8
004D2AC40003BF86
004D2AC8000715C8
004D2ACC000DA212
004D2AD0000548D8
004D2AD4000548D8
004D2AD8000548D8
004D2ADC00069954
004D2AE0000544F0
004D2AE4000B7F82
004D2AE800040888
004D2AEC00069A26
004D2AF00006C384
004D2AF400058AF0
004D2AF8000B8446
004D2AFC000D0D8E
004D2B000007412E
004D2B0400041A94
004D2B08000A8582
004D2B0C00039880
004D2B10000D349E
接上篇,(汗,太长了,结果不能显示了,只好分2篇):
索引的取值,从下面的函数中,很容易看出:
004A4CF4 /$55 push ebp
004A4CF5 |.8BEC mov ebp,esp
004A4CF7 |.B9 12000000 mov ecx,12
004A4CFC |>6A 00 /push 0
004A4CFE |.6A 00 |push 0
004A4D00 |.49 |dec ecx
004A4D01 |.^ 75 F9 \jnz short Video_Co.004A4CFC
004A4D03 |.51 push ecx
004A4D04 |.53 push ebx
004A4D05 |.56 push esi
004A4D06 |.8955 FC mov dword ptr ss:,edx
004A4D09 |.8B45 FC mov eax,dword ptr ss:
004A4D0C |.E8 17FFF5FF call Video_Co.00404C28
004A4D11 |.33C0 xor eax,eax
004A4D13 |.55 push ebp
004A4D14 |.68 69524A00 push Video_Co.004A5269
004A4D19 |.64:FF30 push dword ptr fs:
004A4D1C |.64:8920 mov dword ptr fs:,esp
004A4D1F |.8D55 F8 lea edx,dword ptr ss:
004A4D22 |.8B45 FC mov eax,dword ptr ss:
004A4D25 |.E8 923EF6FF call Video_Co.00408BBC
004A4D2A |.8B55 F8 mov edx,dword ptr ss:
004A4D2D |.B8 80524A00 mov eax,Video_Co.004A5280 ;ASCII "dvd to avi"
004A4D3B |.74 0A je short Video_Co.004A4D47 ;判断,主程序里含有"dvd to avi"
004A4D3D |.BE 0E000000 mov esi,0E ;则返回0xE
004A4D55 |.B8 94524A00 mov eax,Video_Co.004A5294 ;ASCII "rm"
004A4D6F |.B8 A0524A00 mov eax,Video_Co.004A52A0 ;ASCII "video"
004A4D81 |.BE 02000000 mov esi,2
004A4D99 |.B8 B0524A00 mov eax,Video_Co.004A52B0 ;ASCII "mp4"
004A4DB3 |.B8 A0524A00 mov eax,Video_Co.004A52A0 ;ASCII "video"
004A4DC5 |.BE 03000000 mov esi,3
004A4DDD |.B8 A0524A00 mov eax,Video_Co.004A52A0 ;ASCII "video"
004A4DF7 |.B8 BC524A00 mov eax,Video_Co.004A52BC ;ASCII "avi"
004A4E09 |.BE 04000000 mov esi,4
004A4E21 |.B8 C8524A00 mov eax,Video_Co.004A52C8 ;ASCII "gphone"
004A4E3B |.B8 A0524A00 mov eax,Video_Co.004A52A0 ;ASCII "video"
004A4E4D |.BE 05000000 mov esi,5
004A4E65 |.B8 A0524A00 mov eax,Video_Co.004A52A0 ;ASCII "video"
004A4E7F |.B8 D8524A00 mov eax,Video_Co.004A52D8 ;ASCII "wmv"
004A4E91 |.BE 06000000 mov esi,6
004A4EA9 |.B8 E4524A00 mov eax,Video_Co.004A52E4 ;ASCII "flv"
004A4EC3 |.B8 A0524A00 mov eax,Video_Co.004A52A0 ;ASCII "video"
004A4ED5 |.BE 07000000 mov esi,7
004A4EED |.B8 A0524A00 mov eax,Video_Co.004A52A0 ;ASCII "video"
004A4F07 |.B8 F0524A00 mov eax,Video_Co.004A52F0 ;ASCII "ipod"
004A4F19 |.BE 08000000 mov esi,8
004A4F31 |.B8 A0524A00 mov eax,Video_Co.004A52A0 ;ASCII "video"
004A4F4B |.B8 00534A00 mov eax,Video_Co.004A5300 ;ASCII "iphone"
004A4F5D |.BE 09000000 mov esi,9
004A4F75 |.B8 10534A00 mov eax,Video_Co.004A5310 ;ASCII "mpeg"
004A4F8F |.B8 A0524A00 mov eax,Video_Co.004A52A0 ;ASCII "video"
004A4FA1 |.BE 0A000000 mov esi,0A
004A4FB9 |.B8 20534A00 mov eax,Video_Co.004A5320 ;ASCII "psp"
004A4FD3 |.B8 A0524A00 mov eax,Video_Co.004A52A0 ;ASCII "video"
004A4FE5 |.BE 0B000000 mov esi,0B
004A4FFD |.B8 2C534A00 mov eax,Video_Co.004A532C ;ASCII "mkv"
004A5017 |.B8 A0524A00 mov eax,Video_Co.004A52A0 ;ASCII "video"
004A5029 |.BE 0C000000 mov esi,0C
004A5041 |.B8 38534A00 mov eax,Video_Co.004A5338 ;ASCII "dvd ripper"
004A5051 |.BE 0D000000 mov esi,0D
004A5069 |.B8 4C534A00 mov eax,Video_Co.004A534C ;ASCII "dvd to iphone"
004A5079 |.BE 0F000000 mov esi,0F
004A5091 |.B8 64534A00 mov eax,Video_Co.004A5364 ;ASCII "dvd to flv"
004A50A1 |.BE 10000000 mov esi,10
004A50B9 |.B8 78534A00 mov eax,Video_Co.004A5378 ;ASCII "dvd to 3gp"
004A50C9 |.BE 11000000 mov esi,11
004A50E1 |.B8 8C534A00 mov eax,Video_Co.004A538C ;ASCII "dvd to wmv"
004A50F1 |.BE 12000000 mov esi,12
004A5109 |.B8 A0534A00 mov eax,Video_Co.004A53A0 ;ASCII "dvd to mp3"
004A5119 |.BE 13000000 mov esi,13
004A5131 |.B8 B4534A00 mov eax,Video_Co.004A53B4 ;ASCII "dvd to mpeg"
004A5141 |.BE 14000000 mov esi,14
004A5159 |.B8 C8534A00 mov eax,Video_Co.004A53C8 ;ASCII "dvd to mp4"
004A5169 |.BE 15000000 mov esi,15
004A5187 |.B8 DC534A00 mov eax,Video_Co.004A53DC ;ASCII "dvd to psp"
004A5197 |.BE 16000000 mov esi,16
004A51B5 |.B8 F0534A00 mov eax,Video_Co.004A53F0 ;ASCII "dvd to zune"
004A51C5 |.BE 17000000 mov esi,17
004A51E0 |.B8 04544A00 mov eax,Video_Co.004A5404 ;ASCII "dvd to ipod"
004A51F0 |.BE 18000000 mov esi,18
004A520B |.B8 18544A00 mov eax,Video_Co.004A5418 ;ASCII "dvd to mkv"
004A521B |.BE 19000000 mov esi,19
004A5236 |.B8 2C544A00 mov eax,Video_Co.004A542C ;ASCII "video converter"
004A5246 |.BE 01000000 mov esi,1
004A5270 .8BC6 mov eax,esi
004A5272 .5E pop esi
004A5273 .5B pop ebx
004A5274 .8BE5 mov esp,ebp
004A5276 .5D pop ebp
004A5277 .C3 retn
注册机制比较简单,分析就到结束了,下面是我写的一个简单的注册机实现:
#include<stdio.h>
#include<iostream>
using namespace std;
int main(){
char strName[]="VS88T6-Vs86";
int nNameLen=strlen(strName);
int nSumName=0;
for(int i=0;i<=nNameLen;i++)
nSumName+=strName;
//提取的数组
int nNum[]={
0x000DB0D2,0x000549AF,0x000F0188,0x000D6CCF,0x000EDDF4,0x0003BF80,
0x000715C6,0x000DA20D,0x000548D4,0x000548D4,0x000548D4,0x0006994F,
0x000544ED,0x000B7F7E,0x00040886,0x00069A21,0x0006C380,0x00058AEE,
0x000B8442,0x000D0D8A,0x00074129,0x00041A91,0x000A857C,0x0003987B,
0x000D349B,0x000DB0D6,0x000549B4,0x000F018E,0x000D6CD4,0x000EDDF8,
0x0003BF86,0x000715C8,0x000DA212,0x000548D8,0x000548D8,0x000548D8,
0x00069954,0x000544F0,0x000B7F82,0x00040888,0x00069A26,0x0006C384,
0x00058AF0,0x000B8446,0x000D0D8E,0x0007412E,0x00041A94,0x000A8582,
0x00039880,0x000D349E};
//cout<<nNum<<endl;
cout<<"请自行判断主程序名中是否含有下列字符,并选择相应序号:\n\
1:\tvideo converter\t\t\t2:\trm和video\n\
3:\tmp4和video\t\t\t4:\tavi和video\n\
5:\tgphone和video\t\t\t6:\twma和video\n\
7:\tflv和video\t\t\t8:\tipod和video\n\
9:\tiphone和video\t\t\t10:\tmpeg和video\n\
11:\tpsp和video\t\t\t12:\tmkv和video\n\
13:\tdvd ripper\t\t\t14:\tdvd to avi\n\
15:\tdvd to iphone\t\t\t16:\tdvd to flv\n\
17:\tdvd to 3gp\t\t\t18:\tdvd to wmv\n\
19:\tdvd to mp3\t\t\t20:\tdvd to mpeg\n\
21:\tdvd to mp4\t\t\t22:\tdvd to psp\n\
23:\tdvd to zune\t\t\t24:\tdvd to ipod\n\
25:\tdvd to mkv\n\n";
cout<<"请输入你的主程序对应序号:";
int index;
cin>>index;
cout<<"请再次判断主程序名中是否含有 eztoo ??(输入0表示有,输入1表示没有)\n";
int nEztoo;
cin>>nEztoo;
if(nEztoo)
index+=24;
int nRet=nNum*nSumName;
nRet+=0x20;
nRet=nRet>>1;
cout<<"你的用户名是:"<<strName<<endl;
cout<<"你的注册码是:"<<nRet<<endl;
cout<<"-----------------------------\n按任意健退出\n";
getchar();
return 0;
}
请问楼主做 脱壳必须要学会C+吗？ 进来支持老鸦，看不懂C++ 学习写注册机:) 學習分析, 以及注冊机. 郁闷~不懂算法啊 看看老鸭的算法，嘿嘿 老鸦就是强！ 很长，不过还是看完了。不错。
花花送给大牛呢