DVD影碟制作专家 V4.0.1.258 简单算法分析
【文章标题】: DVD影碟制作专家 V4.0.1.258 简单算法分析【文章作者】: 蚊香
【作者邮箱】: xpi386com@163.com
【作者主页】: http://www.xpi386.com
【软件名称】: DVD影碟制作专家
【软件大小】: 17183 KB
【下载地址】: 自己搜索下载
【保护方式】: 注册码
【编写语言】: Delphi
【使用工具】: PEiD OllyDBG
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!刚刚刚刚刚刚接触简单算法 -_-
--------------------------------------------------------------------------------
【详细过程】
PEiD查壳，Borland Delphi 6.0 - 7.0
试注册（5组注册码，每组5位），提示“注册失败”
载入OD,F9运行,输入假码12345-67890-40001-13579-24680注册:
00AA337E55 pushebp ; 通过堆栈调用法定位到这里，下断开始分析
00AA337F68 A237AA00 push00AA37A2
00AA338464:FF30 pushdword ptr fs:
00AA338764:8920 mov dword ptr fs:, esp
00AA338A8D55 FC lea edx, dword ptr
00AA338D8B83 98030000mov eax, dword ptr
00AA3393E8 8028FFFF call00A95C18
00AA33988B45 FC mov eax, dword ptr
00AA339BE8 1821F5FF call009F54B8
00AA33A0E8 A76AF5FF call009F9E4C
00AA33A583F8 05 cmp eax, 5
00AA33A80F85 80000000jnz 00AA342E ; 检查是否5位..不是则挂，下面还有4处
00AA33AE8D55 F8 lea edx, dword ptr
00AA33B18B83 9C030000mov eax, dword ptr
00AA33B7E8 5C28FFFF call00A95C18
00AA33BC8B45 F8 mov eax, dword ptr
00AA33BFE8 F420F5FF call009F54B8
00AA33C4E8 836AF5FF call009F9E4C
00AA33C983F8 05 cmp eax, 5
00AA33CC75 60 jnz short 00AA342E
00AA33CE8D55 F4 lea edx, dword ptr
00AA33D18B83 A0030000mov eax, dword ptr
00AA33D7E8 3C28FFFF call00A95C18
00AA33DC8B45 F4 mov eax, dword ptr
00AA33DFE8 D420F5FF call009F54B8
00AA33E4E8 636AF5FF call009F9E4C
00AA33E983F8 05 cmp eax, 5
00AA33EC75 40 jnz short 00AA342E
00AA33EE8D55 F0 lea edx, dword ptr
00AA33F18B83 A4030000mov eax, dword ptr
00AA33F7E8 1C28FFFF call00A95C18
00AA33FC8B45 F0 mov eax, dword ptr
00AA33FFE8 B420F5FF call009F54B8
00AA3404E8 436AF5FF call009F9E4C
00AA340983F8 05 cmp eax, 5
00AA340C75 20 jnz short 00AA342E
00AA340E8D55 EC lea edx, dword ptr
00AA34118B83 A8030000mov eax, dword ptr
00AA3417E8 FC27FFFF call00A95C18
00AA341C8B45 EC mov eax, dword ptr
00AA341FE8 9420F5FF call009F54B8
00AA3424E8 236AF5FF call009F9E4C
00AA342983F8 05 cmp eax, 5
00AA342C74 2A je short 00AA3458 ; 每组是5位则从这里跳过下面这个失败处
00AA342E6A 40 push40 ; 以上有任一组不为5则跳到这里
00AA3430A1 2017AB00 mov eax, dword ptr
00AA3435E8 7E20F5FF call009F54B8
00AA343A50 pusheax
00AA343BA1 2817AB00 mov eax, dword ptr
00AA3440E8 7320F5FF call009F54B8
00AA344550 pusheax
00AA34468BC3 mov eax, ebx
00AA3448E8 332FFAFF call00A46380
00AA344D50 pusheax
00AA344EE8 454DF5FF call<jmp.&user32.MessageBoxA> ; 这里提示注册失败
00AA3453E9 0D030000 jmp 00AA3765
00AA34588D55 E8 lea edx, dword ptr
00AA345B8B83 A0030000mov eax, dword ptr
00AA3461E8 B227FFFF call00A95C18
00AA34668B45 E8 mov eax, dword ptr
00AA34698B15 1817AB00mov edx, dword ptr
00AA346FE8 901FF5FF call009F5404
00AA347474 2A je short 00AA34A0 ; 通过堆栈窗口可见，第三组必须是40001
00AA34766A 40 push40
00AA3478A1 2017AB00 mov eax, dword ptr
00AA347DE8 3620F5FF call009F54B8
00AA348250 pusheax
00AA3483A1 2817AB00 mov eax, dword ptr
00AA3488E8 2B20F5FF call009F54B8
00AA348D50 pusheax
00AA348E8BC3 mov eax, ebx
00AA3490E8 EB2EFAFF call00A46380
00AA349550 pusheax
00AA3496E8 FD4CF5FF call<jmp.&user32.MessageBoxA> ; 这里是注册失败
00AA349BE9 C5020000 jmp 00AA3765
00AA34A08D55 E4 lea edx, dword ptr
00AA34A38B83 98030000mov eax, dword ptr
00AA34A9E8 6A27FFFF call00A95C18
00AA34AE837D E4 00 cmp dword ptr , 0
00AA34B274 3C je short 00AA34F0
00AA34B48D55 E0 lea edx, dword ptr
00AA34B78B83 9C030000mov eax, dword ptr
00AA34BDE8 5627FFFF call00A95C18
00AA34C2837D E0 00 cmp dword ptr , 0
00AA34C674 28 je short 00AA34F0
00AA34C88D55 DC lea edx, dword ptr
00AA34CB8B83 A0030000mov eax, dword ptr
00AA34D1E8 4227FFFF call00A95C18
00AA34D6837D DC 00 cmp dword ptr , 0
00AA34DA74 14 je short 00AA34F0
00AA34DC8D55 D8 lea edx, dword ptr
00AA34DF8B83 A4030000mov eax, dword ptr
00AA34E5E8 2E27FFFF call00A95C18
00AA34EA837D D8 00 cmp dword ptr , 0
00AA34EE75 2A jnz short 00AA351A
00AA34F06A 40 push40
00AA34F2A1 2017AB00 mov eax, dword ptr
00AA34F7E8 BC1FF5FF call009F54B8
00AA34FC50 pusheax
00AA34FDA1 2817AB00 mov eax, dword ptr
00AA3502E8 B11FF5FF call009F54B8
00AA350750 pusheax
00AA35088BC3 mov eax, ebx
00AA350AE8 712EFAFF call00A46380
00AA350F50 pusheax
00AA3510E8 834CF5FF call<jmp.&user32.MessageBoxA>
00AA3515E9 4B020000 jmp 00AA3765
00AA351A8D45 D4 lea eax, dword ptr
00AA351DE8 BA5BFCFF call00A690DC
00AA35228B45 D4 mov eax, dword ptr
00AA352550 pusheax
00AA35268D55 D0 lea edx, dword ptr
00AA35298B83 A0030000mov eax, dword ptr
00AA352FE8 E426FFFF call00A95C18
00AA35348B55 D0 mov edx, dword ptr
00AA353758 pop eax
00AA3538E8 C71EF5FF call009F5404
00AA353D74 2A je short 00AA3569 ; 又出现第三组和40001比较
00AA353F6A 40 push40
00AA3541A1 2017AB00 mov eax, dword ptr
00AA3546E8 6D1FF5FF call009F54B8
00AA354B50 pusheax
00AA354CA1 2817AB00 mov eax, dword ptr
00AA3551E8 621FF5FF call009F54B8
00AA355650 pusheax
00AA35578BC3 mov eax, ebx
00AA3559E8 222EFAFF call00A46380
00AA355E50 pusheax
00AA355FE8 344CF5FF call<jmp.&user32.MessageBoxA>
00AA3564E9 FC010000 jmp 00AA3765
00AA35698D55 CC lea edx, dword ptr
00AA356C8B83 98030000mov eax, dword ptr
00AA3572E8 A126FFFF call00A95C18 ; 取第一组注册码
00AA35778B45 CC mov eax, dword ptr
00AA357AE8 0963F5FF call009F9888 ; 第一组注册码转16进制=3039
00AA357FE8 1862FCFF call00A6979C ; 里面有算法，F7进入
进入上面的00AA357F
00A6979A8BC0 mov eax, eax
00A6979C8BC8 mov ecx, eax
00A6979E8D81 9F860100lea eax, dword ptr ; EAX=3039 + 1869F = 1B6D8
00A697A4B9 03000000 mov ecx, 3 ; ECX=3
00A697A933D2 xor edx, edx
00A697ABF7F1 div ecx ; EAX=1B6D8 / 3 = 9248
00A697AD83C0 58 add eax, 58 ; EAX = 9248+58=92A0
00A697B0C3 retn
00AA35848BF0 mov esi, eax
00AA35868D55 C8 lea edx, dword ptr
00AA35898B83 9C030000mov eax, dword ptr
00AA358FE8 8426FFFF call00A95C18 ; 取第二组注册码
00AA35948B45 C8 mov eax, dword ptr
00AA3597E8 EC62F5FF call009F9888 ; 第二组注册码转16进制=10932
00AA359CE8 1362FCFF call00A697B4 ; 里面又有算法，F7进
进入上面的00AA359C
00A697B18D40 00 lea eax, dword ptr
00A697B48BC8 mov ecx, eax
00A697B68BC1 mov eax, ecx
00A697B8B9 09000000 mov ecx, 9 ; ECX=9
00A697BD33D2 xor edx, edx
00A697BFF7F1 div ecx ; EAX=10932/9=1D77
00A697C103C0 add eax, eax
00A697C303C0 add eax, eax
00A697C503C0 add eax, eax ; EAX=1D77*8=EBB8
00A697C750 pusheax
00A697C8B8 9E860100 mov eax, 1869E ; EAX=1869E
00A697CD5A pop edx
00A697CE2BC2 sub eax, edx ; EAX=1869E-EBB8=9AE6
00A697D0C3 retn
00AA35A18BF8 mov edi, eax
00AA35A38D55 C4 lea edx, dword ptr
00AA35A68B83 A4030000mov eax, dword ptr
00AA35ACE8 6726FFFF call00A95C18
00AA35B18B45 C4 mov eax, dword ptr
00AA35B4E8 CF62F5FF call009F9888 ; 第四组注册码转16进制=350B
00AA35B999 cdq ; 清空EDX
00AA35BA52 pushedx
00AA35BB50 pusheax
00AA35BC8BC6 mov eax, esi
00AA35BE33D2 xor edx, edx
00AA35C03B5424 04 cmp edx, dword ptr ; 比较350B和上面得到的92A0
00AA35C475 03 jnz short 00AA35C9
00AA35C63B0424 cmp eax, dword ptr
00AA35C95A pop edx
00AA35CA58 pop eax
00AA35CB0F85 94010000jnz 00AA3765 ; 不能跳
00AA35D18D55 C0 lea edx, dword ptr
00AA35D48B83 A8030000mov eax, dword ptr
00AA35DAE8 3926FFFF call00A95C18 ; ？？？？？？
00AA35DF8B45 C0 mov eax, dword ptr
00AA35E2E8 A162F5FF call009F9888 ; 第五组注册码转16进制=6068
00AA35E799 cdq
00AA35E852 pushedx
00AA35E950 pusheax
00AA35EA8BC7 mov eax, edi
00AA35EC33D2 xor edx, edx
00AA35EE3B5424 04 cmp edx, dword ptr ; 比较6068和上面得到的9AE6
00AA35F275 03 jnz short 00AA35F7
00AA35F43B0424 cmp eax, dword ptr
00AA35F75A pop edx
00AA35F858 pop eax
00AA35F90F85 66010000jnz 00AA3765
00AA35FF8D55 BC lea edx, dword ptr
00AA36028B83 98030000mov eax, dword ptr
00AA3608E8 0B26FFFF call00A95C18
00AA360D8B45 BC mov eax, dword ptr
00AA3610E8 7362F5FF call009F9888
00AA3615E8 BA61FCFF call00A697D4
00AA361A8D55 B8 lea edx, dword ptr
00AA361D8B83 98030000mov eax, dword ptr
00AA3623E8 F025FFFF call00A95C18
00AA36288B45 B8 mov eax, dword ptr
00AA362BE8 5862F5FF call009F9888
00AA3630E8 E36BFCFF call00A6A218
00AA36358D55 B4 lea edx, dword ptr
00AA36388B83 9C030000mov eax, dword ptr
00AA363EE8 D525FFFF call00A95C18
00AA36438B45 B4 mov eax, dword ptr
00AA3646E8 3D62F5FF call009F9888
00AA364BE8 4462FCFF call00A69894
00AA36508D55 B0 lea edx, dword ptr
00AA36538B83 9C030000mov eax, dword ptr
00AA3659E8 BA25FFFF call00A95C18
00AA365E8B45 B0 mov eax, dword ptr
00AA3661E8 2262F5FF call009F9888
00AA3666E8 256DFCFF call00A6A390
00AA366B8D55 AC lea edx, dword ptr
00AA366E8B83 A0030000mov eax, dword ptr
00AA3674E8 9F25FFFF call00A95C18
00AA36798B45 AC mov eax, dword ptr
00AA367CE8 0762F5FF call009F9888
00AA3681E8 CE62FCFF call00A69954
00AA36868D55 A8 lea edx, dword ptr
00AA36898B83 A0030000mov eax, dword ptr
00AA368FE8 8425FFFF call00A95C18
00AA36948B45 A8 mov eax, dword ptr
00AA3697E8 EC61F5FF call009F9888
00AA369CE8 7B6EFCFF call00A6A51C
00AA36A18D55 A4 lea edx, dword ptr
00AA36A48B83 A4030000mov eax, dword ptr
00AA36AAE8 6925FFFF call00A95C18
00AA36AF8B45 A4 mov eax, dword ptr
00AA36B2E8 D161F5FF call009F9888
00AA36B7E8 9063FCFF call00A69A4C
00AA36BC8D55 A0 lea edx, dword ptr
00AA36BF8B83 A4030000mov eax, dword ptr
00AA36C5E8 4E25FFFF call00A95C18
00AA36CA8B45 A0 mov eax, dword ptr
00AA36CDE8 B661F5FF call009F9888
00AA36D2E8 D16FFCFF call00A6A6A8
00AA36D78D55 9C lea edx, dword ptr
00AA36DA8B83 A8030000mov eax, dword ptr
00AA36E0E8 3325FFFF call00A95C18
00AA36E58B45 9C mov eax, dword ptr
00AA36E8E8 9B61F5FF call009F9888
00AA36EDE8 5264FCFF call00A69B44
00AA36F28D55 98 lea edx, dword ptr
00AA36F58B83 A8030000mov eax, dword ptr
00AA36FBE8 1825FFFF call00A95C18
00AA37008B45 98 mov eax, dword ptr
00AA3703E8 8061F5FF call009F9888
00AA3708E8 1371FCFF call00A6A820
00AA370D8D55 90 lea edx, dword ptr
00AA3710A1 34CFAA00 mov eax, dword ptr
00AA37158B00 mov eax, dword ptr
00AA3717E8 9087FBFF call00A5BEAC
00AA371C8B45 90 mov eax, dword ptr
00AA371F8D55 94 lea edx, dword ptr
00AA3722E8 9D65F5FF call009F9CC4
00AA37278B45 94 mov eax, dword ptr
00AA372AE8 1150FCFF call00A68740
00AA372F6A 40 push40
00AA3731A1 2017AB00 mov eax, dword ptr
00AA3736E8 7D1DF5FF call009F54B8
00AA373B50 pusheax
00AA373CA1 1C17AB00 mov eax, dword ptr
00AA3741E8 721DF5FF call009F54B8
00AA374650 pusheax
00AA37478BC3 mov eax, ebx
00AA3749E8 322CFAFF call00A46380
00AA374E50 pusheax
00AA374FE8 444AF5FF call<jmp.&user32.MessageBoxA>
00AA3754C705 1017AB00 0>mov dword ptr , 1
00AA375E8BC3 mov eax, ebx
00AA3760E8 A743FBFF call00A57B0C
00AA376533C0 xor eax, eax
00AA37675A pop edx
00AA376859 pop ecx
00AA376959 pop ecx
00AA376A64:8910 mov dword ptr fs:, edx
00AA376D68 A937AA00 push00AA37A9
00AA37728D45 90 lea eax, dword ptr
00AA3775BA 02000000 mov edx, 2
00AA377AE8 9918F5FF call009F5018
00AA377F8D45 98 lea eax, dword ptr
00AA3782BA 0F000000 mov edx, 0F
00AA3787E8 8C18F5FF call009F5018
00AA378C8D45 D4 lea eax, dword ptr
00AA378FE8 6018F5FF call009F4FF4
00AA37948D45 D8 lea eax, dword ptr
00AA3797BA 0A000000 mov edx, 0A
00AA379CE8 7718F5FF call009F5018
00AA37A1C3 retn
00AA37A2 ^ E9 0D11F5FF jmp 009F48B4
00AA37A7 ^ EB C9 jmp short 00AA3772
00AA37A95F pop edi
00AA37AA5E pop esi
00AA37AB5B pop ebx
00AA37AC8BE5 mov esp, ebp
00AA37AE5D pop ebp
00AA37AFC3 retn
--------------------------------------------------------------------------------
【算法总结】
软件注册只需要填注册码，为每组5位的5组。第三组固定为40001。
以12345和67890分别作为第1组和第2组为例：
12345转16进制 = 30393039 + 1869F = 1B6D8 1B6D8 / 3 = 92489248+58=92A0(要和第四组相同)
67890转16进制 = 1093210932/9=1D771D77*8=EBB81869E-EBB8=9AE6 (要和第五组相同)
符合上面的要求即为合法注册码，例如：12345-67890-40001-37536-39654
--------------------------------------------------------------------------------
【版权声明】: 本文 蚊香 原创, 转载请注明作者并保持文章的完整, 谢谢! 好文....
~~~学习一下！！！！ 真厉害,赞一个
引用第2楼178911980于2008-06-19 20:38发表的 :
真厉害,赞一个
.....
汗,你怎么能访问到论坛啊？？？ 哈哈~~
RP好就是这样的啦~
OH YEAH~~ 主持 不错 支持一下。 看看学习学习 ~~~学习一下！！！！~~~学习一下！！！！ 竟然是精华~~~~~~ 蚊.mm的分析还真细致哦！