电脑公司客户售后管理软件 2.0 算法分析
【文章标题】: 电脑公司客户售后管理软件 2.0 算法分析【文章作者】: 蚊香
【作者邮箱】: xpi386com@163.com
【作者主页】: http://www.xpi386.com
【下载地址】: http://www.skycn.com/soft/47219.html
【保护方式】: 机器码 + 注册码
【编写语言】: Borland Delphi
【操作平台】: D版XP-SP2
【软件介绍】: 一款专门为电脑公司售后服务部量体定做的管理软件
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
查壳，无。Borland Delphi
试用123456789注册，发现是重启验证。搜索注册表，找到如下：
"Date"=hex:00,00,00,00,40,5e,e3,40
"Name"="3JX5LR9X"
"Pass"="123456789"
其中这里的"3JX5LR9X"是偶的机器码~~~~~
OD载入主程序，查找字符串“Pass”，找到两处，分别下断。F9运行
0068357C .BA B03A6800 mov edx, 00683AB0;断在这里，一路F8下
00683581 .8B45 F0 mov eax, dword ptr
00683584 .E8 8B85DCFF call0044BB14
00683589 .8B55 B4 mov edx, dword ptr
0068358C .A1 64287200 mov eax, dword ptr
00683591 .8B00mov eax, dword ptr
00683593 .05 4C070000 add eax, 74C
00683598 .E8 5715D8FF call00404AF4
0068359D .33C0xor eax, eax
0068359F .55pushebp
006835A0 .68 C6356800 push006835C6
006835A5 .64:FF30 pushdword ptr fs:
006835A8 .64:8920 mov dword ptr fs:, esp
006835AB .BA C03A6800 mov edx, 00683AC0;date
006835B0 .8B45 F0 mov eax, dword ptr
006835B3 .E8 BC86DCFF call0044BC74
006835B8 .DD5D E8 fstpqword ptr
006835BB .9Bwait
006835BC .33C0xor eax, eax
006835BE .5Apop edx
006835BF .59pop ecx
006835C0 .59pop ecx
006835C1 .64:8910 mov dword ptr fs:, edx
006835C4 .EB 29 jmp short 006835EF
006835C6 .^ E9 250BD8FF jmp 004040F0
006835CB .FF75 E4 pushdword ptr
006835CE .FF75 E0 pushdword ptr
006835D1 .BA C03A6800 mov edx, 00683AC0;ASCII "Date"
006835D6 .8B45 F0 mov eax, dword ptr
006835D9 .E8 8286DCFF call0044BC60
006835DE .8B45 E0 mov eax, dword ptr
006835E1 .8945 E8 mov dword ptr , eax
006835E4 .8B45 E4 mov eax, dword ptr
006835E7 .8945 EC mov dword ptr , eax
006835EA .E8 2D0FD8FF call0040451C
006835EF >8B45 F0 mov eax, dword ptr
006835F2 .E8 2D7EDCFF call0044B424
006835F7 .33C0xor eax, eax
006835F9 .5Apop edx
006835FA .59pop ecx
006835FB .59pop ecx
006835FC .64:8910 mov dword ptr fs:, edx
006835FF .68 14366800 push00683614
00683604 >8B45 F0 mov eax, dword ptr
00683607 .E8 0406D8FF call00403C10
0068360C .C3retn
0068360D .^ E9 920DD8FF jmp 004043A4
00683612 .^ EB F0 jmp short 00683604
00683614 .DD45 E0 fld qword ptr
00683617 .DC65 E8 fsubqword ptr
0068361A .DD5D D8 fstpqword ptr
0068361D .9Bwait
0068361E .D905 C83A6800 fld dword ptr
00683624 .DC65 D8 fsubqword ptr
00683627 .E8 5CF8D7FF call00402E88
0068362C .8B15 64287200 mov edx, dword ptr ;电脑公司.00727098
00683632 .8B12mov edx, dword ptr
00683634 .8982 54080000 mov dword ptr , eax
0068363A .8B45 FC mov eax, dword ptr
0068363D .8B90 1C030000 mov edx, dword ptr
00683643 .B9 D43A6800 mov ecx, 00683AD4;ASCII "select count(*) as T_Num from T_custom"
00683648 .8B45 FC mov eax, dword ptr
0068364B .E8 00FCFFFF call00683250 ;F8直到这里竟然卡住 ？！！！！
00683650 .8B45 FC mov eax, dword ptr ;此行F2，重载后F9到此，继续F8
00683653 .8B90 40040000 mov edx, dword ptr
00683659 .B9 043B6800 mov ecx, 00683B04;ASCII "select count(*) as T_Num1 from T_GOODS"
0068365E .8B45 FC mov eax, dword ptr
00683661 .E8 EAFBFFFF call00683250
00683666 .8B45 FC mov eax, dword ptr
00683669 .8B90 7C060000 mov edx, dword ptr
0068366F .B9 343B6800 mov ecx, 00683B34;ASCII "select count(*) as T_Num2 from T_OA"
00683674 .8B45 FC mov eax, dword ptr
00683677 .E8 D4FBFFFF call00683250
0068367C .8B45 FC mov eax, dword ptr
0068367F .8B80 1C030000 mov eax, dword ptr
00683685 .BA 603B6800 mov edx, 00683B60;ASCII "T_Num"
0068368A .E8 0D74ECFF call0054AA9C
0068368F .8B10mov edx, dword ptr
00683691 .FF52 58 calldword ptr
00683694 .8B55 FC mov edx, dword ptr
00683697 .8982 C0070000 mov dword ptr , eax
0068369D .8B45 FC mov eax, dword ptr
006836A0 .8B80 40040000 mov eax, dword ptr
006836A6 .BA 703B6800 mov edx, 00683B70;ASCII "T_Num1"
006836AB .E8 EC73ECFF call0054AA9C
006836B0 .8B10mov edx, dword ptr
006836B2 .FF52 58 calldword ptr
006836B5 .8B55 FC mov edx, dword ptr
006836B8 .8982 C8070000 mov dword ptr , eax
006836BE .8B45 FC mov eax, dword ptr
006836C1 .8B80 7C060000 mov eax, dword ptr
006836C7 .BA 803B6800 mov edx, 00683B80;ASCII "T_Num2"
006836CC .E8 CB73ECFF call0054AA9C
006836D1 .8B10mov edx, dword ptr
006836D3 .FF52 58 calldword ptr
006836D6 .8B55 FC mov edx, dword ptr
006836D9 .8982 CC070000 mov dword ptr , eax
006836DF .A1 64287200 mov eax, dword ptr
006836E4 .8B00mov eax, dword ptr
006836E6 .C680 68080000>mov byte ptr , 1
006836ED .8D4D B0 lea ecx, dword ptr
006836F0 .A1 64287200 mov eax, dword ptr
006836F5 .8B00mov eax, dword ptr
006836F7 .8B90 48070000 mov edx, dword ptr ;出机器码 3JX5LR9X
006836FD .A1 88247200 mov eax, dword ptr
00683702 .8B00mov eax, dword ptr
00683704 .E8 8BDCFFFF call00681394 ;经过这里后出真码，F7进去看究竟
00683709 .8B55 B0 mov edx, dword ptr
0068370C .A1 64287200 mov eax, dword ptr
00683711 .8B00mov eax, dword ptr
00683713 .8B80 4C070000 mov eax, dword ptr
00683719 .E8 9E17D8FF call00404EBC ;比较CALL，可做内存注册机
0068371E .74 44 jeshort 00683764 ;关键跳转
00683720 .8D4D AC lea ecx, dword ptr ;以下代码省略
00683723 .A1 64287200 mov eax, dword ptr ;.................
进入 00683704
00681394/$55pushebp
00681395|.8BECmov ebp, esp
00681397|.51pushecx
00681398|.B9 04000000 mov ecx, 4
0068139D|>6A 00 /push0
0068139F|.6A 00 |push0
006813A1|.49|dec ecx
006813A2|.^ 75 F9 \jnz short 0068139D
006813A4|.51pushecx
006813A5|.874D FC xchgdword ptr , ecx
006813A8|.53pushebx
006813A9|.56pushesi
006813AA|.57pushedi
006813AB|.8BF9mov edi, ecx
006813AD|.8955 FC mov dword ptr , edx
006813B0|.8B45 FC mov eax, dword ptr
006813B3|.E8 A83BD8FF call00404F60
006813B8|.33C0xor eax, eax
006813BA|.55pushebp
006813BB|.68 55156800 push00681555
006813C0|.64:FF30 pushdword ptr fs:
006813C3|.64:8920 mov dword ptr fs:, esp
006813C6|.8BC7mov eax, edi
006813C8|.E8 D336D8FF call00404AA0
006813CD|.8B45 FC mov eax, dword ptr
006813D0|.E8 9B39D8FF call00404D70
006813D5|.8BF0mov esi, eax
006813D7|.85F6testesi, esi
006813D9|.7E 26 jle short 00681401
006813DB|.BB 01000000 mov ebx, 1
006813E0|>8D4D EC /lea ecx, dword ptr
006813E3|.8B45 FC |mov eax, dword ptr
006813E6|.0FB64418 FF |movzx eax, byte ptr ;依次取机器码的16进制ASCII值到EAX
006813EB|.33D2|xor edx, edx
006813ED|.E8 9A8FD8FF |call0040A38C
006813F2|.8B55 EC |mov edx, dword ptr
006813F5|.8D45 F8 |lea eax, dword ptr
006813F8|.E8 7B39D8FF |call00404D78
006813FD|.43|inc ebx
006813FE|.4E|dec esi
006813FF|.^ 75 DF \jnz short 006813E0;循环
00681401|>8B45 F8 mov eax, dword ptr ;将机器码依次取得的ASCII值相连接，设为STR1
00681404|.E8 6739D8FF call00404D70
00681409|.8BF0mov esi, eax
0068140B|.85F6testesi, esi
0068140D|.7E 2C jle short 0068143B
0068140F|.BB 01000000 mov ebx, 1
00681414|>8B45 F8 /mov eax, dword ptr
00681417|.E8 5439D8FF |call00404D70
0068141C|.2BC3|sub eax, ebx
0068141E|.8B55 F8 |mov edx, dword ptr
00681421|.8A1402|mov dl, byte ptr ;从右至左依次取STR1
00681424|.8D45 E8 |lea eax, dword ptr
00681427|.E8 5C38D8FF |call00404C88
0068142C|.8B55 E8 |mov edx, dword ptr
0068142F|.8D45 F4 |lea eax, dword ptr
00681432|.E8 4139D8FF |call00404D78
00681437|.43|inc ebx
00681438|.4E|dec esi
00681439|.^ 75 D9 \jnz short 00681414;此循环将STR1倒序排列，设为STR2
0068143B|>8D45 F8 lea eax, dword ptr
0068143E|.50pusheax
0068143F|.B9 04000000 mov ecx, 4
00681444|.BA 01000000 mov edx, 1
00681449|.8B45 F4 mov eax, dword ptr
0068144C|.E8 7F3BD8FF call00404FD0
00681451|.8D45 F4 lea eax, dword ptr
00681454|.50pusheax
00681455|.B9 04000000 mov ecx, 4 ;ECX=4
0068145A|.BA 05000000 mov edx, 5 ;EDX=5
0068145F|.8B45 F4 mov eax, dword ptr
00681462|.E8 693BD8FF call00404FD0 ;取STR2中的前4位
00681467|.8B45 F8 mov eax, dword ptr
0068146A|.E8 0139D8FF call00404D70
0068146F|.83F8 04 cmp eax, 4
00681472|.7D 2F jge short 006814A3
00681474|.8B45 F8 mov eax, dword ptr
00681477|.E8 F438D8FF call00404D70
0068147C|.8BD8mov ebx, eax
0068147E|.83FB 03 cmp ebx, 3
00681481|.7F 20 jgshort 006814A3
00681483|>8D4D E4 /lea ecx, dword ptr
00681486|.8BC3|mov eax, ebx
00681488|.C1E0 02 |shl eax, 2
0068148B|.33D2|xor edx, edx
0068148D|.E8 FA8ED8FF |call0040A38C
00681492|.8B55 E4 |mov edx, dword ptr
00681495|.8D45 F8 |lea eax, dword ptr
00681498|.E8 DB38D8FF |call00404D78
0068149D|.43|inc ebx
0068149E|.83FB 04 |cmp ebx, 4
006814A1|.^ 75 E0 \jnz short 00681483
006814A3|>8B45 F4 mov eax, dword ptr ;取STR2的5-8位
006814A6|.E8 C538D8FF call00404D70
006814AB|.83F8 04 cmp eax, 4
006814AE|.7D 2F jge short 006814DF
006814B0|.8B45 F4 mov eax, dword ptr
006814B3|.E8 B838D8FF call00404D70
006814B8|.8BD8mov ebx, eax
006814BA|.83FB 03 cmp ebx, 3
006814BD|.7F 20 jgshort 006814DF
006814BF|>8D4D E0 /lea ecx, dword ptr
006814C2|.8BC3|mov eax, ebx
006814C4|.C1E0 02 |shl eax, 2
006814C7|.33D2|xor edx, edx
006814C9|.E8 BE8ED8FF |call0040A38C
006814CE|.8B55 E0 |mov edx, dword ptr
006814D1|.8D45 F4 |lea eax, dword ptr
006814D4|.E8 9F38D8FF |call00404D78
006814D9|.43|inc ebx
006814DA|.83FB 04 |cmp ebx, 4
006814DD|.^ 75 E0 \jnz short 006814BF
006814DF|>8D45 F0 lea eax, dword ptr
006814E2|.BA 6C156800 mov edx, 0068156C;固定字符串“dnsh268d58k”，设为STR3
006814E7|.E8 4C36D8FF call00404B38
006814EC|.8D45 DC lea eax, dword ptr
006814EF|.50pusheax
006814F0|.B9 04000000 mov ecx, 4 ;ECX=4
006814F5|.BA 01000000 mov edx, 1 ;EDX=1
006814FA|.8B45 F0 mov eax, dword ptr
006814FD|.E8 CE3AD8FF call00404FD0 ;取STR3的前4位即“dnsh”
00681502|.FF75 DC pushdword ptr
00681505|.68 80156800 push00681580 ;-
0068150A|.FF75 F8 pushdword ptr ;用“-”连接
0068150D|.8D45 D8 lea eax, dword ptr
00681510|.50pusheax
00681511|.B9 05000000 mov ecx, 5 ;ECX=5
00681516|.BA 05000000 mov edx, 5 ;EDX=5
0068151B|.8B45 F0 mov eax, dword ptr
0068151E|.E8 AD3AD8FF call00404FD0 ;SRE3中的第5位开始，取5位，即“268d5”
00681523|.FF75 D8 pushdword ptr
00681526|.68 80156800 push00681580 ;-
0068152B|.FF75 F4 pushdword ptr ;用“-”连接
0068152E|.8BC7mov eax, edi
00681530|.BA 06000000 mov edx, 6
00681535|.E8 F638D8FF call00404E30
0068153A|.33C0xor eax, eax
0068153C|.5Apop edx
0068153D|.59pop ecx
0068153E|.59pop ecx
0068153F|.64:8910 mov dword ptr fs:, edx
00681542|.68 5C156800 push0068155C
00681547|>8D45 D8 lea eax, dword ptr
0068154A|.BA 0A000000 mov edx, 0A
0068154F|.E8 7035D8FF call00404AC4
00681554\.C3retn
00681555 .^ E9 4A2ED8FF jmp 004043A4
0068155A .^ EB EB jmp short 00681547
0068155C .5Fpop edi
0068155D .5Epop esi
0068155E .5Bpop ebx
0068155F .8BE5mov esp, ebp
00681561 .5Dpop ebp
00681562 .C3retn
--------------------------------------------------------------------------------
【经验总结】
以偶的机器为例：
机器码 3JX5LR9X
16进制ASCII = 334A58354C523958
倒序排行= 859325C45385A433
取1-4位 = 8593
取5-8位 = 25C4
取固定内容“dnsh” 和 “268d5”
组合以上“dnsh-8593268d5-25C4”即为注册码
KeyGen 核心源码（VB Code）：
For i = 1 To L
a = a & Hex(Asc(Mid(Text1.Text, i, 1)))
Next i
C = a
S = StrReverse(C)
Text2.Text = "dnsh-" & CStr(Mid(S, 1, 4)) & "268d5-" & CStr(Mid(S, 5, 4))
VB6.0精简版测试通过~~~~~~~~~
--------------------------------------------------------------------------------
【版权声明】: 本文 蚊香 原创, 转载请注明作者并保持文章的完整, 谢谢!
2008年08月06日 PM 07:27:56 软件算法很简单，，估计暗桩不少~~~~~~~~~~
偶也是刚接触简单的算术运算，，象这样的软件大家也下载调试一下就知道它的算法怎么回事，大不了对着破文来看~~~~~~~~~
最后说明：偶不是MM~~~~ 不知道怎么有的朋友认为偶是MM~~~~ 花姐说你是MM啊~~~!以后改叫香哥，呵呵。 精彩，MM，看名字就知道不是MM，支持，继续发布一些算法教程吧！！
喜欢！ 好好学习下 支持原创 高手啊 好好学习下 支持原创 看着有点晕。。 受教了，谢谢 学习了，下载研究下
页:
[1]
2