RER DVD to 3GP Converter 3.2.0.0825算法分析

tianxj · 发表于 2008-9-12 12:48

【破文标题】RER DVD to 3GP Converter 3.2.0.0825算法分析
【破文作者】tianxj
【作者邮箱】tianxj_2007@126.com
【作者主页】WwW.ChiNaPYG.CoM
【破解工具】PEiD,OD
【破解平台】Windows XP
【软件名称】RER DVD to 3GP Converter 3.2.0.0825
【软件大小】26217KB
【软件类别】国外软件/视频转换
【软件授权】共享版
【软件语言】英文
【运行环境】Win9x/Me/NT/2000/XP/2003
【更新时间】2008-9-8
【原版下载】华军软件园
【保护方式】注册码
【软件简介】RERDVD的3gp转换器可以转换的DVD文件的移动电话3gp/3g2视频和MP3音频。您可以在完成转换的任务，与3个简单的步骤，您可以享受无损质量，和您最喜爱的视频，音频。
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------
【破解内容】
--------------------------------------------------------------
**************************************************************
一、运行程序，进行注册，输入错误的注册信息进行检测，有提示信息
"Activation Failed! Invalid license code."
**************************************************************
二、用PEiD对DVDto3GPConverter.exe查壳，为 Microsoft Visual C++ 7.0 Method2 [Debug]
**************************************************************
三、运行OD，打开DVDto3GPConverter.exe,用F12暂停发现
==============================================================
0012DBE0 77D505CF ? USER32.MessageBoxExA USER32.77D505CA
0012DBDC
0012DBE4 003C090E hOwner = 003C090E ('Activate RER DVD to 3GP Conve...',class='#32770',parent=008A089
0012DBE8 00464A38 Text =
0012DBEC 00467B38 Title = "Failed"
0012DBF0 00000040 Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0012DBF4 00000000 LanguageID = 0 (LANG_NEUTRAL)
0012DBFC 7C1CE579 ? USER32.MessageBoxA MFC71.7C1CE573
0012DBF8
0012DC00 003C090E hOwner = 003C090E ('Activate RER DVD to 3GP Conve...',class='#32770',parent=008A089
0012DC04 00464A38 Text = "Activation Failed! Invalid license code."
0012DC08 00467B38 Title = "Failed"
0012DC0C 00000040 Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0012DC14 00401EBC ? <JMP.&MFC71.#4104>
DVDto3GP.00401EB7
==============================================================

00401DA0 .6A FF PUSH -100401DA2 .68 1D064200 PUSH DVDto3GP.0042061D;SE 处理程序安装00401DA7 .64:A1 0000000>MOV EAX,DWORD PTR FS:[0]00401DAD .50PUSH EAX00401DAE .64:8925 00000>MOV DWORD PTR FS:[0],ESP00401DB5 .83EC 0C SUB ESP,0C00401DB8 .56PUSH ESI00401DB9 .8BF1MOV ESI,ECX00401DBB .8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]00401DBF .FF15 38424200 CALL DWORD PTR DS:[<&MFC71.#310>] ;MFC71.7C17319900401DC5 .8D4424 04 LEA EAX,DWORD PTR SS:[ESP+4]00401DC9 .50PUSH EAX00401DCA .8D4E 74 LEA ECX,DWORD PTR DS:[ESI+74]00401DCD .C74424 1C 000>MOV DWORD PTR SS:[ESP+1C],000401DD5 .E8 96DB0100 CALL <JMP.&MFC71.#3761> ;//取用户名00401DDA .51PUSH ECX00401DDB .8D5424 08 LEA EDX,DWORD PTR SS:[ESP+8]00401DDF .8BCCMOV ECX,ESP00401DE1 .896424 10 MOV DWORD PTR SS:[ESP+10],ESP00401DE5 .52PUSH EDX00401DE6 .FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ;MFC71.7C14E57500401DEC .8B8E C8000000 MOV ECX,DWORD PTR DS:[ESI+C8]00401DF2 .FF15 28404200 CALL DWORD PTR DS:[<&Control.DvdProxy::RegisteProduct>] ;Control.DvdProxy::RegisteProduct00401DF8 .85C0TEST EAX,EAX00401DFA .8B86 CC000000 MOV EAX,DWORD PTR DS:[ESI+CC]00401E00 .75 6A JNZ SHORT DVDto3GP.00401E6C00401E02 .05 5C010000 ADD EAX,15C00401E07 .50PUSH EAX00401E08 .8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]00401E0C .FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ;MFC71.7C14E57500401E12 .8B8E CC000000 MOV ECX,DWORD PTR DS:[ESI+CC]00401E18 .81C1 60010000 ADD ECX,16000401E1E .51PUSH ECX00401E1F .8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]00401E23 .C64424 1C 01MOV BYTE PTR SS:[ESP+1C],100401E28 .FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ;MFC71.7C14E57500401E2E .6A 40 PUSH 4000401E30 .8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]00401E34 .C64424 1C 02MOV BYTE PTR SS:[ESP+1C],200401E39 .FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ;MFC71.7C158BCD00401E3F .50PUSH EAX00401E40 .8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]00401E44 .FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ;MFC71.7C158BCD00401E4A .50PUSH EAX00401E4B .8BCEMOV ECX,ESI00401E4D .E8 0CDB0100 CALL <JMP.&MFC71.#4104>00401E52 .8B16MOV EDX,DWORD PTR DS:[ESI]00401E54 .8BCEMOV ECX,ESI00401E56 .FF92 54010000 CALL DWORD PTR DS:[EDX+154]00401E5C .8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]00401E60 .FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ;MFC71.7C1771B100401E66 .8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]00401E6A .EB 5E JMP SHORT DVDto3GP.00401ECA00401E6C >05 64010000 ADD EAX,16400401E71 .50PUSH EAX00401E72 .8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]00401E76 .FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ;MFC71.7C14E57500401E7C .8B8E CC000000 MOV ECX,DWORD PTR DS:[ESI+CC]00401E82 .81C1 68010000 ADD ECX,16800401E88 .51PUSH ECX00401E89 .8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]00401E8D .C64424 1C 03MOV BYTE PTR SS:[ESP+1C],300401E92 .FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ;MFC71.7C14E57500401E98 .6A 40 PUSH 4000401E9A .8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]00401E9E .C64424 1C 04MOV BYTE PTR SS:[ESP+1C],400401EA3 .FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ;MFC71.7C158BCD00401EA9 .50PUSH EAX00401EAA .8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]00401EAE .FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ;MFC71.7C158BCD00401EB4 .50PUSH EAX00401EB5 .8BCEMOV ECX,ESI00401EB7 .E8 A2DA0100 CALL <JMP.&MFC71.#4104> ;//错误提示00401EBC .8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]00401EC0 .FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ;MFC71.7C1771B100401EC6 .8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]00401ECA >FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ;MFC71.7C1771B100401ED0 .8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]00401ED4 .FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ;MFC71.7C1771B100401EDA .8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10]00401EDE .64:890D 00000>MOV DWORD PTR FS:[0],ECX00401EE5 .5EPOP ESI00401EE6 .83C4 18 ADD ESP,1800401EE9 .C3RETN==============================================================0037ADA0 >6A FF PUSH -10037ADA268 E9973800 PUSH Control.003897E90037ADA764:A1 00000000MOV EAX,DWORD PTR FS:[0]0037ADAD50PUSH EAX0037ADAE64:8925 0000000>MOV DWORD PTR FS:[0],ESP0037ADB551PUSH ECX0037ADB656PUSH ESI0037ADB757PUSH EDI0037ADB88BF1MOV ESI,ECX0037ADBA51PUSH ECX0037ADBB8D4424 20 LEA EAX,DWORD PTR SS:[ESP+20]0037ADBF8BCCMOV ECX,ESP0037ADC1896424 0C MOV DWORD PTR SS:[ESP+C],ESP0037ADC550PUSH EAX0037ADC6C74424 1C 00000>MOV DWORD PTR SS:[ESP+1C],00037ADCEFF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E5750037ADD48B4E 0C MOV ECX,DWORD PTR DS:[ESI+C]0037ADD7E8 84B9FFFF CALL Control.AVProxy::RegisteProduct; //F70037ADDC8BF8MOV EDI,EAX0037ADDE85FFTEST EDI,EDI0037ADE075 0A JNZ SHORT Control.0037ADEC0037ADE28B4E 08 MOV ECX,DWORD PTR DS:[ESI+8]0037ADE5C741 20 0100000>MOV DWORD PTR DS:[ECX+20],10037ADEC8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]0037ADF0FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B10037ADF68B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]0037ADFA8BC7MOV EAX,EDI0037ADFC5FPOP EDI0037ADFD64:890D 0000000>MOV DWORD PTR FS:[0],ECX0037AE045EPOP ESI0037AE0583C4 10 ADD ESP,100037AE08C2 0400 RETN 4==============================================================00376760 >6A FF PUSH -10037676268 28923800 PUSH Control.003892280037676764:A1 00000000MOV EAX,DWORD PTR FS:[0]0037676D50PUSH EAX0037676E64:8925 0000000>MOV DWORD PTR FS:[0],ESP0037677581EC 54040000 SUB ESP,4540037677BA1 F4553900 MOV EAX,DWORD PTR DS:[3955F4]0037678053PUSH EBX0037678155PUSH EBP0037678256PUSH ESI00376783898424 5C040000 MOV DWORD PTR SS:[ESP+45C],EAX0037678A57PUSH EDI0037678B8BE9MOV EBP,ECX0037678D8D4424 20 LEA EAX,DWORD PTR SS:[ESP+20]0037679133DBXOR EBX,EBX0037679350PUSH EAX00376794899C24 70040000 MOV DWORD PTR SS:[ESP+470],EBX0037679B83CE FF OR ESI,FFFFFFFF0037679EE8 2DD1FFFF CALL Control.003738D0003767A38BC8MOV ECX,EAX003767A5E8 96C7FFFF CALL Control.PgcConfigData::GetPgcName003767AA8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34]003767AEC68424 6C040000>MOV BYTE PTR SS:[ESP+46C],1003767B6E8 1B150100 CALL <JMP.&Util.RegUtil::RegUtil>003767BB8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]003767BFC68424 6C040000>MOV BYTE PTR SS:[ESP+46C],2003767C7E8 F40E0100 CALL Control.003876C0003767CC51PUSH ECX003767CD8D9424 78040000 LEA EDX,DWORD PTR SS:[ESP+478]003767D48BCCMOV ECX,ESP003767D6896424 14 MOV DWORD PTR SS:[ESP+14],ESP003767DA52PUSH EDX003767DBC68424 74040000>MOV BYTE PTR SS:[ESP+474],3003767E3FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575003767E951PUSH ECX003767EA8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28]003767EE8BCCMOV ECX,ESP003767F0896424 20 MOV DWORD PTR SS:[ESP+20],ESP003767F450PUSH EAX003767F5C68424 78040000>MOV BYTE PTR SS:[ESP+478],4003767FDFF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575003768038D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]00376807C68424 74040000>MOV BYTE PTR SS:[ESP+474],30037680FE8 3C120100 CALL Control.00387A50 ; //F7003768140FB6C0MOVZX EAX,AL003768173BC3CMP EAX,EBX003768190F84 50020000 JE Control.00376A6F0037681F8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]00376823FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199003768298D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]0037682D51PUSH ECX0037682EC68424 70040000>MOV BYTE PTR SS:[ESP+470],500376836E8 71140100 CALL <JMP.&Util.AppUtil::GetAppPath>0037683B8B10MOV EDX,DWORD PTR DS:[EAX]0037683D68 DCB33800 PUSH Control.0038B3DC ; ASCII "config.ini"0037684252PUSH EDX003768438D4424 28 LEA EAX,DWORD PTR SS:[ESP+28]0037684768 CCB33800 PUSH Control.0038B3CC ; ASCII "%s\config\%s"0037684C50PUSH EAX0037684DC68424 80040000>MOV BYTE PTR SS:[ESP+480],600376855FF15 E0B03800 CALL DWORD PTR DS:[<&MFC71.#2322>]; MFC71.7C146A9D0037685B83C4 14 ADD ESP,140037685E8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]00376862C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],50037686AFF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1003768708D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18]00376874E8 45140100 CALL <JMP.&Util.ProfileUtil::ProfileUtil>0037687951PUSH ECX0037687A8BCCMOV ECX,ESP0037687C896424 14 MOV DWORD PTR SS:[ESP+14],ESP0037688068 10B43800 PUSH Control.0038B410 ; ASCII "RegPath"00376885C68424 74040000>MOV BYTE PTR SS:[ESP+474],70037688DFF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C0037689351PUSH ECX003768948BCCMOV ECX,ESP00376896896424 40 MOV DWORD PTR SS:[ESP+40],ESP0037689A68 C4B33800 PUSH Control.0038B3C4 ; ASCII "convert"0037689FC68424 78040000>MOV BYTE PTR SS:[ESP+478],8003768A7FF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C003768AD51PUSH ECX003768AE8D5424 28 LEA EDX,DWORD PTR SS:[ESP+28]003768B28BCCMOV ECX,ESP003768B4896424 38 MOV DWORD PTR SS:[ESP+38],ESP003768B852PUSH EDX003768B9C68424 7C040000>MOV BYTE PTR SS:[ESP+47C],9003768C1FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575003768C78D4424 34 LEA EAX,DWORD PTR SS:[ESP+34]003768CB50PUSH EAX003768CC8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28]003768D0C68424 7C040000>MOV BYTE PTR SS:[ESP+47C],7003768D8E8 DB130100 CALL <JMP.&Util.ProfileUtil::GetContentFromProfile>003768DD8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]003768E1C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],0A003768E9E8 E8130100 CALL <JMP.&Util.RegUtil::RegUtil>003768EE33C0XOR EAX,EAX003768F0B9 00010000 MOV ECX,100003768F58D7C24 60 LEA EDI,DWORD PTR SS:[ESP+60]003768F9F3:AB REP STOS DWORD PTR ES:[EDI]003768FB8D4C24 60 LEA ECX,DWORD PTR SS:[ESP+60]003768FF51PUSH ECX003769008D8C24 78040000 LEA ECX,DWORD PTR SS:[ESP+478]00376907C68424 70040000>MOV BYTE PTR SS:[ESP+470],0B0037690FFF15 D0B03800 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD0037691550PUSH EAX003769168D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]0037691AE8 A10F0100 CALL Control.003878C00037691F8D5424 60 LEA EDX,DWORD PTR SS:[ESP+60]0037692352PUSH EDX003769248D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34]00376928FF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C0037692E51PUSH ECX0037692F8D4424 34 LEA EAX,DWORD PTR SS:[ESP+34]003769338BCCMOV ECX,ESP00376935896424 30 MOV DWORD PTR SS:[ESP+30],ESP0037693950PUSH EAX0037693AC68424 74040000>MOV BYTE PTR SS:[ESP+474],0C00376942FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E57500376948C68424 70040000>MOV BYTE PTR SS:[ESP+470],0D0037695051PUSH ECX003769518BCCMOV ECX,ESP00376953896424 40 MOV DWORD PTR SS:[ESP+40],ESP0037695768 B8B53800 PUSH Control.0038B5B8 ; ASCII "SerialCode"0037695CFF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C0037696251PUSH ECX003769638D5424 34 LEA EDX,DWORD PTR SS:[ESP+34]003769678BCCMOV ECX,ESP00376969896424 1C MOV DWORD PTR SS:[ESP+1C],ESP0037696D52PUSH EDX0037696EC68424 7C040000>MOV BYTE PTR SS:[ESP+47C],0E00376976FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E5750037697C68 01000080 PUSH 80000001003769818D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34]00376985C68424 7C040000>MOV BYTE PTR SS:[ESP+47C],0C0037698DE8 7A130100 CALL <JMP.&Util.RegUtil::SetRegContent>003769928D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C]003769968BF0MOV ESI,EAX00376998FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C1731990037699E8D4C24 40 LEA ECX,DWORD PTR SS:[ESP+40]003769A2FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199003769A88D4C24 44 LEA ECX,DWORD PTR SS:[ESP+44]003769ACFF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199003769B28D4C24 48 LEA ECX,DWORD PTR SS:[ESP+48]003769B6FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199003769BC8D4C24 5C LEA ECX,DWORD PTR SS:[ESP+5C]003769C0FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199003769C6895C24 4C MOV DWORD PTR SS:[ESP+4C],EBX003769CA895C24 58 MOV DWORD PTR SS:[ESP+58],EBX003769CE895C24 54 MOV DWORD PTR SS:[ESP+54],EBX003769D283EC 24 SUB ESP,24003769D58D4424 60 LEA EAX,DWORD PTR SS:[ESP+60]003769D98BCCMOV ECX,ESP003769DB896424 50 MOV DWORD PTR SS:[ESP+50],ESP003769DF50PUSH EAX003769E0C68424 94040000>MOV BYTE PTR SS:[ESP+494],0F003769E8C74424 78 64000>MOV DWORD PTR SS:[ESP+78],64003769F0E8 0BF6FFFF CALL Control.00376000003769F58B4D 00 MOV ECX,DWORD PTR SS:[EBP]003769F8E8 3D120100 CALL <JMP.&Convert.AVConverterBridge::SetProductInfo>003769FD8D4C24 5C LEA ECX,DWORD PTR SS:[ESP+5C]00376A01FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100376A078D4C24 48 LEA ECX,DWORD PTR SS:[ESP+48]00376A0BFF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100376A118D4C24 44 LEA ECX,DWORD PTR SS:[ESP+44]00376A15FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100376A1B8D4C24 40 LEA ECX,DWORD PTR SS:[ESP+40]00376A1FFF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100376A258D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C]00376A29FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100376A2F8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+30]00376A33FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100376A398D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]00376A3DC68424 6C040000>MOV BYTE PTR SS:[ESP+46C],0A00376A45E8 80120100 CALL <JMP.&Util.RegUtil::~RegUtil>00376A4A8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28]00376A4EFF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100376A548D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18]00376A58C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],500376A60E8 4D120100 CALL <JMP.&Util.ProfileUtil::~ProfileUtil>00376A658D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]00376A69FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100376A6F8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]00376A73C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],200376A7BE8 80A5FFFF CALL Control.DvdData::Check00376A808D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34]00376A84C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],100376A8CE8 39120100 CALL <JMP.&Util.RegUtil::~RegUtil>00376A918D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20]00376A95FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100376A9B8D8C24 74040000 LEA ECX,DWORD PTR SS:[ESP+474]00376AA2FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100376AA88B8C24 64040000 MOV ECX,DWORD PTR SS:[ESP+464]00376AAF64:890D 0000000>MOV DWORD PTR FS:[0],ECX00376AB68B8C24 60040000 MOV ECX,DWORD PTR SS:[ESP+460]00376ABD8BC6MOV EAX,ESI00376ABFE8 CD150100 CALL Control.0038809100376AC45FPOP EDI00376AC55EPOP ESI00376AC65DPOP EBP00376AC75BPOP EBX00376AC881C4 60040000 ADD ESP,46000376ACEC2 0400 RETN 4==============================================================00387A506A FF PUSH -100387A5268 22AD3800 PUSH Control.0038AD2200387A5764:A1 00000000MOV EAX,DWORD PTR FS:[0]00387A5D50PUSH EAX00387A5E64:8925 0000000>MOV DWORD PTR FS:[0],ESP00387A6581EC B8000000 SUB ESP,0B800387A6B53PUSH EBX00387A6C55PUSH EBP00387A6D56PUSH ESI00387A6E8BF1MOV ESI,ECX00387A7057PUSH EDI00387A71897424 14 MOV DWORD PTR SS:[ESP+14],ESI00387A7551PUSH ECX00387A768D8424 E0000000 LEA EAX,DWORD PTR SS:[ESP+E0]00387A7D8BCCMOV ECX,ESP00387A7F896424 14 MOV DWORD PTR SS:[ESP+14],ESP00387A8350PUSH EAX00387A84C78424 D8000000>MOV DWORD PTR SS:[ESP+D8],100387A8F33FFXOR EDI,EDI00387A91FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E57500387A978BCEMOV ECX,ESI00387A99E8 32FCFFFF CALL Control.003876D0 ; //注册码是否符合要求的格式00387A9E84C0TEST AL,AL00387AA00F84 49010000 JE Control.00387BEF00387AA68B2D 80B13800 MOV EBP,DWORD PTR DS:[<&MSVCR71.toupper>] ; MSVCR71.toupper00387AAC33DBXOR EBX,EBX00387AAE8D7424 68 LEA ESI,DWORD PTR SS:[ESP+68]00387AB283FF 04 CMP EDI,400387AB575 04 JNZ SHORT Control.00387ABB00387AB733FFXOR EDI,EDI00387AB9EB 23 JMP SHORT Control.00387ADE00387ABB53PUSH EBX00387ABC8D8C24 E0000000 LEA ECX,DWORD PTR SS:[ESP+E0]00387AC3FF15 54B13800 CALL DWORD PTR DS:[<&MFC71.#865>] ; //逐位取试练码ASC值00387AC90FBEC8MOVSX ECX,AL00387ACC51PUSH ECX00387ACDFFD5CALL EBP00387ACF0FBED0MOVSX EDX,AL00387AD283EA 41 SUB EDX,41; //EDX=EDX-4100387AD583C4 04 ADD ESP,400387AD88916MOV DWORD PTR DS:[ESI],EDX00387ADA47INC EDI00387ADB83C6 04 ADD ESI,400387ADE43INC EBX00387ADF83FB 18 CMP EBX,1800387AE2^ 7C CE JL SHORT Control.00387AB2 ; //循环,分别将试练码中的字母的ASC值减41h保存00387AE468 80000000 PUSH 8000387AE951PUSH ECX00387AEA8D8424 E0000000 LEA EAX,DWORD PTR SS:[ESP+E0]00387AF18BCCMOV ECX,ESP00387AF3896424 18 MOV DWORD PTR SS:[ESP+18],ESP00387AF750PUSH EAX00387AF8FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E57500387AFE8D8C24 C0000000 LEA ECX,DWORD PTR SS:[ESP+C0]00387B0551PUSH ECX00387B068B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20]00387B0AE8 81FCFFFF CALL Control.0038779000387B0F8B5424 68 MOV EDX,DWORD PTR SS:[ESP+68]00387B138B4C24 70 MOV ECX,DWORD PTR SS:[ESP+70]00387B178B4424 6C MOV EAX,DWORD PTR SS:[ESP+6C]00387B1B895424 18 MOV DWORD PTR SS:[ESP+18],EDX00387B1F8B5424 74 MOV EDX,DWORD PTR SS:[ESP+74]00387B23894C24 20 MOV DWORD PTR SS:[ESP+20],ECX00387B278B4C24 7C MOV ECX,DWORD PTR SS:[ESP+7C]00387B2B894424 1C MOV DWORD PTR SS:[ESP+1C],EAX00387B2F8B4424 78 MOV EAX,DWORD PTR SS:[ESP+78]00387B33895424 24 MOV DWORD PTR SS:[ESP+24],EDX00387B378B9424 80000000 MOV EDX,DWORD PTR SS:[ESP+80]00387B3E894C24 2C MOV DWORD PTR SS:[ESP+2C],ECX00387B428B8C24 88000000 MOV ECX,DWORD PTR SS:[ESP+88]00387B49894424 28 MOV DWORD PTR SS:[ESP+28],EAX00387B4D8B8424 84000000 MOV EAX,DWORD PTR SS:[ESP+84]00387B54895424 30 MOV DWORD PTR SS:[ESP+30],EDX00387B588B9424 8C000000 MOV EDX,DWORD PTR SS:[ESP+8C]00387B5F894C24 38 MOV DWORD PTR SS:[ESP+38],ECX00387B638B8C24 94000000 MOV ECX,DWORD PTR SS:[ESP+94]00387B6A894424 34 MOV DWORD PTR SS:[ESP+34],EAX00387B6E8B8424 90000000 MOV EAX,DWORD PTR SS:[ESP+90]00387B75895424 3C MOV DWORD PTR SS:[ESP+3C],EDX00387B798B9424 98000000 MOV EDX,DWORD PTR SS:[ESP+98]00387B80894C24 44 MOV DWORD PTR SS:[ESP+44],ECX00387B848B8C24 A0000000 MOV ECX,DWORD PTR SS:[ESP+A0]00387B8B894424 40 MOV DWORD PTR SS:[ESP+40],EAX00387B8F8B8424 9C000000 MOV EAX,DWORD PTR SS:[ESP+9C]00387B96895424 48 MOV DWORD PTR SS:[ESP+48],EDX00387B9A8B9424 A4000000 MOV EDX,DWORD PTR SS:[ESP+A4]00387BA1894C24 50 MOV DWORD PTR SS:[ESP+50],ECX00387BA5894424 4C MOV DWORD PTR SS:[ESP+4C],EAX00387BA9895424 54 MOV DWORD PTR SS:[ESP+54],EDX00387BADB3 01 MOV BL,100387BAF33C9XOR ECX,ECX00387BB18B6C0C 18 MOV EBP,DWORD PTR SS:[ESP+ECX+18] ; //试练码第i位运算值00387BB58B840C B8000000 MOV EAX,DWORD PTR SS:[ESP+ECX+B8] ; //根据"ER DVD to 3GP Converter"算出来的4个常数00387BBC8B7C0C 28 MOV EDI,DWORD PTR SS:[ESP+ECX+28] ; //试练码第i+5位运算值00387BC08B740C 48 MOV ESI,DWORD PTR SS:[ESP+ECX+48] ; //试练码第i+10位运算值00387BC48B540C 38 MOV EDX,DWORD PTR SS:[ESP+ECX+38] ; //试练码第i+15位运算值00387BC803C5ADD EAX,EBP00387BCA03C7ADD EAX,EDI00387BCC03C6ADD EAX,ESI00387BCE03C2ADD EAX,EDX ; //四数之和00387BD099CDQ00387BD1BE 1A000000 MOV ESI,1A00387BD6F7FEIDIV ESI00387BD83B940C A8000000 CMP EDX,DWORD PTR SS:[ESP+ECX+A8] ; //除以1Ah的的余数和试练码第i+20位运算值比较00387BDF89540C 58 MOV DWORD PTR SS:[ESP+ECX+58],EDX00387BE375 0A JNZ SHORT Control.00387BEF; //不等则跳00387BE583C1 04 ADD ECX,400387BE883F9 10 CMP ECX,1000387BEB^ 7C C4 JL SHORT Control.00387BB1 ; //循环00387BEDEB 02 JMP SHORT Control.00387BF100387BEF32DBXOR BL,BL00387BF18D8C24 D8000000 LEA ECX,DWORD PTR SS:[ESP+D8]00387BF8FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100387BFE8D8C24 DC000000 LEA ECX,DWORD PTR SS:[ESP+DC]00387C05FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B100387C0B8B8C24 C8000000 MOV ECX,DWORD PTR SS:[ESP+C8]00387C125FPOP EDI00387C135EPOP ESI00387C145DPOP EBP00387C158AC3MOV AL,BL00387C1764:890D 0000000>MOV DWORD PTR FS:[0],ECX00387C1E5BPOP EBX00387C1F81C4 C4000000 ADD ESP,0C400387C25C2 0800 RETN 8==============================================================003876D064:A1 00000000MOV EAX,DWORD PTR FS:[0]003876D66A FF PUSH -1003876D868 F9AC3800 PUSH Control.0038ACF9003876DD50PUSH EAX003876DE64:8925 0000000>MOV DWORD PTR FS:[0],ESP003876E553PUSH EBX003876E656PUSH ESI003876E757PUSH EDI003876E88D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]003876ECC74424 14 00000>MOV DWORD PTR SS:[ESP+14],0003876F433FFXOR EDI,EDI ; //EDI=0003876F6FF15 D0B03800 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD003876FC8D50 01 LEA EDX,DWORD PTR DS:[EAX+1]003876FF90NOP003877008A08MOV CL,BYTE PTR DS:[EAX]0038770240INC EAX0038770384C9TEST CL,CL00387705^ 75 F9 JNZ SHORT Control.00387700003877072BC2SUB EAX,EDX0038770983F8 18 CMP EAX,180038770C75 62 JNZ SHORT Control.00387770; //注册码长度必须为24位0038770E8B1D 80B13800 MOV EBX,DWORD PTR DS:[<&MSVCR71.toupper>] ; MSVCR71.toupper0038771433F6XOR ESI,ESI ; //ESI=000387716EB 08 JMP SHORT Control.00387720003877188DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]0038771F90NOP0038772056PUSH ESI003877218D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20]00387725FF15 54B13800 CALL DWORD PTR DS:[<&MFC71.#865>] ; //逐位取试练码ASC值0038772B0FBEC0MOVSX EAX,AL0038772E50PUSH EAX0038772FFFD3CALL EBX0038773183C4 04 ADD ESP,40038773483FF 04 CMP EDI,40038773775 08 JNZ SHORT Control.00387741; //每隔4位不跳003877393C 2D CMP AL,2D0038773B75 33 JNZ SHORT Control.00387770; //不是“-”就跳0038773D33FFXOR EDI,EDI ; //EDI=00038773FEB 09 JMP SHORT Control.0038774A003877413C 41 CMP AL,41003877437C 2B JL SHORT Control.00387770 ; //小于41h则跳,即"A"003877453C 5A CMP AL,5A003877477F 27 JG SHORT Control.00387770 ; //大于5Ah则跳,即"Z"0038774947INC EDI0038774A46INC ESI0038774B83FE 18 CMP ESI,180038774E^ 7C D0 JL SHORT Control.00387720 ; //循环003877508D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]00387754FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B10038775AB0 01 MOV AL,10038775C8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]0038776064:890D 0000000>MOV DWORD PTR FS:[0],ECX003877675FPOP EDI003877685EPOP ESI003877695BPOP EBX0038776A83C4 0C ADD ESP,0C0038776DC2 0400 RETN 4

**************************************************************
【破解总结】
--------------------------------------------------------------
【算法总结】
1.注册码形式为XXXX-XXXX-XXXX-XXXX-XXXX,X为英文大写字母
2.前4组字母可以是任意字母,第5组字母是根据前4组字母运算所得
--------------------------------------------------------------
【算法注册机】
Private Sub Command1_Click()
Dim C(24), X(4), n, i As Integer
Dim M(24) As String
For n = 1 To 20
C(n) = Int(Rnd() * 26 + 65)
M(n) = Chr(C(n))
Next
X(1) = &H4
X(2) = &H14
X(3) = &HA
X(4) = &H0
For i = 1 To 4
C(i + 20) = ((C(i) + C(i + 5) + C(i + 10) + C(i + 15) - &H41 * 4 + X(i)) Mod &H1A) + &H41
M(i + 20) = Chr(C(i + 20))
Next
Text1.Text = M(1) & M(2) & M(3) & M(4) & "-" & M(6) & M(7) & M(8) & M(9) & "-" & M(11) & M(12) & M(13) & M(14) & "-" & M(16)

& M(17) & M(18) & M(19) & "-" & M(21) & M(22) & M(23) & M(24)
End Sub
--------------------------------------------------------------
【注册信息】
保存在
[HKEY_USERS\S-1-5-21-4062119504-2798039762-1529167351-500\Software\RER Soft, Inc.\DVD to 3GP Converter]
删除可以重新玩 ^_^
--------------------------------------------------------------
感谢飘云老大、猫老大、Nisy老大以及很多前辈们的学习教程以及所有帮助过我的论坛兄弟姐妹们！谢谢
提前祝我的论坛兄弟姐妹们中秋节快乐！！
--------------------------------------------------------------
【版权声明】破文是学习的手记，兴趣是成功的源泉；本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!

qq513701092 · 发表于 2008-9-12 12:54

教程下来看看~~
支持下~~~

unpack · 发表于 2008-9-13 09:57

o(∩_∩)o...学习一下大侠的作品 o(∩_∩)o...

jacky0152 · 发表于 2008-9-17 12:51

的确不错啊。好东西啊！！！！！！！

帐号		自动登录	找回密码
密码			注册[Register]

[原创] RER DVD to 3GP Converter 3.2.0.0825算法分析