Excel Workbook Splitter V1.05注册算法简析

蚊香 · 发表于 2008-9-23 12:22

【文章标题】: Excel Workbook Splitter V1.05注册算法简析
【文章作者】: 蚊香
【作者邮箱】: xpi386com@gmail.com
【作者主页】: http://www.xpi386.com
【软件大小】: 1.01MB
【下载地址】: http://www.leleware.com/download/ExcelWorkbookSplitter105.exe
【使用工具】: PEiD,VBExplorer,OllyDbg,计算器
【操作平台】: D版XP-SP3
【软件介绍】: 一个处理Excel表格的工具.
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
PEiD看了一下,VB,于是用VBExplorer找到‘Register’单击事件响应代码开始处004137B0下断开始跟踪.

004137B0 > \55PUSH EBP ;一大堆垃圾代码影响大家的眼球004137B1 .8BECMOV EBP,ESP004137B3 .83EC 0C SUB ESP,0C004137B6 .68 E6194000 PUSH <JMP.&MSVBVM60.__vbaExceptHandler>;SE 处理程序安装004137BB .64:A1 0000000>MOV EAX,DWORD PTR FS:[0]004137C1 .50PUSH EAX004137C2 .64:8925 00000>MOV DWORD PTR FS:[0],ESP004137C9 .81EC B0000000 SUB ESP,0B0004137CF .53PUSH EBX004137D0 .56PUSH ESI004137D1 .57PUSH EDI004137D2 .8965 F4 MOV DWORD PTR SS:[EBP-C],ESP004137D5 .C745 F8 38124>MOV DWORD PTR SS:[EBP-8],ExcelWor.004012>004137DC .8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]004137DF .8BC6MOV EAX,ESI004137E1 .83E0 01 AND EAX,1004137E4 .8945 FC MOV DWORD PTR SS:[EBP-4],EAX004137E7 .83E6 FE AND ESI,FFFFFFFE004137EA .56PUSH ESI004137EB .8975 08 MOV DWORD PTR SS:[EBP+8],ESI004137EE .8B0EMOV ECX,DWORD PTR DS:[ESI]004137F0 .FF51 04 CALL DWORD PTR DS:[ECX+4]004137F3 .8B16MOV EDX,DWORD PTR DS:[ESI]004137F5 .33DBXOR EBX,EBX004137F7 .56PUSH ESI004137F8 .895D E8 MOV DWORD PTR SS:[EBP-18],EBX004137FB .895D E4 MOV DWORD PTR SS:[EBP-1C],EBX004137FE .895D E0 MOV DWORD PTR SS:[EBP-20],EBX00413801 .895D DC MOV DWORD PTR SS:[EBP-24],EBX00413804 .895D CC MOV DWORD PTR SS:[EBP-34],EBX00413807 .895D BC MOV DWORD PTR SS:[EBP-44],EBX0041380A .895D AC MOV DWORD PTR SS:[EBP-54],EBX0041380D .895D 9C MOV DWORD PTR SS:[EBP-64],EBX00413810 .895D 8C MOV DWORD PTR SS:[EBP-74],EBX00413813 .899D 7CFFFFFF MOV DWORD PTR SS:[EBP-84],EBX00413819 .899D 58FFFFFF MOV DWORD PTR SS:[EBP-A8],EBX0041381F .FF92 0C030000 CALL DWORD PTR DS:[EDX+30C]00413825 .50PUSH EAX00413826 .8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]00413829 .50PUSH EAX0041382A .FF15 6C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet00413830 .8BF8MOV EDI,EAX00413832 .8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]00413835 .52PUSH EDX00413836 .57PUSH EDI00413837 .8B0FMOV ECX,DWORD PTR DS:[EDI]00413839 .FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]0041383F .3BC3CMP EAX,EBX00413841 .DBE2FCLEX00413843 .7D 12 JGE SHORT ExcelWor.0041385700413845 .68 A0000000 PUSH 0A00041384A .68 88564000 PUSH ExcelWor.004056880041384F .57PUSH EDI00413850 .50PUSH EAX00413851 .FF15 44104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj00413857 >8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18];用户名0041385A .8D4D BC LEA ECX,DWORD PTR SS:[EBP-44]0041385D .8945 D4 MOV DWORD PTR SS:[EBP-2C],EAX00413860 .8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]00413863 .50PUSH EAX00413864 .51PUSH ECX00413865 .895D E8 MOV DWORD PTR SS:[EBP-18],EBX00413868 .C745 CC 08000>MOV DWORD PTR SS:[EBP-34],80041386F .FF15 84104000 CALL DWORD PTR DS:[<&MSVBVM60.#520>] ;MSVBVM60.rtcTrimVar00413875 .8B15 20604200 MOV EDX,DWORD PTR DS:[426020]0041387B .8D85 58FFFFFF LEA EAX,DWORD PTR SS:[EBP-A8]00413881 .8D4D BC LEA ECX,DWORD PTR SS:[EBP-44]00413884 .50PUSH EAX00413885 .8B3AMOV EDI,DWORD PTR DS:[EDX]00413887 .8D55 E4 LEA EDX,DWORD PTR SS:[EBP-1C]0041388A .51PUSH ECX0041388B .52PUSH EDX0041388C .FF15 20114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>;MSVBVM60.__vbaStrVarVal00413892 .50PUSH EAX00413893 .A1 20604200 MOV EAX,DWORD PTR DS:[426020]00413898 .68 4C524000 PUSH ExcelWor.0040524C ;UNICODE "LicenseName"0041389D .50PUSH EAX0041389E .FF57 20 CALL DWORD PTR DS:[EDI+20]004138A1 .3BC3CMP EAX,EBX004138A3 .DBE2FCLEX004138A5 .7D 15 JGE SHORT ExcelWor.004138BC004138A7 .8B0D 20604200 MOV ECX,DWORD PTR DS:[426020]004138AD .6A 20 PUSH 20004138AF .68 7C524000 PUSH ExcelWor.0040527C004138B4 .51PUSH ECX004138B5 .50PUSH EAX004138B6 .FF15 44104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj004138BC >8D4D E4 LEA ECX,DWORD PTR SS:[EBP-1C]004138BF .FF15 D8114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr004138C5 .8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]004138C8 .FF15 DC114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj004138CE .8B1D 24104000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaFr>;MSVBVM60.__vbaFreeVarList004138D4 .8D55 BC LEA EDX,DWORD PTR SS:[EBP-44]004138D7 .8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]004138DA .52PUSH EDX004138DB .50PUSH EAX004138DC .6A 02 PUSH 2004138DE .FFD3CALL EBX ;<&MSVBVM60.__vbaFreeVarList>004138E0 .8B0EMOV ECX,DWORD PTR DS:[ESI]004138E2 .83C4 0C ADD ESP,0C004138E5 .56PUSH ESI004138E6 .FF91 08030000 CALL DWORD PTR DS:[ECX+308]004138EC .8D55 DC LEA EDX,DWORD PTR SS:[EBP-24]004138EF .50PUSH EAX004138F0 .52PUSH EDX004138F1 .FF15 6C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet004138F7 .8BF8MOV EDI,EAX004138F9 .8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18]004138FC .51PUSH ECX004138FD .57PUSH EDI004138FE .8B07MOV EAX,DWORD PTR DS:[EDI]00413900 .FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]00413906 .85C0TEST EAX,EAX00413908 .DBE2FCLEX0041390A .7D 12 JGE SHORT ExcelWor.0041391E0041390C .68 A0000000 PUSH 0A000413911 .68 88564000 PUSH ExcelWor.0040568800413916 .57PUSH EDI00413917 .50PUSH EAX00413918 .FF15 44104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj0041391E >8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18];假码00413921 .8D55 CC LEA EDX,DWORD PTR SS:[EBP-34]00413924 .8945 D4 MOV DWORD PTR SS:[EBP-2C],EAX00413927 .8D45 BC LEA EAX,DWORD PTR SS:[EBP-44]0041392A .52PUSH EDX0041392B .50PUSH EAX0041392C .C745 E8 00000>MOV DWORD PTR SS:[EBP-18],000413933 .C745 CC 08000>MOV DWORD PTR SS:[EBP-34],80041393A .FF15 84104000 CALL DWORD PTR DS:[<&MSVBVM60.#520>] ;MSVBVM60.rtcTrimVar00413940 .8B0D 20604200 MOV ECX,DWORD PTR DS:[426020]00413946 .8D95 58FFFFFF LEA EDX,DWORD PTR SS:[EBP-A8]0041394C .8D45 BC LEA EAX,DWORD PTR SS:[EBP-44]0041394F .52PUSH EDX00413950 .8B39MOV EDI,DWORD PTR DS:[ECX]00413952 .8D4D E4 LEA ECX,DWORD PTR SS:[EBP-1C]00413955 .50PUSH EAX00413956 .51PUSH ECX00413957 .FF15 20114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>;MSVBVM60.__vbaStrVarVal0041395D .8B15 20604200 MOV EDX,DWORD PTR DS:[426020]00413963 .50PUSH EAX00413964 .68 90524000 PUSH ExcelWor.00405290 ;UNICODE "LicenseCode"00413969 .52PUSH EDX0041396A .FF57 20 CALL DWORD PTR DS:[EDI+20]0041396D .85C0TEST EAX,EAX0041396F .DBE2FCLEX00413971 .7D 15 JGE SHORT ExcelWor.0041398800413973 .8B0D 20604200 MOV ECX,DWORD PTR DS:[426020]00413979 .6A 20 PUSH 200041397B .68 7C524000 PUSH ExcelWor.0040527C00413980 .51PUSH ECX00413981 .50PUSH EAX00413982 .FF15 44104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj00413988 >8D4D E4 LEA ECX,DWORD PTR SS:[EBP-1C]0041398B .FF15 D8114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr00413991 .8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]00413994 .FF15 DC114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj0041399A .8D55 BC LEA EDX,DWORD PTR SS:[EBP-44]0041399D .8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]004139A0 .52PUSH EDX004139A1 .50PUSH EAX004139A2 .6A 02 PUSH 2004139A4 .FFD3CALL EBX004139A6 .83C4 0C ADD ESP,0C004139A9 .E8 52F5FFFF CALL ExcelWor.00412F00 ;关键CALL，F7进004139AE .66:3D FFFFCMP AX,0FFFF ;比较004139B2 .B9 04000280 MOV ECX,80020004004139B7 .B8 0A000000 MOV EAX,0A004139BC .894D A4 MOV DWORD PTR SS:[EBP-5C],ECX004139BF .8945 9C MOV DWORD PTR SS:[EBP-64],EAX004139C2 .894D B4 MOV DWORD PTR SS:[EBP-4C],ECX004139C5 .8945 AC MOV DWORD PTR SS:[EBP-54],EAX004139C8 .0F85 25010000 JNZ ExcelWor.00413AF3;关键跳，跳向失败004139CE .894D C4 MOV DWORD PTR SS:[EBP-3C],ECX;以下无关代码省略......

重载后F7跟进004139A9

00412F00 $55PUSH EBP00412F01 .8BECMOV EBP,ESP00412F03 .83EC 08 SUB ESP,800412F06 .68 E6194000 PUSH <JMP.&MSVBVM60.__vbaExceptHandler>;SE 处理程序安装00412F0B .64:A1 0000000>MOV EAX,DWORD PTR FS:[0]00412F11 .50PUSH EAX00412F12 .64:8925 00000>MOV DWORD PTR FS:[0],ESP00412F19 .83EC 48 SUB ESP,4800412F1C .53PUSH EBX00412F1D .56PUSH ESI00412F1E .57PUSH EDI00412F1F .8965 F8 MOV DWORD PTR SS:[EBP-8],ESP00412F22 .C745 FC E8114>MOV DWORD PTR SS:[EBP-4],ExcelWor.004011>00412F29 .A1 20604200 MOV EAX,DWORD PTR DS:[426020]00412F2E .8D55 B0 LEA EDX,DWORD PTR SS:[EBP-50]00412F31 .52PUSH EDX00412F32 .33F6XOR ESI,ESI00412F34 .8D55 DC LEA EDX,DWORD PTR SS:[EBP-24]00412F37 .8975 E0 MOV DWORD PTR SS:[EBP-20],ESI00412F3A .8975 DC MOV DWORD PTR SS:[EBP-24],ESI00412F3D .8975 D4 MOV DWORD PTR SS:[EBP-2C],ESI00412F40 .8975 C4 MOV DWORD PTR SS:[EBP-3C],ESI00412F43 .8975 B4 MOV DWORD PTR SS:[EBP-4C],ESI00412F46 .8975 B0 MOV DWORD PTR SS:[EBP-50],ESI00412F49 .8B08MOV ECX,DWORD PTR DS:[EAX]00412F4B .52PUSH EDX00412F4C .68 4C524000 PUSH ExcelWor.0040524C ;UNICODE "LicenseName"00412F51 .50PUSH EAX00412F52 .FF51 1C CALL DWORD PTR DS:[ECX+1C]00412F55 .3BC6CMP EAX,ESI00412F57 .DBE2FCLEX00412F59 .7D 15 JGE SHORT ExcelWor.00412F7000412F5B .8B0D 20604200 MOV ECX,DWORD PTR DS:[426020]00412F61 .6A 1C PUSH 1C00412F63 .68 7C524000 PUSH ExcelWor.0040527C00412F68 .51PUSH ECX00412F69 .50PUSH EAX00412F6A .FF15 44104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj00412F70 >A1 20604200 MOV EAX,DWORD PTR DS:[426020]00412F75 .8D4D B0 LEA ECX,DWORD PTR SS:[EBP-50]00412F78 .51PUSH ECX00412F79 .8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]00412F7C .8B10MOV EDX,DWORD PTR DS:[EAX]00412F7E .51PUSH ECX00412F7F .68 90524000 PUSH ExcelWor.00405290 ;UNICODE "LicenseCode"00412F84 .50PUSH EAX00412F85 .FF52 1C CALL DWORD PTR DS:[EDX+1C]00412F88 .3BC6CMP EAX,ESI00412F8A .DBE2FCLEX00412F8C .7D 15 JGE SHORT ExcelWor.00412FA300412F8E .8B15 20604200 MOV EDX,DWORD PTR DS:[426020]00412F94 .6A 1C PUSH 1C00412F96 .68 7C524000 PUSH ExcelWor.0040527C00412F9B .52PUSH EDX00412F9C .50PUSH EAX00412F9D .FF15 44104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj00412FA3 >8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C];假码00412FA6 .8B3D 1C104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaLe>;MSVBVM60.__vbaLenBstr00412FAC .50PUSH EAX00412FAD .FFD7CALL EDI ;假码位数; <&MSVBVM60.__vbaLenBstr>00412FAF .8B4D DC MOV ECX,DWORD PTR SS:[EBP-24];用户名00412FB2 .8BD8MOV EBX,EAX00412FB4 .F7DBNEG EBX00412FB6 .1BDBSBB EBX,EBX00412FB8 .51PUSH ECX00412FB9 .F7DBNEG EBX00412FBB .FFD7CALL EDI ;用户名位数00412FBD .F7D8NEG EAX00412FBF .1BC0SBB EAX,EAX00412FC1 .F7D8NEG EAX00412FC3 .85D8TEST EAX,EBX00412FC5 .75 0A JNZ SHORT ExcelWor.00412FD100412FC7 .8975 D8 MOV DWORD PTR SS:[EBP-28],ESI00412FCA .68 41304100 PUSH ExcelWor.0041304100412FCF .EB 56 JMP SHORT ExcelWor.0041302700412FD1 >8B55 DC MOV EDX,DWORD PTR SS:[EBP-24]00412FD4 .52PUSH EDX00412FD5 .E8 86000000 CALL ExcelWor.00413060 ;算法CALL，F7进00412FDA .8D55 C4 LEA EDX,DWORD PTR SS:[EBP-3C];省略以下无关代码......

进入00412FD5

00413060 $55PUSH EBP00413061 .8BECMOV EBP,ESP00413063 .83EC 0C SUB ESP,0C00413066 .68 E6194000 PUSH <JMP.&MSVBVM60.__vbaExceptHandler>;SE 处理程序安装0041306B .64:A1 0000000>MOV EAX,DWORD PTR FS:[0]00413071 .50PUSH EAX00413072 .64:8925 00000>MOV DWORD PTR FS:[0],ESP00413079 .81EC 98000000 SUB ESP,980041307F .53PUSH EBX00413080 .56PUSH ESI00413081 .57PUSH EDI00413082 .8965 F4 MOV DWORD PTR SS:[EBP-C],ESP00413085 .C745 F8 F8114>MOV DWORD PTR SS:[EBP-8],ExcelWor.004011>0041308C .8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]0041308F .33C0XOR EAX,EAX00413091 .8D4D D8 LEA ECX,DWORD PTR SS:[EBP-28]00413094 .8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX00413097 .8945 DC MOV DWORD PTR SS:[EBP-24],EAX0041309A .8945 D8 MOV DWORD PTR SS:[EBP-28],EAX0041309D .8945 D4 MOV DWORD PTR SS:[EBP-2C],EAX004130A0 .8945 C4 MOV DWORD PTR SS:[EBP-3C],EAX004130A3 .8945 B4 MOV DWORD PTR SS:[EBP-4C],EAX004130A6 .8945 A4 MOV DWORD PTR SS:[EBP-5C],EAX004130A9 .8945 94 MOV DWORD PTR SS:[EBP-6C],EAX004130AC .8945 84 MOV DWORD PTR SS:[EBP-7C],EAX004130AF .8985 64FFFFFF MOV DWORD PTR SS:[EBP-9C],EAX004130B5 .FF15 54114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCo>;MSVBVM60.__vbaStrCopy004130BB .8B3D 9C104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.#632>];MSVBVM60.rtcMidCharVar004130C1 .8D45 D8 LEA EAX,DWORD PTR SS:[EBP-28]004130C4 .8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]004130C7 .8945 8C MOV DWORD PTR SS:[EBP-74],EAX004130CA .51PUSH ECX004130CB .8D55 84 LEA EDX,DWORD PTR SS:[EBP-7C]004130CE .6A 01 PUSH 1004130D0 .8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]004130D3 .52PUSH EDX004130D4 .50PUSH EAX004130D5 .C745 CC 01000>MOV DWORD PTR SS:[EBP-34],1004130DC .C745 C4 02000>MOV DWORD PTR SS:[EBP-3C],2004130E3 .C745 84 08400>MOV DWORD PTR SS:[EBP-7C],4008004130EA .FFD7CALL EDI ;<&MSVBVM60.#632>004130EC .8B1D 20114000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaSt>;MSVBVM60.__vbaStrVarVal004130F2 .8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]004130F5 .8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]004130F8 .51PUSH ECX004130F9 .52PUSH EDX004130FA .FFD3CALL EBX ;<&MSVBVM60.__vbaStrVarVal>004130FC .50PUSH EAX004130FD .FF15 30104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ;用户名第一位的ASCII00413103 .8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]00413106 .8BF0MOV ESI,EAX00413108 .FF15 D8114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr0041310E .8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]00413111 .8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]00413114 .50PUSH EAX00413115 .51PUSH ECX00413116 .6A 02 PUSH 200413118 .FF15 24104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList0041311E .66:8BC6 MOV AX,SI00413121 .66:B9 0A00MOV CX,0A;CX=0AH00413125 .66:99 CWD00413127 .66:F7F9 IDIV CX;用户名第一位ASCII与0AH取余保存到EDX，记为A0041312A .83C4 0C ADD ESP,0C0041312D .8955 E0 MOV DWORD PTR SS:[EBP-20],EDX00413130 .8B55 D8 MOV EDX,DWORD PTR SS:[EBP-28]00413133 .52PUSH EDX00413134 .FF15 1C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaLenBs>;MSVBVM60.__vbaLenBstr0041313A .8BC8MOV ECX,EAX0041313C .FF15 C0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaI2I4>>;MSVBVM60.__vbaI2I400413142 .8985 5CFFFFFF MOV DWORD PTR SS:[EBP-A4],EAX00413148 .BE 01000000 MOV ESI,10041314D >66:3BB5 5CFFF>CMP SI,WORD PTR SS:[EBP-A4]00413154 .0F8F CE000000 JG ExcelWor.004132280041315A .8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]0041315D .8D4D D8 LEA ECX,DWORD PTR SS:[EBP-28]00413160 .8985 6CFFFFFF MOV DWORD PTR SS:[EBP-94],EAX00413166 .8D55 C4 LEA EDX,DWORD PTR SS:[EBP-3C]00413169 .0FBFC6MOVSX EAX,SI0041316C .894D 8C MOV DWORD PTR SS:[EBP-74],ECX0041316F .52PUSH EDX00413170 .8D4D 84 LEA ECX,DWORD PTR SS:[EBP-7C]00413173 .50PUSH EAX00413174 .8D55 B4 LEA EDX,DWORD PTR SS:[EBP-4C]00413177 .51PUSH ECX00413178 .52PUSH EDX00413179 .C785 64FFFFFF>MOV DWORD PTR SS:[EBP-9C],800413183 .C745 CC 01000>MOV DWORD PTR SS:[EBP-34],10041318A .C745 C4 02000>MOV DWORD PTR SS:[EBP-3C],200413191 .C745 84 08400>MOV DWORD PTR SS:[EBP-7C],400800413198 .FFD7CALL EDI0041319A .8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]0041319D .8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]004131A0 .50PUSH EAX004131A1 .51PUSH ECX004131A2 .FFD3CALL EBX004131A4 .50PUSH EAX004131A5 .FF15 30104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ;依次取用户名ASCII004131AB .66:0345 E0ADD AX,WORD PTR SS:[EBP-20];加上上面得到的A004131AF .0F80 E1000000 JO ExcelWor.00413296004131B5 .66:03C6 ADD AX,SI;加上自己所在用户名的位数i004131B8 .0F80 D8000000 JO ExcelWor.00413296004131BE .0FBFD0MOVSX EDX,AX004131C1 .8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]004131C4 .52PUSH EDX004131C5 .50PUSH EAX004131C6 .FF15 18114000 CALL DWORD PTR DS:[<&MSVBVM60.#608>] ;转换为对应的字符004131CC .8D8D 64FFFFFF LEA ECX,DWORD PTR SS:[EBP-9C]004131D2 .8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]004131D5 .51PUSH ECX004131D6 .8D45 94 LEA EAX,DWORD PTR SS:[EBP-6C]004131D9 .52PUSH EDX004131DA .50PUSH EAX004131DB .FF15 24114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarCa>;MSVBVM60.__vbaVarCat004131E1 .50PUSH EAX004131E2 .FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>;连接字符串004131E8 .8BD0MOV EDX,EAX004131EA .8D4D E4 LEA ECX,DWORD PTR SS:[EBP-1C]004131ED .FF15 9C114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;MSVBVM60.__vbaStrMove004131F3 .8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]004131F6 .FF15 D8114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr004131FC .8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]004131FF .8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]00413202 .51PUSH ECX00413203 .8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]00413206 .52PUSH EDX00413207 .8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]0041320A .50PUSH EAX0041320B .51PUSH ECX0041320C .6A 04 PUSH 40041320E .FF15 24104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList00413214 .B8 01000000 MOV EAX,100413219 .83C4 14 ADD ESP,140041321C .66:03C6 ADD AX,SI0041321F .70 75 JO SHORT ExcelWor.0041329600413221 .8BF0MOV ESI,EAX00413223 .^ E9 25FFFFFF JMP ExcelWor.0041314D;循环00413228 >8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C];省略以下无关代码......

--------------------------------------------------------------------------------
【算法总结】
首先取用户名第一位ASCII与10(0AH)取余得到A.
依次取用户名每一位的ASCII加上A,再加上所在用户名的位数i,再转换为对应ASCII的字符.
最后依次连接所得字符即为对应注册码..注册信息保存到软件安装目录下的 \Config\Config.cfg

KeyGen核心源码(VB Code):

Dim Name, Code As StringDim L, A As IntegerName = CStr(Text1.Text)L = Len(Name)If L = 0 ThenText2.Text = "Input your name!"ElseA = Asc(Left(Name, 1)) Mod 10For i = 1 To LCode = Code & Chr((Asc(Mid(Name, i, 1)) + A + i))NextText2.Text = CodeEnd If

--------------------------------------------------------------------------------
【版权声明】: 本文由蚊香原创,转载请注明作者并保持文章的完整,谢谢!

莱沙 · 发表于 2008-9-25 14:41

先坐个沙发先! [s:41][s:41][s:41]

usurs · 发表于 2008-9-26 13:41

学习了。进步一下。。

冷血书生 · 发表于 2008-9-26 18:19

我是特别来支持蚊香
MM的

石头学破解 · 发表于 2008-9-29 11:19

很详细啊，收下慢慢看了。

shsww · 发表于 2008-9-29 21:06

算法直接不懂啊!!! [s:40]

shaopeng · 发表于 2008-9-30 21:43

学习了。支持一下。。。

帐号		自动登录	找回密码
密码			注册[Register]