用od载入主程序F9运行，查找注册码失败的字符串,找到后定位如下代码：
006890B6
push ebp
006890B7
push cangku.006891F5
006890BC
push dword ptr fs:[eax]
006890BF
mov dword ptr fs:[eax],esp
006890C2
mov eax,dword ptr ss:[ebp-0x4]
006890C5
call cangku.00689388
006890CA
test al,al
006890CC
je cangku.006891AD
//跳向注册失败
006890D2
xor eax,eax
006890D4
push ebp
006890D5
push cangku.00689191
006890DA
push dword ptr fs:[eax]
006890DD
mov dword ptr fs:[eax],esp
006890E0
mov dl,0x1
006890E2
mov eax,dword ptr ds:[0x44E254]
006890E7
call cangku.0044E478
006890EC
mov ebx,eax
006890EE
mov edx,0x80000002
006890F3
mov eax,ebx
006890F5
call cangku.0044E554
006890FA
mov cl,0x1
006890FC
mov edx,cangku.0068920C
;
Software\yisusoft\cangku
00689101
mov eax,ebx
00689103
call cangku.0044E698
00689108
lea edx,dword ptr ss:[ebp-0xC]
0068910B
mov eax,dword ptr ss:[ebp-0x4]
0068910E
mov eax,dword ptr ds:[eax+0x304]
00689114
call cangku.0048EED0
00689119
mov eax,dword ptr ss:[ebp-0xC]
0068911C
lea edx,dword ptr ss:[ebp-0x8]
0068911F
call cangku.004099E4
00689124
mov ecx,dword ptr ss:[ebp-0x8]
00689127
mov edx,cangku.00689230
;
Name
//注册成功将机器码写入注册表
0068912C
mov eax,ebx
0068912E
call cangku.0044EDA0
00689133
lea edx,dword ptr ss:[ebp-0x14]
00689136
mov eax,dword ptr ss:[ebp-0x4]
00689139
mov eax,dword ptr ds:[eax+0x308]
0068913F
call cangku.0048EED0
00689144
mov eax,dword ptr ss:[ebp-0x14]
00689147
lea edx,dword ptr ss:[ebp-0x10]
0068914A
call cangku.004099E4
0068914F
mov ecx,dword ptr ss:[ebp-0x10]
00689152
mov edx,cangku.00689240
;
Pass
//注册成功将注册码写入注册表
00689157
mov eax,ebx
00689159
call cangku.0044EDA0
0068915E
mov eax,ebx
00689160
call cangku.00403B4C
00689165
push 0x40
00689167
push cangku.00689248
;
软件注册
0068916C
push cangku.00689254
;
注册成功，本程序所有功能限制下次启动时将被自动解除，欢迎您成为我们正式版本用户!
00689171
mov eax,dword ptr ss:[ebp-0x4]
00689174
call cangku.0049591C
00689179
push eax
; |hOwner
0068917A
call <jmp.&user32.MessageBoxA>
; \MessageBoxA
0068917F
mov eax,dword ptr ss:[ebp-0x4]
00689182
call cangku.004ACD08
00689187
xor eax,eax
00689189
pop edx
0068918A
pop ecx
0068918B
pop ecx
0068918C
mov dword ptr fs:[eax],edx
0068918F
jmp short cangku.006891C7
00689191
jmp cangku.0040402C
00689196
mov eax,dword ptr ss:[ebp-0x4]
00689199
call cangku.004ACD08
0068919E
mov eax,dword ptr ss:[ebp-0x4]
006891A1
call cangku.006892C8
006891A6
call cangku.00404458
006891AB
jmp short cangku.006891C7
006891AD
push 0x40
006891AF
push cangku.00689248
;
软件注册
006891B4
push cangku.006892A4
;
注册失败，请检查您的注册名和注册码!
006891B9
mov eax,dword ptr ss:[ebp-0x4]
006891BC
call cangku.0049591C
006891C1
push eax
; |hOwner
006891C2
call <jmp.&user32.MessageBoxA>
; \MessageBoxA
006891C7
xor eax,eax
006891C9
pop edx
在006890C5下F2断点，输入假码，单击注册按钮，断下来，F7进入这个call,关键代码如下：
（略去n行代码）
006893E0
|>mov edx,[local.4]
006893E3
|>lea ecx,[local.3]
006893E6
|>mov eax,esi
006893E8
|>call cangku.006894EC
//将机器码计算成注册码
006893ED
|>mov edx,[local.3]
006893F0
|>pop eax
006893F1
|>call cangku.00404E7C
//比较真假注册码
006893F6
|>jnz short cangku.00689448
006893F8
|>mov bl,0x1
006893FA
|>lea edx,[local.7]
006893FD
|>mov eax,dword ptr ds:[esi+0x304]
00689403
|>call cangku.0048EED0
00689408
|>mov eax,[local.7]
0068940B
|>lea edx,[local.6]
0068940E
|>call cangku.004099E4
F7跟进006893E8
|>call cangku.006894EC ，注册码计算详细代码如下：
006894ED
|>mov ebp,esp
006894EF
|>push ecx
006894F0
|>mov ecx,0x4
006894F5
|>/push 0x0
006894F7
|>|push 0x0
006894F9
|>|dec ecx
006894FA
|>\jnz short cangku.006894F5
006894FC
|>push ecx
006894FD
|>xchg [local.1],ecx
00689500
|>push ebx
00689501
|>push esi
00689502
|>push edi
00689503
|>mov edi,ecx
00689505
|>mov [local.1],edx
00689508
|>mov eax,[local.1]
0068950B
|>call cangku.00404F20
00689510
|>xor eax,eax
00689512
|>push ebp
00689513
|>push cangku.006896AD
00689518
|>push dword ptr fs:[eax]
0068951B
|>mov dword ptr fs:[eax],esp
0068951E
|>mov eax,edi
00689520
|>call cangku.00404A60
00689525
|>mov eax,[local.1]
00689528
|>call cangku.00404D30
0068952D
|>mov esi,eax
0068952F
|>test esi,esi
//esi存放的是机器码的位数
00689531
|>jle short cangku.00689559
00689533
|>mov ebx,0x1
00689538
|>/lea ecx,[local.5]
0068953B
|>|mov eax,[local.1]
0068953E
|>|movzx eax,byte ptr ds:[eax+ebx-0x1]
00689543
|>|xor edx,edx
00689545
|>|call cangku.00409FB8
0068954A
|>|mov edx,[local.5]
0068954D
|>|lea eax,[local.2]
00689550
|>|call cangku.00404D38
00689555
|>|inc ebx
00689556
|>|dec esi
00689557
|>\jnz short cangku.00689538
//循环取机器码每位得到机器码的ASCII码字符串，例如我的机器码为：00000000000000000001,得到字符串为：3030303030303030303030303030303030303031
00689559
|>mov eax,[local.2]
0068955C
|>call cangku.00404D30
00689561
|>mov esi,eax
00689563
|>test esi,esi
00689565
|>jle short cangku.00689593
00689567
|>mov ebx,0x1
0068956C
|>/mov eax,[local.2]
0068956F
|>|call cangku.00404D30
00689574
|>|sub eax,ebx
00689576
|>|mov edx,[local.2]
00689579
|>|mov dl,byte ptr ds:[edx+eax]
0068957C
|>|lea eax,[local.6]
0068957F
|>|call cangku.00404C48
00689584
|>|mov edx,[local.6]
00689587
|>|lea eax,[local.3]
0068958A
|>|call cangku.00404D38
0068958F
|>|inc ebx
00689590
|>|dec esi
00689591
|>\jnz short cangku.0068956C
//将得到的字符串：3030303030303030303030303030303030303031颠倒过来变成：1303030303030303030303030303030303030303
00689593
|>lea eax,[local.2]
00689596
|>push eax
00689597
|>mov ecx,0x4
0068959C
|>mov edx,0x1
006895A1
|>mov eax,[local.3]
006895A4
|>call cangku.00404F90
//取字符串的前4位备用（后面要用到），我的机器为1303
006895A9
|>lea eax,[local.3]
006895AC
|>push eax
006895AD
|>mov ecx,0x4
006895B2
|>mov edx,0x5
006895B7
|>mov eax,[local.3]
006895BA
|>call cangku.00404F90
//取字符串的第5位到第8位备用（后面要用到），我的机器为0303
006895BF
|>mov eax,[local.2]
006895C2
|>call cangku.00404D30
006895C7
|>cmp eax,0x4
006895CA
|>jge short cangku.006895FB
006895CC
|>mov eax,[local.2]
006895CF
|>call cangku.00404D30
006895D4
|>mov ebx,eax
006895D6
|>cmp ebx,0x3
006895D9
|>jg short cangku.006895FB
006895DB
|>/lea ecx,[local.7]
006895DE
|>|mov eax,ebx
006895E0
|>|shl eax,0x2
006895E3
|>|xor edx,edx
006895E5
|>|call cangku.00409FB8
006895EA
|>|mov edx,[local.7]
006895ED
|>|lea eax,[local.2]
006895F0
|>|call cangku.00404D38
006895F5
|>|inc ebx
006895F6
|>|cmp ebx,0x4
006895F9
|>\jnz short cangku.006895DB
006895FB
|>mov eax,[local.3]
006895FE
|>call cangku.00404D30
00689603
|>cmp eax,0x4
00689606
|>jge short cangku.00689637
00689608
|>mov eax,[local.3]
0068960B
|>call cangku.00404D30
00689610
|>mov ebx,eax
00689612
|>cmp ebx,0x3
00689615
|>jg short cangku.00689637
00689617
|>/lea ecx,[local.8]
0068961A
|>|mov eax,ebx
0068961C
|>|shl eax,0x2
0068961F
|>|xor edx,edx
00689621
|>|call cangku.00409FB8
00689626
|>|mov edx,[local.8]
00689629
|>|lea eax,[local.3]
0068962C
|>|call cangku.00404D38
00689631
|>|inc ebx
00689632
|>|cmp ebx,0x4
00689635
|>\jnz short cangku.00689617
00689637
|>lea eax,[local.4]
0068963A
|>mov edx,cangku.006896C4
; 固定字符串 Canku888d66k
0068963F
|>call cangku.00404AF8
00689644
|>lea eax,[local.9]
00689647
|>push eax
00689648
|>mov ecx,0x4
0068964D
|>mov edx,0x1
00689652
|>mov eax,[local.4]
00689655
|>call cangku.00404F90
0068965A
|>push [local.9]
0068965D
|>push cangku.006896DC
;
-
00689662
|>push [local.2]
00689665
|>lea eax,[local.10]
00689668
|>push eax
00689669
|>mov ecx,0x5
0068966E
|>mov edx,0x5
00689673
|>mov eax,[local.4]
00689676
|>call cangku.00404F90
0068967B
|>push [local.10]
0068967E
|>push cangku.006896DC
;
-
00689683
|>push [local.3]
00689686
|>mov eax,edi
00689688
|>mov edx,0x6
0068968D
|>call cangku.00404DF0
00689692
|>xor eax,eax
00689694
|>pop edx
00689695
|>pop ecx
00689696
|>pop ecx
00689697
|>mov dword ptr fs:[eax],edx
0068969A
|>push cangku.006896B4
0068969F
|>lea eax,[local.10]
006896A2
|>mov edx,0xA
006896A7
|>call cangku.00404A84
006896AC
\>retn
最后将固定字符串 Canku888d66k和从机器码中得来的2个字符串拼成正确的注册码，例如我的注册码为：Cank-1303u888d-0303，实际上注册码计算只用到机器码的最后4位。下面给出c版的注册机：int main(){
char str[8];
char key[20];
char code[20];
unsigned char
temp;
int i;
int n=0;
int len;
printf("请输入机器码\n");
gets(key);
len=strlen(key);
if(len<=0)
{
return 0;
}
for( i=len-1;i>=len-4;i--)
{
temp=(unsigned char)key%16;
str[n]=temp;
n++;
temp=((unsigned char)key)>>4;
str[n]=temp;
n++;
}
code[0]='C';
code[1]='a';
code[2]='n';
code[3]='k';
code[4]='-';
for( i=0;i<=3;i++)
{
code[i+5]=0x30+str;
}
code[9]='u';
code[10]='8';
code[11]='8';
code[12]='8';
code[13]='d';
code[14]='-';
for( i=4;i<=7;i++)
{
code[i+11]=0x30+str;
}
code[19]='\0';
puts(code);
getchar();
return 0;}头文件我就不提供了，算法简单适新手玩一玩。--------------------------------------------------------------------------------
【版权声明】: 本文原创于asmstock, 转载请注明作者并保持文章的完整, 谢谢!
2011年10月9日
发表于 2011-10-9 15:30
