去水印软件 Inpaint 5.2 算法分析和Delphi注册机源码

小试锋芒 · 发表于 2013-8-12 14:51

Inpaint(去水印软件)是一款去除图片背景中瑕疵的图片处理软件。如果你的图片中有一些你不满意的瑕疵，你不必动用庞大PS来兴师动众处理，只需要使用Teorex.Inpaint就可以轻松搞定。运用选择工具选取你希望去除的对象，然后选择伪装，Inpaint(去水印软件)就会自动计算去除对象周围背景的颜色和分布，利用周围的背景自动填充你去除的对象，从而使你的图片看上去非常完美，让瑕疵轻松去除，不留痕迹。
截图01.jpg

1、PEID查壳：Microsoft Visual C++ v6.0 。

2、输入任意假码，弹出错误提示，如下图：
截图02.jpg

3、搜索该错误提示字符串，来到关键代码段：

[ColdFusion] 纯文本查看 复制代码

00479390  /$  55            push ebp
00479391  |.  8BEC          mov ebp,esp
00479393  |.  6A FF         push -1
00479395  |.  68 C8FBAC00   push Inpaint.00ACFBC8                    ;  SE 句柄安装
0047939A  |.  64:A1 0000000>mov eax,dword ptr fs:[0]
004793A0  |.  50            push eax
004793A1  |.  64:8925 00000>mov dword ptr fs:[0],esp
004793A8  |.  83EC 0C       sub esp,0C
004793AB  |.  56            push esi
004793AC  |.  8BF1          mov esi,ecx
004793AE  |.  8B45 08       mov eax,[arg.1]
004793B1  |.  8378 08 00    cmp dword ptr ds:[eax+8],0
004793B5  |.  C745 FC 00000>mov [local.1],0
004793BC  |.  0F84 EA000000 je Inpaint.004794AC
004793C2  |.  8D4D 08       lea ecx,[arg.1]
004793C5  |.  51            push ecx                                 ; /Arg1
004793C6  |.  E8 B5BDFFFF   call Inpaint.00475180                    ; \算法关键CALL
004793CB  |.  83C4 04       add esp,4
004793CE  |.  84C0          test al,al
004793D0  |.  0F84 D6000000 je Inpaint.004794AC                      ;  不能跳
004793D6  |.  8B8E 88010000 mov ecx,dword ptr ds:[esi+188]
004793DC  |.  6A 00         push 0
004793DE  |.  E8 6D3F1900   call Inpaint.0060D350
004793E3  |.  8B8E 8C010000 mov ecx,dword ptr ds:[esi+18C]
004793E9  |.  6A 00         push 0
004793EB  |.  E8 603F1900   call Inpaint.0060D350
004793F0  |.  8D4D 08       lea ecx,[arg.1]
004793F3  |.  51            push ecx
004793F4  |.  8D4E 14       lea ecx,dword ptr ds:[esi+14]
004793F7  |.  E8 64ED5600   call Inpaint.009E8160
004793FC  |.  6A FF         push -1
004793FE  |.  68 3C41BD00   push Inpaint.00BD413C                    ;  ASCII  "Inpaint"
00479403  |.  E8 48005400   call Inpaint.009B9450
00479408  |.  8945 F0       mov [local.4],eax                        ; |
0047940B  |.  6A 00         push 0                                   ; |Arg3 = 00000000
0047940D  |.  8D55 EC       lea edx,[local.5]                        ; |
00479410  |.  68 8C4EBD00   push Inpaint.00BD4E8C                    ; |Arg2 = 00BD4E8C ASCII  " Thank you for registering!"
00479415  |.  52            push edx                                 ; |Arg1
00479416  |.  C645 FC 03    mov byte ptr ss:[ebp-4],3                ; |
0047941A  |.  E8 41ADFFFF   call Inpaint.00474160                    ; \Inpaint.00474160
0047941F  |.  83C4 14       add esp,14
00479422  |.  6A 00         push 0
00479424  |.  51            push ecx
00479425  |.  8BCC          mov ecx,esp
00479427  |.  8965 E8       mov [local.6],esp
0047942A  |.  50            push eax
0047942B  |.  8D45 F0       lea eax,[local.4]
0047942E  |.  50            push eax
0047942F  |.  56            push esi
00479430  |.  C645 FC 04    mov byte ptr ss:[ebp-4],4
00479434  |.  C701 00040000 mov dword ptr ds:[ecx],400
0047943A  |.  E8 91BA1B00   call Inpaint.00634ED0
0047943F  |.  8B4D EC       mov ecx,[local.5]
00479442  |.  83C4 14       add esp,14
00479445  |.  C645 FC 03    mov byte ptr ss:[ebp-4],3
00479449  |.  83CA FF       or edx,FFFFFFFF
0047944C  |.  F0:0FC111     lock xadd dword ptr ds:[ecx],edx
00479450  |.  75 0C         jnz short Inpaint.0047945E
00479452  |.  8B45 EC       mov eax,[local.5]
00479455  |.  50            push eax
00479456  |.  E8 F5DC5300   call Inpaint.009B7150
0047945B  |.  83C4 04       add esp,4
0047945E  |>  8B4D F0       mov ecx,[local.4]
00479461  |.  C645 FC 00    mov byte ptr ss:[ebp-4],0
00479465  |.  83CA FF       or edx,FFFFFFFF
00479468  |.  F0:0FC111     lock xadd dword ptr ds:[ecx],edx
0047946C  |.  75 0C         jnz short Inpaint.0047947A
0047946E  |.  8B45 F0       mov eax,[local.4]
00479471  |.  50            push eax
00479472  |.  E8 D9DC5300   call Inpaint.009B7150
00479477  |.  83C4 04       add esp,4
0047947A  |>  8B4D 08       mov ecx,[arg.1]
0047947D  |.  C745 FC FFFFF>mov [local.1],-1
00479484  |.  83CA FF       or edx,FFFFFFFF
00479487  |.  F0:0FC111     lock xadd dword ptr ds:[ecx],edx
0047948B  |.  75 0C         jnz short Inpaint.00479499
0047948D  |.  8B45 08       mov eax,[arg.1]
00479490  |.  50            push eax
00479491  |.  E8 BADC5300   call Inpaint.009B7150
00479496  |.  83C4 04       add esp,4
00479499  |>  B0 01         mov al,1
0047949B  |.  8B4D F4       mov ecx,[local.3]
0047949E  |.  64:890D 00000>mov dword ptr fs:[0],ecx
004794A5  |.  5E            pop esi
004794A6  |.  8BE5          mov esp,ebp
004794A8  |.  5D            pop ebp
004794A9  |.  C2 0400       retn 4
004794AC  |>  6A FF         push -1
004794AE  |.  68 3C41BD00   push Inpaint.00BD413C                    ;  ASCII "Inpaint"
004794B3  |.  E8 98FF5300   call Inpaint.009B9450
004794B8  |.  8945 F0       mov [local.4],eax                        ; |
004794BB  |.  6A 00         push 0                                   ; |Arg3 = 00000000
004794BD  |.  8D55 EC       lea edx,[local.5]                        ; |
004794C0  |.  68 5C4EBD00   push Inpaint.00BD4E5C                    ; |Arg2 = 00BD4E5C ASCII "Serial key is invalid. Please check all fields."
004794C5  |.  52            push edx                                 ; |Arg1
004794C6  |.  C645 FC 01    mov byte ptr ss:[ebp-4],1                ; |
004794CA  |.  E8 91ACFFFF   call Inpaint.00474160                    ; \Inpaint.00474160
004794CF  |.  83C4 14       add esp,14
004794D2  |.  6A 00         push 0
004794D4  |.  51            push ecx
004794D5  |.  8BCC          mov ecx,esp
004794D7  |.  8965 E8       mov [local.6],esp
004794DA  |.  50            push eax

4、跟进算法CALL：

[ColdFusion] 纯文本查看 复制代码

00475180  /$  55            push ebp
00475181  |.  8BEC          mov ebp,esp
00475183  |.  83EC 08       sub esp,8
00475186  |.  56            push esi
00475187  |.  8B75 08       mov esi,[arg.1]
0047518A  |.  8B06          mov eax,dword ptr ds:[esi]
0047518C  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
0047518F  |.  0FB751 02     movzx edx,word ptr ds:[ecx+2]
00475193  |.  66:8955 FC    mov word ptr ss:[ebp-4],dx
00475197  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
0047519A  |.  0FB711        movzx edx,word ptr ds:[ecx]
0047519D  |.  66:8955 FE    mov word ptr ss:[ebp-2],dx
004751A1  |.  8B40 0C       mov eax,dword ptr ds:[eax+C]
004751A4  |.  66:8B08       mov cx,word ptr ds:[eax]
004751A7  |.  66:894D 0A    mov word ptr ss:[ebp+A],cx
004751AB  |.  57            push edi
004751AC  |.  8D4D 0A       lea ecx,dword ptr ss:[ebp+A]
004751AF  |.  E8 9C2E5400   call Inpaint.009B8050                    ;  Reg[1]
004751B4  |.  8D4D FE       lea ecx,dword ptr ss:[ebp-2]
004751B7  |.  0FBEF8        movsx edi,al
004751BA  |.  E8 912E5400   call Inpaint.009B8050
004751BF  |.  0FBEC8        movsx ecx,al                             ;  n1 := Byte(RegCode[1])
004751C2  |.  0FAFCF        imul ecx,edi
004751C5  |.  8BC1          mov eax,ecx
004751C7  |.  C1E0 05       shl eax,5                                ;  n2 := (n1*n1)*32
004751CA  |.  03C1          add eax,ecx                              ;  n3 := n2+(n1*n1)
004751CC  |.  99            cdq
004751CD  |.  B9 19000000   mov ecx,19
004751D2  |.  F7F9          idiv ecx                                 ;  n4 := n3 mod $19
004751D4  |.  8D4D FC       lea ecx,[local.1]
004751D7  |.  8D7A 41       lea edi,dword ptr ds:[edx+41]            ;  n5 := n4+$41
004751DA  |.  E8 712E5400   call Inpaint.009B8050
004751DF  |.  0FBED0        movsx edx,al                             ;  RegCode[2] := Char(n5)
004751E2  |.  3BD7          cmp edx,edi
004751E4  |.  74 08         je short Inpaint.004751EE
004751E6  |>  5F            pop edi
004751E7  |.  32C0          xor al,al
004751E9  |.  5E            pop esi
004751EA  |.  8BE5          mov esp,ebp
004751EC  |.  5D            pop ebp
004751ED  |.  C3            retn
004751EE  |>  8B06          mov eax,dword ptr ds:[esi]
004751F0  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
004751F3  |.  0FB751 04     movzx edx,word ptr ds:[ecx+4]
004751F7  |.  66:8955 FE    mov word ptr ss:[ebp-2],dx
004751FB  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
004751FE  |.  0FB711        movzx edx,word ptr ds:[ecx]
00475201  |.  66:8955 FC    mov word ptr ss:[ebp-4],dx
00475205  |.  8B40 0C       mov eax,dword ptr ds:[eax+C]
00475208  |.  66:8B48 02    mov cx,word ptr ds:[eax+2]
0047520C  |.  66:894D 0A    mov word ptr ss:[ebp+A],cx
00475210  |.  8D4D 0A       lea ecx,dword ptr ss:[ebp+A]
00475213  |.  E8 382E5400   call Inpaint.009B8050
00475218  |.  8D4D FC       lea ecx,[local.1]
0047521B  |.  0FBEF8        movsx edi,al
0047521E  |.  E8 2D2E5400   call Inpaint.009B8050
00475223  |.  0FBEC0        movsx eax,al
00475226  |.  0FAFC7        imul eax,edi                             ;  n1 :=  Byte(RegCode[1]) * Byte(RegCode[2])
00475229  |.  6BC0 15       imul eax,eax,15                          ;  n2 := n1*$15
0047522C  |.  99            cdq
0047522D  |.  B9 19000000   mov ecx,19
00475232  |.  F7F9          idiv ecx                                 ;  n3 := n2 mod $19
00475234  |.  8D4D FE       lea ecx,dword ptr ss:[ebp-2]
00475237  |.  8D7A 41       lea edi,dword ptr ds:[edx+41]            ;  n4 := n3+$41
0047523A  |.  E8 112E5400   call Inpaint.009B8050
0047523F  |.  0FBED0        movsx edx,al                             ;  RegCode[3] := Char(n4)
00475242  |.  3BD7          cmp edx,edi
00475244  |.^ 75 A0         jnz short Inpaint.004751E6
00475246  |.  8B06          mov eax,dword ptr ds:[esi]
00475248  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
0047524B  |.  66:8B51 06    mov dx,word ptr ds:[ecx+6]
0047524F  |.  66:8955 FC    mov word ptr ss:[ebp-4],dx
00475253  |.  8B40 0C       mov eax,dword ptr ds:[eax+C]
00475256  |.  66:8B48 04    mov cx,word ptr ds:[eax+4]
0047525A  |.  66:894D 0A    mov word ptr ss:[ebp+A],cx
0047525E  |.  8D4D 0A       lea ecx,dword ptr ss:[ebp+A]
00475261  |.  E8 EA2D5400   call Inpaint.009B8050
00475266  |.  0FBEC0        movsx eax,al
00475269  |.  8D0480        lea eax,dword ptr ds:[eax+eax*4]         ;  n1 :=  Byte(RegCode[3]) * 5
0047526C  |.  99            cdq
0047526D  |.  B9 19000000   mov ecx,19
00475272  |.  F7F9          idiv ecx                                 ;  n2 := n1 mod $19
00475274  |.  8D4D FC       lea ecx,[local.1]
00475277  |.  8D7A 41       lea edi,dword ptr ds:[edx+41]            ;  n3 := n2 + $41
0047527A  |.  E8 D12D5400   call Inpaint.009B8050
0047527F  |.  0FBED0        movsx edx,al                             ;  RegCode[4] := Char(n3)
00475282  |.  3BD7          cmp edx,edi
00475284  |.^ 0F85 5CFFFFFF jnz Inpaint.004751E6
0047528A  |.  8B06          mov eax,dword ptr ds:[esi]
0047528C  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
0047528F  |.  0FB751 0A     movzx edx,word ptr ds:[ecx+A]
00475293  |.  66:8955 FA    mov word ptr ss:[ebp-6],dx
00475297  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
0047529A  |.  0FB751 04     movzx edx,word ptr ds:[ecx+4]
0047529E  |.  66:8955 FE    mov word ptr ss:[ebp-2],dx
004752A2  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
004752A5  |.  0FB751 06     movzx edx,word ptr ds:[ecx+6]
004752A9  |.  66:8955 FC    mov word ptr ss:[ebp-4],dx
004752AD  |.  8B40 0C       mov eax,dword ptr ds:[eax+C]
004752B0  |.  66:8B48 06    mov cx,word ptr ds:[eax+6]
004752B4  |.  66:894D 0A    mov word ptr ss:[ebp+A],cx
004752B8  |.  53            push ebx
004752B9  |.  8D4D 0A       lea ecx,dword ptr ss:[ebp+A]
004752BC  |.  E8 8F2D5400   call Inpaint.009B8050
004752C1  |.  8D4D FC       lea ecx,[local.1]
004752C4  |.  0FBED8        movsx ebx,al
004752C7  |.  E8 842D5400   call Inpaint.009B8050
004752CC  |.  0FBEF8        movsx edi,al
004752CF  |.  8D4D FE       lea ecx,dword ptr ss:[ebp-2]
004752D2  |.  0FAFFB        imul edi,ebx                             ;  n1 := Byte(RegCode[4]) * Byte(RegCode[4])
004752D5  |.  E8 762D5400   call Inpaint.009B8050
004752DA  |.  0FBEC0        movsx eax,al
004752DD  |.  0FAFC7        imul eax,edi                             ;  n2 := n1 *  Byte(RegCode[3])
004752E0  |.  6BC0 0D       imul eax,eax,0D                          ;  n3 := n2 * $d
004752E3  |.  99            cdq
004752E4  |.  B9 19000000   mov ecx,19
004752E9  |.  F7F9          idiv ecx                                 ;  n4 := n3 mod $19
004752EB  |.  8D4D FA       lea ecx,dword ptr ss:[ebp-6]
004752EE  |.  8D7A 41       lea edi,dword ptr ds:[edx+41]            ;   n5 := n4 + $41
004752F1  |.  E8 5A2D5400   call Inpaint.009B8050
004752F6  |.  0FBED0        movsx edx,al                             ;  RegCode[6] := Char(n5)
004752F9  |.  5B            pop ebx
004752FA  |.  3BD7          cmp edx,edi
004752FC  |.^ 0F85 E4FEFFFF jnz Inpaint.004751E6
00475302  |.  8B06          mov eax,dword ptr ds:[esi]
00475304  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
00475307  |.  0FB751 0C     movzx edx,word ptr ds:[ecx+C]
0047530B  |.  66:8955 FC    mov word ptr ss:[ebp-4],dx
0047530F  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
00475312  |.  0FB751 08     movzx edx,word ptr ds:[ecx+8]
00475316  |.  66:8955 FA    mov word ptr ss:[ebp-6],dx
0047531A  |.  8B40 0C       mov eax,dword ptr ds:[eax+C]
0047531D  |.  66:8B48 0A    mov cx,word ptr ds:[eax+A]
00475321  |.  66:894D 0A    mov word ptr ss:[ebp+A],cx
00475325  |.  8D4D 0A       lea ecx,dword ptr ss:[ebp+A]
00475328  |.  E8 232D5400   call Inpaint.009B8050
0047532D  |.  8D4D FA       lea ecx,dword ptr ss:[ebp-6]
00475330  |.  0FBEF8        movsx edi,al
00475333  |.  E8 182D5400   call Inpaint.009B8050
00475338  |.  0FBED0        movsx edx,al
0047533B  |.  8D843A 000100>lea eax,dword ptr ds:[edx+edi+100]       ;  n1 := Byte(RegCode[5]) + Byte(RegCode[6]) + $100
00475342  |.  99            cdq
00475343  |.  B9 19000000   mov ecx,19
00475348  |.  F7F9          idiv ecx                                 ;  n2 := n1 mod $19
0047534A  |.  8D4D FC       lea ecx,[local.1]
0047534D  |.  8D7A 41       lea edi,dword ptr ds:[edx+41]            ;  n3 := n2 + $41
00475350  |.  E8 FB2C5400   call Inpaint.009B8050
00475355  |.  0FBED0        movsx edx,al                             ;   RegCode[7] := Char(n3)
00475358  |.  3BD7          cmp edx,edi
0047535A  |.^ 0F85 86FEFFFF jnz Inpaint.004751E6
00475360  |.  8B06          mov eax,dword ptr ds:[esi]
00475362  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
00475365  |.  0FB751 0E     movzx edx,word ptr ds:[ecx+E]
00475369  |.  66:8955 FE    mov word ptr ss:[ebp-2],dx
0047536D  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
00475370  |.  0FB751 0A     movzx edx,word ptr ds:[ecx+A]
00475374  |.  66:8955 FC    mov word ptr ss:[ebp-4],dx
00475378  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
0047537B  |.  0FB751 0C     movzx edx,word ptr ds:[ecx+C]
0047537F  |.  66:8955 FA    mov word ptr ss:[ebp-6],dx
00475383  |.  8B40 0C       mov eax,dword ptr ds:[eax+C]
00475386  |.  66:8B48 0A    mov cx,word ptr ds:[eax+A]
0047538A  |.  66:894D 0A    mov word ptr ss:[ebp+A],cx
0047538E  |.  8D4D 0A       lea ecx,dword ptr ss:[ebp+A]
00475391  |.  E8 BA2C5400   call Inpaint.009B8050
00475396  |.  8D4D FA       lea ecx,dword ptr ss:[ebp-6]
00475399  |.  0FBEF8        movsx edi,al
0047539C  |.  E8 AF2C5400   call Inpaint.009B8050
004753A1  |.  0FBED0        movsx edx,al
004753A4  |.  8D4D FC       lea ecx,[local.1]
004753A7  |.  03FA          add edi,edx
004753A9  |.  E8 A22C5400   call Inpaint.009B8050
004753AE  |.  0FBEC0        movsx eax,al
004753B1  |.  03C7          add eax,edi                              ;  n1 :=  Byte(RegCode[6]) + Byte(RegCode[7]) +  Byte(RegCode[6])
004753B3  |.  99            cdq
004753B4  |.  B9 19000000   mov ecx,19
004753B9  |.  F7F9          idiv ecx                                 ;  n2 := n1 mod $19
004753BB  |.  8D4D FE       lea ecx,dword ptr ss:[ebp-2]
004753BE  |.  8D7A 41       lea edi,dword ptr ds:[edx+41]            ;  n3 := n2 + $41
004753C1  |.  E8 8A2C5400   call Inpaint.009B8050
004753C6  |.  0FBED0        movsx edx,al                             ;  RegCode[8] :=  Char(n3)
004753C9  |.  3BD7          cmp edx,edi
004753CB  |.^ 0F85 15FEFFFF jnz Inpaint.004751E6
004753D1  |.  8B06          mov eax,dword ptr ds:[esi]
004753D3  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
004753D6  |.  0FB751 12     movzx edx,word ptr ds:[ecx+12]
004753DA  |.  66:8955 FC    mov word ptr ss:[ebp-4],dx
004753DE  |.  8B48 0C       mov ecx,dword ptr ds:[eax+C]
004753E1  |.  0FB751 10     movzx edx,word ptr ds:[ecx+10]
004753E5  |.  66:8955 FA    mov word ptr ss:[ebp-6],dx
004753E9  |.  8B40 0C       mov eax,dword ptr ds:[eax+C]
004753EC  |.  66:8B48 10    mov cx,word ptr ds:[eax+10]
004753F0  |.  66:894D 0A    mov word ptr ss:[ebp+A],cx
004753F4  |.  8D4D 0A       lea ecx,dword ptr ss:[ebp+A]
004753F7  |.  E8 542C5400   call Inpaint.009B8050
004753FC  |.  8D4D FA       lea ecx,dword ptr ss:[ebp-6]
004753FF  |.  0FBEF8        movsx edi,al
00475402  |.  E8 492C5400   call Inpaint.009B8050
00475407  |.  0FBEC0        movsx eax,al
0047540A  |.  0FAFC7        imul eax,edi                             ;  n1 := Byte(RegCode[9]) * Byte(RegCode[9])
0047540D  |.  99            cdq
0047540E  |.  B9 19000000   mov ecx,19
00475413  |.  F7F9          idiv ecx                                 ;  n2 := n1 mod $19
00475415  |.  8D4D FC       lea ecx,[local.1]
00475418  |.  8D7A 41       lea edi,dword ptr ds:[edx+41]            ;  n3 := n2 + $41
0047541B  |.  E8 302C5400   call Inpaint.009B8050
00475420  |.  0FBED0        movsx edx,al                             ;  RegCode[10] := Char(n3)
00475423  |.  3BD7          cmp edx,edi
00475425  |.^ 0F85 BBFDFFFF jnz Inpaint.004751E6
0047542B  |.  8B36          mov esi,dword ptr ds:[esi]
0047542D  |.  8B46 0C       mov eax,dword ptr ds:[esi+C]
00475430  |.  0FB748 14     movzx ecx,word ptr ds:[eax+14]
00475434  |.  66:894D FE    mov word ptr ss:[ebp-2],cx
00475438  |.  8B56 0C       mov edx,dword ptr ds:[esi+C]
0047543B  |.  66:8B42 0C    mov ax,word ptr ds:[edx+C]
0047543F  |.  66:8945 FC    mov word ptr ss:[ebp-4],ax
00475443  |.  8B4E 0C       mov ecx,dword ptr ds:[esi+C]
00475446  |.  66:8B51 0E    mov dx,word ptr ds:[ecx+E]
0047544A  |.  66:8955 FA    mov word ptr ss:[ebp-6],dx
0047544E  |.  8B46 0C       mov eax,dword ptr ds:[esi+C]
00475451  |.  0FB748 10     movzx ecx,word ptr ds:[eax+10]
00475455  |.  66:894D 0A    mov word ptr ss:[ebp+A],cx
00475459  |.  8D4D 0A       lea ecx,dword ptr ss:[ebp+A]
0047545C  |.  E8 EF2B5400   call Inpaint.009B8050
00475461  |.  8D4D FA       lea ecx,dword ptr ss:[ebp-6]
00475464  |.  0FBEF0        movsx esi,al
00475467  |.  E8 E42B5400   call Inpaint.009B8050
0047546C  |.  0FBED0        movsx edx,al
0047546F  |.  8D4D FC       lea ecx,[local.1]
00475472  |.  03F2          add esi,edx
00475474  |.  E8 D72B5400   call Inpaint.009B8050
00475479  |.  0FBEC0        movsx eax,al
0047547C  |.  8D8430 E90100>lea eax,dword ptr ds:[eax+esi+1E9]       ;  n1 := Byte(RegCode[7]) + Byte(RegCode[8])+ Byte(RegCode[9]) + $1e9
00475483  |.  99            cdq
00475484  |.  B9 19000000   mov ecx,19
00475489  |.  F7F9          idiv ecx                                 ;  n2 := n1 mod $19
0047548B  |.  8D4D FE       lea ecx,dword ptr ss:[ebp-2]
0047548E  |.  8D72 41       lea esi,dword ptr ds:[edx+41]            ;  n3 := n2 + $41
00475491  |.  E8 BA2B5400   call Inpaint.009B8050
00475496  |.  0FBED0        movsx edx,al                             ;  RegCode[11] := Char(n3)
00475499  |.  3BD6          cmp edx,esi
0047549B  |.  5F            pop edi
0047549C  |.  0F94C0        sete al
0047549F  |.  5E            pop esi
004754A0  |.  8BE5          mov esp,ebp
004754A2  |.  5D            pop ebp
004754A3  \.  C3            retn

算法小结：
1、注册码由32位大写字母组成。
2、其中第1、5、9、12~32位没有限制，可以为任意字母。
3、其余位数的字母由相关运算产生，详见源码。

DELPHI注册机源码：

[Delphi] 纯文本查看 复制代码

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls, Menus, jpeg, ExtCtrls, Buttons;

type
  TForm1 = class(TForm)
    img1: TImage;
    grp1: TGroupBox;
    lbl1: TLabel;
    lbl2: TLabel;
    Edit1: TEdit;
    btn1: TBitBtn;
    lbl3: TLabel;
    procedure btn1Click(Sender: TObject);

  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation


{$R *.dfm}


procedure TForm1.btn1Click(Sender: TObject);
var
  CapitalLetters, RegCode : string;
  n1,n2,n3,n4,n5 : Integer;
  i,j : Integer;
begin
  //初始化
  RegCode := '********************************';
  CapitalLetters := 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';

  //随机产生RegCode[1]
  RegCode[1] := CapitalLetters[Random(25)+1];

  //计算生成 RegCode[2]
  n1 := Byte(RegCode[1]);
  n2 := (n1*n1)*32 ;
  n3 := n2+(n1*n1);
  n4 := n3 mod $19 ;
  n5 := n4+$41;
  RegCode[2] := Char(n5);

  //计算生成 RegCode[3]
  n1 :=  Byte(RegCode[1]) * Byte(RegCode[2]);
  n2 := n1*$15;
  n3 := n2 mod $19;
  n4 := n3+$41;
  RegCode[3] := Char(n4);

  //计算生成RegCode[4]
  n1 :=  Byte(RegCode[3]) * 5;
  n2 := n1 mod $19;
  n3 := n2 + $41;
  RegCode[4] := Char(n3);

  //随机产生RegCode[5]
  RegCode[5] := CapitalLetters[Random(25)+1];

  //计算生成RegCode[6]
  n1 := Byte(RegCode[4]) * Byte(RegCode[4]);
  n2 := n1 *  Byte(RegCode[3]);
  n3 := n2 * $d;
  n4 := n3 mod $19;
  n5 := n4 + $41;
  RegCode[6] := Char(n5);

  //计算生成RegCode[7]
  n1 := Byte(RegCode[5]) + Byte(RegCode[6]) + $100;
  n2 := n1 mod $19;
  n3 := n2 + $41;
  RegCode[7] := Char(n3);

  //计算生成RegCode[8]
  n1 :=  Byte(RegCode[6]) + Byte(RegCode[7]) +  Byte(RegCode[6]);
  n2 := n1 mod $19;
  n3 := n2 + $41;
  RegCode[8] :=  Char(n3);

  //随机产生RegCode[9]
  RegCode[9] := CapitalLetters[Random(25)+1];

  //计算生成RegCode[10]
  n1 := Byte(RegCode[9]) * Byte(RegCode[9]);
  n2 := n1 mod $19;
  n3 := n2 + $41;
  RegCode[10] := Char(n3);

  //计算生成RegCode[11]
  n1 := Byte(RegCode[7]) + Byte(RegCode[8])+ Byte(RegCode[9]) + $1e9;
  n2 := n1 mod $19;
  n3 := n2 + $41;
  RegCode[11] := Char(n3);

  //随机产生RegCode[12]~RegCode[32]
  for i := 12 to 32 do
  begin
    RegCode[i] := CapitalLetters[Random(25)+1];
  end;

  Edit1.Text := RegCode;
end;

end.

附上一组注册码：
ENWKIATOLBDGUGMDVHTYMWUADDMAOATQ

截图03.jpg

601541097 · 发表于 2013-8-12 15:01

如果真的如楼主所说那真的不错我经常去盗版图片

LoongKing · 发表于 2013-8-12 15:05

膜拜算法分析，做个视频教程更刺激，破文感觉不是很明鸟，可能是没有OD的颜色.........

一曲经年 · 发表于 2013-8-12 15:38

谢谢分享。

老海 · 发表于 2013-8-12 15:46

谢谢楼主的分享，很好的分析。

吾爱扣扣 · 发表于 2013-8-12 15:47

论坛惊现算法男！哇，膜拜

1354669803 · 发表于 2013-8-12 17:03

这些鬼算法看得我头晕啊

Demo · 发表于 2013-8-12 18:49

但求爆版啊

amulin · 发表于 2013-8-12 20:43

膜拜看得懂算法的大大

GGLHY · 发表于 2013-8-16 14:44

膜拜算法男！

帐号		自动登录	找回密码
密码			注册[Register]

[原创] 去水印软件 Inpaint 5.2 算法分析和Delphi注册机源码

免费评分