好友
阅读权限35
听众
最后登录1970-1-1
|
〖破文标题〗: 闪电-AVI视频转换器V4.0.5 算法分析
〖破文作者〗: Null
〖联系邮箱〗: null_vbt@163.com
〖作者主页〗: http://hi.baidu.com/null_vbt
〖保护方式〗: ASPack 2.1
〖下载地址〗: http://www.duote.com/soft/21289.html
〖编写语言〗: Borland Delphi 6.0 - 7.0
〖软件介绍〗: 1.支持将各种视频转换为MOV, QT, MKV, MPEG, DAT,RM 视频格式。
2.支持将各种视频转换为AVI, DivX, Xvid, H264 视频格式。
3.支持将各种视频转换为MPEG1, MPEG2, MPEG4, MP4 视频格式。
4.支持将各种视频转换为VCD, SVCD, DVD 视频格式。
〖作者声明〗: 适合吾等新手玩的玩意。
-----------------------------------------------------------------------------------
〖详细过程〗:
ESP脱壳不说了，找注册事件也不用说了，下面就是注册事件段代码：
00552D2C /$ 55 push ebp
00552D2D |. 8BEC mov ebp,esp
00552D2F |. 83C4 E8 add esp,-0x18
00552D32 |. 53 push ebx
00552D33 |. 56 push esi
00552D34 |. 33D2 xor edx,edx
00552D36 |. 8955 E8 mov [local.6],edx
00552D39 |. 8955 EC mov [local.5],edx
00552D3C |. 8955 F4 mov [local.3],edx
00552D3F |. 8945 FC mov [local.1],eax
00552D42 |. 33C0 xor eax,eax
00552D44 |. 55 push ebp
00552D45 |. 68 2B2E5500 push 1234.00552E2B
00552D4A |. 64:FF30 push dword ptr fs:[eax]
00552D4D |. 64:8920 mov dword ptr fs:[eax],esp
00552D50 |. 33DB xor ebx,ebx
00552D52 |. 8D55 F4 lea edx,[local.3]
00552D55 |. 8B45 FC mov eax,[local.1]
00552D58 |. 8B80 0C030000 mov eax,dword ptr ds:[eax+0x30C]
00552D5E |. E8 3944F1FF call 1234.0046719C ; 取用户名
00552D63 |. 8B45 F4 mov eax,[local.3]
00552D66 |. E8 2D1AEBFF call 1234.00404798
00552D6B |. 8BF0 mov esi,eax
00552D6D |. 85F6 test esi,esi
00552D6F |. 7E 38 jle short 1234.00552DA9
00552D71 |. C745 F0 01000>mov [local.4],0x1
00552D78 |> 8D45 EC /lea eax,[local.5]
00552D7B |. 50 |push eax
00552D7C |. B9 01000000 |mov ecx,0x1
00552D81 |. 8B55 F0 |mov edx,[local.4]
00552D84 |. 8B45 F4 |mov eax,[local.3]
00552D87 |. E8 6C1CEBFF |call 1234.004049F8
00552D8C |. 8B45 EC |mov eax,[local.5]
00552D8F |. E8 041CEBFF |call 1234.00404998
00552D94 |. 8A00 |mov al,byte ptr ds:[eax]
00552D96 |. 25 FF000000 |and eax,0xFF
00552D9B |. 03D8 |add ebx,eax
00552D9D |. 81F3 05FA0B00 |xor ebx,0xBFA05
00552DA3 |. FF45 F0 |inc [local.4]
00552DA6 |. 4E |dec esi
00552DA7 |.^ 75 CF \jnz short 1234.00552D78
00552DA9 |> A1 20B55500 mov eax,dword ptr ds:[0x55B520]
00552DAE |. 8BD0 mov edx,eax
00552DB0 |. C1E0 04 shl eax,0x4
00552DB3 |. 03C2 add eax,edx
00552DB5 |. 03D8 add ebx,eax
00552DB7 |. 81C3 D4A31300 add ebx,0x13A3D4
00552DBD |. 81F3 8DED5900 xor ebx,0x59ED8D
00552DC3 |. 8D55 E8 lea edx,[local.6]
00552DC6 |. 8B45 FC mov eax,[local.1]
00552DC9 |. 8B80 10030000 mov eax,dword ptr ds:[eax+0x310]
00552DCF |. E8 C843F1FF call 1234.0046719C ; 取注册码
00552DD4 |. 8B45 E8 mov eax,[local.6]
00552DD7 |. E8 F063EBFF call 1234.004091CC
00552DDC |. 8BF3 mov esi,ebx
00552DDE |. 81F6 2473C400 xor esi,0xC47324
00552DE4 |. 3BC6 cmp eax,esi
00552DE6 |. 75 19 jnz short 1234.00552E01
00552DE8 |. C645 FB 01 mov byte ptr ss:[ebp-0x5],0x1
00552DEC |. B8 18B55500 mov eax,1234.0055B518
00552DF1 |. 8B55 F4 mov edx,[local.3]
00552DF4 |. E8 3317EBFF call 1234.0040452C
00552DF9 |. 8935 1CB55500 mov dword ptr ds:[0x55B51C],esi
00552DFF |. EB 04 jmp short 1234.00552E05
00552E01 |> C645 FB 00 mov byte ptr ss:[ebp-0x5],0x0
00552E05 |> 33C0 xor eax,eax
00552E07 |. 5A pop edx
00552E08 |. 59 pop ecx
00552E09 |. 59 pop ecx
00552E0A |. 64:8910 mov dword ptr fs:[eax],edx
00552E0D |. 68 322E5500 push 1234.00552E32
00552E12 |> 8D45 E8 lea eax,[local.6]
00552E15 |. E8 BE16EBFF call 1234.004044D8
00552E1A |. 8D45 EC lea eax,[local.5]
00552E1D |. E8 B616EBFF call 1234.004044D8
00552E22 |. 8D45 F4 lea eax,[local.3]
00552E25 |. E8 AE16EBFF call 1234.004044D8
00552E2A \. C3 retn
procedure TForm1.Button1Click(Sender: TObject);
var
i,j,k:Integer;
s:string;
begin
s:=edt1.Text;
k:=0;
for i:=1 to Length(s) do begin
j:=Ord(s[i]); //mov eax,dword ptr ds:[eax+0x310] 逐位取字符ASCII
k:=k+j; //mov esi,ebx 结果累加
k:=k xor 784901; //xor esi,0xC47324 异或
end;
k:=k+158359267+1287124; //00552DB3
k:=(k xor 5893517) xor 12874532; //00552DBD、00552DDE 两次异或
edt2.Text:=IntToStr(k); //输出注册码
end;
0048245D . 66:83BB 8A020>cmp word ptr ds:[ebx+0x28A],0x0
00482465 . 74 0E je short 1234.00482475 //跳则标题显示正式版，爆破也可以直接jmp
00482467 . 8BD3 mov edx,ebx
00482469 . 8B83 8C020000 mov eax,dword ptr ds:[ebx+0x28C]
0048246F . FF93 88020000 call dword ptr ds:[ebx+0x288]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PCPI_TEXT
-----------------------------------------------------------------------------------
〖破解总结〗:
比较简单，也没什么好总结的。
-----------------------------------------------------------------------------------
〖版权声明〗:转载请注明Null原创!
Null 2011-5-8 0:25:43
注册机下载地址：http://www.52pojie.cn/thread-90114-1-1.html
|
免费评分
-
查看全部评分
|
[复制链接]
发表于 2011-5-8 00:56
