某软件注册算法分析｀｀

小黑冰 · 发表于 2008-8-28 09:09

004B550Epush ebp
004B550Fpush Cartoon_.004B58DE
004B5514push dword ptr fs:[eax]
004B5517mov dword ptr fs:[eax],esp
004B551Alea edx,dword ptr ss:[ebp-20]
004B551Dmov eax,dword ptr ds:[ebx+300]
004B5523call Cartoon_.0043C5DC ;取注册名位数
004B5528cmp dword ptr ss:[ebp-20],0;与0比较注册名不能为空
004B552Cjnz short Cartoon_.004B5543;必须跳
004B552Emov eax,dword ptr ds:[ebx+300]
004B5534mov edx,Cartoon_.004B58F4;fill in your usercode
004B5539call Cartoon_.0043C60C
004B553Ejmp Cartoon_.004B5884
004B5543lea edx,dword ptr ss:[ebp-24]
004B5546mov eax,dword ptr ds:[ebx+304]
004B554Ccall Cartoon_.0043C5DC ;取注册码位数
004B5551cmp dword ptr ss:[ebp-24],0;与0比较注册码不能为空
004B5555jnz short Cartoon_.004B556C;必须跳
004B5557mov eax,dword ptr ds:[ebx+304]
004B555Dmov edx,Cartoon_.004B5914;fill in serial number
004B5562call Cartoon_.0043C60C
004B5567jmp Cartoon_.004B5884
004B556Clea edx,dword ptr ss:[ebp-28]
004B556Fmov eax,dword ptr ds:[ebx+300]
004B5575call Cartoon_.0043C5DC
004B557Amov eax,dword ptr ss:[ebp-28];注册名到EAX
004B557Dmov al,byte ptr ds:[eax] ;取注册名第一位
004B557Fmov byte ptr ss:[ebp-1],al ;//[EBP-1]=AL=用户名第1
004B5582lea edx,dword ptr ss:[ebp-2C]
004B5585mov eax,dword ptr ds:[ebx+300]
004B558Bcall Cartoon_.0043C5DC
004B5590mov eax,dword ptr ss:[ebp-2C];注册名到EAX
004B5593mov al,byte ptr ds:[eax+1] ;取注册名第二位到AL
004B5596mov byte ptr ss:[ebp-2],al ;EBP-2=DL=注册名第二位
004B5599lea edx,dword ptr ss:[ebp-30]
004B559Cmov eax,dword ptr ds:[ebx+300]
004B55A2call Cartoon_.0043C5DC
004B55A7mov eax,dword ptr ss:[ebp-30];注册名到EAX
004B55AAmov al,byte ptr ds:[eax+2] ;取注册名3位
004B55ADmov byte ptr ss:[ebp-3],al ;EBP-3=AL=注册名第三位
004B55B0lea edx,dword ptr ss:[ebp-34]
004B55B3mov eax,dword ptr ds:[ebx+300]
004B55B9call Cartoon_.0043C5DC
004B55BEmov eax,dword ptr ss:[ebp-34];注册名到EAX
004B55C1mov al,byte ptr ds:[eax+3] ;取注册名第四位
004B55C4mov byte ptr ss:[ebp-4],al ;EBP-4=AL=注册名第四位
004B55C7lea edx,dword ptr ss:[ebp-38]
004B55CAmov eax,dword ptr ds:[ebx+300]
004B55D0call Cartoon_.0043C5DC
004B55D5mov eax,dword ptr ss:[ebp-38];注册名到EAX
004B55D8mov al,byte ptr ds:[eax+4] ;取注册名第五位
004B55DBmov byte ptr ss:[ebp-5],al ;EBP-5=AL=注册名第五位
004B55DElea edx,dword ptr ss:[ebp-3C]
004B55E1mov eax,dword ptr ds:[ebx+300]
004B55E7call Cartoon_.0043C5DC ;↓应该可以忽略的算法我白算了哎`
004B55ECmov eax,dword ptr ss:[ebp-3C];注册名到EAX
004B55EFmov al,byte ptr ds:[eax+5] ;AL=注册名第六位
004B55F2xor edx,edx;EDX=0
004B55F4mov dl,byte ptr ss:[ebp-1] ;DL=EBP-1=注册名第一位
004B55F7add edx,2;EDX=EDX+2=79 y
004B55FAmovzx esi,byte ptr ss:[ebp-2];ESI=EBP-2=注册名第二位
004B55FEadd esi,9;ESI=ESI+9=78 x
004B5601xor ecx,ecx;ECX=0
004B5603mov cl,byte ptr ss:[ebp-3] ;CL=EBP-3=注册名第三位
004B5606inc ecx;ECX+1=62
004B5607mov dword ptr ss:[ebp-C],ecx ;EBP-C=ECX=62 b
004B560Amovzx edi,byte ptr ss:[ebp-4];EDI=EBP-4=注册名第四位
004B560Esub edi,4;EDI=EDI-4=65 e
004B5611xor ecx,ecx;ECX=0
004B5613mov cl,byte ptr ss:[ebp-5] ;CL=EBP-5=注册名第五位
004B5616dec ecx;ECX-1=6d
004B5617mov dword ptr ss:[ebp-10],ecx;EBP-10=ECX=6D m
004B561Aand eax,0FF;EAX=EAX and 0FF=69 i
004B561Fadd eax,5;EAX=EAX+5=6e n
004B5622mov byte ptr ss:[ebp-11],dl;EBP-11=DL=79 y
004B5625mov edx,esi;EDX=ESI=78 x
004B5627mov byte ptr ss:[ebp-12],dl;EBP-12=DL=78 x
004B562Amov dl,byte ptr ss:[ebp-C] ;DL=EBP-C=62 b
004B562Dmov byte ptr ss:[ebp-13],dl;EBP-12=DL=62 b
004B5630mov edx,edi;EDX=EDI=65 e
004B5632mov byte ptr ss:[ebp-14],dl;EBP-14=DL=65 e
004B5635mov dl,byte ptr ss:[ebp-10];DL=EBP-10=6D m
004B5638mov byte ptr ss:[ebp-15],dl;EBP-15=DL=6D m
004B563Bmov byte ptr ss:[ebp-16],al;EBP-16=AL=6E n
004B563Elea eax,dword ptr ss:[ebp-48]↑应该可以忽略的算法我白算了哎`
004B5641mov dl,byte ptr ss:[ebp-13];DL=EBP-13=62 b
004B5644mov byte ptr ds:[eax+1],dl ;EAX+1=DL=62 b
004B5647mov byte ptr ds:[eax],1;EAX=1
004B564Alea edx,dword ptr ss:[ebp-48]
004B564Dlea eax,dword ptr ss:[ebp-4C]
004B5650call Cartoon_.00402ED8
004B5655lea eax,dword ptr ss:[ebp-50]
004B5658mov dl,byte ptr ss:[ebp-16];DL=EBP-16=6E n
004B565Bmov byte ptr ds:[eax+1],dl ;EAX+1=DL=6E n
004B565Emov byte ptr ds:[eax],1;EAX=1
004B5661lea edx,dword ptr ss:[ebp-50]
004B5664lea eax,dword ptr ss:[ebp-4C]
004B5667mov cl,2 ;CL=2
004B5669call Cartoon_.00402EA8
004B566Elea edx,dword ptr ss:[ebp-4C]
004B5671lea eax,dword ptr ss:[ebp-44]
004B5674call Cartoon_.004047B0 ;;//取上面2个ASC值对应的字符bn
004B5679push dword ptr ss:[ebp-44] ;bn
004B567Clea edx,dword ptr ss:[ebp-54]
004B567Fmov eax,esi;EAX=ESI=78 x
004B5681call Cartoon_.00408B04 ;;//取EAX的10进制字符
004B5686push dword ptr ss:[ebp-54] ;//EAX的78=10进制字符120
004B5689lea eax,dword ptr ss:[ebp-58]
004B568Cmov dl,byte ptr ss:[ebp-15];DL=EBP-15=6D m
004B568Fcall Cartoon_.00404734
004B5694push dword ptr ss:[ebp-58]
004B5697lea eax,dword ptr ss:[ebp-5C]
004B569Amov dl,byte ptr ss:[ebp-12];DL=EBP-12=78 x
004B569Dcall Cartoon_.00404734 ;;//取EAX的10进制字符
004B56A2push dword ptr ss:[ebp-5C] ;//EAX的65=10进制字符101
004B56A5lea edx,dword ptr ss:[ebp-60]
004B56A8mov eax,edi;EAX=EDI=65 10进制为101
004B56AAcall Cartoon_.00408B04
004B56AFpush dword ptr ss:[ebp-60]
004B56B2lea eax,dword ptr ss:[ebp-64]
004B56B5mov dl,byte ptr ss:[ebp-11];DL=EBP-11=79 y
004B56B8call Cartoon_.00404734
004B56BDpush dword ptr ss:[ebp-64]
004B56C0lea eax,dword ptr ss:[ebp-68]
004B56C3mov dl,byte ptr ss:[ebp-14];DL=EBP-14=65 e
004B56C6call Cartoon_.00404734
004B56CBpush dword ptr ss:[ebp-68]
004B56CElea eax,dword ptr ss:[ebp-40]
004B56D1mov edx,7;EDX=7
004B56D6call Cartoon_.004048CC
004B56DBmov edx,dword ptr ss:[ebp-40];//上面的字符全部相连堆栈bn120mx101ye
004B56DEmov eax,dword ptr ds:[ebx+308]
004B56E4call Cartoon_.0043C60C
004B56E9lea eax,dword ptr ss:[ebp-6C]
004B56ECpush eax
004B56EDlea edx,dword ptr ss:[ebp-70]
004B56F0mov eax,dword ptr ds:[ebx+304]
004B56F6call Cartoon_.0043C5DC ;取注册码
004B56FBmov eax,dword ptr ss:[ebp-70]; |EAX=EBP-70=假码=|//试练码
004B56FEmov ecx,8; |ECX=8
004B5703mov edx,1; |EDX=1
004B5708call Cartoon_.00436328 ; \\//取试练码的1-8位
004B570Dmov eax,dword ptr ss:[ebp-6C];EAX=EBP-6C=假码12345678=//试练码的1-8位
004B5710push eax
004B5711lea eax,dword ptr ss:[ebp-74]
004B5714push eax
004B5715lea edx,dword ptr ss:[ebp-78]
004B5718mov eax,dword ptr ds:[ebx+308] ;EAX=EBX+308=FF3C30
004B571Ecall Cartoon_.0043C5DC
004B5723mov eax,dword ptr ss:[ebp-78]; |EAX=EBP-78=相连的码bn120mx101ye
004B5726mov ecx,8; |ECX=8
004B572Bmov edx,1; |EDX=1
004B5730call Cartoon_.00436328 ; \\//取相连字符串的1-8位,即真码
004B5735mov edx,dword ptr ss:[ebp-74];EDX=EBP-74=bn120mx1=//真码
004B5738pop eax;//试练码的1-8位
004B5739call Cartoon_.00404950 ;比较CALL
004B573Ejnz Cartoon_.004B5854;死亡跳
004B5744mov eax,dword ptr ds:[ebx+2FC]
004B574Amov edx,Cartoon_.004B5934;congratulation! registration is successful!
004B574Fcall Cartoon_.0043C60C
004B5754mov eax,dword ptr ds:[4CAD24]
004B5759mov eax,dword ptr ds:[eax]
004B575Bmov eax,dword ptr ds:[eax+310]
004B5761mov edx,Cartoon_.004B5968;registered
004B5766call Cartoon_.0044E68C
004B576Bmov eax,dword ptr ds:[ebx+30C]
004B5771xor edx,edx
004B5773mov ecx,dword ptr ds:[eax]
004B5775call dword ptr ds:[ecx+64]
004B5778mov eax,dword ptr ds:[ebx+310]
004B577Emov edx,Cartoon_.004B597C;close
004B5783call Cartoon_.0043C60C
004B5788mov eax,dword ptr ds:[4CA8D0]
004B578Dmov byte ptr ds:[eax],0
004B5790mov dl,1
004B5792mov eax,dword ptr ds:[474D38]
004B5797call Cartoon_.00474E38
004B579Cmov dword ptr ss:[ebp-1C],eax
004B579Fxor eax,eax
004B57A1push ebp
004B57A2push Cartoon_.004B584D
004B57A7push dword ptr fs:[eax]
004B57AAmov dword ptr fs:[eax],esp
004B57ADmov edx,80000002
004B57B2mov eax,dword ptr ss:[ebp-1C]
004B57B5call Cartoon_.00474ED8
004B57BAxor ecx,ecx
004B57BCmov edx,Cartoon_.004B598C;\software\liangzhu\cartoonmaker
004B57C1mov eax,dword ptr ss:[ebp-1C]
004B57C4call Cartoon_.00475018
004B57C9test al,al
004B57CBje short Cartoon_.004B57FE
004B57CDlea edx,dword ptr ss:[ebp-7C]
004B57D0or eax,FFFFFFFF
004B57D3call Cartoon_.00408B04
004B57D8mov ecx,dword ptr ss:[ebp-7C]
004B57DBmov edx,Cartoon_.004B59B4;times
004B57E0mov eax,dword ptr ss:[ebp-1C]
004B57E3call Cartoon_.004751B4
004B57E8mov eax,dword ptr ds:[4CAD24]
004B57EDmov eax,dword ptr ds:[eax]
004B57EFmov eax,dword ptr ds:[eax+310]
004B57F5xor edx,edx
004B57F7call Cartoon_.0044E750
004B57FCjmp short Cartoon_.004B5837
004B57FEmov edx,Cartoon_.004B598C;\software\liangzhu\cartoonmaker
004B5803mov eax,dword ptr ss:[ebp-1C]
004B5806call Cartoon_.00474F3C
004B580Bmov edx,Cartoon_.004B598C;\software\liangzhu\cartoonmaker
004B5810mov cl,1
004B5812mov eax,dword ptr ss:[ebp-1C]
004B5815call Cartoon_.00475018
004B581Alea edx,dword ptr ss:[ebp-80]
004B581Dmov eax,1
004B5822call Cartoon_.00408B04
004B5827mov ecx,dword ptr ss:[ebp-80]
004B582Amov edx,Cartoon_.004B59B4;times
004B582Fmov eax,dword ptr ss:[ebp-1C]
004B5832call Cartoon_.004751B4
004B5837xor eax,eax
004B5839pop edx
004B583Apop ecx
004B583Bpop ecx
004B583Cmov dword ptr fs:[eax],edx
004B583Fpush Cartoon_.004B5884
004B5844mov eax,dword ptr ss:[ebp-1C]
004B5847call Cartoon_.00403740
004B584Cretn
004B584Djmp Cartoon_.00403ED4
004B5852jmp short Cartoon_.004B5844
004B5854mov eax,dword ptr ds:[ebx+2FC]
004B585Amov edx,Cartoon_.004B59C4;sorry!your usercode or serialnumber is wrong!

woaini
123456789
1.注册名与注册码都不能为空
2.第一位注册码=第一位注册名ASCLL码+2=y
第二位注册码=第二位注册名ASCLL码+9=x
第三位注册码=第三位注册名ASCLL码+1=B
第四位注册码=第四位注册名ASCLL码-4=e
第五位注册码=第五位注册名ASCLL码-1=m
利用一个CALL连接起来
bn120mx101ye
3.取计算出来的注册码前八位bn120mx1与我们输入的注册码12345678前八位比较
注册表类
\software\liangzhu\cartoonmaker

[s:38][s:41][s:38][s:38]技术还是菜｀｀｀｀｀｀

zapline · 发表于 2008-8-28 09:18

看看小黑冰已经厉害到什么程度了@！

coolf4f3 · 发表于 2008-8-28 10:38

学习一下[s:41][s:41][s:41]

XuZhenG · 发表于 2008-8-28 11:00

太强大了...

强烈邀请小黑冰同学加入即将成立的 52PoJie的组织（名字还没弄好...郁闷）

同时鼓励这种不公布软件名称的做法---规避法律风险

再次鼓励...
期待算法注册机的编写

shsww · 发表于 2008-8-28 16:23

谢谢分享!学习一下! [s:40]

囧小九 · 发表于 2008-8-28 16:49

[s:40] 我倒要look look 是什么软件呢

zgb123 · 发表于 2008-8-28 16:49

谢谢分享! 学习一下!

lchy · 发表于 2008-8-28 16:50

好好学习学习，谢谢分享

小黑冰 · 发表于 2008-8-28 17:13

引用第3楼XzOsAPl于2008-08-28 11:00发表的:
太强大了...

强烈邀请小黑冰同学加入即将成立的 52PoJie的组织（名字还没弄好...郁闷）

同时鼓励这种不公布软件名称的做法---规避法律风险

谢谢夸奖哈｀｀
我菜鸟一个　　我比你们任何一个人都差｀｀｀

qslfz · 发表于 2008-8-28 20:55

看一看,学习一下!!!!!!!!!!!!

帐号		自动登录	找回密码
密码			注册[Register]

[分享] 某软件注册算法分析｀｀