对《悠仕书架1.2》程序的算法分析

20 篇文章 0 订阅
14 篇文章 0 订阅
 

 好久没玩过破解,看M这样牛B,我也重操旧业,来玩玩破解

软件下载:

http://www.pcdog.com/soft/19432.htm

 

之所以选这款软件呢,是因为。。。。。算法简单,其实可以直接把JZ换位JNE,但这样就和高中时的我没什么区别

看了这么久的《软件调试分析》,总要有一定的长进嘛,来。。一起算法分析。。

 

用DEDE载入,重要地方我已给出注释,不懂得地方留言讨论。

 

004078CF   E8B8AA0600             call    0047238C 
004078D4   837DFC00               cmp     dword ptr [ebp-$04], +$00      (比较输入种子码是否为空) 
004078D8   7408                   jz      004078E2 
004078DA   8B4DFC                 mov     ecx, [ebp-$04] 
004078DD   8B41FC                 mov     eax, [ecx-$04] 
004078E0   EB02                   jmp     004078E4 
004078E2   33C0                   xor     eax, eax 
004078E4   48                     dec     eax 
004078E5   7C47                   jl      0040792E 
004078E7   33D2                   xor     edx, edx 
004078E9   8955F8                 mov     [ebp-$08], edx 
004078EC   8D55F8                 lea     edx, [ebp-$08] 
004078EF   FF471C                 inc     dword ptr [edi+$1C] 

* Reference to control code_code : TEdit 
| 
004078F2   8B83D8020000           mov     eax, [ebx+$02D8] 

* Reference to: controls.TControl.GetText(TControl):System.String; 
| 
004078F8   E88FAA0600             call    0047238C 
004078FD   837DF800               cmp     dword ptr [ebp-$08], +$00        (比较输出入注册码是否为空) 
00407901   7408                   jz      0040790B 
00407903   8B4DF8                 mov     ecx, [ebp-$08] 
00407906   8B41FC                 mov     eax, [ecx-$04] 
00407909   EB02                   jmp     0040790D 
0040790B   33C0                   xor     eax, eax 
0040790D   48                     dec     eax 
0040790E   0F9CC2                 setl    dl 
00407911   83E201                 and     edx, +$01 
00407914   8D45F8                 lea     eax, [ebp-$08] 
00407917   52                     push    edx 
00407918   BA02000000             mov     edx, $00000002 
0040791D   FF4F1C                 dec     dword ptr [edi+$1C] 

| 
00407920   E8A3EF0B00             call    004C68C8 
00407925   59                     pop     ecx 
00407926   85C9                   test    ecx, ecx 
00407928   7504                   jnz     0040792E 
0040792A   33C0                   xor     eax, eax 
0040792C   EB05                   jmp     00407933 
0040792E   B801000000             mov     eax, $00000001 
00407933   50                     push    eax 
00407934   FF4F1C                 dec     dword ptr [edi+$1C] 
00407937   8D45FC                 lea     eax, [ebp-$04] 
0040793A   BA02000000             mov     edx, $00000002 

| 
0040793F   E884EF0B00             call    004C68C8 
00407944   59                     pop     ecx 
00407945   84C9                   test    cl, cl 
00407947   741D                   jz      00407966            (为空时,出现错误消息框) 
00407949   A14CA04E00             mov     eax, dword ptr [$4EA04C] 
0040794E   6A00                   push    $00 

* Possible String Reference to: '错误' 
| 
00407950   B916F24D00             mov     ecx, $004DF216 

* Possible String Reference to: '请正确输入注册种子与注册码' 
| 
00407955   BAFBF14D00             mov     edx, $004DF1FB 
0040795A   8B00                   mov     eax, [eax] 

| 
0040795C   E897EE0B00             call    004C67F8 
00407961   E9F2010000             jmp     00407B58 
00407966   66C747102000           mov     word ptr [edi+$10], $0020 
0040796C   33D2                   xor     edx, edx 
0040796E   8955F4                 mov     [ebp-$0C], edx 
00407971   8D55F4                 lea     edx, [ebp-$0C] 
00407974   FF471C                 inc     dword ptr [edi+$1C] 

* Reference to control seed_code : TEdit 
| 
00407977   8B83D4020000           mov     eax, [ebx+$02D4] 

* Reference to: controls.TControl.GetText(TControl):System.String; 
| 
0040797D   E80AAA0600             call    0047238C 
00407982   8D45F4                 lea     eax, [ebp-$0C] 
00407985   8B00                   mov     eax, [eax] 

* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer; 
| 
00407987   E8DC8A0A00             call    004B0468        (将种子码变为十六进制) 
0040798C   8945AC                 mov     [ebp-$54], eax 
0040798F   FF4F1C                 dec     dword ptr [edi+$1C] 
00407992   8D45F4                 lea     eax, [ebp-$0C] 
00407995   BA02000000             mov     edx, $00000002 

| 
0040799A   E829EF0B00             call    004C68C8          
0040799F   66C747101400           mov     word ptr [edi+$10], $0014 
004079A5   66C747102C00           mov     word ptr [edi+$10], $002C 
004079AB   33C9                   xor     ecx, ecx 
004079AD   894DF0                 mov     [ebp-$10], ecx 
004079B0   8D55F0                 lea     edx, [ebp-$10] 
004079B3   FF471C                 inc     dword ptr [edi+$1C] 

* Reference to control code_code : TEdit 
| 
004079B6   8B83D8020000           mov     eax, [ebx+$02D8] 

* Reference to: controls.TControl.GetText(TControl):System.String; 
| 
004079BC   E8CBA90600             call    0047238C 
004079C1   8D45F0                 lea     eax, [ebp-$10] 
004079C4   8B00                   mov     eax, [eax] 

* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer; 
| 
004079C6   E89D8A0A00             call    004B0468         (将注册码变为16进制) 
004079CB   8945A8                 mov     [ebp-$58], eax 
004079CE   FF4F1C                 dec     dword ptr [edi+$1C] 
004079D1   8D45F0                 lea     eax, [ebp-$10] 
004079D4   BA02000000             mov     edx, $00000002 

| 
004079D9   E8EAEE0B00             call    004C68C8 
004079DE   66C747101400           mov     word ptr [edi+$10], $0014 
004079E4   B99F860100             mov     ecx, $0001869F           (算法开始,先赋值给EAX=1869Fh) 
004079E9   2B4DAC                 sub     ecx, dword ptr [ebp-$54]     (减去种子码) 
004079EC   8BC1                   mov     eax, ecx                    (将值移到EAX) 
004079EE   03C0                   add     eax, eax                     (EAX+EAX) 
004079F0   8D0480                 lea     eax, [eax+eax*4]            (EAX=EAX*4+EAX) 
004079F3   83C017                 add     eax, +$17                  (EAX=EAX+17h) 
004079F6   3B45A8                 cmp     eax, [ebp-$58]             (与输入假码比较,) 
004079F9   0F853B010000           jnz     00407B3A           (相等则成功,进入注册表操作,不等则出现错误框) 
004079FF   B201                   mov     dl, $01 
00407A01   A118724400             mov     eax, dword ptr [$447218] 

| 
00407A06   E80DF90300             call    00447318 
00407A0B   8BF0                   mov     esi, eax 
00407A0D   BA02000080             mov     edx, $80000002 
00407A12   8BC6                   mov     eax, esi 

| 
00407A14   E8EFED0B00             call    004C6808 
00407A19   66C747103800           mov     word ptr [edi+$10], $0038 

* Possible String Reference to: '\Software\Userlife\bsp' 
| 
00407A1F   BA1BF24D00             mov     edx, $004DF21B 
00407A24   8D45EC                 lea     eax, [ebp-$14] 

| 
00407A27   E8E4ED0B00             call    004C6810 
00407A2C   FF471C                 inc     dword ptr [edi+$1C] 
00407A2F   8B10                   mov     edx, [eax] 
00407A31   B101                   mov     cl, $01 
00407A33   8BC6                   mov     eax, esi 

* Reference to: registry.TRegistry.OpenKey(TRegistry;System.AnsiString;System.Boolean):System.Boolean; 
| 
00407A35   E8E2F90300             call    0044741C 
00407A3A   FF4F1C                 dec     dword ptr [edi+$1C] 
00407A3D   8D45EC                 lea     eax, [ebp-$14] 
00407A40   BA02000000             mov     edx, $00000002 

| 
00407A45   E87EEE0B00             call    004C68C8 
00407A4A   33C9                   xor     ecx, ecx 
00407A4C   894DE4                 mov     [ebp-$1C], ecx 
00407A4F   8D55E4                 lea     edx, [ebp-$1C] 
00407A52   FF471C                 inc     dword ptr [edi+$1C] 

* Reference to control name_code : TEdit 
| 
00407A55   8B83D0020000           mov     eax, [ebx+$02D0] 

* Reference to: controls.TControl.GetText(TControl):System.String; 
| 
00407A5B   E82CA90600             call    0047238C 
00407A60   8D4DE4                 lea     ecx, [ebp-$1C] 

* Possible String Reference to: 'username' 
| 
00407A63   BA32F24D00             mov     edx, $004DF232 
00407A68   8B01                   mov     eax, [ecx] 
00407A6A   50                     push    eax 
00407A6B   8D45E8                 lea     eax, [ebp-$18] 
00407A6E   66C747104400           mov     word ptr [edi+$10], $0044 

| 
00407A74   E897ED0B00             call    004C6810 
00407A79   FF471C                 inc     dword ptr [edi+$1C] 
00407A7C   8B10                   mov     edx, [eax] 
00407A7E   8BC6                   mov     eax, esi 
00407A80   59                     pop     ecx 

* Reference to: registry.TRegistry.WriteString(TRegistry;System.AnsiString;System.AnsiString); 
| 
00407A81   E832FB0300             call    004475B8 
00407A86   FF4F1C                 dec     dword ptr [edi+$1C] 
00407A89   8D45E4                 lea     eax, [ebp-$1C] 
00407A8C   BA02000000             mov     edx, $00000002 

| 
00407A91   E832EE0B00             call    004C68C8 
00407A96   FF4F1C                 dec     dword ptr [edi+$1C] 
00407A99   8D45E8                 lea     eax, [ebp-$18] 
00407A9C   BA02000000             mov     edx, $00000002 

| 
00407AA1   E822EE0B00             call    004C68C8 
00407AA6   66C747105000           mov     word ptr [edi+$10], $0050 

* Possible String Reference to: 'reg1' 
| 
00407AAC   BA3BF24D00             mov     edx, $004DF23B 
00407AB1   8D45E0                 lea     eax, [ebp-$20] 

| 
00407AB4   E857ED0B00             call    004C6810 
00407AB9   FF471C                 inc     dword ptr [edi+$1C] 
00407ABC   8B10                   mov     edx, [eax] 
00407ABE   8B4DAC                 mov     ecx, [ebp-$54] 
00407AC1   8BC6                   mov     eax, esi 

* Reference to: registry.TRegistry.WriteInteger(TRegistry;System.AnsiString;System.Integer); 
| 
00407AC3   E894FB0300             call    0044765C 
00407AC8   FF4F1C                 dec     dword ptr [edi+$1C] 
00407ACB   8D45E0                 lea     eax, [ebp-$20] 
00407ACE   BA02000000             mov     edx, $00000002 

| 
00407AD3   E8F0ED0B00             call    004C68C8 
00407AD8   66C747105C00           mov     word ptr [edi+$10], $005C 

* Possible String Reference to: 'reg2' 
| 
00407ADE   BA40F24D00             mov     edx, $004DF240 
00407AE3   8D45DC                 lea     eax, [ebp-$24] 

| 
00407AE6   E825ED0B00             call    004C6810 
00407AEB   FF471C                 inc     dword ptr [edi+$1C] 
00407AEE   8B10                   mov     edx, [eax] 
00407AF0   8B4DA8                 mov     ecx, [ebp-$58] 
00407AF3   8BC6                   mov     eax, esi 

* Reference to: registry.TRegistry.WriteInteger(TRegistry;System.AnsiString;System.Integer); 
| 
00407AF5   E862FB0300             call    0044765C 
00407AFA   FF4F1C                 dec     dword ptr [edi+$1C] 
00407AFD   8D45DC                 lea     eax, [ebp-$24] 
00407B00   BA02000000             mov     edx, $00000002 

| 
00407B05   E8BEED0B00             call    004C68C8 
00407B0A   8BC6                   mov     eax, esi 

* Reference to: registry.TRegistry.CloseKey(TRegistry); 
| 
00407B0C   E877F80300             call    00447388 
00407B11   8BDE                   mov     ebx, esi 
00407B13   895DD4                 mov     [ebp-$2C], ebx 
00407B16   85DB                   test    ebx, ebx 
00407B18 


 

  • 1
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值