[转]简单算法---主页浏览工具GreenBrowser算法分析!

最新推荐文章于 2022-04-05 17:37:31 发布

糊糊

最新推荐文章于 2022-04-05 17:37:31 发布

阅读量2.6k

点赞数

分类专栏： GreenBrowser 文章标签：算法工具 byte c 破解 hex

本文链接：https://blog.csdn.net/huyoo/article/details/589486

版权

GreenBrowser 专栏收录该内容

9 篇文章 0 订阅

订阅专栏

简单算法---主页浏览工具GreenBrowser算法分析!　　
作者： ShenGe  转摘自：http://www.cracksoft.org/cgi-bin/topic.cgi?forum=19&topic=4175
--------------------------------------------------------------------------------
软件大小： 383 KB
软件语言：英文
软件类别：国产软件 / 共享版 / 主页浏览
应用平台： Win9x/NT/2000/XP
加入时间： 2003-06-25 16:03:12
下载次数： 2321
推荐等级： ★★★
软件介绍：
   GreenBrowser是一个基于IE的多窗口浏览器, 并更拥有更多更好的其他特性. 例如:热键,搜集器,鼠标手势,鼠标拖曳,弹出窗口过滤,搜索引擎,网页背景色设置,工具条皮肤,代理服务器,自动滚动,自动保存,自动填表,启动模式。

软件下载http://count.skycn.com/softdown.php?id=11763&url=http://zztl-http.skycn.net:8080/down/greenbrowsergb.zip

破解工具：Pescan3.31,OllyDby1.09
作者声明：初学破解，仅作学习交流之用，失误之处敬请大侠赐教

这个软件的破解非常简单.用Pescan检测为Aspack2.12的壳，就用Pescan的脱壳功能脱壳，382K--->1100K,OD载入。
任填用户名：ShenGe[BCG],注册码：1234567890

..........
00412DBD CALL    12.0046A8AD
                 <---取用户名
00412DC2 MOV     ECX, DWORD PTR SS:[ESP+8]
                 <---ECX中为我输入的用户名"ShenGe[BCG]"
00412DC6 CMP     DWORD PTR DS:[ECX-8], 1
                 <---判断有无输入用户名
00412DCA JGE     SHORT 12.00412DDA
00412DCC PUSH    -1
00412DCE PUSH    0
00412DD0 PUSH    0EF4F
00412DD5 JMP     12.00412E73
00412DDA LEA     EDX, DWORD PTR SS:[ESP+4]
00412DDE LEA     ECX, DWORD PTR DS:[ESI+98]
00412DE4 PUSH    EDX
00412DE5 CALL    12.0046A8AD
                 <---取输入的注册码
00412DEA MOV     EAX, DWORD PTR SS:[ESP+4]
                 <---EAX中为假码"1234567890"
00412DEE CMP     DWORD PTR DS:[EAX-8], 1
                 <---比较有无输入注册码
00412DF2 JLE     SHORT 12.00412E6A
00412DF4 PUSH    ECX
00412DF5 LEA     EDX, DWORD PTR SS:[ESP+8]
00412DF9 MOV     ECX, ESP
00412DFB MOV     DWORD PTR SS:[ESP+10], ESP
00412DFF PUSH    EDX
00412E00 CALL    12.0046D47E
                 <---这个Call将注册信息写入文件。
00412E05 CALL    12.00412990
                 <---跟进此Call!
00412E0A ADD     ESP, 4
00412E0D TEST    EAX, EAX
00412E0F JE      SHORT 12.00412E5F
                 <---关键跳转!不能跳哦!接跟着后面
                  的代码是将按钮变灰!
00412E11 CALL    12.0047ECB0
00412E16 MOV     ECX, DWORD PTR SS:[ESP+8]
00412E1A MOV     EAX, DWORD PTR DS:[EAX+4]
00412E1D PUSH    ECX
00412E1E PUSH    12.004AEBD4
00412E23 PUSH    12.004AEBC8
00412E28 MOV     ECX, EAX
00412E2A CALL    12.00475101
00412E2F CALL    12.0047ECB0
00412E34 MOV     EDX, DWORD PTR SS:[ESP+4]
00412E38 MOV     EAX, DWORD PTR DS:[EAX+4]
00412E3B PUSH    EDX
00412E3C PUSH    12.004AEBC0
00412E41 PUSH    12.004AEBC8
00412E46 MOV     ECX, EAX
00412E48 CALL    12.00475101
00412E4D MOV     ECX, ESI
00412E4F CALL    12.00412BB0
00412E54 PUSH    -1
00412E56 PUSH    0
00412E58 PUSH    0EF52
00412E5D JMP     SHORT 12.00412E73
00412E5F PUSH    -1
00412E61 PUSH    0
00412E63 PUSH    0EF50
00412E68 JMP     SHORT 12.00412E73
00412E6A PUSH    -1
00412E6C PUSH    0
00412E6E PUSH    0EF51
00412E73 CALL    12.00474F8B
                 <---注册码错误!
00412E78 LEA     ECX, DWORD PTR SS:[ESP+8]
00412E7C MOV     BYTE PTR SS:[ESP+18], 0
...............

跟进那个关键的Call,可看到以下代码:
00412990 PUSH    -1
00412992 PUSH    12.00485388
00412997 MOV     EAX, DWORD PTR FS:[0]
0041299D PUSH    EAX
0041299E MOV     DWORD PTR FS:[0], ESP
004129A5 SUB     ESP, 38
004129A8 PUSH    ESI
004129A9 XOR     ESI, ESI
004129AB LEA     ECX, DWORD PTR SS:[ESP+4C]
004129AF MOV     DWORD PTR SS:[ESP+44], ESI
004129B3 CALL    12.00466730
004129B8 LEA     ECX, DWORD PTR SS:[ESP+4C]
004129BC CALL    12.004666E4
004129C1 MOV     EAX, DWORD PTR SS:[ESP+4C]
004129C5 MOV     EAX, DWORD PTR DS:[EAX-8]
                <---取注册码位数到EAX中
004129C8 CMP     EAX, 0A
                <---判断注册码位数是否为10位
004129CB JE      SHORT 12.004129F0
004129CD LEA     ECX, DWORD PTR SS:[ESP+4C]
004129D1 MOV     DWORD PTR SS:[ESP+44], -1
004129D9 CALL    12.0046D709
004129DE XOR     EAX, EAX
004129E0 POP     ESI
004129E1 MOV     ECX, DWORD PTR SS:[ESP+38]
004129E5 MOV     DWORD PTR FS:[0], ECX
004129EC ADD     ESP, 44
004129EF RETN
004129F0 MOV     EAX, DWORD PTR DS:[4B08B8]
004129F5 PUSH    EBX
004129F6 PUSH    EDI
004129F7 MOV     DWORD PTR SS:[ESP+C], EAX
004129FB MOV     DWORD PTR SS:[ESP+10], EAX
004129FF LEA     ECX, DWORD PTR SS:[ESP+14]
00412A03 PUSH    5
                <---这个参数决定取几位
00412A05 PUSH    ECX
00412A06 LEA     ECX, DWORD PTR SS:[ESP+5C]
00412A0A MOV     BYTE PTR SS:[ESP+54], 2
00412A0F CALL    12.004662F6
                <---取注册码的前5位
00412A14 PUSH    EAX
                <---[EAX]="12345"
00412A15 LEA     ECX, DWORD PTR SS:[ESP+10]
00412A19 MOV     BYTE PTR SS:[ESP+50], 3
00412A1E CALL    12.0046D842
00412A23 LEA     ECX, DWORD PTR SS:[ESP+14]
00412A27 MOV     BYTE PTR SS:[ESP+4C], 2
00412A2C CALL    12.0046D709
00412A31 LEA     EDX, DWORD PTR SS:[ESP+18]
00412A35 PUSH    5
00412A37 PUSH    EDX
00412A38 LEA     ECX, DWORD PTR SS:[ESP+5C]
00412A3C CALL    12.0046627A
                <---取注册码的后5位
00412A41 PUSH    EAX
                <---[EAX]="67890"
00412A42 LEA     ECX, DWORD PTR SS:[ESP+14]
00412A46 MOV     BYTE PTR SS:[ESP+50], 4
00412A4B CALL    12.0046D842
00412A50 LEA     ECX, DWORD PTR SS:[ESP+18]
00412A54 MOV     BYTE PTR SS:[ESP+4C], 2
00412A59 CALL    12.0046D709
00412A5E LEA     ECX, DWORD PTR SS:[ESP+C]
00412A62 CALL    12.0046DC4F
00412A67 XOR     EAX, EAX
------------------------------------------
00412A69 MOV     DWORD PTR SS:[ESP+1C], 2
00412A71 MOV     DWORD PTR SS:[ESP+34], EAX
00412A75 MOV     DWORD PTR SS:[ESP+20], 6
00412A7D MOV     DWORD PTR SS:[ESP+38], EAX
00412A81 MOV     DWORD PTR SS:[ESP+24], -7
00412A89 MOV     DWORD PTR SS:[ESP+3C], EAX
00412A8D MOV     DWORD PTR SS:[ESP+28], 4
00412A95 MOV     DWORD PTR SS:[ESP+2C], -1
00412A9D MOV     DWORD PTR SS:[ESP+30], 8
00412AA5 MOV     DWORD PTR SS:[ESP+40], EAX
-------------------------------------------
这段将一组值2,6,-7,4,-1,8赋给连续内存单元[ESP+1C]
00412AA9 LEA     EDI, DWORD PTR SS:[ESP+1C]
00412AAD /MOV     ECX, DWORD PTR SS:[ESP+C]
00412AB1 |MOV     DL, BYTE PTR DS:[EDI]
                 <---[EDI]中为上面赋值的第1个值,DL=02
00412AB3 |MOV     AL, BYTE PTR DS:[ESI+ECX]
                 <---[ESI+ECX]中为注册码前5位字符,"54321"
                 ESI作指针,第1次AL=35
00412AB6 |ADD     AL, DL
                 <---AL=35+2=37
00412AB8 |CMP     AL, 30
00412ABA |MOV     BYTE PTR SS:[ESP+14], AL
                 <---结果入[ESP+14]中
--------------------------------------
00412ABE |JGE     SHORT 12.00412AC6
00412AC0 |ADD     AL, 0A
00412AC2 |MOV     BYTE PTR SS:[ESP+14], AL
00412AC6 |CMP     AL, 39
00412AC8 |JLE     SHORT 12.00412AD0
00412ACA |ADD     AL, 0F6
-------------------------------------
上面的结果若小于30,则将其加0AH再存入[ESP+14]中;若
和大于39,则将其加0F6H再存入[ESP+14]中,若在30至39之
间则直接存入[ESP+14]中
00412ACC |MOV     BYTE PTR SS:[ESP+14], AL
00412AD0 |MOV     EDX, DWORD PTR SS:[ESP+14]
00412AD4 |LEA     ECX, DWORD PTR SS:[ESP+C]
00412AD8 |PUSH    EDX
00412AD9 |PUSH    ESI
00412ADA |CALL    12.0046DC61
                 <---Hex--->Char,如"37"--->7
00412ADF |INC     ESI
00412AE0 |ADD     EDI, 4
00412AE3 |CMP     ESI, 5
00412AE6 /JL      SHORT 12.00412AAD
                 <---循环完成后D EAX可看到"70660"
00412AE8 LEA     ECX, DWORD PTR SS:[ESP+C]
00412AEC CALL    12.0046DC4F
                <---将字符串倒序,"70660"--->"06607"
00412AF1 MOV     ESI, DWORD PTR SS:[ESP+10]
                <---[ESP+10]中为注册码的后5位"67890"
00412AF5 MOV     EAX, DWORD PTR SS:[ESP+C]
                <---[ESP+C]中为倒序的字符串"06607"
--------------------
00412AF9 /MOV     DL, BYTE PTR DS:[EAX]
00412AFB |MOV     BL, BYTE PTR DS:[ESI]
00412AFD |MOV     CL, DL
00412AFF |CMP     DL, BL
00412B01 |JNZ     SHORT 12.00412B21
00412B03 |TEST    CL, CL
00412B05 |JE      SHORT 12.00412B1D
00412B07 |MOV     DL, BYTE PTR DS:[EAX+1]
00412B0A |MOV     BL, BYTE PTR DS:[ESI+1]
00412B0D |MOV     CL, DL
00412B0F |CMP     DL, BL
00412B11 |JNZ     SHORT 12.00412B21
00412B13 |ADD     EAX, 2
00412B16 |ADD     ESI, 2
00412B19 |TEST    CL, CL
00412B1B /JNZ     SHORT 12.00412AF9
--------------------
呵呵,太经典了不注释了!
00412B1D XOR     EAX, EAX
                <---EAX=0
00412B1F JMP     SHORT 12.00412B26
00412B21 SBB     EAX, EAX
                <---EAX=FFFFFFFF
00412B23 SBB     EAX, -1
                <---EAX=FFFFFFFF!
00412B26 POP     EDI
00412B27 POP     EBX
00412B28 TEST    EAX, EAX
00412B2A MOV     BYTE PTR SS:[ESP+44], 1
00412B2F LEA     ECX, DWORD PTR SS:[ESP+8]
00412B33 JE      SHORT 12.00412B6B
                <---这里要跳噢!
00412B35 CALL    12.0046D709
00412B3A LEA     ECX, DWORD PTR SS:[ESP+4]
00412B3E MOV     BYTE PTR SS:[ESP+44], 0
00412B43 CALL    12.0046D709
00412B48 LEA     ECX, DWORD PTR SS:[ESP+4C]
00412B4C MOV     DWORD PTR SS:[ESP+44], -1
00412B54 CALL    12.0046D709
00412B59 XOR     EAX, EAX
                <---EAX=0
00412B5B POP     ESI
00412B5C MOV     ECX, DWORD PTR SS:[ESP+38]
00412B60 MOV     DWORD PTR FS:[0], ECX
00412B67 ADD     ESP, 44
00412B6A RETN
00412B6B CALL    12.0046D709
00412B70 LEA     ECX, DWORD PTR SS:[ESP+4]
00412B74 MOV     BYTE PTR SS:[ESP+44], 0
00412B79 CALL    12.0046D709
00412B7E LEA     ECX, DWORD PTR SS:[ESP+4C]
00412B82 MOV     DWORD PTR SS:[ESP+44], -1
00412B8A CALL    12.0046D709
00412B8F MOV     ECX, DWORD PTR SS:[ESP+3C]
00412B93 MOV     EAX, 1
                <---EAX=1,到这就可以收工了!
00412B98 POP     ESI
00412B99 MOV     DWORD PTR FS:[0], ECX
00412BA0 ADD     ESP, 44
00412BA3 RETN

总结：注册码与用户名无关!注册码须为10位，假设前5位为abcde,则后5位可
由此推出：a,b,c,d,e分别取其Hex值对应与-1,4,-7,6,2相加,和分别为a1,b1,c1,
d1,f1.
if (a1>39) a1=(a1+0xF6)&0xFF;
else if(a1<30) a1=a1+0x0A;
m1=a1;
依此类推就可得到后五位注册码的Hex值。

可用注册码：
用户名：ShenGe[BCG]
注册码：1234506607

软件注册成功后将注册信息保存在安装文件夹下的GreenBrowser.ini文件中。

Cracked By ShenGe[BCG]