|
因为正在学习这个~所以每学一篇就在帖子里回复一篇~尽管别人已经写出了算法~但那是别人的~我学这个就该自己写出来~验证自己的成果~也正好可以给新手总结一下~因为我学DELPHI~所以注册机当然也是DELPHI的~希望其他人请勿在次帖回复~写了三个了~收获坡大~看了下别人的~第三个算法都没弄对~呵呵 |
第一个学习笔记
下断点 MSVBVM60.__vbaStrMove
取消断点返回到反汇编窗口~往上找到这里下断点
004023BC 6A 01 PUSH 1
004023BE FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaOnEr>; MSVBVM60.__vbaOnError
004023C4 8B16 MOV EDX,DWORD PTR DS:[ESI]
004023C6 56 PUSH ESI
004023C7 FF92 04030000 CALL DWORD PTR DS:[EDX+304]
004023CD 50 PUSH EAX
004023CE 8D45 C4 LEA EAX,DWORD PTR SS:[EBP-3C]
004023D1 50 PUSH EAX
004023D2 FF15 30104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjS>; MSVBVM60.__vbaObjSet
004023D8 8BF8 MOV EDI,EAX
004023DA 8B0F MOV ECX,DWORD PTR DS:[EDI]
004023DC 8D55 C8 LEA EDX,DWORD PTR SS:[EBP-38]
004023DF 52 PUSH EDX
004023E0 57 PUSH EDI
004023E1 FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
004023E7 DBE2 FCLEX
004023E9 3BC3 CMP EAX,EBX
004023EB 7D 12 JGE SHORT KeyGenMe.004023FF
004023ED 68 A0000000 PUSH 0A0
004023F2 68 401C4000 PUSH KeyGenMe.00401C40
004023F7 57 PUSH EDI
004023F8 50 PUSH EAX
004023F9 FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHres>; MSVBVM60.__vbaHresultCheckObj
004023FF 8B55 C8 MOV EDX,DWORD PTR SS:[EBP-38]
00402402 895D C8 MOV DWORD PTR SS:[EBP-38],EBX
00402405 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
00402408 8B3D A0104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrMove
0040240E FFD7 CALL EDI ; <&MSVBVM60.__vbaStrMove>
00402410 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]
00402413 FF15 B0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFree>; MSVBVM60.__vbaFreeObj
00402419 8B45 CC MOV EAX,DWORD PTR SS:[EBP-34]
0040241C 50 PUSH EAX
0040241D FF15 08104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaLenB>; 取用户名长度
00402423 8BC8 MOV ECX,EAX
00402425 FF15 50104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaI2I4>; MSVBVM60.__vbaI2I4
0040242B 8945 D0 MOV DWORD PTR SS:[EBP-30],EAX
0040242E 66:3D 0300 CMP AX,3
00402432 0F8C CD010000 JL KeyGenMe.00402605 ; 跳就死`用户名要大于3
00402438 8B0E MOV ECX,DWORD PTR DS:[ESI]
0040243A 56 PUSH ESI
0040243B FF91 0C030000 CALL DWORD PTR DS:[ECX+30C]
00402441 50 PUSH EAX
00402442 8D55 C4 LEA EDX,DWORD PTR SS:[EBP-3C]
00402445 52 PUSH EDX
00402446 FF15 30104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjS>; MSVBVM60.__vbaObjSet
0040244C 8BF0 MOV ESI,EAX
0040244E 8B06 MOV EAX,DWORD PTR DS:[ESI]
00402450 8D4D C8 LEA ECX,DWORD PTR SS:[EBP-38]
00402453 51 PUSH ECX
00402454 56 PUSH ESI
00402455 FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
0040245B DBE2 FCLEX
0040245D 3BC3 CMP EAX,EBX
0040245F 7D 12 JGE SHORT KeyGenMe.00402473
00402461 68 A0000000 PUSH 0A0
00402466 68 401C4000 PUSH KeyGenMe.00401C40
0040246B 56 PUSH ESI
0040246C 50 PUSH EAX
0040246D FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHres>; MSVBVM60.__vbaHresultCheckObj
00402473 8B55 C8 MOV EDX,DWORD PTR SS:[EBP-38]
00402476 895D C8 MOV DWORD PTR SS:[EBP-38],EBX
00402479 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
0040247C FFD7 CALL EDI
0040247E 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]
00402481 FF15 B0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFree>; MSVBVM60.__vbaFreeObj
00402487 8B55 DC MOV EDX,DWORD PTR SS:[EBP-24]
0040248A 52 PUSH EDX
0040248B FF15 08104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaLenB>; 去试验码位数
00402491 8BC8 MOV ECX,EAX
00402493 FF15 50104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaI2I4>; MSVBVM60.__vbaI2I4
00402499 66:3BC3 CMP AX,BX ; 判断实验码是否为空
0040249C 0F84 63010000 JE KeyGenMe.00402605
004024A2 BF 01000000 MOV EDI,1
004024A7 8BF7 MOV ESI,EDI
004024A9 8B1D 0C104000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004024AF 66:3B75 D0 CMP SI,WORD PTR SS:[EBP-30]
004024B3 0F8F 93000000 JG KeyGenMe.0040254C
004024B9 C745 BC 0100000>MOV DWORD PTR SS:[EBP-44],1
004024C0 C745 B4 0200000>MOV DWORD PTR SS:[EBP-4C],2
004024C7 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]
004024CA 8985 7CFFFFFF MOV DWORD PTR SS:[EBP-84],EAX
004024D0 C785 74FFFFFF 0>MOV DWORD PTR SS:[EBP-8C],4008
004024DA 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
004024DD 51 PUSH ECX
004024DE 0FBFD6 MOVSX EDX,SI
004024E1 52 PUSH EDX
004024E2 8D85 74FFFFFF LEA EAX,DWORD PTR SS:[EBP-8C]
004024E8 50 PUSH EAX
004024E9 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C]
004024EC 51 PUSH ECX
004024ED FF15 44104000 CALL DWORD PTR DS:[<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
004024F3 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
004024F6 52 PUSH EDX
004024F7 8D45 C8 LEA EAX,DWORD PTR SS:[EBP-38]
004024FA 50 PUSH EAX
004024FB FF15 74104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrV>; MSVBVM60.__vbaStrVarVal
00402501 50 PUSH EAX
00402502 FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; 取用户名ASCII码
00402508 66:0FAFC6 IMUL AX,SI ; 用户名ASCII码与相应的位数相乘
0040250C 0F80 5F010000 JO KeyGenMe.00402671
00402512 0FBFC8 MOVSX ECX,AX
00402515 03CF ADD ECX,EDI ; 用户名ASCII累积和放ECX，EDX初为1
00402517 0F80 54010000 JO KeyGenMe.00402671
0040251D 8BF9 MOV EDI,ECX ; 最终累积和放EDI
0040251F 8D4D C8 LEA ECX,DWORD PTR SS:[EBP-38]
00402522 FF15 B4104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFree>; MSVBVM60.__vbaFreeStr
00402528 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
0040252B 52 PUSH EDX
0040252C 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
0040252F 50 PUSH EAX
00402530 6A 02 PUSH 2
00402532 FFD3 CALL EBX
00402534 83C4 0C ADD ESP,0C
00402537 B8 01000000 MOV EAX,1
0040253C 66:03C6 ADD AX,SI
0040253F 0F80 2C010000 JO KeyGenMe.00402671
00402545 8BF0 MOV ESI,EAX
00402547 ^ E9 63FFFFFF JMP KeyGenMe.004024AF
0040254C 69FF 96740100 IMUL EDI,EDI,17496 ; 累积和与十六进制17496相成放EDI为真码的十六进制
00402552 0F80 19010000 JO KeyGenMe.00402671
00402558 897D D8 MOV DWORD PTR SS:[EBP-28],EDI
0040255B DB45 D8 FILD DWORD PTR SS:[EBP-28]
0040255E DD9D 14FFFFFF FSTP QWORD PTR SS:[EBP-EC]
00402564 8B4D DC MOV ECX,DWORD PTR SS:[EBP-24]
00402567 51 PUSH ECX
00402568 FF15 80104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaR8St>; MSVBVM60.__vbaR8Str
0040256E DC9D 14FFFFFF FCOMP QWORD PTR SS:[EBP-EC] 真码比较
00402574 DFE0 FSTSW AX
00402576 F6C4 40 TEST AH,40
00402579 0F84 86000000 JE KeyGenMe.00402605 ; 关键跳~此处可以爆破
0040257F B9 04000280 MOV ECX,80020004
00402584 894D 8C MOV DWORD PTR SS:[EBP-74],ECX
00402587 B8 0A000000 MOV EAX,0A
算法总结：1，取用户名ASCII累加~再加初始值一
2，与十六进制17496十进制相乘就是注册码
我们再来做算法注册机
var
name:string;
s2:longword;
i:integer;
begin
name:=edit1.text;
s2:=1;
for i:=1 to length(name) do
s2:=ord(name[i]) * i + s2;
s2:=s2 * 95382;
edit2.text:=inttostr(s2);
end;
1 2 3 4 5 6 下一页
安全中国首页 > 文章中心 > 补丁技术