【软件名称】Mp3 Joiner
【下载地址】http://www.onlinedown.net/soft/45966.htm
【应用平台】Win9x/NT/2000/XP
【软件大小】410K
【软件限制】未注册时，每次合并不能超过3个Mp3文件。
【保护方式】用户名+序列号
【破 解 者】HappyTown
【破解难度】1/10
【破解声明】这是我分析的第一个共享软件，简单，适合初学者。
【破解工具】OD,Peid,Windows自带计算器
【软件简介】把多个Mp3文件合而为一。
======================================================================
【分析过程】
在这个分析过程中，我不会假设你不知道如何下断点；有些地方我省略去了解释，主要是不想让你变得太懒惰。
1、Peid分析，无壳；
2、正式入题：
输入Name:happy
假码：87654321（为什么是8位？只有你亲自动手才能知道）
00405426 8845 FA mov byte ptr ss:[ebp-6],al ; 61(a)
00405429 0FB645 EF movzx eax,byte ptr ss:[ebp-11] ; 68(h)
0040542D 83C8 4D or eax,4D ; 68 xor 4d =6D
00405430 8845 EF mov byte ptr ss:[ebp-11],al ; 6D(m)
00405433 0FB64D F8 movzx ecx,byte ptr ss:[ebp-8] ; 61(a)
00405437 83C9 50 or ecx,50 ; 71
0040543A 884D F8 mov byte ptr ss:[ebp-8],cl
0040543D 0FB655 FF movzx edx,byte ptr ss:[ebp-1] ; 68
00405441 83CA 33 or edx,33 ; 7B
00405444 8855 FF mov byte ptr ss:[ebp-1],dl
00405447 0FB645 FA movzx eax,byte ptr ss:[ebp-6] ; 61
0040544B 83C8 4A or eax,4A ; 6B
0040544E 8845 FA mov byte ptr ss:[ebp-6],al
00405451 0FB645 EF movzx eax,byte ptr ss:[ebp-11] ; 6D(m)
00405455 99 cdq
00405456 B9 0A000000 mov ecx,0A
0040545B F7F9 idiv ecx ; EAX=A,EDX=9;
0040545D 8855 EF mov byte ptr ss:[ebp-11],dl ; 09 (serial 第1位)
00405460 0FB645 F8 movzx eax,byte ptr ss:[ebp-8] ; 71(q)
00405464 99 cdq
00405465 B9 0A000000 mov ecx,0A
0040546A F7F9 idiv ecx ; EAX=B,EDX=3;
0040546C 8855 F8 mov byte ptr ss:[ebp-8],dl ; 3 (serial 第2位)
0040546F 0FB645 FF movzx eax,byte ptr ss:[ebp-1] ; 7B({)
00405473 99 cdq
00405474 B9 0A000000 mov ecx,0A
00405479 F7F9 idiv ecx
0040547B 8855 FF mov byte ptr ss:[ebp-1],dl ; 7b=C*A+3; 3 (serial 第3位)
0040547E 0FB645 FA movzx eax,byte ptr ss:[ebp-6] ; 6B(k)
00405482 99 cdq
00405483 B9 0A000000 mov ecx,0A
00405488 F7F9 idiv ecx ; 6B=A*A+7
0040548A 8855 FA mov byte ptr ss:[ebp-6],dl ; 7 (serial 第4位)
0040548D C745 F0 00000>mov dword ptr ss:[ebp-10],0
00405494 C745 E8 00000>mov dword ptr ss:[ebp-18],0
0040549B EB 09 jmp short MP3Joine.004054A6
0040549D 8B55 E8 mov edx,dword ptr ss:[ebp-18]
004054A0 83C2 01 add edx,1
004054A3 8955 E8 mov dword ptr ss:[ebp-18],edx
004054A6 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
004054A9 83C1 70 add ecx,70
004054AC E8 EFF3FFFF call MP3Joine.004048A0 ; NameLen
004054B1 3945 E8 cmp dword ptr ss:[ebp-18],eax
004054B4 7D 1E jge short MP3Joine.004054D4
004054B6 8B45 E8 mov eax,dword ptr ss:[ebp-18]
004054B9 50 push eax
004054BA 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
004054BD 83C1 70 add ecx,70
004054C0 E8 8BEAFFFF call MP3Joine.00403F50 ; happy
004054C5 8845 E7 mov byte ptr ss:[ebp-19],al ; 68(h),61(a),70(p),70,79
004054C8 0FB64D E7 movzx ecx,byte ptr ss:[ebp-19] ; 68,61,70,70,79
004054CC 034D F0 add ecx,dword ptr ss:[ebp-10] ; 68+0=68,61+68=C9,C9+70=139,139+70=1A9,1A9+79=222
004054CF 894D F0 mov dword ptr ss:[ebp-10],ecx ; 68,C9,139,1A9,222
004054D2 ^ EB C9 jmp short MP3Joine.0040549D
004054D4 8B45 F0 mov eax,dword ptr ss:[ebp-10] ; 222
004054D7 99 cdq
004054D8 B9 0A000000 mov ecx,0A
004054DD F7F9 idiv ecx ; 222=36*A+6
004054DF 8855 F4 mov byte ptr ss:[ebp-C],dl ; 6 (serial 第5位)
004054E2 6A 00 push 0
004054E4 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
004054E7 83C1 74 add ecx,74
004054EA E8 61EAFFFF call MP3Joine.00403F50 ; 87654321
004054EF 8845 FC mov byte ptr ss:[ebp-4],al ; 38(8)
004054F2 6A 01 push 1
004054F4 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
004054F7 83C1 74 add ecx,74
004054FA E8 51EAFFFF call MP3Joine.00403F50 ; 87654321
004054FF 8845 FD mov byte ptr ss:[ebp-3],al ; 37(7)
00405502 6A 02 push 2
00405504 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
00405507 83C1 74 add ecx,74
0040550A E8 41EAFFFF call MP3Joine.00403F50
0040550F 8845 F6 mov byte ptr ss:[ebp-A],al ; 36(6)
00405512 6A 03 push 3
00405514 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
00405517 83C1 74 add ecx,74
0040551A E8 31EAFFFF call MP3Joine.00403F50
0040551F 8845 F5 mov byte ptr ss:[ebp-B],al ; 35(5)
00405522 6A 04 push 4
00405524 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
00405527 83C1 74 add ecx,74
0040552A E8 21EAFFFF call MP3Joine.00403F50
0040552F 8845 F9 mov byte ptr ss:[ebp-7],al ; 34(4)
00405532 6A 05 push 5
00405534 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
00405537 83C1 74 add ecx,74
0040553A E8 11EAFFFF call MP3Joine.00403F50
0040553F 8845 F7 mov byte ptr ss:[ebp-9],al ; 33(3)
00405542 6A 06 push 6
00405544 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
00405547 83C1 74 add ecx,74
0040554A E8 01EAFFFF call MP3Joine.00403F50
0040554F 8845 FE mov byte ptr ss:[ebp-2],al ; 32(2)
00405552 6A 07 push 7
00405554 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
00405557 83C1 74 add ecx,74
0040555A E8 F1E9FFFF call MP3Joine.00403F50
0040555F 8845 FB mov byte ptr ss:[ebp-5],al ; 31(1)
00405562 0FB655 EF movzx edx,byte ptr ss:[ebp-11] ; 09
00405566 0FB645 FC movzx eax,byte ptr ss:[ebp-4] ; 38(8)
0040556A 83E8 30 sub eax,30 ; 38-30=8
0040556D 3BD0 cmp edx,eax ; 9=8?不等则错
0040556F 75 3C jnz short MP3Joine.004055AD
00405571 0FB64D F8 movzx ecx,byte ptr ss:[ebp-8]
00405575 0FB655 FD movzx edx,byte ptr ss:[ebp-3]
00405579 83EA 30 sub edx,30
0040557C 3BCA cmp ecx,edx ；不等则错
0040557E 75 2D jnz short MP3Joine.004055AD
00405580 0FB645 FF movzx eax,byte ptr ss:[ebp-1]
00405584 0FB64D F6 movzx ecx,byte ptr ss:[ebp-A]
00405588 83E9 30 sub ecx,30
0040558B 3BC1 cmp eax,ecx ；不等则错
0040558D 75 1E jnz short MP3Joine.004055AD
0040558F 0FB655 FA movzx edx,byte ptr ss:[ebp-6]
00405593 0FB645 F5 movzx eax,byte ptr ss:[ebp-B]
00405597 83E8 30 sub eax,30
0040559A 3BD0 cmp edx,eax ；不等则错
0040559C 75 0F jnz short MP3Joine.004055AD
0040559E 0FB64D F4 movzx ecx,byte ptr ss:[ebp-C]
004055A2 0FB655 F9 movzx edx,byte ptr ss:[ebp-7]
004055A6 83EA 30 sub edx,30
004055A9 3BCA cmp ecx,edx ；若相等，则注册成功
004055AB 74 58 je short MP3Joine.00405605
004055AD 0FB645 FC movzx eax,byte ptr ss:[ebp-4]
004055B1 83F8 35 cmp eax,35
004055B4 0F85 A7000000 jnz MP3Joine.00405661 ；以下这些35，35，38等等，你可以尝试，看看它是干什么的。
004055BA 0FB64D FD movzx ecx,byte ptr ss:[ebp-3]
004055BE 83F9 35 cmp ecx,35
004055C1 0F85 9A000000 jnz MP3Joine.00405661
004055C7 0FB655 F6 movzx edx,byte ptr ss:[ebp-A]
004055CB 83FA 38 cmp edx,38
004055CE 0F85 8D000000 jnz MP3Joine.00405661
004055D4 0FB645 F5 movzx eax,byte ptr ss:[ebp-B]
004055D8 83F8 35 cmp eax,35
004055DB 0F85 80000000 jnz MP3Joine.00405661
004055E1 0FB64D F9 movzx ecx,byte ptr ss:[ebp-7]
004055E5 83F9 36 cmp ecx,36
004055E8 75 77 jnz short MP3Joine.00405661
004055EA 0FB655 F7 movzx edx,byte ptr ss:[ebp-9]
004055EE 83FA 37 cmp edx,37
004055F1 75 6E jnz short MP3Joine.00405661
004055F3 0FB645 FE movzx eax,byte ptr ss:[ebp-2]
004055F7 83F8 36 cmp eax,36
004055FA 75 65 jnz short MP3Joine.00405661
004055FC 0FB64D FB movzx ecx,byte ptr ss:[ebp-5]
00405600 83F9 35 cmp ecx,35
00405603 75 5C jnz short MP3Joine.00405661
00405605 6A 00 push 0
00405607 6A 00 push 0
00405609 68 A4C14200 push MP3Joine.0042C1A4 ; ASCII "Registration has succeeded!"
0040560E E8 B2FB0100 call MP3Joine.004251C5
======================================================================
【分析总结】
//注册算法-Delphi版
procedure TfrmMain.edtNameChange(Sender: TObject);
type
intchr_=array [1..5] of Integer;
var
strName,strCode,strRandom:string;
intNameLen,i,intSum,intchr_1,intchr_2,intchr_3,intchr_4,intchr_5:Integer;
intTemp,intTemp1,intTemp2,intTemp3:Integer;
chr_1,chr_2,chr_3,chr_4,chr_5,chr_6,chr_7,chr_8:string;
intchr:intchr_;
begin
strName:=edtName.Text ;
intNameLen:=length(strName);
if intNameLen<=4 then
edtCode.Text :='';
intSum:=0;
if intNameLen>4 then
begin
for i:=1 to intNameLen do
begin
intTemp:=Ord(strName[i]);
intSum:=intSum+intTemp;
end;
for i:=1 to 5 do
intchr [i]:=Ord(strName[i]);
chr_1:=Chr(((intchr[1] or $4D)mod 10)+$30); //注册码第1位
chr_2:=Chr(((intchr[2] or $50)mod 10)+$30); //注册码第2位
chr_3:=Chr(((intchr[1] or $33)mod 10)+$30); //注册码第3位
chr_4:=Chr(((intchr[2] or $4A)mod 10)+$30); //注册码第4位
chr_5:=Chr((intSum mod 10)+$30); //注册码第5位
strCode:='';
//最后3位无所谓，所以采用随机数
Randomize;
intTemp1:=Random(9)+1;
Randomize;
intTemp2:=Random(9)+1;
Randomize;
intTemp3:=Random(9)+1;
strCode:=chr_1+chr_2+chr_3+chr_4+chr_5+IntToStr(intTemp1)+IntToStr(intTemp2)+IntToStr(intTemp3);
edtCode.Text :=strCode;
end;
end;
======================================================================
【版权信息】
CopyLeft(仅限于本破文)
2006-03-21