【文章标题】: QQSee算法分析
【文章作者】: atomy
【软件名称】: QQSee1.71增强版
【下载地址】: http://www.cpzj.zj.com/
【保护方式】: PECompact
【使用工具】: OllyICE,PEID
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
无意在网上看到这个软件，还是收费的，正好练练手。
下载来后，发现该软件比较大有2.64M 用PEID扫描一下 使用了PECompact 壳保护
使用OllyICE载入运行 发现竟然出错，并且程序目录多了好几个文件
后来才发现原来是HideOD插件引起的， 去掉HideOD的选项就Ok了
这个壳可以使用ODScript就可以直接脱了。
载入脚本 运行后停在OEP住 继续运行 od 自动终止 并且程序运行了。
呵呵 bp CreateProcessA 重新运行 od 程序被断在 Kernel32领空 看下堆栈
0012F8A8 0045A2D8 /CALL 到 CreateProcessA 来自 qqsee.0045A2D3
0012F8AC 0012F9F0 |ModuleFileName = "I:\开?,B6,"软件\qqsee\qqsee.uzy"
0012F8B0 0012F8F0 |CommandLine = ""
0012F8B4 00000000 |pProcessSecurity = NULL
0012F8B8 00000000 |pThreadSecurity = NULL
0012F8BC 00000000 |InheritHandles = FALSE
0012F8C0 00000020 |CreationFlags = NORMAL_PRIORITY_CLASS
0012F8C4 00000000 |pEnvironment = NULL
0012F8C8 00000000 |CurrentDir = NULL
0012F8CC 0012FB00 |pStartupInfo = 0012FB00
0012F8D0 0012FAF0 \pProcessInfo = 0012FAF0
原来是调用 qqsee.uzy 正好省了脱壳的事。
修改 qqsee.uzy 后缀名为可执行文件 .exe 再次使用 PEID查 Microsoft Visual Basic 编写
（烦人，没有调试过VB的程序听说很麻烦）
直接使用OllyICE打开 随便乱试了一下注册的地方 注册时候如果邮件输入错误会弹出提示框
就从这里下手 找了下资料 原来 vb的 MessageBox 的 函数为 rtcMsgBox
下断 bp rtcMsgBox
输入一个错误的邮箱 点击确定 程序被断下 按 Ctrl + F9 进入 程序领空
然后一直往上找。 找到一个关键跳转的地方 这个地址比较远
（OllyICE汇编窗口里有一列 HEX 如果有个 > 就代表是从别的地方跳转过来的 可以从这里下手找）
0042DF85 . 66:85DB test bx, bx
0042DF88 . 0F84 23170000 je 0042F6B1 ; 邮箱对比跳转
好了开始输入试练码
User: test@163.com
Sn : 11111-11111-11111-11111
断后下面是分析
0042DF88 . /0F84 23170000 je 0042F6B1 ; 邮箱对比跳转
0042DF8E . |8B16 mov edx, [esi]
0042DF90 . |56 push esi
0042DF91 . |FF92 B0030000 call [edx+3B0]
0042DF97 . |50 push eax ; /Arg2
0042DF98 . |8D45 A4 lea eax, [ebp-5C] ; |
0042DF9B . |50 push eax ; |Arg1
0042DF9C . |FF15 74104000 call [<&MSVBVM60.__vbaObjSet>] ; \__vbaObjSet
0042DFA2 . |8BD8 mov ebx, eax
0042DFA4 . |8B0B mov ecx, [ebx]
0042DFA6 . |8D55 BC lea edx, [ebp-44]
0042DFA9 . |52 push edx
0042DFAA . |53 push ebx
0042DFAB . |FF91 A0000000 call [ecx+A0]
0042DFB1 . |DBE2 fclex
0042DFB3 . |85C0 test eax, eax
0042DFB5 . |7D 12 jge short 0042DFC9
0042DFB7 . |68 A0000000 push 0A0 ; /Arg4 = 000000A0
0042DFBC . |68 ECF84000 push 0040F8EC ; |Arg3 = 0040F8EC
0042DFC1 . |53 push ebx ; |Arg2
0042DFC2 . |50 push eax ; |Arg1
0042DFC3 . |FF15 58104000 call [<&MSVBVM60.__vbaHresultCheckObj>; \__vbaHresultCheckObj
0042DFC9 > |8B45 BC mov eax, [ebp-44] ; 用户名
0042DFCC . |50 push eax ; /Arg1
0042DFCD . |FF15 20104000 call [<&MSVBVM60.__vbaLenBstr>] ; \__vbaLenBstr
0042DFD3 . |8945 C8 mov [ebp-38], eax ; 用户名长度 放入 [ebp-38]
0042DFD6 . |8D4D BC lea ecx, [ebp-44] ; 用户名
0042DFD9 . |FF15 0C124000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
0042DFDF . |8D4D A4 lea ecx, [ebp-5C]
0042DFE2 . |FF15 10124000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
0042DFE8 . |BA 24FB4000 mov edx, 0040FB24
0042DFED . |8D4D C0 lea ecx, [ebp-40]
0042DFF0 . |FF15 84114000 call [<&MSVBVM60.__vbaStrCopy>] ; MSVBVM60.__vbaStrCopy
0042DFF6 . |8B4D C8 mov ecx, [ebp-38] ; 用户名长度
0042DFF9 . |898D 48FDFFFF mov [ebp-2B8], ecx
0042DFFF . |BB 01000000 mov ebx, 1
0042E004 > |3B9D 48FDFFFF cmp ebx, [ebp-2B8] ; 第一步
0042E00A . |0F8F AB010000 jg 0042E1BB ; 循环用户名
0042E010 . |6A 01 push 1 ; /Arg1 = 00000001
0042E012 . |FF15 78104000 call [<&MSVBVM60.__vbaOnError>] ; \__vbaOnError
0042E018 . |8B16 mov edx, [esi]
0042E01A . |56 push esi
0042E01B . |FF92 B0030000 call [edx+3B0]
0042E021 . |50 push eax ; /Arg2
0042E022 . |8D45 A4 lea eax, [ebp-5C] ; |
0042E025 . |50 push eax ; |Arg1
0042E026 . |FF15 74104000 call [<&MSVBVM60.__vbaObjSet>] ; \__vbaObjSet
0042E02C . |8985 70FDFFFF mov [ebp-290], eax
0042E032 . |8B08 mov ecx, [eax]
0042E034 . |8D55 BC lea edx, [ebp-44]
0042E037 . |52 push edx
0042E038 . |50 push eax
0042E039 . |FF91 A0000000 call [ecx+A0]
0042E03F . |DBE2 fclex
0042E041 . |85C0 test eax, eax
0042E043 . |7D 18 jge short 0042E05D
0042E045 . |68 A0000000 push 0A0 ; /Arg4 = 000000A0
0042E04A . |68 ECF84000 push 0040F8EC ; |Arg3 = 0040F8EC
0042E04F . |8B8D 70FDFFFF mov ecx, [ebp-290] ; |
0042E055 . |51 push ecx ; |Arg2
0042E056 . |50 push eax ; |Arg1
0042E057 . |FF15 58104000 call [<&MSVBVM60.__vbaHresultCheckObj>; \__vbaHresultCheckObj
0042E05D > |8B55 BC mov edx, [ebp-44] ; 用户名
0042E060 . |52 push edx
0042E061 . |FF15 CC104000 call [<&MSVBVM60.#527>] ; 转为大写
0042E067 . |8BD0 mov edx, eax
0042E069 . |8D4D B0 lea ecx, [ebp-50] ; 用户名
0042E06C . |FFD7 call edi
0042E06E . |C745 90 01000>mov dword ptr [ebp-70], 1
0042E075 . |C745 88 02000>mov dword ptr [ebp-78], 2
0042E07C . |8B55 B0 mov edx, [ebp-50]
0042E07F . |C745 B0 00000>mov dword ptr [ebp-50], 0
0042E086 . |8D45 88 lea eax, [ebp-78]
0042E089 . |50 push eax
0042E08A . |53 push ebx
0042E08B . |8D4D B8 lea ecx, [ebp-48]
0042E08E . |FFD7 call edi
0042E090 . |50 push eax
0042E091 . |FF15 B8104000 call [<&MSVBVM60.#631>] ; mid 一个字符
0042E097 . |8BD0 mov edx, eax
0042E099 . |8D4D B4 lea ecx, [ebp-4C]
0042E09C . |FFD7 call edi
0042E09E . |50 push eax
0042E09F . |FF15 38104000 call [<&MSVBVM60.#516>] ; 获取ascii 码
0042E0A5 . |66:05 0200 add ax, 2 ; 将 ascii码 + 2
0042E0A9 . |0F80 B2180000 jo 0042F961
0042E0AF . |50 push eax
0042E0B0 . |FF15 04104000 call [<&MSVBVM60.__vbaStrI2>] ; 转换为字符
0042E0B6 . |8BD0 mov edx, eax
0042E0B8 . |8D4D C4 lea ecx, [ebp-3C]
0042E0BB . |FFD7 call edi
0042E0BD . |8D4D B0 lea ecx, [ebp-50]
0042E0C0 . |51 push ecx
0042E0C1 . |8D55 B4 lea edx, [ebp-4C]
0042E0C4 . |52 push edx
0042E0C5 . |8D45 B8 lea eax, [ebp-48]
0042E0C8 . |50 push eax
0042E0C9 . |8D4D BC lea ecx, [ebp-44]
0042E0CC . |51 push ecx
0042E0CD . |6A 04 push 4
0042E0CF . |FF15 8C114000 call [<&MSVBVM60.__vbaFreeStrList>] ; MSVBVM60.__vbaFreeStrList
0042E0D5 . |83C4 14 add esp, 14
0042E0D8 . |8D4D A4 lea ecx, [ebp-5C]
0042E0DB . |FF15 10124000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
0042E0E1 . |8D4D 88 lea ecx, [ebp-78]
0042E0E4 . |FF15 1C104000 call [<&MSVBVM60.__vbaFreeVar>] ; MSVBVM60.__vbaFreeVar
0042E0EA . |8D55 C4 lea edx, [ebp-3C] ; 计算后的用户名
0042E0ED . |8995 00FEFFFF mov [ebp-200], edx
0042E0F3 . |C785 F8FDFFFF>mov dword ptr [ebp-208], 4008
0042E0FD . |8D85 F8FDFFFF lea eax, [ebp-208]
0042E103 . |50 push eax
0042E104 . |8D4D 88 lea ecx, [ebp-78]
0042E107 . |51 push ecx
0042E108 . |FF15 88114000 call [<&MSVBVM60.#573>] ; 再转成16进制
0042E10E . |8B55 C0 mov edx, [ebp-40]
0042E111 . |8995 F0FDFFFF mov [ebp-210], edx
0042E117 . |C785 E8FDFFFF>mov dword ptr [ebp-218], 8
0042E121 . |8D45 C4 lea eax, [ebp-3C]
0042E124 . |8985 E0FDFFFF mov [ebp-220], eax
0042E12A . |C785 D8FDFFFF>mov dword ptr [ebp-228], 4008
0042E134 . |8D8D D8FDFFFF lea ecx, [ebp-228]
0042E13A . |51 push ecx
0042E13B . |8D95 68FFFFFF lea edx, [ebp-98]
0042E141 . |52 push edx
0042E142 . |FF15 90114000 call [<&MSVBVM60.#575>] ; 转化成八进制
0042E148 . |8D45 88 lea eax, [ebp-78]
0042E14B . |50 push eax
0042E14C . |8D8D E8FDFFFF lea ecx, [ebp-218]
0042E152 . |51 push ecx
0042E153 . |8D95 78FFFFFF lea edx, [ebp-88]
0042E159 . |52 push edx
0042E15A . |FF15 58114000 call [<&MSVBVM60.__vbaVarCat>] ; 将16进的值字符连接一起
0042E160 . |50 push eax
0042E161 . |8D85 68FFFFFF lea eax, [ebp-98]
0042E167 . |50 push eax
0042E168 . |8D8D 58FFFFFF lea ecx, [ebp-A8]
0042E16E . |51 push ecx
0042E16F . |FF15 58114000 call [<&MSVBVM60.__vbaVarCat>] ; 将8进的值字符连接一起
0042E175 . |50 push eax ; /Arg1
0042E176 . |FF15 24104000 call [<&MSVBVM60.__vbaStrVarMove>] ; \将16进制和8进制的字符串连接一起
0042E17C . |8BD0 mov edx, eax
0042E17E . |8D4D C0 lea ecx, [ebp-40]
0042E181 . |FFD7 call edi
0042E183 . |8D95 58FFFFFF lea edx, [ebp-A8]
0042E189 . |52 push edx
0042E18A . |8D85 68FFFFFF lea eax, [ebp-98]
0042E190 . |50 push eax
0042E191 . |8D8D 78FFFFFF lea ecx, [ebp-88]
0042E197 . |51 push ecx
0042E198 . |8D55 88 lea edx, [ebp-78]
0042E19B . |52 push edx
0042E19C . |6A 04 push 4
0042E19E . |FF15 28104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
0042E1A4 . |83C4 14 add esp, 14
0042E1A7 . |B8 01000000 mov eax, 1
0042E1AC . |03C3 add eax, ebx
0042E1AE . |0F80 AD170000 jo 0042F961
0042E1B4 . |8BD8 mov ebx, eax
0042E1B6 .^|E9 49FEFFFF jmp 0042E004
0042E1BB > \8B45 C0 mov eax, [ebp-40] ; 第二步
0042E1BE . 50 push eax ; /计算出来的东东
0042E1BF . FF15 20104000 call [<&MSVBVM60.__vbaLenBstr>] ; \__vbaLenBstr
0042E1C5 . 8985 40FDFFFF mov [ebp-2C0], eax
0042E1CB . BB 01000000 mov ebx, 1
0042E1D0 > 3B9D 40FDFFFF cmp ebx, [ebp-2C0]
0042E1D6 . 0F8F 83000000 jg 0042E25F ; 循环
0042E1DC . 6A 01 push 1 ; /Arg1 = 00000001
0042E1DE . FF15 78104000 call [<&MSVBVM60.__vbaOnError>] ; \__vbaOnError
0042E1E4 . C745 90 01000>mov dword ptr [ebp-70], 1
0042E1EB . C745 88 02000>mov dword ptr [ebp-78], 2
0042E1F2 . 8B4D C4 mov ecx, [ebp-3C]
0042E1F5 . 51 push ecx
0042E1F6 . 8D55 88 lea edx, [ebp-78]
0042E1F9 . 52 push edx
0042E1FA . 53 push ebx
0042E1FB . 8B45 C0 mov eax, [ebp-40]
0042E1FE . 50 push eax
0042E1FF . FF15 B8104000 call [<&MSVBVM60.#631>] ; MSVBVM60.rtcMidCharBstr
0042E205 . 8BD0 mov edx, eax
0042E207 . 8D4D BC lea ecx, [ebp-44]
0042E20A . FFD7 call edi
0042E20C . 50 push eax
0042E20D . FF15 38104000 call [<&MSVBVM60.#516>] ; 取 ascii 值
0042E213 . 50 push eax
0042E214 . FF15 04104000 call [<&MSVBVM60.__vbaStrI2>] ; 转化成字符
0042E21A . 8BD0 mov edx, eax
0042E21C . 8D4D B8 lea ecx, [ebp-48]
0042E21F . FFD7 call edi
0042E221 . 50 push eax
0042E222 . FF15 48104000 call [<&MSVBVM60.__vbaStrCat>] ; MSVBVM60.__vbaStrCat
0042E228 . 8BD0 mov edx, eax
0042E22A . 8D4D C4 lea ecx, [ebp-3C]
0042E22D . FFD7 call edi
0042E22F . 8D4D B8 lea ecx, [ebp-48]
0042E232 . 51 push ecx
0042E233 . 8D55 BC lea edx, [ebp-44]
0042E236 . 52 push edx
0042E237 . 6A 02 push 2
0042E239 . FF15 8C114000 call [<&MSVBVM60.__vbaFreeStrList>] ; MSVBVM60.__vbaFreeStrList
0042E23F . 83C4 0C add esp, 0C
0042E242 . 8D4D 88 lea ecx, [ebp-78]
0042E245 . FF15 1C104000 call [<&MSVBVM60.__vbaFreeVar>] ; MSVBVM60.__vbaFreeVar
0042E24B . B8 01000000 mov eax, 1
0042E250 . 03C3 add eax, ebx
0042E252 . 0F80 09170000 jo 0042F961
0042E258 . 8BD8 mov ebx, eax
0042E25A .^ E9 71FFFFFF jmp 0042E1D0
0042E25F > \8B45 C4 mov eax, [ebp-3C] ; 第三步
0042E262 . 50 push eax ; /Arg1
0042E263 . FF15 20104000 call [<&MSVBVM60.__vbaLenBstr>] ; \__vbaLenBstr
0042E269 . 8985 38FDFFFF mov [ebp-2C8], eax
0042E26F . BB 01000000 mov ebx, 1
0042E274 > 3B9D 38FDFFFF cmp ebx, [ebp-2C8]
0042E27A . 7F 6E jg short 0042E2EA ; 循环
0042E27C . 6A 01 push 1 ; /Arg1 = 00000001
0042E27E . FF15 78104000 call [<&MSVBVM60.__vbaOnError>] ; \__vbaOnError
0042E284 . C745 90 05000>mov dword ptr [ebp-70], 5
0042E28B . C745 88 02000>mov dword ptr [ebp-78], 2
0042E292 . 8D4D 88 lea ecx, [ebp-78]
0042E295 . 51 push ecx ; 取5个字符
0042E296 . 53 push ebx
0042E297 . 8B55 C4 mov edx, [ebp-3C]
0042E29A . 52 push edx
0042E29B . FF15 B8104000 call [<&MSVBVM60.#631>] ; MSVBVM60.rtcMidCharBstr
0042E2A1 . 8BD0 mov edx, eax
0042E2A3 . 8D4D BC lea ecx, [ebp-44]
0042E2A6 . FFD7 call edi
0042E2A8 . 50 push eax
0042E2A9 . FF15 74114000 call [<&MSVBVM60.__vbaR8Str>] ; MSVBVM60.__vbaR8Str
0042E2AF . FF15 CC114000 call [<&MSVBVM60.__vbaFpI4>] ; 转换成16进制
0042E2B5 . 8945 E0 mov [ebp-20], eax
0042E2B8 . 8D4D BC lea ecx, [ebp-44]
0042E2BB . FF15 0C124000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
0042E2C1 . 8D4D 88 lea ecx, [ebp-78]
0042E2C4 . FF15 1C104000 call [<&MSVBVM60.__vbaFreeVar>] ; MSVBVM60.__vbaFreeVar
0042E2CA . 8B45 C8 mov eax, [ebp-38] ; 用户名长度
0042E2CD . 0345 E0 add eax, [ebp-20] ; +=
0042E2D0 . 0F80 8B160000 jo 0042F961
0042E2D6 . 8945 C8 mov [ebp-38], eax
0042E2D9 . B8 05000000 mov eax, 5
0042E2DE . 03C3 add eax, ebx
0042E2E0 . 0F80 7B160000 jo 0042F961
0042E2E6 . 8BD8 mov ebx, eax
0042E2E8 .^ EB 8A jmp short 0042E274
0042E2EA > \8B4D C4 mov ecx, [ebp-3C] ; 第四步
0042E2ED . 51 push ecx ; /Arg1
0042E2EE . FF15 20104000 call [<&MSVBVM60.__vbaLenBstr>] ; \__vbaLenBstr
0042E2F4 . 8985 30FDFFFF mov [ebp-2D0], eax
0042E2FA . BB 01000000 mov ebx, 1
0042E2FF > 3B9D 30FDFFFF cmp ebx, [ebp-2D0]
0042E305 . 7F 6E jg short 0042E375 ; 循环
0042E307 . 6A 01 push 1 ; /Arg1 = 00000001
0042E309 . FF15 78104000 call [<&MSVBVM60.__vbaOnError>] ; \__vbaOnError
0042E30F . C745 90 04000>mov dword ptr [ebp-70], 4
0042E316 . C745 88 02000>mov dword ptr [ebp-78], 2
0042E31D . 8D55 88 lea edx, [ebp-78]
0042E320 . 52 push edx ; 取四位
0042E321 . 53 push ebx
0042E322 . 8B45 C4 mov eax, [ebp-3C]
0042E325 . 50 push eax
0042E326 . FF15 B8104000 call [<&MSVBVM60.#631>] ; MSVBVM60.rtcMidCharBstr
0042E32C . 8BD0 mov edx, eax
0042E32E . 8D4D BC lea ecx, [ebp-44]
0042E331 . FFD7 call edi
0042E333 . 50 push eax
0042E334 . FF15 74114000 call [<&MSVBVM60.__vbaR8Str>] ; MSVBVM60.__vbaR8Str
0042E33A . FF15 CC114000 call [<&MSVBVM60.__vbaFpI4>] ; 转换16进制
0042E340 . 8945 E0 mov [ebp-20], eax
0042E343 . 8D4D BC lea ecx, [ebp-44]
0042E346 . FF15 0C124000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
0042E34C . 8D4D 88 lea ecx, [ebp-78]
0042E34F . FF15 1C104000 call [<&MSVBVM60.__vbaFreeVar>] ; MSVBVM60.__vbaFreeVar
0042E355 . 8B4D D8 mov ecx, [ebp-28]
0042E358 . 034D E0 add ecx, [ebp-20] ; ＋＝
0042E35B . 0F80 00160000 jo 0042F961
0042E361 . 894D D8 mov [ebp-28], ecx
0042E364 . B8 04000000 mov eax, 4
0042E369 . 03C3 add eax, ebx
0042E36B . 0F80 F0150000 jo 0042F961
0042E371 . 8BD8 mov ebx, eax
0042E373 .^ EB 8A jmp short 0042E2FF
0042E375 > 8B55 C4 mov edx, [ebp-3C] ; 第五步
0042E378 . 52 push edx ; /Arg1
0042E379 . FF15 20104000 call [<&MSVBVM60.__vbaLenBstr>] ; \__vbaLenBstr
0042E37F . 8985 28FDFFFF mov [ebp-2D8], eax
0042E385 . BB 01000000 mov ebx, 1
0042E38A > 3B9D 28FDFFFF cmp ebx, [ebp-2D8]
0042E390 . 7F 6E jg short 0042E400
0042E392 . 6A 01 push 1 ; /Arg1 = 00000001
0042E394 . FF15 78104000 call [<&MSVBVM60.__vbaOnError>] ; \__vbaOnError
0042E39A . C745 90 03000>mov dword ptr [ebp-70], 3
0042E3A1 . C745 88 02000>mov dword ptr [ebp-78], 2
0042E3A8 . 8D45 88 lea eax, [ebp-78]
0042E3AB . 50 push eax ; 取三位
0042E3AC . 53 push ebx
0042E3AD . 8B4D C4 mov ecx, [ebp-3C]
0042E3B0 . 51 push ecx
0042E3B1 . FF15 B8104000 call [<&MSVBVM60.#631>] ; MSVBVM60.rtcMidCharBstr
0042E3B7 . 8BD0 mov edx, eax
0042E3B9 . 8D4D BC lea ecx, [ebp-44]
0042E3BC . FFD7 call edi
0042E3BE . 50 push eax
0042E3BF . FF15 74114000 call [<&MSVBVM60.__vbaR8Str>] ; MSVBVM60.__vbaR8Str
0042E3C5 . FF15 CC114000 call [<&MSVBVM60.__vbaFpI4>] ; 转换16进制
0042E3CB . 8945 E0 mov [ebp-20], eax
0042E3CE . 8D4D BC lea ecx, [ebp-44]
0042E3D1 . FF15 0C124000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
0042E3D7 . 8D4D 88 lea ecx, [ebp-78]
0042E3DA . FF15 1C104000 call [<&MSVBVM60.__vbaFreeVar>] ; MSVBVM60.__vbaFreeVar
0042E3E0 . 8B55 D4 mov edx, [ebp-2C]
0042E3E3 . 0355 E0 add edx, [ebp-20] ; +=
0042E3E6 . 0F80 75150000 jo 0042F961
0042E3EC . 8955 D4 mov [ebp-2C], edx
0042E3EF . B8 03000000 mov eax, 3
0042E3F4 . 03C3 add eax, ebx
0042E3F6 . 0F80 65150000 jo 0042F961
0042E3FC . 8BD8 mov ebx, eax
0042E3FE .^ EB 8A jmp short 0042E38A
0042E400 > 8B45 C4 mov eax, [ebp-3C] ; 第六步
0042E403 . 50 push eax ; /Arg1
0042E404 . FF15 20104000 call [<&MSVBVM60.__vbaLenBstr>] ; \__vbaLenBstr
0042E40A . 8985 20FDFFFF mov [ebp-2E0], eax
0042E410 . BB 01000000 mov ebx, 1
0042E415 > 3B9D 20FDFFFF cmp ebx, [ebp-2E0]
0042E41B . 6A 01 push 1 ; /Arg1 = 00000001
0042E41D . 7F 6C jg short 0042E48B ; |
0042E41F . FF15 78104000 call [<&MSVBVM60.__vbaOnError>] ; \__vbaOnError
0042E425 . C745 90 01000>mov dword ptr [ebp-70], 1
0042E42C . C745 88 02000>mov dword ptr [ebp-78], 2
0042E433 . 8D4D 88 lea ecx, [ebp-78]
0042E436 . 51 push ecx ; 取一位
0042E437 . 53 push ebx
0042E438 . 8B55 C4 mov edx, [ebp-3C]
0042E43B . 52 push edx
0042E43C . FF15 B8104000 call [<&MSVBVM60.#631>] ; MSVBVM60.rtcMidCharBstr
0042E442 . 8BD0 mov edx, eax
0042E444 . 8D4D BC lea ecx, [ebp-44]
0042E447 . FFD7 call edi
0042E449 . 50 push eax
0042E44A . FF15 74114000 call [<&MSVBVM60.__vbaR8Str>] ; MSVBVM60.__vbaR8Str
0042E450 . FF15 CC114000 call [<&MSVBVM60.__vbaFpI4>] ; 转换成16进制
0042E456 . 8945 E0 mov [ebp-20], eax
0042E459 . 8D4D BC lea ecx, [ebp-44]
0042E45C . FF15 0C124000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
0042E462 . 8D4D 88 lea ecx, [ebp-78]
0042E465 . FF15 1C104000 call [<&MSVBVM60.__vbaFreeVar>] ; MSVBVM60.__vbaFreeVar
0042E46B . 8B45 CC mov eax, [ebp-34]
0042E46E . 0345 E0 add eax, [ebp-20] ; +=
0042E471 . 0F80 EA140000 jo 0042F961
0042E477 . 8945 CC mov [ebp-34], eax
0042E47A . B8 01000000 mov eax, 1
0042E47F . 03C3 add eax, ebx
0042E481 . 0F80 DA140000 jo 0042F961
0042E487 . 8BD8 mov ebx, eax
0042E489 .^ EB 8A jmp short 0042E415
0042E48B > FF15 78104000 call [<&MSVBVM60.__vbaOnError>] ; \第七步
0042E491 . 8D4D CC lea ecx, [ebp-34] ; 1+
0042E494 . 898D 00FEFFFF mov [ebp-200], ecx
0042E49A . C785 F8FDFFFF>mov dword ptr [ebp-208], 4003
0042E4A4 . 8D95 F8FDFFFF lea edx, [ebp-208]
0042E4AA . 52 push edx
0042E4AB . 8D45 88 lea eax, [ebp-78]
0042E4AE . 50 push eax
0042E4AF . 8B1D C4114000 mov ebx, [<&MSVBVM60.#613>] ; 将数字转换成字符串 MSVBVM60.rtcVarStrFromVar
0042E4B5 . FFD3 call ebx ; <&MSVBVM60.#613>
0042E4B7 . 8D4D 88 lea ecx, [ebp-78]
0042E4BA . 51 push ecx
0042E4BB . 8D95 78FFFFFF lea edx, [ebp-88]
0042E4C1 . 52 push edx
0042E4C2 . FF15 A0104000 call [<&MSVBVM60.#522>] ; MSVBVM60.rtcLeftTrimVar
0042E4C8 . 8D45 D4 lea eax, [ebp-2C] ; 3+
0042E4CB . 8985 F0FDFFFF mov [ebp-210], eax
0042E4D1 . C785 E8FDFFFF>mov dword ptr [ebp-218], 4003
0042E4DB . 8D8D E8FDFFFF lea ecx, [ebp-218]
0042E4E1 . 51 push ecx
0042E4E2 . 8D95 68FFFFFF lea edx, [ebp-98]
0042E4E8 . 52 push edx
0042E4E9 . FFD3 call ebx ;将数字转换成字符串
0042E4EB . 8D85 68FFFFFF lea eax, [ebp-98]
0042E4F1 . 50 push eax
0042E4F2 . 8D8D 58FFFFFF lea ecx, [ebp-A8]
0042E4F8 . 51 push ecx
0042E4F9 . FF15 A0104000 call [<&MSVBVM60.#522>] ; MSVBVM60.rtcLeftTrimVar
0042E4FF . 8D55 D8 lea edx, [ebp-28] ; 4+
0042E502 . 8995 E0FDFFFF mov [ebp-220], edx
0042E508 . C785 D8FDFFFF>mov dword ptr [ebp-228], 4003
0042E512 . 8D85 D8FDFFFF lea eax, [ebp-228]
0042E518 . 50 push eax
0042E519 . 8D8D 38FFFFFF lea ecx, [ebp-C8]
0042E51F . 51 push ecx
0042E520 . FFD3 call ebx ;将数字转换成字符串
0042E522 . 8D95 38FFFFFF lea edx, [ebp-C8]
0042E528 . 52 push edx
0042E529 . 8D85 28FFFFFF lea eax, [ebp-D8]
0042E52F . 50 push eax
0042E530 . FF15 A0104000 call [<&MSVBVM60.#522>] ; MSVBVM60.rtcLeftTrimVar
0042E536 . 8D4D C8 lea ecx, [ebp-38] ; 5+
0042E539 . 898D D0FDFFFF mov [ebp-230], ecx
0042E53F . C785 C8FDFFFF>mov dword ptr [ebp-238], 4003
0042E549 . 8D95 C8FDFFFF lea edx, [ebp-238]
0042E54F . 52 push edx
0042E550 . 8D85 08FFFFFF lea eax, [ebp-F8]
0042E556 . 50 push eax
0042E557 . FFD3 call ebx ;将数字转换成字符串
0042E559 . 8D8D 08FFFFFF lea ecx, [ebp-F8]
0042E55F . 51 push ecx
0042E560 . 8D95 F8FEFFFF lea edx, [ebp-108]
0042E566 . 52 push edx
0042E567 . FF15 A0104000 call [<&MSVBVM60.#522>] ; MSVBVM60.rtcLeftTrimVar
0042E56D . C785 C0FDFFFF>mov dword ptr [ebp-240], 14
0042E577 . C785 B8FDFFFF>mov dword ptr [ebp-248], 8002
0042E581 . 8D85 78FFFFFF lea eax, [ebp-88] ; 1+
0042E587 . 50 push eax
0042E588 . 8D8D 58FFFFFF lea ecx, [ebp-A8] ; 3+
0042E58E . 51 push ecx
0042E58F . 8D95 48FFFFFF lea edx, [ebp-B8]
0042E595 . 52 push edx
0042E596 . FF15 58114000 call [<&MSVBVM60.__vbaVarCat>] ; 将计算出来的结果相连 MSVBVM60.__vbaVarCat
0042E59C . 50 push eax
0042E59D . 8D85 28FFFFFF lea eax, [ebp-D8] ; 4+
0042E5A3 . 50 push eax
0042E5A4 . 8D8D 18FFFFFF lea ecx, [ebp-E8]
0042E5AA . 51 push ecx
0042E5AB . FF15 58114000 call [<&MSVBVM60.__vbaVarCat>] ; 将计算出来的结果相连 MSVBVM60.__vbaVarCat
0042E5B1 . 50 push eax
0042E5B2 . 8D95 F8FEFFFF lea edx, [ebp-108] ; 5+
0042E5B8 . 52 push edx
0042E5B9 . 8D85 E8FEFFFF lea eax, [ebp-118]
0042E5BF . 50 push eax
0042E5C0 . FF15 58114000 call [<&MSVBVM60.__vbaVarCat>] ; 将计算出来的结果相连 MSVBVM60.__vbaVarCat
0042E5C6 . 50 push eax
0042E5C7 . 8D8D D8FEFFFF lea ecx, [ebp-128]
0042E5CD . 51 push ecx
0042E5CE . FF15 5C104000 call [<&MSVBVM60.__vbaLenVar>] ; MSVBVM60.__vbaLenVar
0042E5D4 . 50 push eax ;
0042E5D5 . 8D95 B8FDFFFF lea edx, [ebp-248]
0042E5DB . 52 push edx ; 14
0042E5DC . FF15 A8104000 call [<&MSVBVM60.__vbaVarTstLt>] ; 对比算出来的字符长度 是否 < 14 MSVBVM60.__vbaVarTstLt
0042E5E2 . 66:8985 70FDF>mov [ebp-290], ax ; eax < edx 放入内存
0042E5E9 . 8D85 E8FEFFFF lea eax, [ebp-118]
0042E5EF . 50 push eax
0042E5F0 . 8D8D F8FEFFFF lea ecx, [ebp-108]
0042E5F6 . 51 push ecx
0042E5F7 . 8D95 18FFFFFF lea edx, [ebp-E8]
0042E5FD . 52 push edx
0042E5FE . 8D85 08FFFFFF lea eax, [ebp-F8]
0042E604 . 50 push eax
0042E605 . 8D8D 28FFFFFF lea ecx, [ebp-D8]
0042E60B . 51 push ecx
0042E60C . 8D95 48FFFFFF lea edx, [ebp-B8]
0042E612 . 52 push edx
0042E613 . 8D85 38FFFFFF lea eax, [ebp-C8]
0042E619 . 50 push eax
0042E61A . 8D8D 58FFFFFF lea ecx, [ebp-A8]
0042E620 . 51 push ecx
0042E621 . 8D95 78FFFFFF lea edx, [ebp-88]
0042E627 . 52 push edx
0042E628 . 8D85 68FFFFFF lea eax, [ebp-98]
0042E62E . 50 push eax
0042E62F . 8D4D 88 lea ecx, [ebp-78]
0042E632 . 51 push ecx
0042E633 . 6A 0B push 0B
0042E635 . FF15 28104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
0042E63B . 83C4 30 add esp, 30 ; 还原 esp
0042E63E . 66:83BD 70FDF>cmp word ptr [ebp-290], 0 ; 字符长度对比
0042E646 . 0F84 32030000 je 0042E97E
.....
这里有段代码为
最终算出的长度如果小于20位 就在前面补上 "0179543"
但现在好像不会出现这种情况 所以省略分析部分 其实和下面也差不多
跳转后 绕过一些无关的代码 来到序列号对比处
0042EB6C > \8B55 BC mov edx, [ebp-44]
0042EB6F . 52 push edx
0042EB70 . 8B45 B8 mov eax, [ebp-48]
0042EB73 . 50 push eax
0042EB74 . FF15 48104000 call [<&MSVBVM60.__vbaStrCat>] ; 假序列号
0042EB7A . 8BD0 mov edx, eax
0042EB7C . 8D4D B0 lea ecx, [ebp-50]
0042EB7F . FFD7 call edi
0042EB81 . 50 push eax
0042EB82 . 8B4D B4 mov ecx, [ebp-4C]
0042EB85 . 51 push ecx
0042EB86 . FF15 48104000 call [<&MSVBVM60.__vbaStrCat>] ; 连接假序列号一共四组 MSVBVM60.__vbaStrCat
0042EB8C . 8BD0 mov edx, eax
0042EB8E . 8D4D A8 lea ecx, [ebp-58]
0042EB91 . FFD7 call edi
0042EB93 . 50 push eax
0042EB94 . 8B55 AC mov edx, [ebp-54]
0042EB97 . 52 push edx
0042EB98 . FF15 48104000 call [<&MSVBVM60.__vbaStrCat>] ; MSVBVM60.__vbaStrCat
0042EB9E . 8985 D0FEFFFF mov [ebp-130], eax
0042EBA4 . C785 C8FEFFFF>mov dword ptr [ebp-138], 8008
0042EBAE . 6A 14 push 14 ; 取连接字符的个数 20位
0042EBB0 . 8D85 78FFFFFF lea eax, [ebp-88] ;1+
0042EBB6 . 50 push eax
0042EBB7 . 8D8D 58FFFFFF lea ecx, [ebp-A8] ;3+
0042EBBD . 51 push ecx
0042EBBE . 8D95 48FFFFFF lea edx, [ebp-B8]
0042EBC4 . 52 push edx
0042EBC5 . FF15 58114000 call [<&MSVBVM60.__vbaVarCat>] ; MSVBVM60.__vbaVarCat
0042EBCB . 50 push eax
0042EBCC . 8D85 28FFFFFF lea eax, [ebp-D8] ;4+
0042EBD2 . 50 push eax
0042EBD3 . 8D8D 18FFFFFF lea ecx, [ebp-E8]
0042EBD9 . 51 push ecx
0042EBDA . FF15 58114000 call [<&MSVBVM60.__vbaVarCat>] ; MSVBVM60.__vbaVarCat
0042EBE0 . 50 push eax
0042EBE1 . 8D95 F8FEFFFF lea edx, [ebp-108] ; 5+
0042EBE7 . 52 push edx
0042EBE8 . 8D85 E8FEFFFF lea eax, [ebp-118]
0042EBEE . 50 push eax
0042EBEF . FF15 58114000 call [<&MSVBVM60.__vbaVarCat>] ; MSVBVM60.__vbaVarCat
0042EBF5 . 50 push eax
0042EBF6 . 8D8D D8FEFFFF lea ecx, [ebp-128]
0042EBFC . 51 push ecx
0042EBFD . FF15 D4114000 call [<&MSVBVM60.#617>] ; 取左20位 MSVBVM60.rtcLeftCharVar
0042EC03 . 8D95 C8FEFFFF lea edx, [ebp-138]
0042EC09 . 52 push edx
0042EC0A . 8D85 D8FEFFFF lea eax, [ebp-128]
0042EC10 . 50 push eax
0042EC11 . FF15 DC104000 call [<&MSVBVM60.__vbaVarTstEq>] ; 对比
0042EC17 . 8985 50FDFFFF mov [ebp-2B0], eax
0042EC1D . 8D4D AC lea ecx, [ebp-54]
0042EC20 . 51 push ecx
0042EC21 . 8D55 A8 lea edx, [ebp-58]
0042EC24 . 52 push edx
0042EC25 . 8D45 B4 lea eax, [ebp-4C]
0042EC28 . 50 push eax
0042EC29 . 8D4D B0 lea ecx, [ebp-50]
0042EC2C . 51 push ecx
0042EC2D . 8D55 B8 lea edx, [ebp-48]
0042EC30 . 52 push edx
0042EC31 . 8D45 BC lea eax, [ebp-44]
0042EC34 . 50 push eax
0042EC35 . 6A 06 push 6
0042EC37 . FF15 8C114000 call [<&MSVBVM60.__vbaFreeStrList>] ; MSVBVM60.__vbaFreeStrList
0042EC3D . 8D4D 98 lea ecx, [ebp-68]
0042EC40 . 51 push ecx
0042EC41 . 8D55 9C lea edx, [ebp-64]
0042EC44 . 52 push edx
0042EC45 . 8D45 A0 lea eax, [ebp-60]
0042EC48 . 50 push eax
0042EC49 . 8D4D A4 lea ecx, [ebp-5C]
0042EC4C . 51 push ecx
0042EC4D . 6A 04 push 4
0042EC4F . FF15 34104000 call [<&MSVBVM60.__vbaFreeObjList>] ; MSVBVM60.__vbaFreeObjList
0042EC55 . 8D95 D8FEFFFF lea edx, [ebp-128]
0042EC5B . 52 push edx
0042EC5C . 8D85 C8FEFFFF lea eax, [ebp-138]
0042EC62 . 50 push eax
0042EC63 . 8D8D E8FEFFFF lea ecx, [ebp-118]
0042EC69 . 51 push ecx
0042EC6A . 8D95 F8FEFFFF lea edx, [ebp-108]
0042EC70 . 52 push edx
0042EC71 . 8D85 18FFFFFF lea eax, [ebp-E8]
0042EC77 . 50 push eax
0042EC78 . 8D8D 08FFFFFF lea ecx, [ebp-F8]
0042EC7E . 51 push ecx
0042EC7F . 8D95 28FFFFFF lea edx, [ebp-D8]
0042EC85 . 52 push edx
0042EC86 . 8D85 48FFFFFF lea eax, [ebp-B8]
0042EC8C . 50 push eax
0042EC8D . 8D8D 38FFFFFF lea ecx, [ebp-C8]
0042EC93 . 51 push ecx
0042EC94 . 8D95 58FFFFFF lea edx, [ebp-A8]
0042EC9A . 52 push edx
0042EC9B . 8D85 78FFFFFF lea eax, [ebp-88]
0042ECA1 . 50 push eax
0042ECA2 . 8D8D 68FFFFFF lea ecx, [ebp-98]
0042ECA8 . 51 push ecx
0042ECA9 . 8D55 88 lea edx, [ebp-78]
0042ECAC . 52 push edx
0042ECAD . 6A 0D push 0D
0042ECAF . FF15 28104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
0042ECB5 . 83C4 68 add esp, 68
0042ECB8 . 66:83BD 50FDF>cmp word ptr [ebp-2B0], 0
0042ECC0 . 0F84 A9020000 je 0042EF6F ; 关键跳转
分析完了，如果有什么错误请大家指正。
--------------------------------------------------------------------------------
【经验总结】
总的来说 算法还是比较简单的，只是开始不太清楚VB的函数 在网上找了好多资料才搞懂了一些。
下面是用Delphi写的注册机代码
program KeyGen;
{$APPTYPE CONSOLE}
uses
SysUtils;
var
input : string;
ls1,ls2,ls3,ls4 : Integer;
shex,soct,sint : string;
i: Integer;
label
LIn;
function IntToOct(value: integer):string;
var
i : Integer;
str : string;
begin
Result:='';
str := '0123456789';
while value > 0 do
begin
i := value mod 8;
value := value div 8;
result:= Copy(str, i+1, 1) + result;
end;
end;
function CalcSum(Value: string; len: integer): integer;
var
i : integer;
sint : string;
begin
i := 1;
Result := 0;
while i <= Length(Value) do
begin
sint := Copy(Value, i, len);
Result := Result + StrToInt(sint);
i := i + len;
end;
end;
begin
{ TODO -oUser -cConsole Main : Insert code here }
Lin:
Write('请输入用户名：');
Readln(input);
input := UpperCase(input);
ls4 := Length(input);
if (Pos('@163.COM', input) = 0) and (Pos('@YAHOO.COM.CN', input) = 0) then
begin
Writeln('请输入163.com 或者 yahoo.com.cn 的邮箱！');
goto Lin;
end;
shex := '';
soct := '';
//第一步
for I := 1 to Length(input) do
begin
ls1:= Ord(input[i]) + 2;
shex := IntToHex(ls1,2) + shex;
soct := soct + IntToOct(ls1);
end;
input := shex + soct ;
sint := IntToStr(ls1);
//第二步
for I := 1 to Length(input) do
begin
sint := sint + IntToStr(Ord(input[i]));
end;
//第三步
input := sint;
ls4 := ls4 + CalcSum(input, 5);
//第四步
ls3 := CalcSum(input, 4);
//第五步
ls2 := CalcSum(input, 3);
//第六步
ls1 := CalcSum(input, 1);
input := Copy(Format('%d%d%d%d',[ls1,ls2,ls3,ls4]),0,20);
if Length(input) < 20 then
input := '0179543' + input;
Writeln('序列号为 ' + Copy(input,1,5) +'-'+ Copy(input,6, 5) +'-'+ Copy(input, 11, 5) +'-'+ Copy(input,
16,5));
goto Lin;
end.
--------------------------------------------------------------------------------
【版权声明】: 本文原创于看雪技术论坛, 转载请注明作者并保持文章的完整, 谢谢!
2007年03月05日 22:05:24