Teorex Inpaint v3.0 注册算法

【软件名称】:
    Teorex Inpaint

【下载地址】:
    Http://www.theinpaint.com/

【软件简介】:
    Teorex Inpaint 是一款不错的图片水印去除程序,使用它可以非常轻松的去除令人讨厌的图片水印.



【软件限制】:
    自己试吧.

【破解声明】:
    网上也有 Teorex Inpaint v3.0 及其注册码,可惜不能注册从官方网站下载的最新版本.所以自己动手吧,希望喜欢的人在试用之后,自动删除,我只对它的注册算法感兴趣,虽然破解之后,没多大感觉.

【破解工具】:
    PEID v0.94,OllyDBG v1.10

【破文作者】:
    WSLVIC 电邮:Crk4u@163.com

【破解时间】:
    二一一年七月二十日

【破解过程】:

    首先当然是查壳了,发现是 Microsoft Visual Studio .NET 2005 -- 2008 -> Microsoft Corporation *,没加壳,省的麻烦!然后运行一下,随便输入个注册码,点击 'Ok',弹出注册失败对话框,"Serial key is invalid...",记住这个字符串,在 OD 中查找字符串参考,很快就找到了,双击目标字符串,转到 CPU 窗口,向上/向下都翻翻,其注册流程就比较清晰了,如下:
    ┌──────────────────────────────────────────────┐
    │00403730   $ SUB ESP,8                                                                      │
    │00403733   . PUSH ESI                                                                       │
    │00403734   . LEA EAX,DWORD PTR SS:[ESP+10]                                                  │
    │00403738   . PUSH EAX                                 ; /Arg1                               │
    │00403739   . MOV ESI,ECX                              ; |                                   │
    │0040373B   . CALL Inpaint.00402BB0                    ; \关键调用 Inpaint.00402BB0          │
    │00403740   . CMP BYTE PTR DS:[ESI+3C],0                                                     │
     ───────────────────────────────────────────────
    │00403744   . JNZ Inpaint.004037E8                     ;  不跳就死                           │
     ───────────────────────────────────────────────
    │0040374A   . PUSH -1                                                                        │
    │0040374C   . PUSH Inpaint.007F3948                    ;  ASCII "Inpaint"                    │
    │00403751   . CALL Inpaint.00736150                                                          │
    │00403756   . ADD ESP,8                                                                      │
    │00403759   . PUSH 0                                                                         │
    │0040375B   . PUSH ECX                                                                       │
    │0040375C   . MOV DWORD PTR SS:[ESP+10],EAX                                                  │
    │00403760   . MOV EAX,ESP                                                                    │
    │00403762   . PUSH 0                                                                         │
    │00403764   . PUSH Inpaint.007F3BE4                    ;  ASCII "Serial key is invalid..."   │
    │00403769   . LEA ECX,DWORD PTR SS:[ESP+14]                                                  │
    │0040376D   . PUSH ECX                                                                       │
    │0040376E   . MOV ECX,Inpaint.007F4898                                                       │
    │00403773   . MOV DWORD PTR DS:[EAX],400                                                     │
    │00403779   . CALL Inpaint.00743950                                                          │
    │0040377E   . LEA EDX,DWORD PTR SS:[ESP+C]                                                   │
    │00403782   . PUSH EDX                                                                       │
    │00403783   . LEA EAX,DWORD PTR SS:[ESP+14]                                                  │
    │00403787   . PUSH EAX                                                                       │
    │00403788   . PUSH ESI                                                                       │
    │00403789   . CALL Inpaint.0046F940                                                          │
    │0040378E   . MOV ECX,DWORD PTR SS:[ESP+18]                                                  │
    │00403792   . ADD ESP,14                                                                     │
    │00403795   . OR EDX,FFFFFFFF                                                                │
    │00403798   . LOCK XADD DWORD PTR DS:[ECX],EDX         ;  锁定前缀                           │
    │0040379C   . JNZ SHORT Inpaint.004037AB                                                     │
    │0040379E   . MOV EAX,DWORD PTR SS:[ESP+4]                                                   │
    │004037A2   . PUSH EAX                                                                       │
    │004037A3   . CALL Inpaint.00733BB0                                                          │
    │004037A8   . ADD ESP,4                                                                      │
    │004037AB   > MOV ECX,DWORD PTR SS:[ESP+8]                                                   │
    │004037AF   . OR EDX,FFFFFFFF                                                                │
    │004037B2   . LOCK XADD DWORD PTR DS:[ECX],EDX         ;  锁定前缀                           │
    │004037B6   . JNZ SHORT Inpaint.004037C5                                                     │
    │004037B8   . MOV EAX,DWORD PTR SS:[ESP+8]                                                   │
    │004037BC   . PUSH EAX                                                                       │
    │004037BD   . CALL Inpaint.00733BB0                                                          │
    │004037C2   . ADD ESP,4                                                                      │
    │004037C5   > MOV ECX,DWORD PTR SS:[ESP+10]                                                  │
    │004037C9   . OR EDX,FFFFFFFF                                                                │
    │004037CC   . LOCK XADD DWORD PTR DS:[ECX],EDX         ;  锁定前缀                           │
    │004037D0   . JNZ SHORT Inpaint.004037DF                                                     │
    │004037D2   . MOV EAX,DWORD PTR SS:[ESP+10]                                                  │
    │004037D6   . PUSH EAX                                                                       │
    │004037D7   . CALL Inpaint.00733BB0                                                          │
    │004037DC   . ADD ESP,4                                                                      │
    │004037DF   > XOR AL,AL                                                                      │
    │004037E1   . POP ESI                                                                        │
    │004037E2   . ADD ESP,8                                                                      │
    │004037E5   . RETN 4                                                                         │
    │004037E8   > LEA ECX,DWORD PTR SS:[ESP+10]                                                  │
    │004037EC   . PUSH ECX                                                                       │
    │004037ED   . LEA ECX,DWORD PTR DS:[ESI+40]                                                  │
    │004037F0   . CALL Inpaint.00733BC0                                                          │
    │004037F5   . MOV ECX,ESI                                                                    │
    │004037F7   . CALL Inpaint.00402A70                                                          │
    │004037FC   . PUSH -1                                                                        │
    │004037FE   . PUSH Inpaint.007F3948                    ;  ASCII "Inpaint"                    │
    │00403803   . CALL Inpaint.00736150                                                          │
    │00403808   . ADD ESP,8                                                                      │
    │0040380B   . PUSH 0                                                                         │
    │0040380D   . PUSH ECX                                                                       │
    │0040380E   . MOV DWORD PTR SS:[ESP+C],EAX                                                   │
    │00403812   . MOV EAX,ESP                                                                    │
    │00403814   . PUSH 0                                                                         │
    │00403816   . PUSH Inpaint.007F3BC8                    ;  ASCII "Thank you for registration!"│
    │0040381B   . LEA EDX,DWORD PTR SS:[ESP+18]                                                  │
    │0040381F   . PUSH EDX                                                                       │
    │00403820   . MOV ECX,Inpaint.007F4898                                                       │
    │00403825   . MOV DWORD PTR DS:[EAX],400                                                     │
    │0040382B   . CALL Inpaint.00743950                                                          │
    │00403830   . LEA EAX,DWORD PTR SS:[ESP+10]                                                  │
    │00403834   . PUSH EAX                                                                       │
    │00403835   . LEA ECX,DWORD PTR SS:[ESP+10]                                                  │
    │00403839   . PUSH ECX                                                                       │
    │0040383A   . PUSH ESI                                                                       │
     ───────────────────────────────────────────────
    │0040383B   . CALL Inpaint.0046F910                    ;  调用注册成功对话框                 │
     ───────────────────────────────────────────────
    │00403840   . MOV EDX,DWORD PTR SS:[ESP+1C]                                                  │
    │00403844   . ADD ESP,14                                                                     │
    │00403847   . OR EAX,FFFFFFFF                                                                │
    │0040384A   . LOCK XADD DWORD PTR DS:[EDX],EAX         ;  锁定前缀                           │
    │0040384E   . JNZ SHORT Inpaint.0040385D                                                     │
    │00403850   . MOV ECX,DWORD PTR SS:[ESP+8]                                                   │
    │00403854   . PUSH ECX                                                                       │
    │00403855   . CALL Inpaint.00733BB0                                                          │
    │0040385A   . ADD ESP,4                                                                      │
    │0040385D   > MOV EDX,DWORD PTR SS:[ESP+4]                                                   │
    │00403861   . OR EAX,FFFFFFFF                                                                │
    │00403864   . LOCK XADD DWORD PTR DS:[EDX],EAX         ;  锁定前缀                           │
    │00403868   . JNZ SHORT Inpaint.00403877                                                     │
    │0040386A   . MOV ECX,DWORD PTR SS:[ESP+4]                                                   │
    │0040386E   . PUSH ECX                                                                       │
    │0040386F   . CALL Inpaint.00733BB0                                                          │
    │00403874   . ADD ESP,4                                                                      │
    │00403877   > MOV EDX,DWORD PTR SS:[ESP+10]                                                  │
    │0040387B   . OR EAX,FFFFFFFF                                                                │
    │0040387E   . LOCK XADD DWORD PTR DS:[EDX],EAX         ;  锁定前缀                           │
    │00403882   . JNZ SHORT Inpaint.00403891                                                     │
    │00403884   . MOV ECX,DWORD PTR SS:[ESP+10]                                                  │
    │00403888   . PUSH ECX                                                                       │
    │00403889   . CALL Inpaint.00733BB0                                                          │
    │0040388E   . ADD ESP,4                                                                      │
    │00403891   > MOV AL,1                                                                       │
    │00403893   . POP ESI                                                                        │
    │00403894   . ADD ESP,8                                                                      │
    │00403897   . RETN 4                                                                         │
    └──────────────────────────────────────────────┘
    其中 CALL Inpaint.00402BB0 为关键调用处,是注册码比较的地方,当然要跟进了,然后 F8 单步,并不时修改测试注册码,最终明白各部分的功能,如下:
    ┌──────────────────────────────────────────────┐
    │00402BB0  /$SUB ESP,8                                                                       │
    │00402BB3  |.PUSH EBP                                                                        │
    │00402BB4  |.PUSH ESI                                                                        │
    │00402BB5  |.MOV ESI,DWORD PTR SS:[ESP+14]                                                   │
    │00402BB9  |.MOV EAX,DWORD PTR DS:[ESI]                                                      │
    │00402BBB  |.CMP DWORD PTR DS:[EAX+8],0                                                      │
    │00402BBF  |.MOV EBP,ECX                                                                     │
    │00402BC1  |.JE Inpaint.004030A6                                                             │
    │00402BC7  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  输入的注册码(UNICODE)               │
    │00402BCA  |.MOV DX,WORD PTR DS:[ECX+2]               ;  DX=注册码第二位                     │
    │00402BCE  |.MOV WORD PTR SS:[ESP+A],DX                                                      │
    │00402BD3  |.MOV EAX,DWORD PTR DS:[EAX+C]             ;  EAX=注册码                          │
    │00402BD6  |.MOV CX,WORD PTR DS:[EAX]                 ;  CX=注册码第一位                     │
    │00402BD9  |.MOV WORD PTR SS:[ESP+14],CX                                                     │
    │00402BDE  |.PUSH EDI                                                                        │
    │00402BDF  |.LEA ECX,DWORD PTR SS:[ESP+18]                                                   │
    │00402BE3  |.CALL Inpaint.00735440                                                           │
    │00402BE8  |.MOVSX EAX,AL                                                                    │
    │00402BEB  |.ADD EAX,EAX                                                                     │
    │00402BED  |.CDQ                                                                             │
    │00402BEE  |.MOV ECX,19                                                                      │
    │00402BF3  |.IDIV ECX                                                                        │
    │00402BF5  |.LEA ECX,DWORD PTR SS:[ESP+E]                                                    │
    │00402BF9  |.LEA EDI,DWORD PTR DS:[EDX+41]                                                   │
    │00402BFC  |.CALL Inpaint.00735440                                                           │
    │00402C01  |.MOVSX EDX,AL                             ;  EDX=注册码的第二位                  │
    │00402C04  |.CMP EDX,EDI                                                                     │
     ───────────────────────────────────────────────
    │00402C06  |.JNZ Inpaint.004030A5                     ;  一跳就死                            │
     ───────────────────────────────────────────────
    │00402C0C  |.MOV EAX,DWORD PTR DS:[ESI]                                                      │
    │00402C0E  |.MOV ECX,DWORD PTR DS:[EAX+C]                                                    │
    │00402C11  |.MOVZX EDX,WORD PTR DS:[ECX+4]            ;  EDX=注册码第三位                    │
    │00402C15  |.MOV WORD PTR SS:[ESP+10],DX                                                     │
    │00402C1A  |.MOV ECX,DWORD PTR DS:[EAX+C]                                                    │
    │00402C1D  |.MOVZX EDX,WORD PTR DS:[ECX]              ;  EDX=注册码第一位                    │
    │00402C20  |.MOV WORD PTR SS:[ESP+E],DX                                                      │
    │00402C25  |.MOV EAX,DWORD PTR DS:[EAX+C]             ;  EAX=注册码                          │
    │00402C28  |.MOV CX,WORD PTR DS:[EAX+2]               ;  CX=注册码的第二位                   │
    │00402C2C  |.MOV WORD PTR SS:[ESP+18],CX                                                     │
    │00402C31  |.LEA ECX,DWORD PTR SS:[ESP+18]                                                   │
    │00402C35  |.CALL Inpaint.00735440                                                           │
    │00402C3A  |.LEA ECX,DWORD PTR SS:[ESP+E]                                                    │
    │00402C3E  |.MOVSX EDI,AL                                                                    │
    │00402C41  |.CALL Inpaint.00735440                                                           │
    │00402C46  |.MOVSX EAX,AL                                                                    │
    │00402C49  |.IMUL EAX,EDI                                                                    │
    │00402C4C  |.CDQ                                                                             │
    │00402C4D  |.MOV ECX,19                                                                      │
    │00402C52  |.IDIV ECX                                                                        │
    │00402C54  |.LEA ECX,DWORD PTR SS:[ESP+10]                                                   │
    │00402C58  |.LEA EDI,DWORD PTR DS:[EDX+41]                                                   │
    │00402C5B  |.CALL Inpaint.00735440                                                           │
    │00402C60  |.MOVSX EDX,AL                             ;  EDX=注册码的第三位                  │
    │00402C63  |.CMP EDX,EDI                                                                     │
     ───────────────────────────────────────────────
    │00402C65  |.JNZ Inpaint.004030A5                     ;  一跳就死                            │
     ───────────────────────────────────────────────
    │00402C6B  |.MOV EAX,DWORD PTR DS:[ESI]                                                      │
    │00402C6D  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  ECX=注册码                          │
    │00402C70  |.MOV DX,WORD PTR DS:[ECX+6]               ;  DX=注册码第四位                     │
    │00402C74  |.MOV WORD PTR SS:[ESP+10],DX                                                     │
    │00402C79  |.MOV EAX,DWORD PTR DS:[EAX+C]             ;  EAX=注册码                          │
    │00402C7C  |.MOV CX,WORD PTR DS:[EAX+4]               ;  CX=注册码第三位                     │
    │00402C80  |.MOV WORD PTR SS:[ESP+18],CX                                                     │
    │00402C85  |.LEA ECX,DWORD PTR SS:[ESP+18]                                                   │
    │00402C89  |.CALL Inpaint.00735440                                                           │
    │00402C8E  |.MOVSX EAX,AL                                                                    │
    │00402C91  |.ADD EAX,EAX                                                                     │
    │00402C93  |.ADD EAX,EAX                                                                     │
    │00402C95  |.CDQ                                                                             │
    │00402C96  |.MOV ECX,19                                                                      │
    │00402C9B  |.IDIV ECX                                                                        │
    │00402C9D  |.LEA ECX,DWORD PTR SS:[ESP+10]                                                   │
    │00402CA1  |.LEA EDI,DWORD PTR DS:[EDX+41]                                                   │
    │00402CA4  |.CALL Inpaint.00735440                                                           │
    │00402CA9  |.MOVSX EDX,AL                             ;  EDX=注册码的第四位                  │
     ───────────────────────────────────────────────
    │00402CAC  |.CMP EDX,EDI                              ;  一跳就死                            │
     ───────────────────────────────────────────────
    │00402CAE  |.JNZ Inpaint.004030A5                                                            │
    │00402CB4  |.MOV EAX,DWORD PTR DS:[ESI]                                                      │
    │00402CB6  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  ECX=注册码                          │
    │00402CB9  |.MOVZX EDX,WORD PTR DS:[ECX+A]            ;  EDX=注册码第六位                    │
    │00402CBD  |.MOV WORD PTR SS:[ESP+E],DX                                                      │
    │00402CC2  |.MOV ECX,DWORD PTR DS:[EAX+C]                                                    │
    │00402CC5  |.MOVZX EDX,WORD PTR DS:[ECX+4]            ;  EDX=注册码第三位                    │
    │00402CC9  |.MOV WORD PTR SS:[ESP+10],DX                                                     │
    │00402CCE  |.MOV EAX,DWORD PTR DS:[EAX+C]             ;  EAX=注册码                          │
    │00402CD1  |.MOV CX,WORD PTR DS:[EAX+6]               ;  CX=注册码第四位                     │
    │00402CD5  |.MOV WORD PTR SS:[ESP+18],CX                                                     │
    │00402CDA  |.LEA ECX,DWORD PTR SS:[ESP+18]                                                   │
    │00402CDE  |.CALL Inpaint.00735440                                                           │
    │00402CE3  |.LEA ECX,DWORD PTR SS:[ESP+10]                                                   │
    │00402CE7  |.MOVSX EDI,AL                                                                    │
    │00402CEA  |.CALL Inpaint.00735440                                                           │
    │00402CEF  |.MOVSX EAX,AL                                                                    │
    │00402CF2  |.IMUL EAX,EDI                                                                    │
    │00402CF5  |.ADD EAX,EAX                                                                     │
    │00402CF7  |.CDQ                                                                             │
    │00402CF8  |.MOV ECX,19                                                                      │
    │00402CFD  |.IDIV ECX                                                                        │
    │00402CFF  |.LEA ECX,DWORD PTR SS:[ESP+E]                                                    │
    │00402D03  |.LEA EDI,DWORD PTR DS:[EDX+41]                                                   │
    │00402D06  |.CALL Inpaint.00735440                                                           │
    │00402D0B  |.MOVSX EDX,AL                             ;  EDX=注册码的第六位                  │
    │00402D0E  |.CMP EDX,EDI                                                                     │
     ───────────────────────────────────────────────
    │00402D10  |.JNZ Inpaint.004030A5                     ;  一跳就死                            │
     ───────────────────────────────────────────────
    │00402D16  |.MOV EAX,DWORD PTR DS:[ESI]                                                      │
    │00402D18  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  ECX=注册码                          │
    │00402D1B  |.MOVZX EDX,WORD PTR DS:[ECX+C]            ;  EDX=注册码第七位                    │
    │00402D1F  |.MOV WORD PTR SS:[ESP+E],DX                                                      │
    │00402D24  |.MOV ECX,DWORD PTR DS:[EAX+C]                                                    │
    │00402D27  |.MOVZX EDX,WORD PTR DS:[ECX+8]            ;  EDX=注册码第五位                    │
    │00402D2B  |.MOV WORD PTR SS:[ESP+10],DX                                                     │
    │00402D30  |.MOV EAX,DWORD PTR DS:[EAX+C]             ;  EAX=注册码                          │
    │00402D33  |.MOV CX,WORD PTR DS:[EAX+A]               ;  CX=注册码第六位                     │
    │00402D37  |.MOV WORD PTR SS:[ESP+18],CX                                                     │
    │00402D3C  |.LEA ECX,DWORD PTR SS:[ESP+18]                                                   │
    │00402D40  |.CALL Inpaint.00735440                                                           │
    │00402D45  |.LEA ECX,DWORD PTR SS:[ESP+10]                                                   │
    │00402D49  |.MOVSX EDI,AL                                                                    │
    │00402D4C  |.CALL Inpaint.00735440                                                           │
    │00402D51  |.MOVSX EAX,AL                                                                    │
    │00402D54  |.IMUL EAX,EDI                                                                    │
    │00402D57  |.ADD EAX,0F                                                                      │
    │00402D5A  |.CDQ                                                                             │
    │00402D5B  |.MOV ECX,19                                                                      │
    │00402D60  |.IDIV ECX                                                                        │
    │00402D62  |.LEA ECX,DWORD PTR SS:[ESP+E]                                                    │
    │00402D66  |.LEA EDI,DWORD PTR DS:[EDX+41]                                                   │
    │00402D69  |.CALL Inpaint.00735440                                                           │
    │00402D6E  |.MOVSX EDX,AL                             ;  EDX=注册码的第七位                  │
    │00402D71  |.CMP EDX,EDI                                                                     │
     ───────────────────────────────────────────────
    │00402D73  |.JNZ Inpaint.004030A5                     ;  一跳就死                            │
     ───────────────────────────────────────────────
    │00402D79  |.MOV EAX,DWORD PTR DS:[ESI]                                                      │
    │00402D7B  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  ECX=注册码                          │
    │00402D7E  |.MOVZX EDX,WORD PTR DS:[ECX+E]            ;  EDX=注册码第八位                    │
    │00402D82  |.MOV WORD PTR SS:[ESP+12],DX                                                     │
    │00402D87  |.MOV ECX,DWORD PTR DS:[EAX+C]                                                    │
    │00402D8A  |.MOVZX EDX,WORD PTR DS:[ECX+A]            ;  EDX=注册码第六位                    │
    │00402D8E  |.MOV WORD PTR SS:[ESP+E],DX                                                      │
    │00402D93  |.MOV ECX,DWORD PTR DS:[EAX+C]                                                    │
    │00402D96  |.MOVZX EDX,WORD PTR DS:[ECX+C]            ;  EDX=注册码第七位                    │
    │00402D9A  |.MOV WORD PTR SS:[ESP+10],DX                                                     │
    │00402D9F  |.MOV EAX,DWORD PTR DS:[EAX+C]             ;  EAX=注册码                          │
    │00402DA2  |.MOV CX,WORD PTR DS:[EAX+C]               ;  CX=注册码第七位                     │
    │00402DA6  |.MOV WORD PTR SS:[ESP+18],CX                                                     │
    │00402DAB  |.LEA ECX,DWORD PTR SS:[ESP+18]                                                   │
    │00402DAF  |.CALL Inpaint.00735440                                                           │
    │00402DB4  |.LEA ECX,DWORD PTR SS:[ESP+10]                                                   │
    │00402DB8  |.MOVSX EDI,AL                                                                    │
    │00402DBB  |.CALL Inpaint.00735440                                                           │
    │00402DC0  |.MOVSX EDX,AL                                                                    │
    │00402DC3  |.LEA ECX,DWORD PTR SS:[ESP+E]                                                    │
    │00402DC7  |.ADD EDI,EDX                                                                     │
    │00402DC9  |.CALL Inpaint.00735440                                                           │
    │00402DCE  |.MOVSX EAX,AL                                                                    │
    │00402DD1  |.ADD EAX,EDI                                                                     │
    │00402DD3  |.CDQ                                                                             │
    │00402DD4  |.MOV ECX,19                                                                      │
    │00402DD9  |.IDIV ECX                                                                        │
    │00402DDB  |.LEA ECX,DWORD PTR SS:[ESP+12]                                                   │
    │00402DDF  |.LEA EDI,DWORD PTR DS:[EDX+41]                                                   │
    │00402DE2  |.CALL Inpaint.00735440                                                           │
    │00402DE7  |.MOVSX EDX,AL                             ;  EDX=注册码的第八位                  │
    │00402DEA  |.CMP EDX,EDI                                                                     │
     ───────────────────────────────────────────────
    │00402DEC  |.JNZ Inpaint.004030A5                     ;  一跳就死                            │
     ───────────────────────────────────────────────
    │00402DF2  |.MOV EAX,DWORD PTR DS:[ESI]                                                      │
    │00402DF4  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  ECX=注册码                          │
    │00402DF7  |.MOV DX,WORD PTR DS:[ECX+12]              ;  DX=注册码第十位                     │
    │00402DFB  |.MOV WORD PTR SS:[ESP+12],DX                                                     │
    │00402E00  |.MOV EAX,DWORD PTR DS:[EAX+C]             ;  EAX=注册码                          │
    │00402E03  |.MOV CX,WORD PTR DS:[EAX+10]              ;  CX=注册码第九位                     │
    │00402E07  |.MOV WORD PTR SS:[ESP+18],CX                                                     │
    │00402E0C  |.LEA ECX,DWORD PTR SS:[ESP+18]                                                   │
    │00402E10  |.CALL Inpaint.00735440                                                           │
    │00402E15  |.MOVSX EAX,AL                                                                    │
    │00402E18  |.SHL EAX,4                                                                       │
    │00402E1B  |.CDQ                                                                             │
    │00402E1C  |.MOV ECX,19                                                                      │
    │00402E21  |.IDIV ECX                                                                        │
    │00402E23  |.LEA ECX,DWORD PTR SS:[ESP+12]                                                   │
    │00402E27  |.LEA EDI,DWORD PTR DS:[EDX+41]                                                   │
    │00402E2A  |.CALL Inpaint.00735440                                                           │
    │00402E2F  |.MOVSX EDX,AL                             ;  EDX=注册码的第十位                  │
    │00402E32  |.CMP EDX,EDI                                                                     │
     ───────────────────────────────────────────────
    │00402E34  |.JNZ Inpaint.004030A5                     ;  一跳就死                            │
     ───────────────────────────────────────────────
    │00402E3A  |.MOV EAX,DWORD PTR DS:[ESI]                                                      │
    │00402E3C  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  ECX=注册码                          │
    │00402E3F  |.MOVZX EDX,WORD PTR DS:[ECX+14]           ;  EDX=注册码第十一位                  │
    │00402E43  |.MOV WORD PTR SS:[ESP+E],DX                                                      │
    │00402E48  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  ECX=注册码                          │
    │00402E4B  |.MOVZX EDX,WORD PTR DS:[ECX+C]            ;  EDX=注册码第七位                    │
    │00402E4F  |.MOV WORD PTR SS:[ESP+12],DX                                                     │
    │00402E54  |.MOV ECX,DWORD PTR DS:[EAX+C]                                                    │
    │00402E57  |.MOVZX EDX,WORD PTR DS:[ECX+E]            ;  EDX=注册码第八位                    │
    │00402E5B  |.MOV WORD PTR SS:[ESP+18],DX                                                     │
    │00402E60  |.MOV EAX,DWORD PTR DS:[EAX+C]             ;  EAX=注册码                          │
    │00402E63  |.MOV CX,WORD PTR DS:[EAX+A]               ;  CX=注册码第六位                     │
    │00402E67  |.MOV WORD PTR SS:[ESP+10],CX                                                     │
    │00402E6C  |.PUSH EBX                                                                        │
    │00402E6D  |.LEA ECX,DWORD PTR SS:[ESP+1C]                                                   │
    │00402E71  |.CALL Inpaint.00735440                                                           │
    │00402E76  |.LEA ECX,DWORD PTR SS:[ESP+16]                                                   │
    │00402E7A  |.MOVSX EBX,AL                                                                    │
    │00402E7D  |.CALL Inpaint.00735440                                                           │
    │00402E82  |.MOVSX EDI,AL                                                                    │
    │00402E85  |.LEA ECX,DWORD PTR SS:[ESP+14]                                                   │
    │00402E89  |.IMUL EDI,EBX                                                                    │
    │00402E8C  |.CALL Inpaint.00735440                                                           │
    │00402E91  |.MOVSX EDX,AL                                                                    │
    │00402E94  |.LEA EAX,DWORD PTR DS:[EDX+EDI+5]                                                │
    │00402E98  |.CDQ                                                                             │
    │00402E99  |.MOV ECX,19                                                                      │
    │00402E9E  |.IDIV ECX                                                                        │
    │00402EA0  |.LEA ECX,DWORD PTR SS:[ESP+12]                                                   │
    │00402EA4  |.LEA EDI,DWORD PTR DS:[EDX+41]                                                   │
    │00402EA7  |.CALL Inpaint.00735440                                                           │
    │00402EAC  |.MOVSX EDX,AL                             ;  EDX=注册码的第十一位                │
    │00402EAF  |.CMP EDX,EDI                                                                     │
     ───────────────────────────────────────────────
    │00402EB1  |.JNZ Inpaint.004030A4                     ;  一跳就死                            │
     ───────────────────────────────────────────────
    │00402EB7  |.MOV EAX,DWORD PTR DS:[ESI]                                                      │
    │00402EB9  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  ECX=注册码                          │
    │00402EBC  |.MOVZX EDX,WORD PTR DS:[ECX+16]           ;  EDX=注册码第十二位                  │
    │00402EC0  |.MOV WORD PTR SS:[ESP+12],DX                                                     │
    │00402EC5  |.MOV ECX,DWORD PTR DS:[EAX+C]                                                    │
    │00402EC8  |.MOVZX EDX,WORD PTR DS:[ECX+10]           ;  EDX=注册码第九位                    │
    │00402ECC  |.MOV WORD PTR SS:[ESP+14],DX                                                     │
    │00402ED1  |.MOV ECX,DWORD PTR DS:[EAX+C]                                                    │
    │00402ED4  |.MOVZX EDX,WORD PTR DS:[ECX+12]           ;  EDX=注册码第十位                    │
    │00402ED8  |.MOV WORD PTR SS:[ESP+16],DX                                                     │
    │00402EDD  |.MOV EAX,DWORD PTR DS:[EAX+C]             ;  EAX=注册码                          │
    │00402EE0  |.MOV CX,WORD PTR DS:[EAX+14]              ;  CX=注册码第十一位                   │
    │00402EE4  |.MOV WORD PTR SS:[ESP+1C],CX                                                     │
    │00402EE9  |.LEA ECX,DWORD PTR SS:[ESP+1C]                                                   │
    │00402EED  |.CALL Inpaint.00735440                                                           │
    │00402EF2  |.LEA ECX,DWORD PTR SS:[ESP+16]                                                   │
    │00402EF6  |.MOVSX EBX,AL                                                                    │
    │00402EF9  |.CALL Inpaint.00735440                                                           │
    │00402EFE  |.MOVSX EDI,AL                                                                    │
    │00402F01  |.LEA ECX,DWORD PTR SS:[ESP+14]                                                   │
    │00402F05  |.IMUL EDI,EBX                                                                    │
    │00402F08  |.CALL Inpaint.00735440                                                           │
    │00402F0D  |.MOVSX EAX,AL                                                                    │
    │00402F10  |.IMUL EAX,EDI                                                                    │
    │00402F13  |.CDQ                                                                             │
    │00402F14  |.MOV ECX,19                                                                      │
    │00402F19  |.IDIV ECX                                                                        │
    │00402F1B  |.LEA ECX,DWORD PTR SS:[ESP+12]                                                   │
    │00402F1F  |.LEA EDI,DWORD PTR DS:[EDX+41]                                                   │
    │00402F22  |.CALL Inpaint.00735440                                                           │
    │00402F27  |.MOVSX EDX,AL                             ;  EDX=注册码的第十二位                │
    │00402F2A  |.CMP EDX,EDI                                                                     │
     ───────────────────────────────────────────────
    │00402F2C  |.JNZ Inpaint.004030A4                     ;  一跳就死                            │
     ───────────────────────────────────────────────
    │00402F32  |.MOV EAX,DWORD PTR DS:[ESI]                                                      │
    │00402F34  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  ECX=注册码                          │
    │00402F37  |.MOVZX EDX,WORD PTR DS:[ECX+1A]           ;  EDX=注册码第十四位                  │
    │00402F3B  |.MOV WORD PTR SS:[ESP+14],DX                                                     │
    │00402F40  |.MOV ECX,DWORD PTR DS:[EAX+C]                                                    │
    │00402F43  |.MOVZX EDX,WORD PTR DS:[ECX+14]           ;  EDX=注册码第十一位                  │
    │00402F47  |.MOV WORD PTR SS:[ESP+16],DX                                                     │
    │00402F4C  |.MOV EAX,DWORD PTR DS:[EAX+C]             ;  EAX=注册码                          │
    │00402F4F  |.MOV CX,WORD PTR DS:[EAX+18]              ;  CX=注册码第十三位                   │
    │00402F53  |.MOV WORD PTR SS:[ESP+1C],CX                                                     │
    │00402F58  |.LEA ECX,DWORD PTR SS:[ESP+1C]                                                   │
    │00402F5C  |.CALL Inpaint.00735440                                                           │
    │00402F61  |.MOVSX EAX,AL                                                                    │
    │00402F64  |.LEA ECX,DWORD PTR SS:[ESP+16]                                                   │
    │00402F68  |.LEA EDI,DWORD PTR DS:[EAX+EAX*2]                                                │
    │00402F6B  |.CALL Inpaint.00735440                                                           │
    │00402F70  |.MOVSX EAX,AL                                                                    │
    │00402F73  |.ADD EAX,EDI                                                                     │
    │00402F75  |.CDQ                                                                             │
    │00402F76  |.MOV ECX,19                                                                      │
    │00402F7B  |.IDIV ECX                                                                        │
    │00402F7D  |.LEA ECX,DWORD PTR SS:[ESP+14]                                                   │
    │00402F81  |.LEA EDI,DWORD PTR DS:[EDX+41]                                                   │
    │00402F84  |.CALL Inpaint.00735440                                                           │
    │00402F89  |.MOVSX EDX,AL                             ;  EDX=注册码的第十四位                │
    │00402F8C  |.CMP EDX,EDI                                                                     │
     ───────────────────────────────────────────────
    │00402F8E  |.JNZ Inpaint.004030A4                     ;  一跳就死                            │
     ───────────────────────────────────────────────
    │00402F94  |.MOV EAX,DWORD PTR DS:[ESI]                                                      │
    │00402F96  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  ECX=注册码                          │
    │00402F99  |.MOVZX EDX,WORD PTR DS:[ECX+1C]           ;  EDX=注册码第十五位                  │
    │00402F9D  |.MOV WORD PTR SS:[ESP+12],DX                                                     │
    │00402FA2  |.MOV ECX,DWORD PTR DS:[EAX+C]             ;  ECX=注册码                          │
    │00402FA5  |.MOVZX EDX,WORD PTR DS:[ECX+18]           ;  EDX=注册码第十三位                  │
    │00402FA9  |.MOV WORD PTR SS:[ESP+16],DX                                                     │
    │00402FAE  |.MOV ECX,DWORD PTR DS:[EAX+C]                                                    │
    │00402FB1  |.MOVZX EDX,WORD PTR DS:[ECX+1A]           ;  EDX=注册码第十四位                  │
    │00402FB5  |.MOV WORD PTR SS:[ESP+1C],DX                                                     │
    │00402FBA  |.MOV EAX,DWORD PTR DS:[EAX+C]             ;  EAX=注册码                          │
    │00402FBD  |.MOV CX,WORD PTR DS:[EAX+16]              ;  CX=注册码第十二位                   │
    │00402FC1  |.MOV WORD PTR SS:[ESP+14],CX                                                     │
    │00402FC6  |.LEA ECX,DWORD PTR SS:[ESP+1C]                                                   │
    │00402FCA  |.CALL Inpaint.00735440                                                           │
    │00402FCF  |.LEA ECX,DWORD PTR SS:[ESP+16]                                                   │
    │00402FD3  |.MOVSX EBX,AL                                                                    │
    │00402FD6  |.CALL Inpaint.00735440                                                           │
    │00402FDB  |.MOVSX EDI,AL                                                                    │
    │00402FDE  |.LEA ECX,DWORD PTR SS:[ESP+14]                                                   │
    │00402FE2  |.IMUL EDI,EBX                                                                    │
    │00402FE5  |.CALL Inpaint.00735440                                                           │
    │00402FEA  |.MOVSX EAX,AL                                                                    │
    │00402FED  |.ADD EAX,EDI                                                                     │
    │00402FEF  |.CDQ                                                                             │
    │00402FF0  |.MOV ECX,19                                                                      │
    │00402FF5  |.IDIV ECX                                                                        │
    │00402FF7  |.LEA ECX,DWORD PTR SS:[ESP+12]                                                   │
    │00402FFB  |.LEA EDI,DWORD PTR DS:[EDX+41]                                                   │
    │00402FFE  |.CALL Inpaint.00735440                                                           │
    │00403003  |.MOVSX EDX,AL                             ;  EDX=注册码的第十五位                │
    │00403006  |.CMP EDX,EDI                                                                     │
     ───────────────────────────────────────────────
    │00403008  |.JNZ Inpaint.004030A4                     ;  一跳就死                            │
     ───────────────────────────────────────────────
    │0040300E  |.MOV ESI,DWORD PTR DS:[ESI]                                                      │
    │00403010  |.MOV EAX,DWORD PTR DS:[ESI+C]             ;  EAX=注册码                          │
    │00403013  |.MOVZX ECX,WORD PTR DS:[EAX+1E]           ;  ECX=注册码第十六位                  │
    │00403017  |.MOV WORD PTR SS:[ESP+12],CX                                                     │
    │0040301C  |.MOV EDX,DWORD PTR DS:[ESI+C]             ;  EDX=注册码                          │
    │0040301F  |.MOV AX,WORD PTR DS:[EDX+18]              ;  AX=注册码第十三位                   │
    │00403023  |.MOV WORD PTR SS:[ESP+16],AX                                                     │
    │00403028  |.MOV ECX,DWORD PTR DS:[ESI+C]             ;  ECX=注册码                          │
    │0040302B  |.MOV DX,WORD PTR DS:[ECX+1A]              ;  DX=注册码第十四位                   │
    │0040302F  |.MOV WORD PTR SS:[ESP+1C],DX                                                     │
    │00403034  |.MOV EAX,DWORD PTR DS:[ESI+C]             ;  EAX=注册码                          │
    │00403037  |.MOVZX ECX,WORD PTR DS:[EAX+1C]           ;  ECX=注册码第十五位                  │
    │0040303B  |.MOV WORD PTR SS:[ESP+14],CX                                                     │
    │00403040  |.LEA ECX,DWORD PTR SS:[ESP+1C]                                                   │
    │00403044  |.CALL Inpaint.00735440                                                           │
    │00403049  |.LEA ECX,DWORD PTR SS:[ESP+16]                                                   │
    │0040304D  |.MOVSX EDI,AL                                                                    │
    │00403050  |.CALL Inpaint.00735440                                                           │
    │00403055  |.MOVSX ESI,AL                                                                    │
    │00403058  |.LEA ECX,DWORD PTR SS:[ESP+14]                                                   │
    │0040305C  |.IMUL ESI,EDI                                                                    │
    │0040305F  |.CALL Inpaint.00735440                                                           │
    │00403064  |.MOVSX EDX,AL                                                                    │
    │00403067  |.MOV EAX,ESI                                                                     │
    │00403069  |.SUB EAX,EDX                                                                     │
    │0040306B  |.CDQ                                                                             │
    │0040306C  |.MOV ECX,19                                                                      │
    │00403071  |.IDIV ECX                                                                        │
    │00403073  |.LEA ECX,DWORD PTR SS:[ESP+12]                                                   │
    │00403077  |.LEA ESI,DWORD PTR DS:[EDX+41]                                                   │
    │0040307A  |.CALL Inpaint.00735440                                                           │
    │0040307F  |.MOVSX EDX,AL                             ;  EDX=注册码的第十六位                │
    │00403082  |.CMP EDX,ESI                                                                     │
     ───────────────────────────────────────────────
    │00403084  |.JNZ SHORT Inpaint.004030A4               ;  一跳就死                            │
     ───────────────────────────────────────────────
    │00403086  |.MOV ECX,DWORD PTR SS:[EBP+BC]                                                   │
    │0040308C  |.PUSH 0                                                                          │
    │0040308E  |.CALL Inpaint.004559B0                                                           │
    │00403093  |.MOV ECX,DWORD PTR SS:[EBP+C0]                                                   │
    │00403099  |.PUSH 0                                                                          │
    │0040309B  |.CALL Inpaint.004559B0                                                           │
    │004030A0  |.MOV BYTE PTR SS:[EBP+3C],1                                                      │
    │004030A4  |>POP EBX                                                                         │
    │004030A5  |>POP EDI                                                                         │
    │004030A6  |>POP ESI                                                                         │
    │004030A7  |.POP EBP                                                                         │
    │004030A8  |.ADD ESP,8                                                                       │
    │004030AB  \.RETN 4                                                                          │
    └──────────────────────────────────────────────┘
    若测试注册码为:XUVZ-BWQE-FDAC-HIKJ-RSTV-WQEX-QWEZ-CZXD,则其注册过程如下:

    注册码第二位必须等于:
    ASCII(注册码第一位)*2 除 25(0x19)所得余数 + 65(0x41)
    X(B)VZ-BWQE-FDAC-HIKJ-RSTV-WQEX-QWEZ-CZXD

    注册码第三位必须等于:
    ASCII(注册码第一位)*ASCII(注册码第二位) 除 25(0x19)所得余数 + 65(0x41)
    XB(I)Z-BWQE-FDAC-HIKJ-RSTV-WQEX-QWEZ-CZXD

    注册码第四位必须等于:
    ASCII(注册码第三位)*4 除 25(0x19)所得余数 + 65(0x41)
    XBI(R)-BWQE-FDAC-HIKJ-RSTV-WQEX-QWEZ-CZXD

    注册码第六位必须等于:
   (ASCII(注册码第三位)*ASCII(注册码第四位))*2 除 25(0x19)所得余数 + 65(0x41)
    XBIR-B(W)QE-FDAC-HIKJ-RSTV-WQEX-QWEZ-CZXD

    注册码第七位必须等于:
    ASCII(注册码第五位)*ASCII(注册码第六位) + 15(0xF) 除 25(0x19)所得余数 + 65(0x41)
    XBIR-BW(H)E-FDAC-HIKJ-RSTV-WQEX-QWEZ-CZXD

    注册码第八位必须等于:
    ASCII(注册码第六位)+ASCII(注册码第七位)*2 除 25(0x19)所得余数 + 65(0x41)
    XBIR-BWH(G)-FDAC-HIKJ-RSTV-WQEX-QWEZ-CZXD

    注册码第十位必须等于:
    ASCII(注册码第九位)*16 除 25(0x19)所得余数 + 65(0x41)
    XBIR-BWHG-F(U)AC-HIKJ-RSTV-WQEX-QWEZ-CZXD

    注册码第十一位必须等于:
   (ASCII(注册码第六位)+ASCII(注册码第七位)*ASCII(注册码第八位)+5) 除 25(0x19)所得余数 + 65(0x41)
    XBIR-BWHG-FU(E)C-HIKJ-RSTV-WQEX-QWEZ-CZXD

    注册码第十二位必须等于:
    ASCII(注册码第九位)*ASCII(注册码第十位)*ASCII(注册码第十一位) 除 25(0x19)所得余数 + 65(0x41)
    XBIR-BWHG-FUE(A)-HIKJ-RSTV-WQEX-QWEZ-CZXD

    注册码第十四位必须等于:
    ASCII(注册码第十一位)+ASCII(注册码第十三位)*3 除 25(0x19)所得余数 + 65(0x41)
    XBIR-BWHG-FUEA-H(K)KJ-RSTV-WQEX-QWEZ-CZXD

    注册码第十五位必须等于:
    ASCII(注册码第十二位)+ASCII(注册码第十三位)*ASCII(注册码第十四位) 除 25(0x19)所得余数 + 65(0x41)
    XBIR-BWHG-FUEA-HK(P)J-RSTV-WQEX-QWEZ-CZXD

    注册码第十六位必须等于:
   (ASCII(注册码第十三位)*ASCII(注册码第十四位)-ASCII(注册码第十五位)) 除 25(0x19)所得余数 + 65(0x41)
    XBIR-BWHG-FUEA-HKP(U)-RSTV-WQEX-QWEZ-CZXD

    显然,可以看到注册码只比较了前 16 位,后 16 位没有,这就说明后 16 位可以随便填了,呵呵.这里给出两个可用的前 16 位:
    AFAK-HAUK-JJUK-BISK-※※※※-※※※※-※※※※-※※※※
    XBIR-BWHG-FUEA-HKPU-※※※※-※※※※-※※※※-※※※※
    ※ 可以随便填,但必须是大写字母 A-Z 中的一个.

【破解总结】:

    破解之后没什么成就感,就是觉得,算法有点简单,适合新手.注册机应该很好写,索性随便写一个,看看卡通美女,很正常啊.

上传的附件 KeyGen.rar
Inpaint.part1.rar
Inpaint.part2.rar