目标软件:chm帮助编辑器v2.6
破 解 人:TAE!
保护方式:序列号
破解方式:分析出注册码
软件介绍:此软件的作者似乎处境相当困难,此篇的目的在于学习,
请支持一下其作者,注册吧!
下载地址:http://kshii.51.net/
序言:其实这个软件的注册码计算,比较部分相当简单,关键在于破解方法!
如果用常规的方法即输入注册码,设断点,按注册,那就会什么反应都没有,
那就换个方法吧!
软件的试用次数过了以后,会跳出一个Nag,说已经过期,想想看,软件怎么知道
我们有没有注册呢?肯定是读取了某处的一个注册标志!就从这里入手,如何?
在软件弹出Nag时,到TRW下命令Pmodule,这时回到程序,按确定,又回到了TRW
(Pmodule真是个很好用的命令),然后就向上查看,发现有两个地方可以跳过Nag:
:0047A276 E8BDFDFFFF call
0047A038 //*很关键的地方*
:0047A27B A1E0B84800 mov eax,
dword ptr [0048B8E0]
:0047A280 8B80CC060000 mov eax, dword
ptr [eax+000006CC]
:0047A286 81780CF4010000 cmp dword ptr [eax+0C],
000001F4
:0047A28D 0F845A010000 je 0047A3ED
//检查是否已经注册.(第一个)
:0047A293 6800010000 push
00000100
:0047A298 8D85F7FEFFFF lea eax, dword
ptr [ebp+FFFFFEF7]
:0047A29E 50
push eax
* Possible StringData Ref from Data Obj ->""
|
:0047A29F 6828A44700 push
0047A428
* Possible StringData Ref from Data Obj ->"PWes"
//win.ini中的字符
|
:0047A2A4 68F8A44700 push
0047A4F8
* Possible StringData Ref from Data Obj ->"AgeSet" //win.ini中的字符
|
:0047A2A9 6834A44700 push
0047A434
:0047A2AE E8E5C7F8FF call
00406A98
:0047A2B3 8D45FC
lea eax, dword ptr [ebp-04]
:0047A2B6 8D95F7FEFFFF lea edx, dword
ptr [ebp+FFFFFEF7]
:0047A2BC B901010000 mov ecx,
00000101
:0047A2C1 E85E9BF8FF call
00403E24
:0047A2C6 8D45F8
lea eax, dword ptr [ebp-08]
:0047A2C9 50
push eax
:0047A2CA B901000000 mov ecx,
00000001
:0047A2CF BA01000000 mov edx,
00000001
:0047A2D4 8B45FC
mov eax, dword ptr [ebp-04]
:0047A2D7 E8A09DF8FF call
0040407C
* Possible StringData Ref from Data Obj ->"1234567890!@#$%^-*()QWERTYUIOPASDFGHJKLZXCVBNM"
->"qwertyuiopasdfghjklzxcvbnm"
|
:0047A2DC BA44A44700 mov edx,
0047A444
:0047A2E1 8B45F8
mov eax, dword ptr [ebp-08]
:0047A2E4 E8779EF8FF call
00404160
:0047A2E9 8BD8
mov ebx, eax
:0047A2EB 83FB3E
cmp ebx, 0000003E
:0047A2EE 7E5D
jle 0047A34D //检查使用次数(第二个)
:0047A2F0 6A30
push 00000030
* Possible StringData Ref from Data Obj ->"软件过期"
|
:0047A2F2 6808A54700 push
0047A508
* Possible StringData Ref from Data Obj ->"您的试用期限已过,若有继续使用本软件,请您注册."
|
:0047A2F7 6814A54700 push
0047A514
进入那个call 0047A038
:0047A038 53
push ebx
:0047A039 8BD8
mov ebx, eax
:0047A03B 8B83BC060000 mov eax, dword
ptr [ebx+000006BC]
:0047A041 8B4070
mov eax, dword ptr [eax+70]
:0047A044 E80BFEFFFF call
00479E54 //*计算比较注册码*
:0047A049 84C0
test al, al
:0047A04B 743A
je 0047A087
:0047A04D 8B83BC060000 mov eax, dword
ptr [ebx+000006BC]
:0047A053 8B4070
mov eax, dword ptr [eax+70]
:0047A056 E8DD9FF8FF call
00404038
:0047A05B 50
push eax
进入CAll 00479E54
:00479E54 55
push ebp
:00479E55 8BEC
mov ebp, esp
:00479E57 33C9
xor ecx, ecx
:00479E59 51
push ecx
:00479E5A 51
push ecx
:00479E5B 51
push ecx
:00479E5C 51
push ecx
:00479E5D 51
push ecx
:00479E5E 51
push ecx
:00479E5F 51
push ecx
:00479E60 51
push ecx
:00479E61 53
push ebx
:00479E62 56
push esi
:00479E63 8945FC
mov dword ptr [ebp-04], eax
:00479E66 8B45FC
mov eax, dword ptr [ebp-04]
:00479E69 E8BAA1F8FF call
00404028
:00479E6E 33C0
xor eax, eax
:00479E70 55
push ebp
* Possible StringData Ref from Data Obj ->"闁�朊[迕��"
|
:00479E71 68EC9F4700 push
00479FEC
:00479E76 64FF30
push dword ptr fs:[eax]
:00479E79 648920
mov dword ptr fs:[eax], esp
:00479E7C 33DB
xor ebx, ebx
:00479E7E 8B45FC
mov eax, dword ptr [ebp-04]
:00479E81 E8EE9FF8FF call
00403E74 //检查Win.ini中是否有一个Pset=XXX(存放注册码的地方)
:00479E86 83F80D
cmp eax, 0000000D //比较注册码的位数是否为13位,我们在这里设断点.
:00479E89 0F8542010000 jne 00479FD1
//发现EAX不是13个跳走,是13个继续检查
所以在win.ini中加入这样一句Pset=1234567890abc,在此运行程序此时被中断,继续F10
走到这里
* Possible StringData Ref from Data Obj ->"Ee"
|
:00479EA8 BA04A04700 mov edx,
0047A004
:00479EAD E8D2A0F8FF call
00403F84 //检查第一个和第二个字符是不是Ee
:00479EB2 0F8519010000 jne 00479FD1
//不是就跳
:00479EB8 8D45F0
lea eax, dword ptr [ebp-10]
:00479EBB 50
push eax
:00479EBC B901000000 mov ecx,
00000001
:00479EC1 BA03000000 mov edx,
00000003
:00479EC6 8B45FC
mov eax, dword ptr [ebp-04]
:00479EC9 E8AEA1F8FF call
0040407C
:00479ECE 8B45F0
mov eax, dword ptr [ebp-10]
* Possible StringData Ref from Data Obj ->"@"
|
:00479ED1 BA10A04700 mov edx,
0047A010
:00479ED6 E8A9A0F8FF call
00403F84 //检查第三个字符是不是@
:00479EDB 0F85F0000000 jne 00479FD1
//不是就跳
:00479EE1 8D45EC
lea eax, dword ptr [ebp-14]
:00479EE4 50
push eax
:00479EE5 B901000000 mov ecx,
00000001
:00479EEA BA0A000000 mov edx,
0000000A
:00479EEF 8B45FC
mov eax, dword ptr [ebp-04]
:00479EF2 E885A1F8FF call
0040407C
:00479EF7 8B45EC
mov eax, dword ptr [ebp-14]
* Possible StringData Ref from Data Obj ->"%"
|
:00479EFA BA1CA04700 mov edx,
0047A01C
:00479EFF E880A0F8FF call
00403F84 //检查倒数第四个字符是不是%
:00479F04 0F85C7000000 jne 00479FD1
:00479F0A 8D45E8
lea eax, dword ptr [ebp-18]
:00479F0D 50
push eax
:00479F0E B901000000 mov ecx,
00000001
:00479F13 BA0B000000 mov edx,
0000000B
:00479F18 8B45FC
mov eax, dword ptr [ebp-04]
:00479F1B E85CA1F8FF call
0040407C
:00479F20 8B45E8
mov eax, dword ptr [ebp-18]
* Possible StringData Ref from Data Obj ->"("
|
:00479F23 BA28A04700 mov edx,
0047A028
:00479F28 E857A0F8FF call
00403F84 //检查倒数第三个字符是不是(
:00479F2D 0F859E000000 jne 00479FD1
:00479F33 8D45E4
lea eax, dword ptr [ebp-1C]
:00479F36 50
push eax
:00479F37 B901000000 mov ecx,
00000001
:00479F3C BA0D000000 mov edx,
0000000D
:00479F41 8B45FC
mov eax, dword ptr [ebp-04]
:00479F44 E833A1F8FF call
0040407C
:00479F49 8B45E4
mov eax, dword ptr [ebp-1C]
* Possible StringData Ref from Data Obj ->")"
|
:00479F4C BA34A04700 mov edx,
0047A034
:00479F51 E82EA0F8FF call
00403F84 //检查倒数第一个字符是不是)
:00479F56 7579
jne 00479FD1
:00479F58 8D45E0
lea eax, dword ptr [ebp-20]
:00479F5B 50
push eax
:00479F5C B906000000 mov ecx,
00000006
:00479F61 BA04000000 mov edx,
00000004
:00479F66 8B45FC
mov eax, dword ptr [ebp-04]
:00479F69 E80EA1F8FF call
0040407C
:00479F6E 8B45E0
mov eax, dword ptr [ebp-20]
:00479F71 E8C2A0F8FF call
00404038
:00479F76 8BF0
mov esi, eax
:00479F78 8D55F8
lea edx, dword ptr [ebp-08]
:00479F7B A1E0B84800 mov eax,
dword ptr [0048B8E0]
:00479F80 8B80C0060000 mov eax, dword
ptr [eax+000006C0]
:00479F86 E83567FBFF call
004306C0
:00479F8B 8B45F8
mov eax, dword ptr [ebp-08]
:00479F8E E8A5A0F8FF call
00404038
:00479F93 8BC8
mov ecx, eax
:00479F95 8A16
mov dl, byte ptr [esi]
:00479F97 8A4107
mov al, byte ptr [ecx+07]
:00479F9A 3AC2
cmp al, dl
\
:00479F9C 7533
jne 00479FD1
\
:00479F9E 8A5601
mov dl, byte ptr [esi+01] \
:00479FA1 8A4104
mov al, byte ptr [ecx+04] \
:00479FA4 3AC2
cmp al, dl
\
:00479FA6 7529
jne 00479FD1
\
:00479FA8 8A5602
mov dl, byte ptr [esi+02] \
:00479FAB 8A01
mov al, byte ptr [ecx] \
:00479FAD 3AC2
cmp al, dl
\
:00479FAF 7520
jne 00479FD1
|检查其它六位数.经过跟踪发现
:00479FB1 8A5603
mov dl, byte ptr [esi+03] /其它这六位数,必须都在它给的
:00479FB4 8A4109
mov al, byte ptr [ecx+09] / ID中,只是排列顺序不同.
:00479FB7 3AC2
cmp al, dl
/ 至于是如何排列的,自己研究吧
:00479FB9 7516
jne 00479FD1
/ 很简单的.
:00479FBB 8A5604
mov dl, byte ptr [esi+04] /
:00479FBE 8A4102
mov al, byte ptr [ecx+02] /
:00479FC1 3AC2
cmp al, dl
/
:00479FC3 750C
jne 00479FD1
/
:00479FC5 8A5605
mov dl, byte ptr [esi+05] /
:00479FC8 8A4106
mov al, byte ptr [ecx+06] /
:00479FCB 3AC2
cmp al, dl /
:00479FCD 7502
jne 00479FD1
:00479FCF B301
mov bl, 01 <------------看到希望了
我的ID:Nsd5JLy!jt
注册码:Ee@!JNtdy%(b)
自己跟一跟,很简单的,只是切入的方法不同而已.
后记:这篇好像注重了方法,若你想写出注册机,就自己分析吧!
这个软件的注册很特别,我破解的方法也很特别,
所以说解软件,一定不能轻易放弃,要从不同的地方入手,多想想办法一定会有收获的!
- 标 题：chm帮助编辑器v2.6 注册码破解详谈之二*解码篇* (11千字)
- 作 者：TAE!
- 时 间：2001-2-4 13:36:50
- 链 接：http://bbs.pediy.com