Windows设置大师 2003 Build 0415

标题：简单算法——Windows设置大师 2003 Build 0415
作者：fly
时间：2003/04/06 03:21pm
链接：http://bbs.pediy.com

下载页面： http://www.skycn.net/soft/11596.html
软件大小： 693 KB
软件语言：简体中文
软件类别：国产软件 / 共享版 / 系统设置
应用平台： Win9x/NT/2000/XP
加入时间： 2003-04-03 16:03:55
下载次数： 226
推荐等级： ***

【软件简介】：1、Windows高级设置:在这个设置里，您可以系统进行一系列设置，包括禁止注册表运行、禁止按取消键登录系统等等……2、开始菜单和控制面板设置:在这个设置里，您可以对开始菜单和控制面板进行一系列设置……3、IE高级设置:在这个设置里，您可以IE进行一系列设置，包括隐藏部分选项、修改IE标题等等……4、其它高级设置:在这个设置里，您可以清除系统垃圾、隐藏驱动器等等……5、其它功能正在扩充中……

【软件限制】：20次试用。

【作者声明】：初学Crack，只是感兴趣，没有其它目的。失误之处敬请诸位大侠赐教！

【破解工具】：TRW2000娃娃修改版、Ollydbg1.09、PEiD、PE-scan、W32Dasm 10修改版

—————————————————————————————————
【过程】：

Windows设置大师2003.exe 是 PECompact壳。用PE-scan脱之。414K->1.23M。Delphi编写。

申请号：14215752
姓名：fly
公司：【OCN】不参与运算
试炼码：13572468

反汇编，查看出错提示，很容易就找到下面的核心了。
—————————————————————————————————
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004AAE09(C)
|
:004AAE7D 6964617465640053 imul esp, dword ptr [ecx+74], 53006465
:004AAE85 8BD8 mov ebx, eax
:004AAE87 8BC3 mov eax, ebx
:004AAE89 E876ABFFFF call 004A5A04
====>关键CALL!进入！

:004AAE8E 84C0 test al, al
:004AAE90 7409 je 004AAE9B
====>跳则OVER！

:004AAE92 8BC3 mov eax, ebx
:004AAE94 E877AAFFFF call 004A5910
:004AAE99 5B pop ebx
:004AAE9A C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004AAE90(C)
|
:004AAE9B 6A00 push 00000000

* Possible StringData Ref from Code Obj ->"请与作者联系注册!"
|
:004AAE9D B9B8AE4A00 mov ecx, 004AAEB8

* Possible StringData Ref from Code Obj ->"对不起!您输入的注册码不正确,无法完成注册"
====>BAD BOY！

:004AAEA2 BACCAE4A00 mov edx, 004AAECC
:004AAEA7 A110DC4A00 mov eax, dword ptr [004ADC10]
:004AAEAC 8B00 mov eax, dword ptr [eax]
:004AAEAE E86D29FDFF call 0047D820
:004AAEB3 5B pop ebx
:004AAEB4 C3 ret

* Referenced by a CALL at Address:
|:004AAE94
|

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A58A5(C)
|
:004A5910 53 push ebx
:004A5911 B201 mov dl, 01
:004A5913 A1D4644300 mov eax, dword ptr [004364D4]
:004A5918 E8B70CF9FF call 004365D4
:004A591D 8BD8 mov ebx, eax
:004A591F BA03000080 mov edx, 80000003
:004A5924 8BC3 mov eax, ebx
:004A5926 E8490DF9FF call 00436674
:004A592B B101 mov cl, 01

* Possible StringData Ref from Code Obj ->".DEFAULT\Software\xt-studio\windows\exe"
====>保存注册信息

:004A592D BA88594A00 mov edx, 004A5988
:004A5932 8BC3 mov eax, ebx
:004A5934 E87B0EF9FF call 004367B4
:004A5939 8B0D54F14A00 mov ecx, dword ptr [004AF154]

* Possible StringData Ref from Code Obj ->"Name"
|
:004A593F BAB8594A00 mov edx, 004A59B8
:004A5944 8BC3 mov eax, ebx
:004A5946 E8DD11F9FF call 00436B28
:004A594B 8B0D58F14A00 mov ecx, dword ptr [004AF158]

* Possible StringData Ref from Code Obj ->"Pass"
|
:004A5951 BAC8594A00 mov edx, 004A59C8
:004A5956 8BC3 mov eax, ebx
:004A5958 E86F12F9FF call 00436BCC
:004A595D 8BC3 mov eax, ebx
:004A595F E800DAF5FF call 00403364
:004A5964 6A00 push 00000000

* Possible StringData Ref from Code Obj ->"谢谢您注册本软件"
====>呵呵，胜利女神！

:004A5966 B9D0594A00 mov ecx, 004A59D0

* Possible StringData Ref from Code Obj ->"请您重新启动程序以验证注册码!"
|
:004A596B BAE4594A00 mov edx, 004A59E4
:004A5970 A110DC4A00 mov eax, dword ptr [004ADC10]
:004A5975 8B00 mov eax, dword ptr [eax]
:004A5977 E8A47EFDFF call 0047D820
:004A597C 5B pop ebx
:004A597D C3 ret

—————————————————————————————————
进入关键CALL：4AAE89 call 004A5A04

* Referenced by a CALL at Address:
|:004AAE89
|
:004A5A04 55 push ebp
:004A5A05 8BEC mov ebp, esp
:004A5A07 B905000000 mov ecx, 00000005

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A5A11(C)
|
:004A5A0C 6A00 push 00000000
:004A5A0E 6A00 push 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A599A(C)
|
:004A5A10 49 dec ecx
:004A5A11 75F9 jne 004A5A0C
:004A5A13 51 push ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A59AD(C)
|
:004A5A14 53 push ebx
:004A5A15 56 push esi
:004A5A16 57 push edi
:004A5A17 8945FC mov dword ptr [ebp-04], eax
:004A5A1A 33C0 xor eax, eax
:004A5A1C 55 push ebp
:004A5A1D 685F5B4A00 push 004A5B5F
:004A5A22 64FF30 push dword ptr fs:[eax]
:004A5A25 648920 mov dword ptr fs:[eax], esp
:004A5A28 33DB xor ebx, ebx
:004A5A2A 8D55F4 lea edx, dword ptr [ebp-0C]
:004A5A2D 8B45FC mov eax, dword ptr [ebp-04]
:004A5A30 8B80D8040000 mov eax, dword ptr [eax+000004D8]
:004A5A36 E84574FBFF call 0045CE80
:004A5A3B 8B45F4 mov eax, dword ptr [ebp-0C]
====>EAX=[ebp-0C]=fly

:004A5A3E E815EAF5FF call 00404458
====>取位数 EAX=3

:004A5A43 8BF8 mov edi, eax
:004A5A45 6A00 push 00000000
:004A5A47 6800040000 push 00000400
:004A5A4C B003 mov al, 03
:004A5A4E E8AD32F6FF call 00408D00
:004A5A53 E864F5F5FF call 00404FBC
:004A5A58 8BC8 mov ecx, eax
:004A5A5A BE01000000 mov esi, 00000001
:004A5A5F 8D0431 lea eax, dword ptr [ecx+esi]
:004A5A62 99 cdq
:004A5A63 33C2 xor eax, edx
:004A5A65 2BC2 sub eax, edx
:004A5A67 054747A000 add eax, 00A04747
:004A5A6C 8BF0 mov esi, eax
:004A5A6E 8D45E0 lea eax, dword ptr [ebp-20]
:004A5A71 50 push eax
:004A5A72 8D55DC lea edx, dword ptr [ebp-24]
:004A5A75 8BC6 mov eax, esi
:004A5A77 E8702BF6FF call 004085EC
:004A5A7C 8B45DC mov eax, dword ptr [ebp-24]
:004A5A7F B908000000 mov ecx, 00000008
:004A5A84 BA01000000 mov edx, 00000001
:004A5A89 E82AECF5FF call 004046B8
:004A5A8E 8B45E0 mov eax, dword ptr [ebp-20]
====>EAX=14215752 申请号

:004A5A91 E8922CF6FF call 00408728
:004A5A96 8945E8 mov dword ptr [ebp-18], eax
====>EAX=00D8EA48（H）=14215752（D）

:004A5A99 8D45F0 lea eax, dword ptr [ebp-10]

* Possible StringData Ref from Code Obj ->"-MK5609ZW"
|
:004A5A9C BA785B4A00 mov edx, 004A5B78
====>EDX=-MK5609ZW

:004A5AA1 E88AE7F5FF call 00404230
:004A5AA6 8B45F0 mov eax, dword ptr [ebp-10]
====>EAX=-MK5609ZW

:004A5AA9 E8AAE9F5FF call 00404458
====>取-MK5609ZW的位数

:004A5AAE 8945E4 mov dword ptr [ebp-1C], eax
====>EAX=9

:004A5AB1 8BF7 mov esi, edi
:004A5AB3 85F6 test esi, esi
:004A5AB5 7E3E jle 004A5AF5
:004A5AB7 C745EC01000000 mov [ebp-14], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A5AF3(C)
|
:004A5ABE 8D45D8 lea eax, dword ptr [ebp-28]
:004A5AC1 50 push eax
:004A5AC2 B901000000 mov ecx, 00000001
:004A5AC7 8B55EC mov edx, dword ptr [ebp-14]
:004A5ACA 8B45F4 mov eax, dword ptr [ebp-0C]
====>EAX=[ebp-0C]=fly

:004A5ACD E8E6EBF5FF call 004046B8
:004A5AD2 8B45D8 mov eax, dword ptr [ebp-28]
:004A5AD5 E87EEBF5FF call 00404658
:004A5ADA 8A00 mov al, byte ptr [eax]
1、 ====>AL=66
2、 ====>AL=6C
3、 ====>AL=79

:004A5ADC 25FF000000 and eax, 000000FF
:004A5AE1 03D8 add ebx, eax
1、 ====>EBX=00000000 + 66=00000066
2、 ====>EBX=042EB57D + 6C=042EB5E9
3、 ====>EBX=085D6B00 + 79=085D6B79

:004A5AE3 81C3C6CA5503 add ebx, 0355CAC6
1、 ====>EBX=00000066 + 0355CAC6=0355CB2C
2、 ====>EBX=042EB5E9 + 0355CAC6=078480AF
3、 ====>EBX=085D6B79 + 0355CAC6=0BB3363F

:004A5AE9 035DE8 add ebx, dword ptr [ebp-18]
1、 ====>EBX=0355CB2C + 00D8EA48=042EB574
2、 ====>EBX=078480AF + 00D8EA48=085D6AF7
3、 ====>EBX=0BB3363F + 00D8EA48=0C8C2087

:004A5AEC 035DE4 add ebx, dword ptr [ebp-1C]
1、 ====>EBX=042EB574 + 9=042EB57D
2、 ====>EBX=085D6AF7 + 9=085D6B00
3、 ====>EBX=0C8C2087 + 9=0C8C2090
呵呵，0C8C2090的10进制值就是我的注册码了！

:004A5AEF FF45EC inc [ebp-14]
:004A5AF2 4E dec esi
====>ESI 依次减1

:004A5AF3 75C9 jne 004A5ABE
====>循环用户名位数次

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A5AB5(C)
|
:004A5AF5 8D55D4 lea edx, dword ptr [ebp-2C]
:004A5AF8 8B45FC mov eax, dword ptr [ebp-04]
:004A5AFB 8B80E0040000 mov eax, dword ptr [eax+000004E0]
====>EAX=00CD45A0

:004A5B01 E87A73FBFF call 0045CE80
:004A5B06 8B45D4 mov eax, dword ptr [ebp-2C]
====>EAX=13572468

:004A5B09 E81A2CF6FF call 00408728
====>把13572468（D）转换成16进制值EAX=00CF1974（H）

:004A5B0E 3BD8 cmp ebx, eax
====>EBX=0C8C2090（H）=210509968（D）注册码！
====>EAX=00CF1974（H）=13572468 （D）试炼码
呵呵，比较注册码了。如果相等就OK了！所以我的注册码就是EBX里的10进制值！

:004A5B10 7519 jne 004A5B2B
====>跳则OVER！

:004A5B12 C645FB01 mov [ebp-05], 01
====>置1则OK！

:004A5B16 B854F14A00 mov eax, 004AF154
:004A5B1B 8B55F4 mov edx, dword ptr [ebp-0C]
:004A5B1E E8C9E6F5FF call 004041EC
:004A5B23 891D58F14A00 mov dword ptr [004AF158], ebx
:004A5B29 EB04 jmp 004A5B2F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A5B10(C)
|
:004A5B2B C645FB00 mov [ebp-05], 00
====>清0则OVER！

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A5B29(U)
|
:004A5B2F 33C0 xor eax, eax
:004A5B31 5A pop edx
:004A5B32 59 pop ecx
:004A5B33 59 pop ecx
:004A5B34 648910 mov dword ptr fs:[eax], edx
:004A5B37 68665B4A00 push 004A5B66

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A5B64(U)
|
:004A5B3C 8D45D4 lea eax, dword ptr [ebp-2C]
:004A5B3F E854E6F5FF call 00404198
:004A5B44 8D45D8 lea eax, dword ptr [ebp-28]
:004A5B47 BA03000000 mov edx, 00000003
:004A5B4C E86BE6F5FF call 004041BC
:004A5B51 8D45F0 lea eax, dword ptr [ebp-10]
:004A5B54 BA02000000 mov edx, 00000002
:004A5B59 E85EE6F5FF call 004041BC
:004A5B5E C3 ret

:004A5B5F E994DFF5FF jmp 00403AF8
:004A5B64 EBD6 jmp 004A5B3C
:004A5B66 8A45FB mov al, byte ptr [ebp-05]
====>标志位值入 AL

:004A5B69 5F pop edi
:004A5B6A 5E pop esi
:004A5B6B 5B pop ebx
:004A5B6C 8BE5 mov esp, ebp
:004A5B6E 5D pop ebp
:004A5B6F C3 ret

—————————————————————————————————
【算法总结】：

姓名字符的HEX值累加，再加（0355CAC6+申请号+9）* 姓名的位数

—————————————————————————————————
【KeyMake之内存注册机】：

中断地址：4A5B0E
中断次数：1
第一字节：3B
指令长度：2

寄存器方式：EBX
十进制

—————————————————————————————————
【注册信息保存】：

REGEDIT4

[HKEY_USERS\.DEFAULT\Software\xt-studio\windows\exe]
"Name"="fly"
"Pass"=dword:0c8c2090

—————————————————————————————————
【整理】：

申请号：14215752
姓名：fly
公司：【OCN】
授权码：210509968

—————————————————————————————————

Cracked By 巢水工作坊——fly【OCN】

2003-4-6 15:20