下载页面：
http://www.skycn.com/soft/6669.html
软件大小：
443 KB
软件语言： 简体中文
软件类别： 国产软件 / 共享版 / 图像管理
应用平台： Win9x/NT/2000/XP
加入时间：
2001-10-06 11:19:47
下载次数： 10985
推荐等级： ****
开 发 商： http://minicards.home.sohu.com/
【软件简介】：忆美电子像册是一个集像片管理，像册生成于一体的电子图片管理系统，它操作简单，功能强大，界面友好美观，是一款不可多得的必备工具。它不但在平时可以方便的 分类 管理个人或单位的图片资料，而且可以把某一个专题（如：家庭像册，名星写真，自然风光。。。）从管理器中直接成成像册，所制作的像册可以方便的制作成多媒体光盘，且具有自动运行功能，方便浏览观赏。随着电子设备和网络的广泛应用，我们所接触到的电子信息也越来越多，电子形式的像片便是其一。如果你正为繁多的电子像片的管理而发愁，E美电子像册系统便是你的首要选择。
【软件限制】：NAG
【作者声明】：初学Crack，只是感兴趣，没有其它目的。失误之处敬请诸位大侠赐教！
【破解工具】：TRW2000娃娃修改版、Ollydbg1.09、PEiD、W32Dasm 9.0白金版
—————————————————————————————————
【过 程】：
ebum.exe 无壳。 VB 5.0 编写。
点“注册”后无提示，用TRW下万能断点拦截，发现程序只是把用户名转换成大写字母，然后把用户名和试炼码保存到注册表就结束了。于是猜想程序是要重启验证，呵呵，作者连这点提示都不给。注册表中保存试炼码的键名是softkey，简单的方法在反汇编代码里搜索softkey，找到2处，一处是输入试炼码时保存试炼码的，而另一处就“可疑”了。再用Ollydbg重新载入程序，把断点下在另一处softkey，果然断了下来。^O^^O^
呵呵，VB的东东看着太累了，追算法、整理笔记就更烦人了。^O^^O^
用户名：fly
试炼码：1357246890 （需要10位）
—————————————————————————————————
* Possible StringData Ref from Code Obj ->"ssoftkey"
|
:00470AA6 68949A4000 push
00409A94
* Possible StringData Ref from Code Obj ->"SSecKey"
|
:00470AAB 68809A4000 push
00409A80
:00470AB0 890A
mov dword ptr [edx], ecx
:00470AB2 8B4DA8 mov
ecx, dword ptr [ebp-58]
:00470AB5 894A04 mov
dword ptr [edx+04], ecx
:00470AB8 8B4DE0 mov
ecx, dword ptr [ebp-20]
:00470ABB 51
push ecx
:00470ABC 894208 mov
dword ptr [edx+08], eax
:00470ABF 8B45B0 mov
eax, dword ptr [ebp-50]
:00470AC2 89420C mov
dword ptr [edx+0C], eax
* Reference To: MSVBVM50.rtcGetSetting, Ord:02B1h
|
:00470AC5 FF1518A54700 Call dword
ptr [0047A518]
* Reference To: MSVBVM50.__vbaStrMove, Ord:0000h
|
:00470ACB 8B3D58A54700 mov edi, dword
ptr [0047A558]
:00470AD1 8BD0
mov edx, eax
====>EDX=1357246890
试炼码
:00470AD3 8D4DEC
lea ecx, dword ptr [ebp-14]
:00470AD6 FFD7
call edi
:00470AD8 8D4DE0 lea
ecx, dword ptr [ebp-20]
* Reference To: MSVBVM50.__vbaFreeStr, Ord:0000h
|
:00470ADB FF1588A54700 Call dword
ptr [0047A588]
:00470AE1 8D4DD4 lea
ecx, dword ptr [ebp-2C]
* Reference To: MSVBVM50.__vbaFreeObj, Ord:0000h
|
:00470AE4 FF158CA54700 Call dword
ptr [0047A58C]
:00470AEA 8B55EC mov
edx, dword ptr [ebp-14]
:00470AED 52
push edx
* Reference To: MSVBVM50.__vbaLenBstr, Ord:0000h
|
:00470AEE FF1518A34700 Call dword
ptr [0047A318]
====>取试炼码的长度
:00470AF4 83F80A
cmp eax, 0000000A
====>是否是10位？
:00470AF7 0F854B020000
jne 00470D48
====>跳则OVER！爆破点！①
:00470AFD EB11 jmp 00470B10
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470A3C(C)
|
:00470AFF 8B17
mov edx, dword ptr [edi]
:00470B01 8D4DEC lea
ecx, dword ptr [ebp-14]
* Reference To: MSVBVM50.__vbaStrCopy, Ord:0000h
|
:00470B04 FF15E8A44700 Call dword
ptr [0047A4E8]
* Reference To: MSVBVM50.__vbaStrMove, Ord:0000h
|
:00470B0A 8B3D58A54700 mov edi, dword
ptr [0047A558]
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470AFD(U)
|
:00470B10 391D84404700 cmp dword
ptr [00474084], ebx
:00470B16 7510
jne 00470B28
:00470B18 6884404700 push
00474084
:00470B1D 68C8A84000 push
0040A8C8
* Reference To: MSVBVM50.__vbaNew2, Ord:0000h
|
:00470B22 FF15D4A44700 Call dword
ptr [0047A4D4]
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470B16(C)
|
:00470B28 8B1D84404700 mov ebx, dword
ptr [00474084]
:00470B2E 8D4DD4 lea
ecx, dword ptr [ebp-2C]
:00470B31 51
push ecx
:00470B32 53
push ebx
:00470B33 8B03
mov eax, dword ptr [ebx]
:00470B35 FF5014 call
[eax+14]
:00470B38 85C0
test eax, eax
:00470B3A 7D0B
jge 00470B47
:00470B3C 6A14
push 00000014
:00470B3E 68B8A84000 push
0040A8B8
:00470B43 53
push ebx
:00470B44 50
push eax
:00470B45 FFD6
call esi
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470B3A(C)
|
:00470B47 8B45D4 mov
eax, dword ptr [ebp-2C]
:00470B4A 8D4DE0 lea
ecx, dword ptr [ebp-20]
:00470B4D 51
push ecx
:00470B4E 50
push eax
:00470B4F 8B10
mov edx, dword ptr [eax]
:00470B51 8BD8
mov ebx, eax
:00470B53 FF5258 call
[edx+58]
:00470B56 85C0
test eax, eax
:00470B58 7D0B
jge 00470B65
:00470B5A 6A58
push 00000058
* Possible StringData Ref from Code Obj ->"yO?檉??"
|
:00470B5C 6884BE4000 push
0040BE84
:00470B61 53
push ebx
:00470B62 50
push eax
:00470B63 FFD6
call esi
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470B58(C)
|
:00470B65 83EC10 sub
esp, 00000010
:00470B68 B90A000000 mov ecx,
0000000A
:00470B6D 8BD4
mov edx, esp
:00470B6F B804000280 mov eax,
80020004
* Possible StringData Ref from Code Obj ->"UUserName"
|
:00470B74 68A89A4000 push
00409AA8
* Possible StringData Ref from Code Obj ->"SSecKey"
|
:00470B79 68809A4000 push
00409A80
:00470B7E 890A
mov dword ptr [edx], ecx
:00470B80 8B4DA8 mov
ecx, dword ptr [ebp-58]
:00470B83 894A04 mov
dword ptr [edx+04], ecx
:00470B86 8B4DE0 mov
ecx, dword ptr [ebp-20]
:00470B89 51
push ecx
:00470B8A 894208 mov
dword ptr [edx+08], eax
:00470B8D 8B45B0 mov
eax, dword ptr [ebp-50]
:00470B90 89420C mov
dword ptr [edx+0C], eax
* Reference To: MSVBVM50.rtcGetSetting, Ord:02B1h
|
:00470B93 FF1518A54700 Call dword
ptr [0047A518]
* Reference To: MSVBVM50.rtcTrimVar, Ord:0208h
|
:00470B99 8B1DC0A34700 mov ebx, dword
ptr [0047A3C0]
:00470B9F 8945CC mov
dword ptr [ebp-34], eax
====>EAX=FLY
用户名
:00470BA2 8D55C4
lea edx, dword ptr [ebp-3C]
:00470BA5 8D45B4 lea
eax, dword ptr [ebp-4C]
:00470BA8 52
push edx
:00470BA9 50
push eax
:00470BAA C745C408000000 mov [ebp-3C], 00000008
:00470BB1 FFD3
call ebx
:00470BB3 8D4DB4 lea
ecx, dword ptr [ebp-4C]
:00470BB6 51
push ecx
* Reference To: MSVBVM50.__vbaStrVarMove, Ord:0000h
|
:00470BB7 FF1514A34700 Call dword
ptr [0047A314]
:00470BBD 8BD0
mov edx, eax
:00470BBF 8D4DDC lea
ecx, dword ptr [ebp-24]
:00470BC2 FFD7
call edi
:00470BC4 8D55DC lea
edx, dword ptr [ebp-24]
:00470BC7 52
push edx
:00470BC8 E883F3FFFF call
0046FF50
====>关键CALL！
:00470BCD 8BD0
mov edx, eax
:00470BCF 8D4DD8 lea
ecx, dword ptr [ebp-28]
:00470BD2 FFD7
call edi
:00470BD4 50
push eax
:00470BD5 68789A4000 push
00409A78
* Reference To: MSVBVM50.__vbaStrCmp, Ord:0000h
|
:00470BDA FF150CA44700 Call dword
ptr [0047A40C]
:00470BE0 8BF0
mov esi, eax
:00470BE2 8D45D8 lea
eax, dword ptr [ebp-28]
:00470BE5 F7DE
neg esi
:00470BE7 8D4DDC lea
ecx, dword ptr [ebp-24]
:00470BEA 50
push eax
:00470BEB 1BF6
sbb esi, esi
:00470BED 8D55E0 lea
edx, dword ptr [ebp-20]
:00470BF0 51
push ecx
:00470BF1 46
inc esi
:00470BF2 52
push edx
:00470BF3 6A03
push 00000003
:00470BF5 F7DE
neg esi
* Reference To: MSVBVM50.__vbaFreeStrList, Ord:0000h
|
:00470BF7 FF15F4A44700 Call dword
ptr [0047A4F4]
:00470BFD 83C410 add
esp, 00000010
:00470C00 8D4DD4 lea
ecx, dword ptr [ebp-2C]
* Reference To: MSVBVM50.__vbaFreeObj, Ord:0000h
|
:00470C03 FF158CA54700 Call dword
ptr [0047A58C]
:00470C09 8D45B4 lea
eax, dword ptr [ebp-4C]
:00470C0C 8D4DC4 lea
ecx, dword ptr [ebp-3C]
:00470C0F 50
push eax
:00470C10 51
push ecx
:00470C11 6A02
push 00000002
* Reference To: MSVBVM50.__vbaFreeVarList, Ord:0000h
|
:00470C13 FF151CA34700 Call dword
ptr [0047A31C]
:00470C19 83C40C add
esp, 0000000C
:00470C1C 6685F6 test
si, si
:00470C1F 7411
je 00470C32
:00470C21 C745E400000000 mov [ebp-1C], 00000000
:00470C28 68940D4700 push
00470D94
:00470C2D E951010000 jmp 00470D83
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470C1F(C)
|
:00470C32 A184404700 mov eax,
dword ptr [00474084]
:00470C37 85C0
test eax, eax
:00470C39 7510
jne 00470C4B
:00470C3B 6884404700 push
00474084
:00470C40 68C8A84000 push
0040A8C8
* Reference To: MSVBVM50.__vbaNew2, Ord:0000h
|
:00470C45 FF15D4A44700 Call dword
ptr [0047A4D4]
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470C39(C)
|
:00470C4B 8B3584404700 mov esi, dword
ptr [00474084]
:00470C51 8D45D4 lea
eax, dword ptr [ebp-2C]
:00470C54 50
push eax
:00470C55 56
push esi
:00470C56 8B16
mov edx, dword ptr [esi]
:00470C58 FF5214 call
[edx+14]
:00470C5B 85C0
test eax, eax
:00470C5D 7D0F
jge 00470C6E
:00470C5F 6A14
push 00000014
:00470C61 68B8A84000 push
0040A8B8
:00470C66 56
push esi
:00470C67 50
push eax
* Reference To: MSVBVM50.__vbaHresultCheckObj, Ord:0000h
|
:00470C68 FF1570A34700 Call dword
ptr [0047A370]
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470C5D(C)
|
:00470C6E 8B45D4 mov
eax, dword ptr [ebp-2C]
:00470C71 8D55E0 lea
edx, dword ptr [ebp-20]
:00470C74 52
push edx
:00470C75 50
push eax
:00470C76 8B08
mov ecx, dword ptr [eax]
:00470C78 8BF0
mov esi, eax
:00470C7A FF5158 call
[ecx+58]
:00470C7D 85C0
test eax, eax
:00470C7F 7D0F
jge 00470C90
:00470C81 6A58
push 00000058
* Possible StringData Ref from Code Obj ->"yO?檉??"
|
:00470C83 6884BE4000 push
0040BE84
:00470C88 56
push esi
:00470C89 50
push eax
* Reference To: MSVBVM50.__vbaHresultCheckObj, Ord:0000h
|
:00470C8A FF1570A34700 Call dword
ptr [0047A370]
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470C7F(C)
|
:00470C90 83EC10 sub
esp, 00000010
:00470C93 B90A000000 mov ecx,
0000000A
:00470C98 8BD4
mov edx, esp
:00470C9A B804000280 mov eax,
80020004
* Possible StringData Ref from Code Obj ->"UUserName"
|
:00470C9F 68A89A4000 push
00409AA8
* Possible StringData Ref from Code Obj ->"SSecKey"
|
:00470CA4 68809A4000 push
00409A80
:00470CA9 890A
mov dword ptr [edx], ecx
:00470CAB 8B4DA8 mov
ecx, dword ptr [ebp-58]
:00470CAE 894A04 mov
dword ptr [edx+04], ecx
:00470CB1 8B4DE0 mov
ecx, dword ptr [ebp-20]
:00470CB4 51
push ecx
:00470CB5 894208 mov
dword ptr [edx+08], eax
:00470CB8 8B45B0 mov
eax, dword ptr [ebp-50]
:00470CBB 89420C mov
dword ptr [edx+0C], eax
* Reference To: MSVBVM50.rtcGetSetting, Ord:02B1h
|
:00470CBE FF1518A54700 Call dword
ptr [0047A518]
:00470CC4 8945CC mov
dword ptr [ebp-34], eax
:00470CC7 8D55C4 lea
edx, dword ptr [ebp-3C]
:00470CCA 8D45B4 lea
eax, dword ptr [ebp-4C]
:00470CCD 52
push edx
:00470CCE 50
push eax
:00470CCF C745C408000000 mov [ebp-3C], 00000008
:00470CD6 FFD3
call ebx
:00470CD8 8D4DB4 lea
ecx, dword ptr [ebp-4C]
:00470CDB 51
push ecx
* Reference To: MSVBVM50.__vbaStrVarMove, Ord:0000h
|
:00470CDC FF1514A34700 Call dword
ptr [0047A314]
:00470CE2 8BD0
mov edx, eax
:00470CE4 8D4DDC lea
ecx, dword ptr [ebp-24]
:00470CE7 FFD7
call edi
:00470CE9 8B55EC mov
edx, dword ptr [ebp-14]
:00470CEC 8D45DC lea
eax, dword ptr [ebp-24]
:00470CEF 52
push edx
:00470CF0 50
push eax
:00470CF1 E85AF2FFFF call
0046FF50
====>关键CALL！进入！
:00470CF6 8BD0
mov edx, eax
:00470CF8 8D4DD8 lea
ecx, dword ptr [ebp-28]
:00470CFB FFD7
call edi
:00470CFD 50
push eax
====>EAX=JJVPCNXAKL
注册码
* Reference To: MSVBVM50.__vbaStrCmp, Ord:0000h
|
:00470CFE FF150CA44700 Call dword
ptr [0047A40C]
====>比较CALL！
:00470D04 8BF0
mov esi, eax
====>错误则EAX返回FFFFFFFF
:00470D06 8D4DD8
lea ecx, dword ptr [ebp-28]
:00470D09 F7DE
neg esi
:00470D0B 8D55DC lea
edx, dword ptr [ebp-24]
:00470D0E 51
push ecx
:00470D0F 1BF6
sbb esi, esi
====>呵呵，爆破点！②
:00470D11 8D45E0
lea eax, dword ptr [ebp-20]
:00470D14 52
push edx
:00470D15 46
inc esi
:00470D16 50
push eax
:00470D17 6A03
push 00000003
:00470D19 F7DE
neg esi
* Reference To: MSVBVM50.__vbaFreeStrList, Ord:0000h
|
:00470D1B FF15F4A44700 Call dword
ptr [0047A4F4]
:00470D21 83C410 add
esp, 00000010
:00470D24 8D4DD4 lea
ecx, dword ptr [ebp-2C]
* Reference To: MSVBVM50.__vbaFreeObj, Ord:0000h
|
:00470D27 FF158CA54700 Call dword
ptr [0047A58C]
:00470D2D 8D4DB4 lea
ecx, dword ptr [ebp-4C]
:00470D30 8D55C4 lea
edx, dword ptr [ebp-3C]
:00470D33 51
push ecx
:00470D34 52
push edx
:00470D35 6A02
push 00000002
* Reference To: MSVBVM50.__vbaFreeVarList, Ord:0000h
|
:00470D37 FF151CA34700 Call dword
ptr [0047A31C]
:00470D3D 83C40C add
esp, 0000000C
:00470D40 66F7DE neg
si
:00470D43 1BF6
sbb esi, esi
:00470D45 8975E4 mov
dword ptr [ebp-1C], esi
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470AF7(C)
|
:00470D48 68940D4700 push
00470D94
:00470D4D EB34
jmp 00470D83
:00470D4F 8D45D8 lea
eax, dword ptr [ebp-28]
:00470D52 8D4DDC lea
ecx, dword ptr [ebp-24]
:00470D55 50
push eax
:00470D56 8D55E0 lea
edx, dword ptr [ebp-20]
:00470D59 51
push ecx
:00470D5A 52
push edx
:00470D5B 6A03
push 00000003
* Reference To: MSVBVM50.__vbaFreeStrList, Ord:0000h
|
:00470D5D FF15F4A44700 Call dword
ptr [0047A4F4]
:00470D63 83C410 add
esp, 00000010
:00470D66 8D4DD4 lea
ecx, dword ptr [ebp-2C]
* Reference To: MSVBVM50.__vbaFreeObj, Ord:0000h
|
:00470D69 FF158CA54700 Call dword
ptr [0047A58C]
:00470D6F 8D45B4 lea
eax, dword ptr [ebp-4C]
:00470D72 8D4DC4 lea
ecx, dword ptr [ebp-3C]
:00470D75 50
push eax
:00470D76 51
push ecx
:00470D77 6A02
push 00000002
* Reference To: MSVBVM50.__vbaFreeVarList, Ord:0000h
|
:00470D79 FF151CA34700 Call dword
ptr [0047A31C]
:00470D7F 83C40C add
esp, 0000000C
:00470D82 C3
ret
—————————————————————————————————
进入关键CALL： CALL 0046FF50
* Referenced by a CALL at Addresses:
|:00470BC8 , :00470CF1
|
:0046FF50 55
push ebp
:0046FF51 8BEC
mov ebp, esp
:0046FF53 83EC18 sub
esp, 00000018
* Possible StringData Ref from Code Obj ->"�%l"
|
:0046FF56 68B6224000 push
004022B6
:0046FF5B 64A100000000 mov eax, dword
ptr fs:[00000000]
:0046FF61 50
push eax
:0046FF62 64892500000000 mov dword ptr fs:[00000000],
esp
:0046FF69 B820010000 mov eax,
00000120
* Reference To: MSVBVM50.__vbaChkstk, Ord:0000h
|
:0046FF6E E83D23F9FF Call
004022B0
:0046FF73 53
push ebx
:0046FF74 56
push esi
:0046FF75 57
push edi
:0046FF76 8965E8 mov
dword ptr [ebp-18], esp
* Possible StringData Ref from Code Obj ->".."
|
:0046FF79 C745ECA8204000 mov [ebp-14], 004020A8
:0046FF80 C745F000000000 mov [ebp-10], 00000000
:0046FF87 C745F400000000 mov [ebp-0C], 00000000
:0046FF8E C745FC01000000 mov [ebp-04], 00000001
:0046FF95 68C0D44000 push
0040D4C0
:0046FF9A 8D45B8 lea
eax, dword ptr [ebp-48]
:0046FF9D 50
push eax
* Reference To: MSVBVM50.__vbaAryConstruct, Ord:0000h
|
:0046FF9E FF1530A44700 Call dword
ptr [0047A430]
:0046FFA4 68C0D44000 push
0040D4C0
:0046FFA9 8D4D90 lea
ecx, dword ptr [ebp-70]
:0046FFAC 51
push ecx
* Reference To: MSVBVM50.__vbaAryConstruct, Ord:0000h
|
:0046FFAD FF1530A44700 Call dword
ptr [0047A430]
:0046FFB3 C745FC02000000 mov [ebp-04], 00000002
:0046FFBA 6AFF
push FFFFFFFF
* Reference To: MSVBVM50.__vbaonError, Ord:0000h
|
:0046FFBC FF159CA34700 Call dword
ptr [0047A39C]
:0046FFC2 C745FC03000000 mov [ebp-04], 00000003
:0046FFC9 8B5508 mov
edx, dword ptr [ebp+08]
:0046FFCC 8B02
mov eax, dword ptr [edx]
====>EAX=FLY
:0046FFCE 50
push eax
:0046FFCF 68789A4000 push
00409A78
* Reference To: MSVBVM50.__vbaStrCmp, Ord:0000h
|
:0046FFD4 FF150CA44700 Call dword
ptr [0047A40C]
:0046FFDA 85C0
test eax, eax
:0046FFDC 751A
jne 0046FFF8
:0046FFDE C745FC04000000 mov [ebp-04], 00000004
:0046FFE5 BA789A4000 mov edx,
00409A78
:0046FFEA 8D4DD8 lea
ecx, dword ptr [ebp-28]
* Reference To: MSVBVM50.__vbaStrCopy, Ord:0000h
|
:0046FFED FF15E8A44700 Call dword
ptr [0047A4E8]
:0046FFF3 E9ED080000 jmp 004708E5
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0046FFDC(C)
|
:0046FFF8 C745FC07000000 mov [ebp-04], 00000007
:0046FFFF 8B4D08 mov
ecx, dword ptr [ebp+08]
:00470002 898D60FFFFFF mov dword
ptr [ebp+FFFFFF60], ecx
:00470008 C78558FFFFFF08400000 mov dword ptr [ebp+FFFFFF58],
00004008
:00470012 8D9558FFFFFF lea edx, dword
ptr [ebp+FFFFFF58]
:00470018 52
push edx
:00470019 8D8578FFFFFF lea eax, dword
ptr [ebp+FFFFFF78]
:0047001F 50
push eax
* Reference To: MSVBVM50.rtcUpperCaseVar, Ord:0210h
|
:00470020 FF15FCA34700 Call dword
ptr [0047A3FC]
:00470026 6880000000 push
00000080
:0047002B 8D8D78FFFFFF lea ecx, dword
ptr [ebp+FFFFFF78]
:00470031 51
push ecx
:00470032 8D9568FFFFFF lea edx, dword
ptr [ebp+FFFFFF68]
:00470038 52
push edx
* Reference To: MSVBVM50.rtcStrConvVar, Ord:026Eh
|
:00470039 FF152CA34700 Call dword
ptr [0047A32C]
:0047003F 8D8568FFFFFF lea eax, dword
ptr [ebp+FFFFFF68]
:00470045 50
push eax
* Reference To: MSVBVM50.__vbaStrVarMove, Ord:0000h
|
:00470046 FF1514A34700 Call dword
ptr [0047A314]
:0047004C 8BD0
mov edx, eax
:0047004E 8B4D08 mov
ecx, dword ptr [ebp+08]
* Reference To: MSVBVM50.__vbaStrMove, Ord:0000h
|
:00470051 FF1558A54700 Call dword
ptr [0047A558]
:00470057 8D8D68FFFFFF lea ecx, dword
ptr [ebp+FFFFFF68]
:0047005D 51
push ecx
:0047005E 8D9578FFFFFF lea edx, dword
ptr [ebp+FFFFFF78]
:00470064 52
push edx
:00470065 6A02
push 00000002
* Reference To: MSVBVM50.__vbaFreeVarList, Ord:0000h
|
:00470067 FF151CA34700 Call dword
ptr [0047A31C]
:0047006D 83C40C add
esp, 0000000C
:00470070 C745FC08000000 mov [ebp-04], 00000008
:00470077 B909000000 mov ecx,
00000009
* Reference To: MSVBVM50.__vbaUI1I2, Ord:0000h
|
:0047007C FF1558A44700 Call dword
ptr [0047A458]
:00470082 888528FFFFFF mov byte ptr
[ebp+FFFFFF28], al
:00470088 C6852CFFFFFF01 mov byte ptr [ebp+FFFFFF2C],
01
:0047008F 33C9
xor ecx, ecx
* Reference To: MSVBVM50.__vbaUI1I2, Ord:0000h
|
:00470091 FF1558A44700 Call dword
ptr [0047A458]
:00470097 8845DC mov
byte ptr [ebp-24], al
:0047009A EB12
jmp 004700AE
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047012D(U)
|
:0047009C 8A45DC mov
al, byte ptr [ebp-24]
:0047009F 02852CFFFFFF add al, byte
ptr [ebp+FFFFFF2C]
:004700A5 0F82C7080000 jb 00470972
:004700AB 8845DC mov
byte ptr [ebp-24], al
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047009A(U)
|
:004700AE 8A4DDC mov
cl, byte ptr [ebp-24]
:004700B1 3A8D28FFFFFF cmp cl, byte
ptr [ebp+FFFFFF28]
:004700B7 7779
ja 00470132
:004700B9 C745FC09000000 mov [ebp-04], 00000009
:004700C0 8B55DC mov
edx, dword ptr [ebp-24]
:004700C3 81E2FF000000 and edx, 000000FF
:004700C9 89953CFFFFFF mov dword
ptr [ebp+FFFFFF3C], edx
:004700CF 83BD3CFFFFFF0B cmp dword ptr [ebp+FFFFFF3C],
0000000B
:004700D6 730C
jnb 004700E4
:004700D8 C785F8FEFFFF00000000 mov dword ptr [ebp+FFFFFEF8],
00000000
:004700E2 EB0C
jmp 004700F0
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004700D6(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:004700E4 FF1500A44700 Call dword
ptr [0047A400]
:004700EA 8985F8FEFFFF mov dword
ptr [ebp+FFFFFEF8], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004700E2(U)
|
:004700F0 660FB645DC movzx
ax, byte ptr [ebp-24]
:004700F5 6669C0B907 imul
ax, 07B9
:004700FA 0F8072080000 jo 00470972
:00470100 66050C00 add
ax, 000C
:00470104 0F8068080000 jo 00470972
:0047010A 6699
cwd
:0047010C 66B9FF00 mov
cx, 00FF
:00470110 66F7F9 idiv
cx
====>这里循环求模的参数是固定的，所以没有详细记录了。
:00470113 8BCA mov ecx, edx
* Reference To: MSVBVM50.__vbaUI1I2, Ord:0000h
|
:00470115 FF1558A44700 Call dword
ptr [0047A458]
:0047011B 8B55C4 mov
edx, dword ptr [ebp-3C]
:0047011E 03953CFFFFFF add edx, dword
ptr [ebp+FFFFFF3C]
:00470124 8802
mov byte ptr [edx], al
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
循环运算的结果：
00498910 0C CC 8D
4E 0F CF 90 51 12 D2 呵呵，发现这组值是固定参数！^O^^O^
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
:00470126 C745FC0A000000 mov [ebp-04], 0000000A
====>[ebp-04]=A
:0047012D E96AFFFFFF
jmp 0047009C
====>循环10次，得出一个主要的参数！
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004700B7(C)
|
:00470132 C745FC0B000000 mov [ebp-04], 0000000B
:00470139 33C9
xor ecx, ecx
* Reference To: MSVBVM50.__vbaUI1I2, Ord:0000h
|
:0047013B FF1558A44700 Call dword
ptr [0047A458]
:00470141 8845D0 mov
byte ptr [ebp-30], al
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004702D5(U)
|
:00470144 C745FC0C000000 mov [ebp-04], 0000000C
:0047014B 660FB645D0 movzx
ax, byte ptr [ebp-30]
:00470150 663D0900 cmp
ax, 0009
:00470154 0F8F80010000 jg 004702DA
:0047015A C745FC0D000000 mov [ebp-04], 0000000D
:00470161 8B4D08 mov
ecx, dword ptr [ebp+08]
:00470164 8B11
mov edx, dword ptr [ecx]
:00470166 52
push edx
====>EDX=FLY
* Reference To: MSVBVM50.__vbaLenBstrB, Ord:0000h
|
:00470167 FF156CA34700 Call dword
ptr [0047A36C]
====>取用户名长度
:0047016D 8BC8
mov ecx, eax
====>ECX=3
* Reference To: MSVBVM50.__vbaUI1I4, Ord:0000h
|
:0047016F FF1568A44700 Call dword
ptr [0047A468]
:00470175 888520FFFFFF mov byte ptr
[ebp+FFFFFF20], al
:0047017B C68524FFFFFF01 mov byte ptr [ebp+FFFFFF24],
01
:00470182 B901000000 mov ecx,
00000001
* Reference To: MSVBVM50.__vbaUI1I2, Ord:0000h
|
:00470187 FF1558A44700 Call dword
ptr [0047A458]
:0047018D 8845DC mov
byte ptr [ebp-24], al
:00470190 EB12
jmp 004701A4
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004702D0(U)
|
:00470192 8A45DC mov
al, byte ptr [ebp-24]
:00470195 028524FFFFFF add al, byte
ptr [ebp+FFFFFF24]
:0047019B 0F82D1070000 jb 00470972
:004701A1 8845DC mov
byte ptr [ebp-24], al
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470190(U)
|
:004701A4 8A4DDC mov
cl, byte ptr [ebp-24]
:004701A7 3A8D20FFFFFF cmp cl, byte
ptr [ebp+FFFFFF20]
:004701AD 0F8722010000 ja 004702D5
:004701B3 C745FC0E000000 mov [ebp-04], 0000000E
:004701BA C7458001000000 mov [ebp-80], 00000001
:004701C1 C78578FFFFFF02000000 mov dword ptr [ebp+FFFFFF78],
00000002
:004701CB 8B5508 mov
edx, dword ptr [ebp+08]
:004701CE 899560FFFFFF mov dword
ptr [ebp+FFFFFF60], edx
:004701D4 C78558FFFFFF08400000 mov dword ptr [ebp+FFFFFF58],
00004008
:004701DE 8D8578FFFFFF lea eax, dword
ptr [ebp+FFFFFF78]
:004701E4 50
push eax
:004701E5 8B4DDC mov
ecx, dword ptr [ebp-24]
:004701E8 81E1FF000000 and ecx, 000000FF
:004701EE 51
push ecx
:004701EF 8D9558FFFFFF lea edx, dword
ptr [ebp+FFFFFF58]
:004701F5 52
push edx
:004701F6 8D8568FFFFFF lea eax, dword
ptr [ebp+FFFFFF68]
:004701FC 50
push eax
* Reference To: MSVBVM50.rtcMidVar, Ord:0275h
|
:004701FD FF1550A34700 Call dword
ptr [0047A350]
====>取用户名字符
:00470203 8D8D68FFFFFF
lea ecx, dword ptr [ebp+FFFFFF68]
:00470209 51
push ecx
:0047020A 8D5588 lea
edx, dword ptr [ebp-78]
:0047020D 52
push edx
* Reference To: MSVBVM50.__vbaStrVarVal, Ord:0000h
|
:0047020E FF15A4A44700 Call dword
ptr [0047A4A4]
:00470214 50
push eax
* Reference To: MSVBVM50.rtcBytevalueBstr, Ord:02B5h
|
:00470215 FF15FCA24700 Call dword
ptr [0047A2FC]
:0047021B 8845AC mov
byte ptr [ebp-54], al
:0047021E 8D4D88 lea
ecx, dword ptr [ebp-78]
* Reference To: MSVBVM50.__vbaFreeStr, Ord:0000h
|
:00470221 FF1588A54700 Call dword
ptr [0047A588]
:00470227 8D8568FFFFFF lea eax, dword
ptr [ebp+FFFFFF68]
:0047022D 50
push eax
:0047022E 8D8D78FFFFFF lea ecx, dword
ptr [ebp+FFFFFF78]
:00470234 51
push ecx
:00470235 6A02
push 00000002
* Reference To: MSVBVM50.__vbaFreeVarList, Ord:0000h
|
:00470237 FF151CA34700 Call dword
ptr [0047A31C]
:0047023D 83C40C add
esp, 0000000C
:00470240 C745FC0F000000 mov [ebp-04], 0000000F
:00470247 660FB655AC movzx
dx, byte ptr [ebp-54]
:0047024C 6683FA20 cmp
dx, 0020
:00470250 7477
je 004702C9
:00470252 C745FC10000000 mov [ebp-04], 00000010
:00470259 8B45D0 mov
eax, dword ptr [ebp-30]
:0047025C 25FF000000 and eax,
000000FF
:00470261 89853CFFFFFF mov dword
ptr [ebp+FFFFFF3C], eax
:00470267 83BD3CFFFFFF0B cmp dword ptr [ebp+FFFFFF3C],
0000000B
:0047026E 730C
jnb 0047027C
:00470270 C785F4FEFFFF00000000 mov dword ptr [ebp+FFFFFEF4],
00000000
:0047027A EB0C
jmp 00470288
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047026E(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:0047027C FF1500A44700 Call dword
ptr [0047A400]
:00470282 8985F4FEFFFF mov dword
ptr [ebp+FFFFFEF4], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047027A(U)
|
:00470288 8B4D9C mov
ecx, dword ptr [ebp-64]
:0047028B 038D3CFFFFFF add ecx, dword
ptr [ebp+FFFFFF3C]
:00470291 8A55AC mov
dl, byte ptr [ebp-54]
:00470294 8811
mov byte ptr [ecx], dl
:00470296 C745FC11000000 mov [ebp-04], 00000011
:0047029D 660FB64DD0 movzx
cx, byte ptr [ebp-30]
:004702A2 6683C101 add
cx, 0001
:004702A6 0F80C6060000 jo 00470972
* Reference To: MSVBVM50.__vbaUI1I2, Ord:0000h
|
:004702AC FF1558A44700 Call dword
ptr [0047A458]
:004702B2 8845D0 mov
byte ptr [ebp-30], al
:004702B5 C745FC12000000 mov [ebp-04], 00000012
:004702BC 660FB645D0 movzx
ax, byte ptr [ebp-30]
:004702C1 663D0900 cmp
ax, 0009
====>AX从0开始，0-9，共10次
:004702C5 7E02
jle 004702C9
:004702C7 EB11
jmp 004702DA
* Referenced by a (U)nconditional or (C)onditional Jump
at Addresses:
|:00470250(C), :004702C5(C)
|
:004702C9 C745FC16000000 mov [ebp-04], 00000016
:004702D0 E9BDFEFFFF jmp 00470192
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004701AD(C)
|
:004702D5 E96AFEFFFF jmp 00470144
* Referenced by a (U)nconditional or (C)onditional Jump
at Addresses:
|:00470154(C), :004702C7(U)
|
:004702DA C745FC18000000 mov [ebp-04], 00000018
:004702E1 B909000000 mov ecx,
00000009
* Reference To: MSVBVM50.__vbaUI1I2, Ord:0000h
|
:004702E6 FF1558A44700 Call dword
ptr [0047A458]
:004702EC 888518FFFFFF mov byte ptr
[ebp+FFFFFF18], al
:004702F2 C6851CFFFFFF01 mov byte ptr [ebp+FFFFFF1C],
01
:004702F9 33C9
xor ecx, ecx
* Reference To: MSVBVM50.__vbaUI1I2, Ord:0000h
|
:004702FB FF1558A44700 Call dword
ptr [0047A458]
:00470301 8845DC mov
byte ptr [ebp-24], al
:00470304 EB12
jmp 00470318
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470697(U)
|
:00470306 8A4DDC mov
cl, byte ptr [ebp-24]
:00470309 028D1CFFFFFF add cl, byte
ptr [ebp+FFFFFF1C]
:0047030F 0F825D060000 jb 00470972
:00470315 884DDC mov
byte ptr [ebp-24], cl
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470304(U)
|
:00470318 8A55DC mov
dl, byte ptr [ebp-24]
:0047031B 3A9518FFFFFF cmp dl, byte
ptr [ebp+FFFFFF18]
:00470321 0F8775030000 ja 0047069C
:00470327 C745FC19000000 mov [ebp-04], 00000019
:0047032E 8B45DC mov
eax, dword ptr [ebp-24]
:00470331 25FF000000 and eax,
000000FF
:00470336 898538FFFFFF mov dword
ptr [ebp+FFFFFF38], eax
:0047033C 83BD38FFFFFF0B cmp dword ptr [ebp+FFFFFF38],
0000000B
:00470343 730C
jnb 00470351
:00470345 C785F0FEFFFF00000000 mov dword ptr [ebp+FFFFFEF0],
00000000
:0047034F EB0C
jmp 0047035D
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470343(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:00470351 FF1500A44700 Call dword
ptr [0047A400]
:00470357 8985F0FEFFFF mov dword
ptr [ebp+FFFFFEF0], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047034F(U)
|
:0047035D 8B4DDC mov
ecx, dword ptr [ebp-24]
:00470360 81E1FF000000 and ecx, 000000FF
:00470366 898D34FFFFFF mov dword
ptr [ebp+FFFFFF34], ecx
:0047036C 83BD34FFFFFF0B cmp dword ptr [ebp+FFFFFF34],
0000000B
:00470373 730C
jnb 00470381
:00470375 C785ECFEFFFF00000000 mov dword ptr [ebp+FFFFFEEC],
00000000
:0047037F EB0C
jmp 0047038D
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470373(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:00470381 FF1500A44700 Call dword
ptr [0047A400]
:00470387 8985ECFEFFFF mov dword
ptr [ebp+FFFFFEEC], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047037F(U)
|
:0047038D 8B55DC mov
edx, dword ptr [ebp-24]
:00470390 81E2FF000000 and edx, 000000FF
:00470396 89953CFFFFFF mov dword
ptr [ebp+FFFFFF3C], edx
:0047039C 83BD3CFFFFFF0B cmp dword ptr [ebp+FFFFFF3C],
0000000B
:004703A3 730C
jnb 004703B1
:004703A5 C785E8FEFFFF00000000 mov dword ptr [ebp+FFFFFEE8],
00000000
:004703AF EB0C
jmp 004703BD
====>上面一长串的循环是重复取你的用户名直至长度为10位！
====>FLY—>FLYFLYFLYF 如果你输入超过10位的名字，则只取前10位！
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004703A3(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:004703B1 FF1500A44700 Call dword
ptr [0047A400]
:004703B7 8985E8FEFFFF mov dword
ptr [ebp+FFFFFEE8], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004703AF(U)
|
:004703BD 8B459C mov
eax, dword ptr [ebp-64]
====>EAX=FLYFLYFLYF
用户名重复的结果
:004703C0 038538FFFFFF
add eax, dword ptr [ebp+FFFFFF38]
====>依次取FLYFLYFLYF字符的HEX值
:004703C6 8B4DC4
mov ecx, dword ptr [ebp-3C]
====>ECX=0C CC 8D
4E 0F CF 90 51 12 D2
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
[ebp-3C]内存中的值：
00498910 0C CC 8D
4E 0F CF 90 51 12 D2 即：00470110处循环求余的结果
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
:004703C9 038D34FFFFFF add ecx, dword
ptr [ebp+FFFFFF34]
====>依次取0C CC 8D
4E 0F CF 90 51 12 D2
:004703CF 8A10
mov dl, byte ptr [eax]
:004703D1 3211
xor dl, byte ptr [ecx]
====>依次进行异或运算！
:004703D3 8B459C
mov eax, dword ptr [ebp-64]
:004703D6 03853CFFFFFF add eax, dword
ptr [ebp+FFFFFF3C]
:004703DC 8810
mov byte ptr [eax], dl
====>结果：4A、80、D4、08、43、96、D6、1D、4B、94
====>下面根据这些HEX值所对应的字符是否是大写字母、数字而进行处理
:004703DE C745FC1A000000
mov [ebp-04], 0000001A
:004703E5 8B4DDC mov
ecx, dword ptr [ebp-24]
:004703E8 81E1FF000000 and ecx, 000000FF
:004703EE 898D3CFFFFFF mov dword
ptr [ebp+FFFFFF3C], ecx
:004703F4 83BD3CFFFFFF0B cmp dword ptr [ebp+FFFFFF3C],
0000000B
:004703FB 730C
jnb 00470409
:004703FD C785E4FEFFFF00000000 mov dword ptr [ebp+FFFFFEE4],
00000000
:00470407 EB0C
jmp 00470415
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004703FB(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:00470409 FF1500A44700 Call dword
ptr [0047A400]
:0047040F 8985E4FEFFFF mov dword
ptr [ebp+FFFFFEE4], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470407(U)
|
:00470415 8B559C mov
edx, dword ptr [ebp-64]
:00470418 03953CFFFFFF add edx, dword
ptr [ebp+FFFFFF3C]
:0047041E 660FB632 movzx
si, byte ptr [edx]
:00470422 6890D44000 push
0040D490
* Reference To: MSVBVM50.rtcAnsivalueBstr, Ord:0204h
|
:00470427 FF1534A34700 Call dword
ptr [0047A334]
:0047042D 663BF0 cmp
si, ax
====>和5A（即：Z）比较
:00470430 7D0F
jge 00470441
====>大于5A就跳
:00470432 C745FC1B000000
mov [ebp-04], 0000001B
:00470439 66C745D41200 mov [ebp-2C],
0012
====>[ebp-2C]=0012 如果小于A（41）且不是数字，则下面加0012
:0047043F EB0D jmp 0047044E
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470430(C)
|
:00470441 C745FC1D000000 mov [ebp-04], 0000001D
:00470448 66C745D4EEFF mov [ebp-2C],
FFEE
====>[ebp-2C]=FFEE 如果大于Z（5A），则下面加FFEE
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047043F(U)
|
:0047044E C745FC1F000000 mov [ebp-04], 0000001F
:00470455 8B45DC mov
eax, dword ptr [ebp-24]
:00470458 25FF000000 and eax,
000000FF
:0047045D 89853CFFFFFF mov dword
ptr [ebp+FFFFFF3C], eax
:00470463 83BD3CFFFFFF0B cmp dword ptr [ebp+FFFFFF3C],
0000000B
:0047046A 730C
jnb 00470478
:0047046C C785E0FEFFFF00000000 mov dword ptr [ebp+FFFFFEE0],
00000000
:00470476 EB0C
jmp 00470484
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047046A(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:00470478 FF1500A44700 Call dword
ptr [0047A400]
:0047047E 8985E0FEFFFF mov dword
ptr [ebp+FFFFFEE0], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470476(U)
|
:00470484 8B4D9C mov
ecx, dword ptr [ebp-64]
:00470487 038D3CFFFFFF add ecx, dword
ptr [ebp+FFFFFF3C]
:0047048D 8A11
mov dl, byte ptr [ecx]
:0047048F 8855AC mov
byte ptr [ebp-54], dl
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047068B(U)
|
:00470492 C745FC20000000 mov [ebp-04], 00000020
:00470499 8B45DC mov
eax, dword ptr [ebp-24]
:0047049C 25FF000000 and eax,
000000FF
:004704A1 89853CFFFFFF mov dword
ptr [ebp+FFFFFF3C], eax
:004704A7 83BD3CFFFFFF0B cmp dword ptr [ebp+FFFFFF3C],
0000000B
:004704AE 730C
jnb 004704BC
:004704B0 C785DCFEFFFF00000000 mov dword ptr [ebp+FFFFFEDC],
00000000
:004704BA EB0C
jmp 004704C8
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004704AE(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:004704BC FF1500A44700 Call dword
ptr [0047A400]
:004704C2 8985DCFEFFFF mov dword
ptr [ebp+FFFFFEDC], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004704BA(U)
|
:004704C8 8B4DDC mov
ecx, dword ptr [ebp-24]
:004704CB 81E1FF000000 and ecx, 000000FF
:004704D1 898D38FFFFFF mov dword
ptr [ebp+FFFFFF38], ecx
:004704D7 83BD38FFFFFF0B cmp dword ptr [ebp+FFFFFF38],
0000000B
:004704DE 730C
jnb 004704EC
:004704E0 C785D8FEFFFF00000000 mov dword ptr [ebp+FFFFFED8],
00000000
:004704EA EB0C
jmp 004704F8
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004704DE(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:004704EC FF1500A44700 Call dword
ptr [0047A400]
:004704F2 8985D8FEFFFF mov dword
ptr [ebp+FFFFFED8], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004704EA(U)
|
:004704F8 8B55DC mov
edx, dword ptr [ebp-24]
:004704FB 81E2FF000000 and edx, 000000FF
:00470501 899534FFFFFF mov dword
ptr [ebp+FFFFFF34], edx
:00470507 83BD34FFFFFF0B cmp dword ptr [ebp+FFFFFF34],
0000000B
:0047050E 730C
jnb 0047051C
:00470510 C785D4FEFFFF00000000 mov dword ptr [ebp+FFFFFED4],
00000000
:0047051A EB0C
jmp 00470528
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047050E(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:0047051C FF1500A44700 Call dword
ptr [0047A400]
:00470522 8985D4FEFFFF mov dword
ptr [ebp+FFFFFED4], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047051A(U)
|
:00470528 8B45DC mov
eax, dword ptr [ebp-24]
:0047052B 25FF000000 and eax,
000000FF
:00470530 898530FFFFFF mov dword
ptr [ebp+FFFFFF30], eax
:00470536 83BD30FFFFFF0B cmp dword ptr [ebp+FFFFFF30],
0000000B
:0047053D 730C
jnb 0047054B
:0047053F C785D0FEFFFF00000000 mov dword ptr [ebp+FFFFFED0],
00000000
:00470549 EB0C
jmp 00470557
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047053D(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:0047054B FF1500A44700 Call dword
ptr [0047A400]
:00470551 8985D0FEFFFF mov dword
ptr [ebp+FFFFFED0], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470549(U)
|
:00470557 8B4D9C mov
ecx, dword ptr [ebp-64]
:0047055A 038D3CFFFFFF add ecx, dword
ptr [ebp+FFFFFF3C]
:00470560 660FB631 movzx
si, byte ptr [ecx]
:00470564 6890D44000 push
0040D490
* Reference To: MSVBVM50.rtcAnsivalueBstr, Ord:0204h
|
:00470569 FF1534A34700 Call dword
ptr [0047A334]
:0047056F 33DB
xor ebx, ebx
:00470571 663BF0 cmp
si, ax
====>和5A（即：Z）比较
:00470574 0F9FC3
setg bl
:00470577 8B559C mov
edx, dword ptr [ebp-64]
:0047057A 039538FFFFFF add edx, dword
ptr [ebp+FFFFFF38]
:00470580 660FB632 movzx
si, byte ptr [edx]
:00470584 6898D44000 push
0040D498
* Reference To: MSVBVM50.rtcAnsivalueBstr, Ord:0204h
|
:00470589 FF1534A34700 Call dword
ptr [0047A334]
:0047058F 33C9
xor ecx, ecx
:00470591 663BF0 cmp
si, ax
====>和41（即：A）比较
:00470594 0F9CC1
setl cl
:00470597 0BD9
or ebx, ecx
:00470599 F7DB
neg ebx
:0047059B 1BDB
sbb ebx, ebx
:0047059D F7DB
neg ebx
:0047059F 8B559C mov
edx, dword ptr [ebp-64]
:004705A2 039534FFFFFF add edx, dword
ptr [ebp+FFFFFF34]
:004705A8 660FB632 movzx
si, byte ptr [edx]
:004705AC 68A0D44000 push
0040D4A0
* Reference To: MSVBVM50.rtcAnsivalueBstr, Ord:0204h
|
:004705B1 FF1534A34700 Call dword
ptr [0047A334]
:004705B7 899DCCFEFFFF mov dword
ptr [ebp+FFFFFECC], ebx
:004705BD 33DB
xor ebx, ebx
:004705BF 663BF0 cmp
si, ax
====>和39（即：9）比较
:004705C2 0F9FC3
setg bl
:004705C5 8B459C mov
eax, dword ptr [ebp-64]
:004705C8 038530FFFFFF add eax, dword
ptr [ebp+FFFFFF30]
:004705CE 660FB630 movzx
si, byte ptr [eax]
:004705D2 68A8D44000 push
0040D4A8
* Reference To: MSVBVM50.rtcAnsivalueBstr, Ord:0204h
|
:004705D7 FF1534A34700 Call dword
ptr [0047A334]
:004705DD 33C9
xor ecx, ecx
:004705DF 663BF0 cmp
si, ax
====>和30（即：0）比较
:004705E2 0F9CC1
setl cl
:004705E5 0BD9
or ebx, ecx
:004705E7 F7DB
neg ebx
:004705E9 1BDB
sbb ebx, ebx
:004705EB F7DB
neg ebx
:004705ED 8B95CCFEFFFF mov edx, dword
ptr [ebp+FFFFFECC]
:004705F3 23D3
and edx, ebx
:004705F5 85D2
test edx, edx
:004705F7 0F8493000000 je 00470690
====>如果是大写字母和数字则直接跳下去。否则进行处理
:004705FD C745FC21000000
mov [ebp-04], 00000021
:00470604 8B45DC mov
eax, dword ptr [ebp-24]
:00470607 25FF000000 and eax,
000000FF
:0047060C 898538FFFFFF mov dword
ptr [ebp+FFFFFF38], eax
:00470612 83BD38FFFFFF0B cmp dword ptr [ebp+FFFFFF38],
0000000B
:00470619 730C
jnb 00470627
:0047061B C785C8FEFFFF00000000 mov dword ptr [ebp+FFFFFEC8],
00000000
:00470625 EB0C
jmp 00470633
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470619(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:00470627 FF1500A44700 Call dword
ptr [0047A400]
:0047062D 8985C8FEFFFF mov dword
ptr [ebp+FFFFFEC8], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470625(U)
|
:00470633 8B4DDC mov
ecx, dword ptr [ebp-24]
:00470636 81E1FF000000 and ecx, 000000FF
:0047063C 898D3CFFFFFF mov dword
ptr [ebp+FFFFFF3C], ecx
:00470642 83BD3CFFFFFF0B cmp dword ptr [ebp+FFFFFF3C],
0000000B
:00470649 730C
jnb 00470657
:0047064B C785C4FEFFFF00000000 mov dword ptr [ebp+FFFFFEC4],
00000000
:00470655 EB0C
jmp 00470663
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470649(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:00470657 FF1500A44700 Call dword
ptr [0047A400]
:0047065D 8985C4FEFFFF mov dword
ptr [ebp+FFFFFEC4], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470655(U)
|
:00470663 8B559C mov
edx, dword ptr [ebp-64]
:00470666 039538FFFFFF add edx, dword
ptr [ebp+FFFFFF38]
:0047066C 660FB60A movzx
cx, byte ptr [edx]
:00470670 66034DD4 add
cx, word ptr [ebp-2C]
====>如果大于5A则加FFEE，再取得数的低位
====>如果小于41则加0012
2、 ====>处理80：80+FFEE=6E+FFEE=5C+FFEE=4A
3、
====>处理D4：D4+FFEE=C2+FFEE=B0+……=68+FFEE=56
4、
====>处理08：08+0012=1A+0012=2C+0012=3E+0012=50
6、
====>处理96：96+FFEE=84+FFEE=72+FFEE=60+FFEE=4E
7、
====>处理D6：D6+FFEE=C4+FFEE=B2+……=6A+FFEE=58
8、
====>处理1D：1D+0012=2F+0012=41
10、
====>处理94：94+0012=82+0012=70+0012=5E+0012=4C
:00470674 0F80F8020000 jo 00470972
* Reference To: MSVBVM50.__vbaUI1I2, Ord:0000h
|
:0047067A FF1558A44700 Call dword
ptr [0047A458]
:00470680 8B4D9C mov
ecx, dword ptr [ebp-64]
:00470683 038D3CFFFFFF add ecx, dword
ptr [ebp+FFFFFF3C]
:00470689 8801
mov byte ptr [ecx], al
====>最后得出：4A 4A 56 50 43 4E 58
41 4B 4C
4A 4A 56 50
43 4E 58 41 4B 4C 分别所对应的字符是：JJVPCNXAKL
:0047068B E902FEFFFF jmp 00470492
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004705F7(C)
|
:00470690 C745FC23000000 mov [ebp-04], 00000023
:00470697 E96AFCFFFF jmp 00470306
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470321(C)
|
:0047069C C745FC24000000 mov [ebp-04], 00000024
:004706A3 B909000000 mov ecx,
00000009
* Reference To: MSVBVM50.__vbaUI1I2, Ord:0000h
|
:004706A8 FF1558A44700 Call dword
ptr [0047A458]
:004706AE 888510FFFFFF mov byte ptr
[ebp+FFFFFF10], al
:004706B4 C68514FFFFFF01 mov byte ptr [ebp+FFFFFF14],
01
:004706BB 33C9
xor ecx, ecx
* Reference To: MSVBVM50.__vbaUI1I2, Ord:0000h
|
:004706BD FF1558A44700 Call dword
ptr [0047A458]
:004706C3 8845DC mov
byte ptr [ebp-24], al
:004706C6 EB12
jmp 004706DA
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:0047088E(U)
|
:004706C8 8A55DC mov
dl, byte ptr [ebp-24]
:004706CB 029514FFFFFF add dl, byte
ptr [ebp+FFFFFF14]
:004706D1 0F829B020000 jb 00470972
:004706D7 8855DC mov
byte ptr [ebp-24], dl
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004706C6(U)
|
:004706DA 8A45DC mov
al, byte ptr [ebp-24]
:004706DD 3A8510FFFFFF cmp al, byte
ptr [ebp+FFFFFF10]
:004706E3 0F87AA010000 ja 00470893
:004706E9 C745FC25000000 mov [ebp-04], 00000025
:004706F0 8B4DDC mov
ecx, dword ptr [ebp-24]
:004706F3 81E1FF000000 and ecx, 000000FF
:004706F9 898D3CFFFFFF mov dword
ptr [ebp+FFFFFF3C], ecx
:004706FF 83BD3CFFFFFF0B cmp dword ptr [ebp+FFFFFF3C],
0000000B
:00470706 730C
jnb 00470714
:00470708 C785C0FEFFFF00000000 mov dword ptr [ebp+FFFFFEC0],
00000000
:00470712 EB0C
jmp 00470720
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470706(C)
|
* Reference To: MSVBVM50.__vbaGenerateBoundsError, Ord:0000h
|
:00470714 FF1500A44700 Call dword
ptr [0047A400]
:0047071A 8985C0FEFFFF mov dword
ptr [ebp+FFFFFEC0], eax
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470712(U)
|
:00470720 8B559C mov
edx, dword ptr [ebp-64]
====>EDX=JJVPCNXAKL
:00470723 03953CFFFFFF
add edx, dword ptr [ebp+FFFFFF3C]
:00470729 33C0
xor eax, eax
:0047072B 8A02
mov al, byte ptr [edx]
:0047072D 50
push eax
:0047072E 8D8D78FFFFFF lea ecx, dword
ptr [ebp+FFFFFF78]
:00470734 51
push ecx
* Reference To: MSVBVM50.rtcVarBstrFromAnsi, Ord:0260h
|
:00470735 FF158CA44700 Call dword
ptr [0047A48C]
:0047073B 8D9578FFFFFF lea edx, dword
ptr [ebp+FFFFFF78]
:00470741 52
push edx
:00470742 8D8568FFFFFF lea eax, dword
ptr [ebp+FFFFFF68]
:00470748 50
push eax
* Reference To: MSVBVM50.rtcUpperCaseVar, Ord:0210h
|
:00470749 FF15FCA34700 Call dword
ptr [0047A3FC]
:0047074F 8D8D68FFFFFF lea ecx, dword
ptr [ebp+FFFFFF68]
:00470755 51
push ecx
* Reference To: MSVBVM50.__vbaStrVarMove, Ord:0000h
|
:00470756 FF1514A34700 Call dword
ptr [0047A314]
:0047075C 50
push eax
:0047075D 8D55A8 lea
edx, dword ptr [ebp-58]
:00470760 52
push edx
:00470761 6A01
push 00000001
* Reference To: MSVBVM50.__vbaLsetFixstrFree, Ord:0000h
|
:00470763 FF15B0A44700 Call dword
ptr [0047A4B0]
:00470769 8D8568FFFFFF lea eax, dword
ptr [ebp+FFFFFF68]
:0047076F 50
push eax
:00470770 8D8D78FFFFFF lea ecx, dword
ptr [ebp+FFFFFF78]
:00470776 51
push ecx
:00470777 6A02
push 00000002
* Reference To: MSVBVM50.__vbaFreeVarList, Ord:0000h
|
:00470779 FF151CA34700 Call dword
ptr [0047A31C]
:0047077F 83C40C add
esp, 0000000C
:00470782 C745FC26000000 mov [ebp-04], 00000026
:00470789 8D55A8 lea
edx, dword ptr [ebp-58]
:0047078C 52
push edx
:0047078D 6A01
push 00000001
* Reference To: MSVBVM50.__vbaStrFixstr, Ord:0000h
|
:0047078F FF15B8A34700 Call dword
ptr [0047A3B8]
:00470795 8BD0
mov edx, eax
:00470797 8D4D88 lea
ecx, dword ptr [ebp-78]
* Reference To: MSVBVM50.__vbaStrMove, Ord:0000h
|
:0047079A FF1558A54700 Call dword
ptr [0047A558]
:004707A0 50
push eax
:004707A1 68B0D44000 push
0040D4B0
* Reference To: MSVBVM50.__vbaStrCmp, Ord:0000h
|
:004707A6 FF150CA44700 Call dword
ptr [0047A40C]
====>对上面得出的JJVPCNXAKL检测，如有O（4Fh）则替换成9
:004707AC F7D8
neg eax
:004707AE 1BC0
sbb eax, eax
:004707B0 40
inc eax
:004707B1 F7D8
neg eax
:004707B3 6689853CFFFFFF mov word ptr [ebp+FFFFFF3C],
ax
:004707BA 8D4D88 lea
ecx, dword ptr [ebp-78]
* Reference To: MSVBVM50.__vbaFreeStr, Ord:0000h
|
:004707BD FF1588A54700 Call dword
ptr [0047A588]
:004707C3 0FBF853CFFFFFF movsx eax, word
ptr [ebp+FFFFFF3C]
:004707CA 85C0
test eax, eax
:004707CC 7418
je 004707E6
====>不跳就进行替换工作。
:004707CE C745FC27000000
mov [ebp-04], 00000027
:004707D5 68A0D44000 push
0040D4A0
:004707DA 8D4DA8 lea
ecx, dword ptr [ebp-58]
:004707DD 51
push ecx
:004707DE 6A01
push 00000001
* Reference To: MSVBVM50.__vbaLsetFixstr, Ord:0000h
|
:004707E0 FF1560A34700 Call dword
ptr [0047A360]
====>这里把O替换成9
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:004707CC(C)
|
:004707E6 C745FC29000000 mov [ebp-04], 00000029
:004707ED 8D55A8 lea
edx, dword ptr [ebp-58]
:004707F0 52
push edx
:004707F1 6A01
push 00000001
* Reference To: MSVBVM50.__vbaStrFixstr, Ord:0000h
|
:004707F3 FF15B8A34700 Call dword
ptr [0047A3B8]
:004707F9 8BD0
mov edx, eax
:004707FB 8D4D88 lea
ecx, dword ptr [ebp-78]
* Reference To: MSVBVM50.__vbaStrMove, Ord:0000h
|
:004707FE FF1558A54700 Call dword
ptr [0047A558]
:00470804 50
push eax
:00470805 68A8D44000 push
0040D4A8
* Reference To: MSVBVM50.__vbaStrCmp, Ord:0000h
|
:0047080A FF150CA44700 Call dword
ptr [0047A40C]
====>对上面得出的JJVPCNXAKL检测，如有0（30h）则替换成1
:00470810 F7D8
neg eax
:00470812 1BC0
sbb eax, eax
:00470814 40
inc eax
:00470815 F7D8
neg eax
:00470817 6689853CFFFFFF mov word ptr [ebp+FFFFFF3C],
ax
:0047081E 8D4D88 lea
ecx, dword ptr [ebp-78]
* Reference To: MSVBVM50.__vbaFreeStr, Ord:0000h
|
:00470821 FF1588A54700 Call dword
ptr [0047A588]
:00470827 0FBF853CFFFFFF movsx eax, word
ptr [ebp+FFFFFF3C]
:0047082E 85C0
test eax, eax
:00470830 7418
je 0047084A
====>呵呵，我没有需要替换的，差点忽略了这2个检测。
:00470832 C745FC2A000000
mov [ebp-04], 0000002A
:00470839 68B8D44000 push
0040D4B8
:0047083E 8D4DA8 lea
ecx, dword ptr [ebp-58]
:00470841 51
push ecx
:00470842 6A01
push 00000001
* Reference To: MSVBVM50.__vbaLsetFixstr, Ord:0000h
|
:00470844 FF1560A34700 Call dword
ptr [0047A360]
====>这里把0替换成1
* Referenced by a (U)nconditional or (C)onditional Jump
at Address:
|:00470830(C)
|
:0047084A C745FC2C000000 mov [ebp-04], 0000002C
:00470851 8B558C mov
edx, dword ptr [ebp-74]
:00470854 52
push edx
:00470855 8D45A8 lea
eax, dword ptr [ebp-58]
:00470858 50
push eax
:00470859 6A01
push 00000001
* Reference To: MSVBVM50.__vbaStrFixstr, Ord:0000h
|
:0047085B FF15B8A34700 Call dword
ptr [0047A3B8]
:00470861 8BD0
mov edx, eax
:00470863 8D4D88 lea
ecx, dword ptr [ebp-78]
* Reference To: MSVBVM50.__vbaStrMove, Ord:0000h
|
:00470866 FF1558A54700 Call dword
ptr [0047A558]
:0047086C 50
push eax
* Reference To: MSVBVM50.__vbaStrCat, Ord:0000h
|
:0047086D FF1554A34700 Call dword
ptr [0047A354]
====>连接所得字符
:00470873 8BD0
mov edx, eax
:00470875 8D4D8C lea
ecx, dword ptr [ebp-74]
* Reference To: MSVBVM50.__vbaStrMove, Ord:0000h
|
:00470878 FF1558A54700 Call dword
ptr [0047A558]
:0047087E 8D4D88 lea
ecx, dword ptr [ebp-78]
* Reference To: MSVBVM50.__vbaFreeStr, Ord:0000h
|
:00470881 FF1588A54700 Call dword
ptr [0047A588]
:00470887 C745FC2D000000 mov [ebp-04], 0000002D
:0047088E E935FEFFFF jmp 004706C8
====>循环检测
—————————————————————————————————
【算 法 总 结】：
1、注册码10位。
2、取用户名字符，小写字母转成大写字母，数字的不变，中文的不清楚。
3、取用户名的字符的前10位，不足10位的重复取用户名字符直至10位。
4、依次取用户名字符的HEX值和参数0C CC 8D 4E 0F CF 90 51 12 D2 异或。
5、异或的结果对应的字符若是数字和大写字母则直接保留。
①、如果大于5A则加FFEE，再取得数的低位，循环相加直至结果对应的字符是数字或大写字母。
②、如果小于41（且不是数字）则加0012，循环相加直至结果对应的字符是数字或大写字母。
6、对上面得出的10位字符再检测：若有O（4F）则替换成9，若有0（30）则替换成1。
—————————————————————————————————
【完 美 爆 破】：
1、00470AF7 0F854B020000 jne 00470D48
改为： 909090909090 NOP掉
2、00470D0F 1BF6
sbb esi, esi
改为： 33F6
xor esi, esi
呵呵，这样就可以输入任意注册码了。^O^^O^^O^^O^
—————————————————————————————————
【KeyMake之{79th}内存注册机】：
中断地址：00470CFD
中断次数：1
第一字节：50
指令长度：1
内存方式：EAX
宽字符串
—————————————————————————————————
【注册信息保存】：
REGEDIT4
[HKEY_CURRENT_USER\Software\VB and VBA Program Settings\EBUM\SecKey]
"softkey"="JJVPCNXAKL"
"UserName"="FLY"
—————————————————————————————————
【整 理】：
用户名：fly
注册码：JJVPCNXAKL
—————————————————————————————————
, _/
/| _.-~/ \_
, 青春都一饷
( /~ /
\~-._ |\
`\\ _/
\ ~\ ) 忍把浮名
_-~~~-.) )__/;;,. \_
//'
/'_,\ --~ \ ~~~- ,;;\___( (.-~~~-.
换了破解轻狂
`~ _( ,_..--\ ( ,;'' / ~-- /._`\
/~~//' /' `~\ ) /--.._, )_ `~
" `~" " `"
/~'`\ `\\~~\
" " "~' ""
Cracked By 巢水工作坊——fly [OCN][FCG]
2003-05-04 2:35