专业扫雷v1.2

标题：专业扫雷v1.2版破解分析　
作者：billwfm
时间：2003/05/12 08:28am　
链接：http://bbs.pediy.com

//
// tHinkIng_v1.0
// 19:13 2003-5-9
//

说明：输入注册名：tHinkIng
注册码：14259775
使用TRW2000下断点bpx hmemcpy可跟踪到此

* Reference To: USER32.GetDlgItemTextA, Ord:0000h
|
:00404FEB E807600100 Call 0041AFF7

* Possible Ref to Menu: PROFMINEMENU1, Item: "-嘯E]"
|
:00404FF0 6A0A push 0000000A
:00404FF2 6818EE4100 push 0041EE18

* Possible Reference to Dialog: DIALOG_ABOUT1, CONTROL_ID:0066, "Bojan Urosevic"
|

* Possible Reference to String Resource ID=00102: "m筨"
|
:00404FF7 6A66 push 00000066
:00404FF9 53 push ebx

* Reference To: USER32.GetDlgItemTextA, Ord:0000h
|
:00404FFA E8F85F0100 Call 0041AFF7
:00404FFF 6818EE4100 push 0041EE18;[0041EE18] = 14259775
:00405004 68C8ED4100 push 0041EDC8;[0041EDC8] = tHinkIng
:00405009 E849060000 call 00405657;注册码验证模块，跟入！
:0040500E 83C408 add esp, 00000008
:00405011 A222EE4100 mov byte ptr [0041EE22], al
:00405016 84C0 test al, al
:00405018 7411 je 0040502B
:0040501A C60574C0410000 mov byte ptr [0041C074], 00
:00405021 6A00 push 00000000
:00405023 53 push ebx

* Reference To: USER32.EndDialog, Ord:0000h
|
:00405024 E8EC5F0100 Call 0041B015
:00405029 EB13 jmp 0040503E

说明：进入注册验证模块

* Referenced by a CALL at Addresses:
|:00401821 , :00405009
|
:00405657 55 push ebp
:00405658 8BEC mov ebp, esp
:0040565A 83C4E4 add esp, FFFFFFE4
:0040565D 53 push ebx
:0040565E 56 push esi
:0040565F 57 push edi
:00405660 8B5D0C mov ebx, dword ptr [ebp+0C];ebx = 14259775
:00405663 8B4D08 mov ecx, dword ptr [ebp+08];ecx = tHinkIng
:00405666 33C0 xor eax, eax;eax = 0

说明：
序号：1 2 3 4 5 6 7
数字：1 4 2 5 9 7 7
位置：ebp-1C ebp-18 ebp-14 ebp-10 ebp-C ebp-8 ebp-4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004056A8(C)
|
:00405668 0FBE1403 movsx edx, byte ptr [ebx+eax];edx = '1' = 31
:0040566C 83C2D0 add edx, FFFFFFD0;将对应的字符数字转换为数字
:0040566F 895485E4 mov dword ptr [ebp+4*eax-1C], edx;edx = 1
:00405673 837C85E400 cmp dword ptr [ebp+4*eax-1C], 00000000;判断edx是否小于0
:00405678 7C07 jl 00405681
:0040567A 837C85E409 cmp dword ptr [ebp+4*eax-1C], 00000009;判断edx是否小于等于9
:0040567F 7E23 jle 004056A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405678(C)
|

* Possible StringData Ref from Data Obj ->"-------"
|
:00405681 682DC44100 push 0041C42D
:00405686 51 push ecx
:00405687 E8F4F00000 call 00414780
:0040568C 83C408 add esp, 00000008

* Possible StringData Ref from Data Obj ->"-------"
|
:0040568F 6835C44100 push 0041C435
:00405694 53 push ebx
:00405695 E8E6F00000 call 00414780
:0040569A 83C408 add esp, 00000008
:0040569D 33C0 xor eax, eax
:0040569F E9A5000000 jmp 00405749

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040567F(C)
|
:004056A4 40 inc eax;eax++
:004056A5 83F807 cmp eax, 00000007;判断eax是否小于7
:004056A8 7CBE jl 00405668;仅仅取注册码的前7位
:004056AA 6945F4E8030000 imul eax, dword ptr [ebp-0C], 000003E8;eax = 9 * 3E8 = 2328
:004056B1 6B55EC64 imul edx, dword ptr [ebp-14], 00000064;edx = 2 * 64 = C8
:004056B5 03C2 add eax, edx;eax = eax + edx = 2328 + C8 = 23F0
:004056B7 8B55FC mov edx, dword ptr [ebp-04];edx = 7
:004056BA 03D2 add edx, edx;edx = edx + edx = E
:004056BC 8D1492 lea edx, dword ptr [edx+4*edx];edx = 5*edx = 46
:004056BF 03C2 add eax, edx;eax = eax + edx = 23F0 + 46 = 2436
:004056C1 0345E4 add eax, dword ptr [ebp-1C];eax = eax + 1 = 2437
:004056C4 6BF00D imul esi, eax, 0000000D;esi = eax * D = 2437 * D = 1D6CB
:004056C7 8BC6 mov eax, esi;eax = esi = 1D6CB
:004056C9 BEC5000000 mov esi, 000000C5;esi = C5
:004056CE 99 cdq;edx = 0
:004056CF F7FE idiv esi;eax = eax/esi = 1D6CB/C5 = 263 edx = 9C
:004056D1 8BF2 mov esi, edx;esi = edx = 9C
:004056D3 33FF xor edi, edi;edi = 0
:004056D5 33C0 xor eax, eax;eax = 0

说明：esi = ([1]+[3]*64+[5]*3E8+[7]*A)*D/C5的余数 = 9C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004056E7(C)
|
:004056D7 803C0100 cmp byte ptr [ecx+eax], 00
:004056DB 740C je 004056E9
:004056DD 0FBE1401 movsx edx, byte ptr [ecx+eax];edx = 74
:004056E1 03FA add edi, edx;edi = edi + edx = 74
:004056E3 40 inc eax
:004056E4 83F850 cmp eax, 00000050;取注册名前50个
:004056E7 7CEE jl 004056D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004056DB(C)
|
:004056E9 8BC6 mov eax, esi;eax = esi = 9C edi = 31C
:004056EB 51 push ecx;ecx为注册名位置，入栈

说明：edi = 注册名所有ASCII码的和 = 31C

* Possible Ref to Menu: PROFMINEMENU1, Item: "-嘯E]"
|
:004056EC B90A000000 mov ecx, 0000000A;ecx = A
:004056F1 99 cdq;edx = 0
:004056F2 F7F9 idiv ecx;eax = eax/ecx = 9C/A = F edx = 6
:004056F4 59 pop ecx;ecx为注册名位置，出栈
:004056F5 03C7 add eax, edi;eax = eax + edi = F + 31C = 32B
:004056F7 BF64000000 mov edi, 00000064;edi = 64
:004056FC 99 cdq;edx = 0
:004056FD F7FF idiv edi;eax = eax/edi = 32B/64 = 8 edx = B
:004056FF 8BFA mov edi, edx;edi = edx = B
:00405701 8BC6 mov eax, esi;eax = esi = 9C

说明：edi = (31C(edi) + 9C(esi)/A)/64的余数 = B

* Possible Ref to Menu: PROFMINEMENU1, Item: "-嘯E]"
|
:00405703 BE0A000000 mov esi, 0000000A;esi = A
:00405708 99 cdq;edx = 0
:00405709 F7FE idiv esi;eax = eax/esi = 9C/A = F edx = 6
:0040570B 8BC7 mov eax, edi;eax = edi = B
:0040570D 03C0 add eax, eax;eax = eax + eax = 16
:0040570F 8D0480 lea eax, dword ptr [eax+4*eax];eax = 5*eax = 6E
:00405712 03D0 add edx, eax;edx = edx + eax = 6 + 6E = 74
:00405714 8BF2 mov esi, edx;esi = edx = 74
:00405716 6B45F064 imul eax, dword ptr [ebp-10], 00000064;eax = 5*64 = 1F4
:0040571A 8B55E8 mov edx, dword ptr [ebp-18];edx = 4
:0040571D 03D2 add edx, edx;edx = edx + edx = 8
:0040571F 8D1492 lea edx, dword ptr [edx+4*edx];edx = 5*edx = 28
:00405722 03C2 add eax, edx;eax = eax + edx = 1F4 + 28 = 21C
:00405724 0345F8 add eax, dword ptr [ebp-08];eax = eax + 7 = 223
:00405727 3BC6 cmp eax, esi
:00405729 741E je 00405749

说明：esi = B(edi)*A+9C(esi)/A的余数 = 74
eax = [2]*A+[4]*64+[6] = 223
注册成功就是需要让esi和eax相等，很明显修改esi比较麻烦，修改eax最为方便。
经过调整得到：注册名：tHinkIng
注册码：1121967

* Possible StringData Ref from Data Obj ->"-------"
|
:0040572B 683DC44100 push 0041C43D
:00405730 51 push ecx
:00405731 E84AF00000 call 00414780
:00405736 83C408 add esp, 00000008

* Possible StringData Ref from Data Obj ->"-------"
|
:00405739 6845C44100 push 0041C445
:0040573E 53 push ebx
:0040573F E83CF00000 call 00414780
:00405744 83C408 add esp, 00000008
:00405747 33C0 xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040569F(U), :00405729(C)
|
:00405749 5F pop edi
:0040574A 5E pop esi
:0040574B 5B pop ebx
:0040574C 8BE5 mov esp, ebp
:0040574E 5D pop ebp
:0040574F C3 ret