汉语宝典 Build 2003.05.28　

标题：汉语宝典 Build 2003.05.28　　
作者：fly
时间：2003/06/01 12:15pm　
链接：http://bbs.pediy.com

简单算法——汉语宝典 Build 2003.05.28

下载页面： http://www.skycn.com/soft/11289.html
软件大小： 13179 KB
软件语言：简体中文
软件类别：国产软件 / 共享版 / 文科工具
应用平台： Win9x/NT/2000/XP
加入时间： 2003-05-29 08:16:28
下载次数： 10306
推荐等级： ***
开发商： http://www.renyuansoft.com/

【软件简介】：汉语宝典是任远工作室继考试系统后的又一力作，汉语宝典内容如下：1、全中文电脑朗读，可以朗读任意汉语文章；2、汉语拼音加注功能，儿童阅读文章更加方便；3、7000余个汉字的字义解释、拼音、笔画及繁体字；4、14000个成语、拼音、成语释义、出处及示例；5、93600余首中华诗词，包括作者、考证及出处，内容涉及各个朝代；6、11551个病例，涉及外科、内科、眼科、儿科、妇科等；2000余种中西医药物特性说明；7、10000余篇中外文摘；8、部分词汇及相应解释。9、13000个名言警句及出处。10、5200余组反义词。11、近千个文言文字词释义。12、精心收集幽默笑话，工作之余更为轻松。13、数据库自扩充功能，可以根据自己的需要，添加数据库中没有的内容，方便日常使用。系统的数据库总容量已达100M以上，你可以以各种方式快速检索出你所需要的内容。汉语宝典是一个真正的文科、医科工具。

【软件限制】：NAG

【作者声明】：初学Crack，只是感兴趣，没有其它目的。失误之处敬请诸位大侠赐教！

【破解工具】：TRW2000娃娃修改版、Ollydbg1.09、PEiD、CasprGui、W32Dasm 9.0白金版

—————————————————————————————————
【过程】：

程序用了不少的“冗余代码”，有点花眼，算法却是简单的。本来不想公布这个笔记，但是看到作者在代码里用了某些让人难受的词语，所以贴了出来。其实何必如此？不如提高软件的水平和增强加密。

chinesedic.exe 是ASProtect 1.2壳，用CasprGui脱之。770K->2.04M。 Delphi 编写。

机器码：555490825
试炼码：13572468
—————————————————————————————————
:00508C82 E821040000 call 005090A8
====>取C盘的硬盘序列号并转换成10进制值

:00508C87 FF75F8 push [ebp-08]
====>[ebp-08]=555490825 这就是机器码

* Possible StringData Ref from Data Obj ->"〗和E-Mail"
|
:00508C8A 68FC8F5000 push 00508FFC
:00508C8F 8D45FC lea eax, dword ptr [ebp-04]
:00508C92 BA03000000 mov edx, 00000003
:00508C97 E834B4EFFF call 004040D0
:00508C9C 8B45FC mov eax, dword ptr [ebp-04]
:00508C9F 50 push eax
:00508CA0 8B83E8020000 mov eax, dword ptr [ebx+000002E8]
:00508CA6 8B404C mov eax, dword ptr [eax+4C]
:00508CA9 33D2 xor edx, edx
:00508CAB E844D4FAFF call 004B60F4
:00508CB0 5A pop edx
:00508CB1 E8C2CFFAFF call 004B5C78
:00508CB6 8D45F4 lea eax, dword ptr [ebp-0C]
:00508CB9 50 push eax

* Possible StringData Ref from Data Obj ->"NoSET"
|
:00508CBA B910905000 mov ecx, 00509010

* Possible StringData Ref from Data Obj ->"LocalM"
|
:00508CBF BA20905000 mov edx, 00509020
:00508CC4 8B83E0020000 mov eax, dword ptr [ebx+000002E0]
:00508CCA E8E19BFAFF call 004B28B0
:00508CCF 8B45F4 mov eax, dword ptr [ebp-0C]

* Possible StringData Ref from Data Obj ->"NoSET"
|
:00508CD2 BA10905000 mov edx, 00509010
:00508CD7 E844B4EFFF call 00404120
:00508CDC 7537 jne 00508D15
:00508CDE 8D55F0 lea edx, dword ptr [ebp-10]
:00508CE1 8BC3 mov eax, ebx
:00508CE3 E8C0030000 call 005090A8
:00508CE8 8B4DF0 mov ecx, dword ptr [ebp-10]

* Possible StringData Ref from Data Obj ->"LocalM"
|
:00508CEB BA20905000 mov edx, 00509020
:00508CF0 8B83E0020000 mov eax, dword ptr [ebx+000002E0]
:00508CF6 E8BD9FFAFF call 004B2CB8

* Possible StringData Ref from Data Obj ->"05328499517"
|
:00508CFB B930905000 mov ecx, 00509030

* Possible StringData Ref from Data Obj ->"LocalID"
|
:00508D00 BA44905000 mov edx, 00509044
:00508D05 8B83E0020000 mov eax, dword ptr [ebx+000002E0]
:00508D0B E8A89FFAFF call 004B2CB8
:00508D10 E923020000 jmp 00508F38

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00508CDC(C)
|
:00508D15 8D45EC lea eax, dword ptr [ebp-14]
:00508D18 50 push eax

* Possible StringData Ref from Data Obj ->"370285"
|
:00508D19 B954905000 mov ecx, 00509054

* Possible StringData Ref from Data Obj ->"LocalM"
|
:00508D1E BA20905000 mov edx, 00509020
:00508D23 8B83E0020000 mov eax, dword ptr [ebx+000002E0]
:00508D29 E8629DFAFF call 004B2A90
:00508D2E 8B55EC mov edx, dword ptr [ebp-14]
====>EDX=555490825

:00508D31 B86CF05000 mov eax, 0050F06C
:00508D36 E8A9B0EFFF call 00403DE4
:00508D3B 8D45E8 lea eax, dword ptr [ebp-18]
:00508D3E 50 push eax

* Possible StringData Ref from Data Obj ->"8499517"
|
:00508D3F B964905000 mov ecx, 00509064

* Possible StringData Ref from Data Obj ->"LocalID"
|
:00508D44 BA44905000 mov edx, 00509044
:00508D49 8B83E0020000 mov eax, dword ptr [ebx+000002E0]
:00508D4F E83C9DFAFF call 004B2A90
:00508D54 8B55E8 mov edx, dword ptr [ebp-18]
:00508D57 B870F05000 mov eax, 0050F070
:00508D5C E883B0EFFF call 00403DE4
:00508D61 8D45E4 lea eax, dword ptr [ebp-1C]

* Possible StringData Ref from Data Obj ->"8499517"
|
:00508D64 B964905000 mov ecx, 00509064
:00508D69 8B1550CB5000 mov edx, dword ptr [0050CB50]
:00508D6F E8E8B2EFFF call 0040405C
:00508D74 8B45E4 mov eax, dword ptr [ebp-1C]
:00508D77 50 push eax
:00508D78 8D4DE0 lea ecx, dword ptr [ebp-20]
:00508D7B BA54CB5000 mov edx, 0050CB54
:00508D80 8BC3 mov eax, ebx
:00508D82 E88D030000 call 00509114
:00508D87 8D45E0 lea eax, dword ptr [ebp-20]

* Possible StringData Ref from Data Obj ->"8499517"
|
:00508D8A BA64905000 mov edx, 00509064
:00508D8F E884B2EFFF call 00404018
:00508D94 8B55E0 mov edx, dword ptr [ebp-20]
:00508D97 58 pop eax
:00508D98 E883B3EFFF call 00404120
:00508D9D 0F8572010000 jne 00508F15
:00508DA3 8D4DD8 lea ecx, dword ptr [ebp-28]
:00508DA6 BA54CB5000 mov edx, 0050CB54
:00508DAB 8BC3 mov eax, ebx
:00508DAD E862030000 call 00509114
:00508DB2 8B4DD8 mov ecx, dword ptr [ebp-28]
:00508DB5 8D45DC lea eax, dword ptr [ebp-24]

* Possible StringData Ref from Data Obj ->"TNND"
|
:00508DB8 BA74905000 mov edx, 00509074
:00508DBD E89AB2EFFF call 0040405C
:00508DC2 8B45DC mov eax, dword ptr [ebp-24]
:00508DC5 50 push eax
:00508DC6 8D45D4 lea eax, dword ptr [ebp-2C]
:00508DC9 8B0D50CB5000 mov ecx, dword ptr [0050CB50]

* Possible StringData Ref from Data Obj ->"TNND"
|
:00508DCF BA74905000 mov edx, 00509074
:00508DD4 E883B2EFFF call 0040405C
:00508DD9 8B55D4 mov edx, dword ptr [ebp-2C]
:00508DDC 58 pop eax
:00508DDD E83EB3EFFF call 00404120
:00508DE2 0F852D010000 jne 00508F15
:00508DE8 8D45D0 lea eax, dword ptr [ebp-30]

* Possible StringData Ref from Data Obj ->"Fuck"
|
:00508DEB B984905000 mov ecx, 00509084
:00508DF0 8B1550CB5000 mov edx, dword ptr [0050CB50]
:00508DF6 E861B2EFFF call 0040405C
:00508DFB 8B45D0 mov eax, dword ptr [ebp-30]
:00508DFE 50 push eax
:00508DFF 8D4DCC lea ecx, dword ptr [ebp-34]
:00508E02 BA54CB5000 mov edx, 0050CB54
:00508E07 8BC3 mov eax, ebx
:00508E09 E806030000 call 00509114
:00508E0E 8D45CC lea eax, dword ptr [ebp-34]

* Possible StringData Ref from Data Obj ->"Fuck"
|
:00508E11 BA84905000 mov edx, 00509084
:00508E16 E8FDB1EFFF call 00404018
:00508E1B 8B55CC mov edx, dword ptr [ebp-34]
:00508E1E 58 pop eax
:00508E1F E8FCB2EFFF call 00404120
:00508E24 0F85EB000000 jne 00508F15
:00508E2A 8D4DC8 lea ecx, dword ptr [ebp-38]
:00508E2D BA6CF05000 mov edx, 0050F06C
:00508E32 8BC3 mov eax, ebx
:00508E34 E8DB020000 call 00509114
====>关键CALL！进入！

:00508E39 8B55C8 mov edx, dword ptr [ebp-38]
====>EDX=388411845

:00508E3C A170F05000 mov eax, dword ptr [0050F070]
====>爆破点！

:00508E41 E8DAB2EFFF call 00404120
====>比较一次

:00508E46 0F84C2000000 je 00508F0E
====>是否已经注册？

:00508E4C A170F05000 mov eax, dword ptr [0050F070]

* Possible StringData Ref from Data Obj ->"37028513518625167"
|
:00508E51 BA94905000 mov edx, 00509094
:00508E56 E8C5B2EFFF call 00404120
:00508E5B 0F84AD000000 je 00508F0E
:00508E61 C60574F0500000 mov byte ptr [0050F074], 00
:00508E68 8D4DC4 lea ecx, dword ptr [ebp-3C]
:00508E6B 33D2 xor edx, edx
:00508E6D 8B83E8020000 mov eax, dword ptr [ebx+000002E8]
:00508E73 E808D3FAFF call 004B6180
====>弹出注册窗口

:00508E78 8B55C4 mov edx, dword ptr [ebp-3C]
====>EDX=13572468 试炼码

:00508E7B B878F05000 mov eax, 0050F078
:00508E80 E85FAFEFFF call 00403DE4
:00508E85 8B0D78F05000 mov ecx, dword ptr [0050F078]

* Possible StringData Ref from Data Obj ->"LocalID"
|
:00508E8B BA44905000 mov edx, 00509044
:00508E90 8B83E0020000 mov eax, dword ptr [ebx+000002E0]
:00508E96 E81D9EFAFF call 004B2CB8
:00508E9B 8D45C0 lea eax, dword ptr [ebp-40]
:00508E9E 50 push eax

* Possible StringData Ref from Data Obj ->"370285"
|
:00508E9F B954905000 mov ecx, 00509054

* Possible StringData Ref from Data Obj ->"LocalM"
|
:00508EA4 BA20905000 mov edx, 00509020
:00508EA9 8B83E0020000 mov eax, dword ptr [ebx+000002E0]
:00508EAF E8DC9BFAFF call 004B2A90
:00508EB4 8B55C0 mov edx, dword ptr [ebp-40]
:00508EB7 B86CF05000 mov eax, 0050F06C
:00508EBC E823AFEFFF call 00403DE4
:00508EC1 8D45BC lea eax, dword ptr [ebp-44]
:00508EC4 50 push eax

* Possible StringData Ref from Data Obj ->"8499517"
|
:00508EC5 B964905000 mov ecx, 00509064

* Possible StringData Ref from Data Obj ->"LocalID"
|
:00508ECA BA44905000 mov edx, 00509044
:00508ECF 8B83E0020000 mov eax, dword ptr [ebx+000002E0]
:00508ED5 E8B69BFAFF call 004B2A90
:00508EDA 8B55BC mov edx, dword ptr [ebp-44]
:00508EDD B870F05000 mov eax, 0050F070
:00508EE2 E8FDAEEFFF call 00403DE4
:00508EE7 8D4DB8 lea ecx, dword ptr [ebp-48]
:00508EEA BA6CF05000 mov edx, 0050F06C
:00508EEF 8BC3 mov eax, ebx
:00508EF1 E81E020000 call 00509114
:00508EF6 8B55B8 mov edx, dword ptr [ebp-48]
====>EDX=388411845 注册码

:00508EF9 A170F05000 mov eax, dword ptr [0050F070]
====>EAX=13572468 试炼码

:00508EFE E81DB2EFFF call 00404120
====>比较CALL！

:00508F03 7510 jne 00508F15
:00508F05 8BC3 mov eax, ebx
:00508F07 E8F867F4FF call 0044F704
:00508F0C EB07 jmp 00508F15

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00508E46(C), :00508E5B(C)
|
:00508F0E C60574F0500001 mov byte ptr [0050F074], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00508D9D(C), :00508DE2(C), :00508E24(C), :00508F03(C), :00508F0C(U)
|
:00508F15 B201 mov dl, 01
:00508F17 8B8324030000 mov eax, dword ptr [ebx+00000324]
:00508F1D E872D3F4FF call 00456294
:00508F22 803D74F0500000 cmp byte ptr [0050F074], 00
:00508F29 740D je 00508F38
:00508F2B 33D2 xor edx, edx
:00508F2D 8B8324030000 mov eax, dword ptr [ebx+00000324]
:00508F33 E85CD3F4FF call 00456294

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00508D10(U), :00508F29(C)
|
:00508F38 33C0 xor eax, eax
:00508F3A 5A pop edx
:00508F3B 59 pop ecx
:00508F3C 59 pop ecx
:00508F3D 648910 mov dword ptr fs:[eax], edx
:00508F40 685A8F5000 push 00508F5A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00508F58(U)
|
:00508F45 8D45B8 lea eax, dword ptr [ebp-48]
:00508F48 BA12000000 mov edx, 00000012
:00508F4D E862AEEFFF call 00403DB4
:00508F52 C3 ret

—————————————————————————————————
进入关键CALL：00508E34 call 00509114

* Referenced by a CALL at Addresses:
|:00508D82 , :00508DAD , :00508E09 , :00508E34 , :00508EF1
|:005092E4
|
:00509114 55 push ebp
:00509115 8BEC mov ebp, esp
:00509117 6A00 push 00000000
:00509119 6A00 push 00000000
:0050911B 6A00 push 00000000
:0050911D 6A00 push 00000000
:0050911F 6A00 push 00000000
:00509121 6A00 push 00000000
:00509123 53 push ebx
:00509124 56 push esi
:00509125 57 push edi
:00509126 894DFC mov dword ptr [ebp-04], ecx
:00509129 8BF2 mov esi, edx
:0050912B 8BF8 mov edi, eax
:0050912D 33C0 xor eax, eax
:0050912F 55 push ebp
:00509130 68EB915000 push 005091EB
:00509135 64FF30 push dword ptr fs:[eax]
:00509138 648920 mov dword ptr fs:[eax], esp
:0050913B 8D45F8 lea eax, dword ptr [ebp-08]
:0050913E E84DACEFFF call 00403D90
:00509143 8B06 mov eax, dword ptr [esi]
:00509145 E8C6AEEFFF call 00404010
:0050914A 8BD8 mov ebx, eax
:0050914C 83FB01 cmp ebx, 00000001
:0050914F 7C22 jl 00509173

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00509171(C)
|
:00509151 8D45F0 lea eax, dword ptr [ebp-10]
:00509154 50 push eax
:00509155 8B06 mov eax, dword ptr [esi]
====>EAX=555490825

:00509157 B901000000 mov ecx, 00000001
:0050915C 8BD3 mov edx, ebx
:0050915E E8B5B0EFFF call 00404218
:00509163 8B55F0 mov edx, dword ptr [ebp-10]
:00509166 8D45F8 lea eax, dword ptr [ebp-08]
:00509169 E8AAAEEFFF call 00404018
:0050916E 4B dec ebx
:0050916F 85DB test ebx, ebx
:00509171 75DE jne 00509151
====>循环将555490825倒序排列

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0050914F(C)
|
:00509173 8D4DEC lea ecx, dword ptr [ebp-14]
:00509176 8D55F8 lea edx, dword ptr [ebp-08]
====>EDX=528094555 倒序的结果

:00509179 8BC7 mov eax, edi
:0050917B E87C000000 call 005091FC
====>加法CALL！进入！

:00509180 8B55EC mov edx, dword ptr [ebp-14]
====>EDX=548114883

:00509183 8D45F8 lea eax, dword ptr [ebp-08]
:00509186 E89DACEFFF call 00403E28
:0050918B 8D45F4 lea eax, dword ptr [ebp-0C]
:0050918E E8FDABEFFF call 00403D90
:00509193 8B45F8 mov eax, dword ptr [ebp-08]
:00509196 E875AEEFFF call 00404010
:0050919B 8BD8 mov ebx, eax
:0050919D 83FB01 cmp ebx, 00000001
:005091A0 7C23 jl 005091C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005091C3(C)
|
:005091A2 8D45E8 lea eax, dword ptr [ebp-18]
:005091A5 50 push eax
:005091A6 B901000000 mov ecx, 00000001
:005091AB 8BD3 mov edx, ebx
:005091AD 8B45F8 mov eax, dword ptr [ebp-08]
:005091B0 E863B0EFFF call 00404218
:005091B5 8B55E8 mov edx, dword ptr [ebp-18]
:005091B8 8D45F4 lea eax, dword ptr [ebp-0C]
:005091BB E858AEEFFF call 00404018
:005091C0 4B dec ebx
:005091C1 85DB test ebx, ebx
:005091C3 75DD jne 005091A2
====>这个循环将548114883倒序排列388411845

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005091A0(C)
|
:005091C5 8B45FC mov eax, dword ptr [ebp-04]
:005091C8 8B55F4 mov edx, dword ptr [ebp-0C]
====>EDX=388411845 这就是注册码！

:005091CB E814ACEFFF call 00403DE4
:005091D0 33C0 xor eax, eax
:005091D2 5A pop edx
:005091D3 59 pop ecx
:005091D4 59 pop ecx
:005091D5 648910 mov dword ptr fs:[eax], edx
:005091D8 68F2915000 push 005091F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005091F0(U)
|
:005091DD 8D45E8 lea eax, dword ptr [ebp-18]
:005091E0 BA05000000 mov edx, 00000005
:005091E5 E8CAABEFFF call 00403DB4
:005091EA C3 ret

—————————————————————————————————
进入加法CALL：0050917B call 005091FC

* Referenced by a CALL at Address:
|:0050917B
|
:005091FC 53 push ebx
:005091FD 56 push esi
:005091FE 8BF1 mov esi, ecx
:00509200 8BDA mov ebx, edx
:00509202 8B03 mov eax, dword ptr [ebx]
====>EAX=528094555

:00509204 E8BB1AF0FF call 0040ACC4
====>转换成浮点数

:00509209 D80520925000 fadd dword ptr [00509220]
====>ST=528094555.00000000000 + 20020328=548114883.00000000000

:0050920F 83C4F4 add esp, FFFFFFF4
:00509212 DB3C24 fstp tbyte ptr [esp]
:00509215 9B wait
:00509216 8BC6 mov eax, esi
:00509218 E89718F0FF call 0040AAB4
:0050921D 5E pop esi
:0050921E 5B pop ebx
:0050921F C3 ret

—————————————————————————————————
【算法总结】：

1、取硬盘序列号的10进制值555490825作为机器码

2、倒序排列机器码：528094555

3、528094555.00000000000 + 20020328=548114883.00000000000

4、倒序排列548114883，得出388411845 就是注册码 ^O^ ^O^

—————————————————————————————————
【完美爆破】：

00508E3C A170F05000 mov eax, dword ptr [0050F070]
改为： 8B45C89090 mov eax, dword ptr [ebp-38] 补2个NOP
与00508E39处相映成趣。

—————————————————————————————————
【KeyMake之{89th}内存注册机】：

中断地址：00508EFE
中断次数：1
第一字节：E8
指令长度：5

内存方式：EDX

—————————————————————————————————
【注册信息保存】：

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\RenYuanSoft\HYDIC]
"LocalM"="|||{€wy|棬汉径公"
"LocalID"="z{xx{|棬汉径公"

—————————————————————————————————
【整理】：

机器码：555490825
注册码：388411845

—————————————————————————————————

, _/
/| _.-~/ \_ , 青春都一饷
( /~ / \~-._ |\
`\\ _/ \ ~\ ) 忍把浮名
_-~~~-.) )__/;;,. \_ //'
/'_,\ --~ \ ~~~- ,;;\___( (.-~~~-. 换了破解轻狂
`~ _( ,_..--\ ( ,;'' / ~-- /._`\
/~~//' /' `~\ ) /--.._, )_ `~
" `~" " `" /~'`\ `\\~~\
" " "~' ""

Cracked By 巢水工作坊——fly [OCN][FCG]

2003-05-31 23:00