<<Anti-Hack>> 2.0注册算法分析
作者:lordor[BCG]
Mail:lordor@sina.com
目的:属技术交流,无其它目的,请不要任意散布或用用商业用途。初学破解,如有不对的地方欢迎批评指出。
工具:softice,w32Dasm,ollydbg
试炼码:
用户名:lordor[BCG]
注册码:9876543210
查找出错信息。
* Reference To: MSVBVM60.__vbaVarTstEq,
Ord:0000h
|
:0042B243 FF15D0104000 Call dword
ptr [004010D0]
:0042B249 6685C0 test
ax, ax
:0042B24C 0F848D000000 je 0042B2DF
:0042B252 EB06
jmp 0042B25A ====>
* Referenced by a (U)nconditional or
(C)onditional Jump at Address:
|:0042B17D(C)
|
* Reference To: MSVBVM60.__vbaFreeVarList,
Ord:0000h
|
:0042B254 8B3D30104000 mov edi, dword
ptr [00401030]
* Referenced by a (U)nconditional or
(C)onditional Jump at Address:
|:0042B252(U)
|
:0042B25A B904000280 mov ecx,
80020004
:0042B25F B80A000000 mov eax,
0000000A
:0042B264 894D88 mov
dword ptr [ebp-78], ecx
:0042B267 894D98 mov
dword ptr [ebp-68], ecx
:0042B26A BE08000000 mov esi,
00000008
:0042B26F 8D9560FFFFFF lea edx, dword
ptr [ebp+FFFFFF60]
:0042B275 8D4DA0 lea
ecx, dword ptr [ebp-60]
:0042B278 894580 mov
dword ptr [ebp-80], eax
:0042B27B 894590 mov
dword ptr [ebp-70], eax
* Possible StringData Ref from Code Obj
->"error"
|
:0042B27E C78568FFFFFF48CE4000 mov dword ptr [ebp+FFFFFF68],
0040CE48
:0042B288 89B560FFFFFF mov dword
ptr [ebp+FFFFFF60], esi
:0042B28E FFD3
call ebx
:0042B290 8D9570FFFFFF lea edx, dword
ptr [ebp+FFFFFF70]
:0042B296 8D4DB0 lea
ecx, dword ptr [ebp-50]
* Possible StringData Ref from Code Obj
->"Invalid serial number. Try Again"
|
在od中查找出错信息
0042AE09 . 50 PUSH EAX
0042AE0A . FF15 90104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;
MSVBVM60.__vbaObjSet
0042AE10 . 8BF8 MOV EDI,EAX
0042AE12 . 8D55 C4 LEA EDX,DWORD PTR SS:[EBP-3C]
0042AE15 . 52 PUSH EDX
0042AE16 . 57 PUSH EDI
0042AE17 . 8B0F MOV ECX,DWORD
PTR DS:[EDI]
0042AE19 . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
; 取用户名
0042AE1F . 3BC3 CMP EAX,EBX
0042AE21 . DBE2 FCLEX
0042AE23 . 7D 12 JGE SHORT Anti-Hac.0042AE37
0042AE25 . 68 A0000000 PUSH 0A0
0042AE2A . 68 38CF4000 PUSH Anti-Hac.0040CF38
0042AE2F . 57 PUSH EDI
0042AE30 . 50 PUSH EAX
0042AE31 . FF15 68104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;
MSVBVM60.__vbaHresultCheckObj
0042AE37 > 8B45 C4 MOV EAX,DWORD PTR
SS:[EBP-3C] ; 用户名入eax
0042AE3A . 50 PUSH EAX
0042AE3B . 68 E0CD4000 PUSH Anti-Hac.0040CDE0
0042AE40 . FF15 CC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCm>;
MSVBVM60.__vbaStrCmp
0042AE46 . 8BF8 MOV EDI,EAX
0042AE48 . 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]
0042AE4B . F7DF NEG EDI
0042AE4D . 1BFF SBB EDI,EDI
0042AE4F . 47 INC EDI
0042AE50 . F7DF NEG EDI
0042AE52 . FF15 E4114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;
MSVBVM60.__vbaFreeStr
0042AE58 . 8D4D C0 LEA ECX,DWORD PTR SS:[EBP-40]
0042AE5B . FF15 E0114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;
MSVBVM60.__vbaFreeObj
0042AE61 . 66:3BFB CMP DI,BX
0042AE64 . 0F84 8C000000 JE Anti-Hac.0042AEF6
; 此为判断用户名是否为空
0042AE6A . 8B1D 9C114000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaVa>;
MSVBVM60.__vbaVarDup
0042AE70 . B9 04000280 MOV ECX,80020004
0042AE75 . 894D 88 MOV DWORD PTR SS:[EBP-78],ECX
0042AE78 . B8 0A000000 MOV EAX,0A
0042AE7D . 894D 98 MOV DWORD PTR SS:[EBP-68],ECX
0042AE80 . BF 08000000 MOV EDI,8
0042AE85 . 8D95 60FFFFFF LEA EDX,DWORD PTR SS:[EBP-A0]
0042AE8B . 8D4D A0 LEA ECX,DWORD PTR SS:[EBP-60]
0042AE8E . 8945 80 MOV DWORD PTR SS:[EBP-80],EAX
0042AE91 . 8945 90 MOV DWORD PTR SS:[EBP-70],EAX
0042AE94 . C785 68FFFFFF>MOV DWORD PTR SS:[EBP-98],Anti-Hac.0040D>;
UNICODE "Error"
0042AE9E . 89BD 60FFFFFF MOV DWORD PTR SS:[EBP-A0],EDI
0042AEA4 . FFD3 CALL EBX
; <&MSVBVM60.__vbaVarDup>
0042AEA6 . 8D95 70FFFFFF LEA EDX,DWORD PTR SS:[EBP-90]
0042AEAC . 8D4D B0 LEA ECX,DWORD PTR SS:[EBP-50]
0042AEAF . C785 78FFFFFF>MOV DWORD PTR SS:[EBP-88],Anti-Hac.0040F>;
UNICODE "Please enter your name"
0042AEB9 . 89BD 70FFFFFF MOV DWORD PTR SS:[EBP-90],EDI
0042AEBF . FFD3 CALL EBX
0042AEC1 . 8D4D 80 LEA ECX,DWORD PTR SS:[EBP-80]
0042AEC4 . 8D55 90 LEA EDX,DWORD PTR SS:[EBP-70]
0042AEC7 . 51 PUSH ECX
0042AEC8 . 8D45 A0 LEA EAX,DWORD PTR SS:[EBP-60]
0042AECB . 52 PUSH EDX
0042AECC . 50 PUSH EAX
0042AECD . 8D4D B0 LEA ECX,DWORD PTR SS:[EBP-50]
0042AED0 . 6A 10 PUSH 10
0042AED2 . 51 PUSH ECX
0042AED3 . FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>]
; MSVBVM60.rtcMsgBox
0042AED9 . 8D55 80 LEA EDX,DWORD PTR SS:[EBP-80]
0042AEDC . 8D45 90 LEA EAX,DWORD PTR SS:[EBP-70]
0042AEDF . 52 PUSH EDX
0042AEE0 . 8D4D A0 LEA ECX,DWORD PTR SS:[EBP-60]
0042AEE3 . 50 PUSH EAX
0042AEE4 . 8D55 B0 LEA EDX,DWORD PTR SS:[EBP-50]
0042AEE7 . 51 PUSH ECX
0042AEE8 . 52 PUSH EDX
0042AEE9 . 6A 04 PUSH 4
0042AEEB . FF15 30104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;
MSVBVM60.__vbaFreeVarList
0042AEF1 . 83C4 14 ADD ESP,14
0042AEF4 . EB 06 JMP SHORT Anti-Hac.0042AEFC
0042AEF6 > 8B1D 9C114000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaVa>;
MSVBVM60.__vbaVarDup
0042AEFC > 8B06 MOV EAX,DWORD
PTR DS:[ESI]
0042AEFE . 56 PUSH ESI
0042AEFF . FF90 14030000 CALL DWORD PTR DS:[EAX+314]
0042AF05 . 8D4D C0 LEA ECX,DWORD PTR SS:[EBP-40]
0042AF08 . 50 PUSH EAX
0042AF09 . 51 PUSH ECX
0042AF0A . FF15 90104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;
MSVBVM60.__vbaObjSet
0042AF10 . 8BF8 MOV EDI,EAX
0042AF12 . 8D45 C4 LEA EAX,DWORD PTR SS:[EBP-3C]
0042AF15 . 50 PUSH EAX
0042AF16 . 57 PUSH EDI
0042AF17 . 8B17 MOV EDX,DWORD
PTR DS:[EDI]
0042AF19 . FF92 A0000000 CALL DWORD PTR DS:[EDX+A0]
0042AF1F . 85C0 TEST EAX,EAX
0042AF21 . DBE2 FCLEX
0042AF23 . 7D 12 JGE SHORT Anti-Hac.0042AF37
0042AF25 . 68 A0000000 PUSH 0A0
0042AF2A . 68 38CF4000 PUSH Anti-Hac.0040CF38
0042AF2F . 57 PUSH EDI
0042AF30 . 50 PUSH EAX
0042AF31 . FF15 68104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;
MSVBVM60.__vbaHresultCheckObj
0042AF37 > 8B4D C4 MOV ECX,DWORD PTR
SS:[EBP-3C] ; 用户名入ecx
0042AF3A . 51 PUSH ECX
0042AF3B . 68 E0CD4000 PUSH Anti-Hac.0040CDE0
0042AF40 . FF15 CC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCm>;
MSVBVM60.__vbaStrCmp
0042AF46 . 8BF8 MOV EDI,EAX
0042AF48 . 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]
0042AF4B . F7DF NEG EDI
0042AF4D . 1BFF SBB EDI,EDI
0042AF4F . 47 INC EDI
0042AF50 . F7DF NEG EDI
0042AF52 . FF15 E4114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;
MSVBVM60.__vbaFreeStr
0042AF58 . 8D4D C0 LEA ECX,DWORD PTR SS:[EBP-40]
0042AF5B . FF15 E0114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;
MSVBVM60.__vbaFreeObj
0042AF61 . 66:85FF TEST DI,DI
0042AF64 . 0F85 11080000 JNZ Anti-Hac.0042B77B
0042AF6A . 8B16 MOV EDX,DWORD
PTR DS:[ESI]
0042AF6C . 56 PUSH ESI
0042AF6D . FF92 10030000 CALL DWORD PTR DS:[EDX+310]
0042AF73 . 50 PUSH EAX
0042AF74 . 8D45 C0 LEA EAX,DWORD PTR SS:[EBP-40]
0042AF77 . 50 PUSH EAX
0042AF78 . FF15 90104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;
MSVBVM60.__vbaObjSet
0042AF7E . 8BF8 MOV EDI,EAX
0042AF80 . 8D55 C4 LEA EDX,DWORD PTR SS:[EBP-3C]
0042AF83 . 52 PUSH EDX
0042AF84 . 57 PUSH EDI
0042AF85 . 8B0F MOV ECX,DWORD
PTR DS:[EDI]
0042AF87 . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
0042AF8D . 85C0 TEST EAX,EAX
0042AF8F . DBE2 FCLEX
0042AF91 . 7D 12 JGE SHORT Anti-Hac.0042AFA5
0042AF93 . 68 A0000000 PUSH 0A0
0042AF98 . 68 38CF4000 PUSH Anti-Hac.0040CF38
0042AF9D . 57 PUSH EDI
0042AF9E . 50 PUSH EAX
0042AF9F . FF15 68104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;
MSVBVM60.__vbaHresultCheckObj
0042AFA5 > 8B45 C4 MOV EAX,DWORD PTR
SS:[EBP-3C] ; 注册码入eax
0042AFA8 . 50 PUSH EAX
0042AFA9 . 68 E0CD4000 PUSH Anti-Hac.0040CDE0
0042AFAE . FF15 CC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCm>;
MSVBVM60.__vbaStrCmp
0042AFB4 . 8BF8 MOV EDI,EAX
0042AFB6 . 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]
0042AFB9 . F7DF NEG EDI
0042AFBB . 1BFF SBB EDI,EDI
0042AFBD . 47 INC EDI
0042AFBE . F7DF NEG EDI
0042AFC0 . FF15 E4114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;
MSVBVM60.__vbaFreeStr
0042AFC6 . 8D4D C0 LEA ECX,DWORD PTR SS:[EBP-40]
0042AFC9 . FF15 E0114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;
MSVBVM60.__vbaFreeObj
0042AFCF . 66:85FF TEST DI,DI
0042AFD2 . 0F84 84000000 JE Anti-Hac.0042B05C
; 注册码是否为空
0042AFD8 . B9 04000280 MOV ECX,80020004
0042AFDD . B8 0A000000 MOV EAX,0A
0042AFE2 . 894D 88 MOV DWORD PTR SS:[EBP-78],ECX
0042AFE5 . 894D 98 MOV DWORD PTR SS:[EBP-68],ECX
0042AFE8 . BF 08000000 MOV EDI,8
0042AFED . 8D95 60FFFFFF LEA EDX,DWORD PTR SS:[EBP-A0]
0042AFF3 . 8D4D A0 LEA ECX,DWORD PTR SS:[EBP-60]
0042AFF6 . 8945 80 MOV DWORD PTR SS:[EBP-80],EAX
0042AFF9 . 8945 90 MOV DWORD PTR SS:[EBP-70],EAX
0042AFFC . C785 68FFFFFF>MOV DWORD PTR SS:[EBP-98],Anti-Hac.0040D>;
UNICODE "Error"
0042B006 . 89BD 60FFFFFF MOV DWORD PTR SS:[EBP-A0],EDI
0042B00C . FFD3 CALL EBX
0042B00E . 8D95 70FFFFFF LEA EDX,DWORD PTR SS:[EBP-90]
0042B014 . 8D4D B0 LEA ECX,DWORD PTR SS:[EBP-50]
0042B017 . C785 78FFFFFF>MOV DWORD PTR SS:[EBP-88],Anti-Hac.0040F>;
UNICODE "Please enter a serial number"
0042B021 . 89BD 70FFFFFF MOV DWORD PTR SS:[EBP-90],EDI
0042B027 . FFD3 CALL EBX
0042B029 . 8D4D 80 LEA ECX,DWORD PTR SS:[EBP-80]
0042B02C . 8D55 90 LEA EDX,DWORD PTR SS:[EBP-70]
0042B02F . 51 PUSH ECX
0042B030 . 8D45 A0 LEA EAX,DWORD PTR SS:[EBP-60]
0042B033 . 52 PUSH EDX
0042B034 . 50 PUSH EAX
0042B035 . 8D4D B0 LEA ECX,DWORD PTR SS:[EBP-50]
0042B038 . 6A 10 PUSH 10
0042B03A . 51 PUSH ECX
0042B03B . FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>]
; MSVBVM60.rtcMsgBox
0042B041 . 8D55 80 LEA EDX,DWORD PTR SS:[EBP-80]
0042B044 . 8D45 90 LEA EAX,DWORD PTR SS:[EBP-70]
0042B047 . 52 PUSH EDX
0042B048 . 8D4D A0 LEA ECX,DWORD PTR SS:[EBP-60]
0042B04B . 50 PUSH EAX
0042B04C . 8D55 B0 LEA EDX,DWORD PTR SS:[EBP-50]
0042B04F . 51 PUSH ECX
0042B050 . 52 PUSH EDX
0042B051 . 6A 04 PUSH 4
0042B053 . FF15 30104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;
MSVBVM60.__vbaFreeVarList
0042B059 . 83C4 14 ADD ESP,14
0042B05C > 8B06 MOV EAX,DWORD
PTR DS:[ESI]
0042B05E . 56 PUSH ESI
0042B05F . FF90 10030000 CALL DWORD PTR DS:[EAX+310]
0042B065 . 8D4D C0 LEA ECX,DWORD PTR SS:[EBP-40]
0042B068 . 50 PUSH EAX
0042B069 . 51 PUSH ECX
0042B06A . FF15 90104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;
MSVBVM60.__vbaObjSet
0042B070 . 8BF8 MOV EDI,EAX
0042B072 . 8D45 C4 LEA EAX,DWORD PTR SS:[EBP-3C]
0042B075 . 50 PUSH EAX
0042B076 . 57 PUSH EDI
0042B077 . 8B17 MOV EDX,DWORD
PTR DS:[EDI]
0042B079 . FF92 A0000000 CALL DWORD PTR DS:[EDX+A0]
0042B07F . 85C0 TEST EAX,EAX
0042B081 . DBE2 FCLEX
0042B083 . 7D 12 JGE SHORT Anti-Hac.0042B097
0042B085 . 68 A0000000 PUSH 0A0
0042B08A . 68 38CF4000 PUSH Anti-Hac.0040CF38
0042B08F . 57 PUSH EDI
0042B090 . 50 PUSH EAX
0042B091 . FF15 68104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;
MSVBVM60.__vbaHresultCheckObj
0042B097 > 8B4D C4 MOV ECX,DWORD PTR
SS:[EBP-3C] ; 注册码入ecx
0042B09A . 51 PUSH ECX
0042B09B . 68 E0CD4000 PUSH Anti-Hac.0040CDE0
0042B0A0 . FF15 CC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCm>;
MSVBVM60.__vbaStrCmp
0042B0A6 . 8BF8 MOV EDI,EAX
0042B0A8 . 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]
0042B0AB . F7DF NEG EDI
0042B0AD . 1BFF SBB EDI,EDI
0042B0AF . 47 INC EDI
0042B0B0 . F7DF NEG EDI
0042B0B2 . FF15 E4114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;
MSVBVM60.__vbaFreeStr
0042B0B8 . 8D4D C0 LEA ECX,DWORD PTR SS:[EBP-40]
0042B0BB . FF15 E0114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;
MSVBVM60.__vbaFreeObj
0042B0C1 . 66:85FF TEST DI,DI
0042B0C4 . 0F85 B1060000 JNZ Anti-Hac.0042B77B
0042B0CA . 8B16 MOV EDX,DWORD
PTR DS:[ESI]
0042B0CC . 56 PUSH ESI
0042B0CD . FF92 10030000 CALL DWORD PTR DS:[EDX+310]
0042B0D3 . 50 PUSH EAX
0042B0D4 . 8D45 C0 LEA EAX,DWORD PTR SS:[EBP-40]
0042B0D7 . 50 PUSH EAX
0042B0D8 . FF15 90104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;
MSVBVM60.__vbaObjSet
0042B0DE . 8BF8 MOV EDI,EAX
0042B0E0 . 8D55 C4 LEA EDX,DWORD PTR SS:[EBP-3C]
0042B0E3 . 52 PUSH EDX
0042B0E4 . 57 PUSH EDI
0042B0E5 . 8B0F MOV ECX,DWORD
PTR DS:[EDI]
0042B0E7 . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
0042B0ED . 85C0 TEST EAX,EAX
0042B0EF . DBE2 FCLEX
0042B0F1 . 7D 12 JGE SHORT Anti-Hac.0042B105
0042B0F3 . 68 A0000000 PUSH 0A0
0042B0F8 . 68 38CF4000 PUSH Anti-Hac.0040CF38
0042B0FD . 57 PUSH EDI
0042B0FE . 50 PUSH EAX
0042B0FF . FF15 68104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;
MSVBVM60.__vbaHresultCheckObj
0042B105 > 8B45 C4 MOV EAX,DWORD PTR
SS:[EBP-3C] ; 注册码入eax
0042B108 . 50 PUSH EAX
0042B109 . FF15 28104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaLenBs>;
MSVBVM60.__vbaLenBstr
0042B10F . 33C9 XOR ECX,ECX
; 取注册码长度
0042B111 . 83F8 0A CMP EAX,0A
; 是否为大于10位
0042B114 . 0F9CC1 SETL CL
0042B117 . F7D9 NEG ECX
0042B119 . 8BF9 MOV EDI,ECX
0042B11B . 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]
0042B11E . FF15 E4114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;
MSVBVM60.__vbaFreeStr
0042B124 . 8D4D C0 LEA ECX,DWORD PTR SS:[EBP-40]
0042B127 . FF15 E0114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;
MSVBVM60.__vbaFreeObj
0042B12D . 66:85FF TEST DI,DI
0042B130 . 74 23 JE SHORT Anti-Hac.0042B155
0042B132 . 8D95 70FFFFFF LEA EDX,DWORD PTR SS:[EBP-90]
0042B138 . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
0042B13B . C785 78FFFFFF>MOV DWORD PTR SS:[EBP-88],-1
0042B145 . C785 70FFFFFF>MOV DWORD PTR SS:[EBP-90],0B
0042B14F . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarMo>;
MSVBVM60.__vbaVarMove
0042B155 > 8D55 DC LEA EDX,DWORD PTR
SS:[EBP-24]
0042B158 . 8D85 70FFFFFF LEA EAX,DWORD PTR SS:[EBP-90]
0042B15E . 52 PUSH EDX
0042B15F . 50 PUSH EAX
0042B160 . C785 78FFFFFF>MOV DWORD PTR SS:[EBP-88],-1
0042B16A . C785 70FFFFFF>MOV DWORD PTR SS:[EBP-90],800B
0042B174 . FF15 D0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarTs>;
MSVBVM60.__vbaVarTstEq
0042B17A . 66:85C0 TEST AX,AX
0042B17D . 0F85 D1000000 JNZ Anti-Hac.0042B254
; 注册码不为10位就跳往出错
0042B183 . 8B0E MOV ECX,DWORD
PTR DS:[ESI]
0042B185 . 56 PUSH ESI
0042B186 . FF91 10030000 CALL DWORD PTR DS:[ECX+310]
0042B18C . 8D55 C0 LEA EDX,DWORD PTR SS:[EBP-40]
0042B18F . 50 PUSH EAX
0042B190 . 52 PUSH EDX
0042B191 . FF15 90104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;
MSVBVM60.__vbaObjSet
0042B197 . 8B45 C0 MOV EAX,DWORD PTR SS:[EBP-40]
0042B19A . 6A 0A PUSH 0A
0042B19C . 8945 B8 MOV DWORD PTR SS:[EBP-48],EAX
0042B19F . 8D45 B0 LEA EAX,DWORD PTR SS:[EBP-50]
0042B1A2 . 8D4D A0 LEA ECX,DWORD PTR SS:[EBP-60]
0042B1A5 . 50 PUSH EAX
0042B1A6 . 51 PUSH ECX
0042B1A7 . C745 C0 00000>MOV DWORD PTR SS:[EBP-40],0
0042B1AE . C745 B0 09000>MOV DWORD PTR SS:[EBP-50],9
0042B1B5 . FF15 B0114000 CALL DWORD PTR DS:[<&MSVBVM60.#617>]
; MSVBVM60.rtcLeftCharVar
0042B1BB . 8D55 A0 LEA EDX,DWORD PTR SS:[EBP-60]
; 从注册码中左边开始取10位
0042B1BE . 52 PUSH EDX
0042B1BF . FF15 24104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>;
MSVBVM60.__vbaStrVarMove
0042B1C5 . 8BD0 MOV EDX,EAX
0042B1C7 . 8D4D C8 LEA ECX,DWORD PTR SS:[EBP-38]
0042B1CA . FF15 B8114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;
MSVBVM60.__vbaStrMove
0042B1D0 . 8D4D C0 LEA ECX,DWORD PTR SS:[EBP-40]
0042B1D3 . FF15 E0114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;
MSVBVM60.__vbaFreeObj
0042B1D9 . 8B3D 30104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaFr>;
MSVBVM60.__vbaFreeVarList
0042B1DF . 8D45 A0 LEA EAX,DWORD PTR SS:[EBP-60]
0042B1E2 . 8D4D B0 LEA ECX,DWORD PTR SS:[EBP-50]
0042B1E5 . 50 PUSH EAX
0042B1E6 . 51 PUSH ECX
0042B1E7 . 6A 02 PUSH 2
0042B1E9 . FFD7 CALL EDI
; <&MSVBVM60.__vbaFreeVarList>
0042B1EB . 8B55 C8 MOV EDX,DWORD PTR SS:[EBP-38]
; 取得的十位注册码入edx
0042B1EE . 83C4 0C ADD ESP,0C
0042B1F1 . 52 PUSH EDX
0042B1F2 . 68 F4F54000 PUSH Anti-Hac.0040F5F4
; UNICODE "s81d-9adf-"
0042B1F7 . FF15 CC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCm>;
MSVBVM60.__vbaStrCmp
0042B1FD . 85C0 TEST EAX,EAX
; 比较与s81d-9adf-是否相等
0042B1FF . 75 23 JNZ SHORT Anti-Hac.0042B224
; 不等则跳
0042B201 . 8D95 70FFFFFF LEA EDX,DWORD PTR SS:[EBP-90]
0042B207 . 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
0042B20A . C785 78FFFFFF>MOV DWORD PTR SS:[EBP-88],-1
0042B214 . C785 70FFFFFF>MOV DWORD PTR SS:[EBP-90],0B
0042B21E . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarMo>;
MSVBVM60.__vbaVarMove
0042B224 > 8D45 CC LEA EAX,DWORD PTR
SS:[EBP-34]
0042B227 . 8D8D 70FFFFFF LEA ECX,DWORD PTR SS:[EBP-90]
0042B22D . 50 PUSH EAX
0042B22E . 51 PUSH ECX
0042B22F . C785 78FFFFFF>MOV DWORD PTR SS:[EBP-88],0
0042B239 . C785 70FFFFFF>MOV DWORD PTR SS:[EBP-90],800B
0042B243 . FF15 D0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarTs>;
MSVBVM60.__vbaVarTstEq
0042B249 . 66:85C0 TEST AX,AX
0042B24C . 0F84 8D000000 JE Anti-Hac.0042B2DF
0042B252 . EB 06 JMP SHORT Anti-Hac.0042B25A
0042B254 > 8B3D 30104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaFr>;
MSVBVM60.__vbaFreeVarList
0042B25A > B9 04000280 MOV ECX,80020004
0042B25F . B8 0A000000 MOV EAX,0A
0042B264 . 894D 88 MOV DWORD PTR SS:[EBP-78],ECX
0042B267 . 894D 98 MOV DWORD PTR SS:[EBP-68],ECX
0042B26A . BE 08000000 MOV ESI,8
0042B26F . 8D95 60FFFFFF LEA EDX,DWORD PTR SS:[EBP-A0]
0042B275 . 8D4D A0 LEA ECX,DWORD PTR SS:[EBP-60]
0042B278 . 8945 80 MOV DWORD PTR SS:[EBP-80],EAX
0042B27B . 8945 90 MOV DWORD PTR SS:[EBP-70],EAX
0042B27E . C785 68FFFFFF>MOV DWORD PTR SS:[EBP-98],Anti-Hac.0040C>;
UNICODE "error"
0042B288 . 89B5 60FFFFFF MOV DWORD PTR SS:[EBP-A0],ESI
0042B28E . FFD3 CALL EBX
0042B290 . 8D95 70FFFFFF LEA EDX,DWORD PTR SS:[EBP-90]
0042B296 . 8D4D B0 LEA ECX,DWORD PTR SS:[EBP-50]
0042B299 . C785 78FFFFFF>MOV DWORD PTR SS:[EBP-88],Anti-Hac.0040F>;
UNICODE "Invalid serial number. Try Again"
0042B2A3 . 89B5 70FFFFFF MOV DWORD PTR SS:[EBP-90],ESI
0042B2A9 . FFD3 CALL EBX
0042B2AB . 8D55 80 LEA EDX,DWORD PTR SS:[EBP-80]
0042B2AE . 8D45 90 LEA EAX,DWORD PTR SS:[EBP-70]
0042B2B1 . 52 PUSH EDX
0042B2B2 . 8D4D A0 LEA ECX,DWORD PTR SS:[EBP-60]
0042B2B5 . 50 PUSH EAX
0042B2B6 . 51 PUSH ECX
0042B2B7 . 8D55 B0 LEA EDX,DWORD PTR SS:[EBP-50]
0042B2BA . 6A 10 PUSH 10
0042B2BC . 52 PUSH EDX
0042B2BD . FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>]
; MSVBVM60.rtcMsgBox
0042B2C3 . 8D45 80 LEA EAX,DWORD PTR SS:[EBP-80]
0042B2C6 . 8D4D 90 LEA ECX,DWORD PTR SS:[EBP-70]
0042B2C9 . 50 PUSH EAX
0042B2CA . 8D55 A0 LEA EDX,DWORD PTR SS:[EBP-60]
0042B2CD . 51 PUSH ECX
0042B2CE . 8D45 B0 LEA EAX,DWORD PTR SS:[EBP-50]
0042B2D1 . 52 PUSH EDX
0042B2D2 . 50 PUSH EAX
0042B2D3 . 6A 04 PUSH 4
0042B2D5 . FFD7 CALL EDI
0042B2D7 . 83C4 14 ADD ESP,14
0042B2DA . E9 9C040000 JMP Anti-Hac.0042B77B
0042B2DF > B9 0A000000 MOV ECX,0A
0042B2E4 . B8 04000280 MOV EAX,80020004
0042B2E9 . 894D 80 MOV DWORD PTR SS:[EBP-80],ECX
0042B2EC . 894D 90 MOV DWORD PTR SS:[EBP-70],ECX
0042B2EF . 8D95 60FFFFFF LEA EDX,DWORD PTR SS:[EBP-A0]
0042B2F5 . 8D4D A0 LEA ECX,DWORD PTR SS:[EBP-60]
0042B2F8 . 8945 88 MOV DWORD PTR SS:[EBP-78],EAX
0042B2FB . 8945 98 MOV DWORD PTR SS:[EBP-68],EAX
0042B2FE . C785 68FFFFFF>MOV DWORD PTR SS:[EBP-98],Anti-Hac.0040F>;
UNICODE "Registerd"
0042B308 . C785 60FFFFFF>MOV DWORD PTR SS:[EBP-A0],8
0042B312 . FFD3 CALL EBX
0042B314 . 8D95 70FFFFFF LEA EDX,DWORD PTR SS:[EBP-90]
0042B31A . 8D4D B0 LEA ECX,DWORD PTR SS:[EBP-50]
0042B31D . C785 78FFFFFF>MOV DWORD PTR SS:[EBP-88],Anti-Hac.0040F>;
UNICODE "Thank you for registering Anti-Hack!"
0042B327 . C785 70FFFFFF>MOV DWORD PTR SS:[EBP-90],8
0042B331 . FFD3 CALL EBX
0042B333 . 8D4D 80 LEA ECX,DWORD PTR SS:[EBP-80]
0042B336 . 8D55 90 LEA EDX,DWORD PTR SS:[EBP-70]
0042B339 . 51 PUSH ECX
0042B33A . 8D45 A0 LEA EAX,DWORD PTR SS:[EBP-60]
0042B33D . 52 PUSH EDX
0042B33E . 50 PUSH EAX
0042B33F . 8D4D B0 LEA ECX,DWORD PTR SS:[EBP-50]
0042B342 . 6A 40 PUSH 40
0042B344 . 51 PUSH ECX
0042B345 . FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>]
; MSVBVM60.rtcMsgBox
0042B34B . 8D55 80 LEA EDX,DWORD PTR SS:[EBP-80]
0042B34E . 8D45 90 LEA EAX,DWORD PTR SS:[EBP-70]
0042B351 . 52 PUSH EDX
0042B352 . 8D4D A0 LEA ECX,DWORD PTR SS:[EBP-60]
0042B355 . 50 PUSH EAX
0042B356 . 8D55 B0 LEA EDX,DWORD PTR SS:[EBP-50]
0042B359 . 51 PUSH ECX
0042B35A . 52 PUSH EDX
0042B35B . 6A 04 PUSH 4
0042B35D . FFD7 CALL EDI
0042B35F . 8B1D 08104000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.#690>]
; MSVBVM60.rtcSaveSetting
0042B365 . 83C4 14 ADD ESP,14
0042B368 . 68 DCD14000 PUSH Anti-Hac.0040D1DC
; UNICODE "(2k)-(2000)-Carbosoft
:)"
0042B36D . 68 C0D14000 PUSH Anti-Hac.0040D1C0
; UNICODE "Registered?"
0042B372 . 68 A8D14000 PUSH Anti-Hac.0040D1A8
; UNICODE "Register"
0042B377 . 68 90D14000 PUSH Anti-Hac.0040D190
; UNICODE "Anti-Hack"
0042B37C . FFD3 CALL EBX
; <&MSVBVM60.#690>
0042B37E . 8B06 MOV EAX,DWORD
PTR DS:[ESI]
0042B380 . 56 PUSH ESI
0042B381 . FF90 14030000 CALL DWORD PTR DS:[EAX+314]
0042B387 . 8D4D C0 LEA ECX,DWORD PTR SS:[EBP-40]
0042B38A . 50 PUSH EAX
0042B38B . 51 PUSH ECX
0042B38C . FF15 90104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;
MSVBVM60.__vbaObjSet
----------------------------------------
注册码左边必须是s81d-9adf-,后面是任意
总结:
用户名:lordor[BCG]
注册码:s81d-9adf-987654321
注册信息保存在:
[HKEY_USERS\S-1-5-21-1275210071-764733703-842925246-1003\Software\VB and VBA
Program Settings\Anti-Hack\Register]
"loaded"="1"
"Registered?"="(2k)-(2000)-Carbosoft :)"
"Owner"="lordor[BCG]"
"SerialNumber"="s81d-9adf-987654321"
cracked by lordor[BCG]
03.06.05