Magic Utilities V2.10

标题：重启验证----系统增强工具Magic Utilities的破解!
作者：henGe
时间：2003/07/06 08:53pm
链接：http://bbs.pediy.com

软件大小： 891 KB
软件语言：英文
软件类别：国外软件 / 共享版 / 系统增强
应用平台： Win9x/NT/2000/XP
界面预览：无
加入时间： 2003-04-04 14:09:33
下载次数： 366
推荐等级： ☆☆☆☆
软件下载: http://count.skycn.com/softdown.php?id=11435&url=http://gd-http.skycn.net:8080/down/mgutil_210.exe

软件介绍：
Magic Utilities 是一款方便的系统工具。它拥有卸载管理、启动加载、进程管理三大功能，操作相当方便和智能。最重要的是本软件界面相当华丽，是追求视觉完美的用户的首选。

破解工具：OllyDby1.09,PWdasm,Pe-Scan3.31
作者声明：初学破解，仅作学习交流之用，失误之处敬请大侠赐教!

用Pe-scan检测为pe-compact的壳，用pe-scan脱壳后592K->1468K,VC编写，软件
为重启验证型，软件将注册信息保存在C:\windows下的mgutil_win.in文件中，重启后取出进行注册验证。
查找字串"mgutil_win.ini",你很快会找到合适的断点。
这个软件设置了陷井,真是可恶,下面列出的代码很多,可是跟注册码密切相关的真的不多!

【简要过程】:
..........(略)
:004201A0 6848784900 push 00497848
:004201A5 8D8424B4000000 lea eax, dword ptr [esp+000000B4]
:004201AC 6A28 push 00000028
:004201AE 50 push eax
:004201AF 6824D34900 push 0049D324

* Possible StringData Ref from Code Obj ->"RegCode"
|
:004201B4 6830784900 push 00497830

* Possible StringData Ref from Code Obj ->"REG"
|
:004201B9 6838784900 push 00497838
:004201BE FFD7 call edi
:004201C0 8D8C2450010000 lea ecx, dword ptr [esp+00000150]
<===ecx="ShenGe[BCG]",用户名
:004201C7 51 push ecx
:004201C8 8D4C2438 lea ecx, dword ptr [esp+38]
:004201CC E811430400 call 004644E2
:004201D1 8D9424B0000000 lea edx, dword ptr [esp+000000B0]
<===edx="12345678",试验码
:004201D8 8D4C2430 lea ecx, dword ptr [esp+30]
:004201DC 52 push edx
:004201DD E800430400 call 004644E2
:004201E2 8B6C2418 mov ebp, dword ptr [esp+18]
:004201E6 8D8424B0000000 lea eax, dword ptr [esp+000000B0]
<===eax="12345678"
:004201ED 8D8C2450010000 lea ecx, dword ptr [esp+00000150]
<===ecx="ShenGe[BCG]"
:004201F4 50 push eax
:004201F5 51 push ecx
:004201F6 8BCD mov ecx, ebp
:004201F8 E8F3100000 call 004212F0
<===第1个验证Call,跟进!①我第1次跟的时候
是这样认为的,结果,唉!多浪费了我很多的时间做无用功!

以下部分是按修正试验码为"22072008912"后的追踪流程!

:004201FD 85C0 test eax, eax
:004201FF 740F je 00420210
:00420201 83FB04 cmp ebx, 00000004
<===判断用户名长度是否大于4
:00420204 C7054CD4490001000000 mov dword ptr [0049D44C], 00000001
:0042020E 730A jnb 0042021A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004201FF(C)
|
:00420210 C7054CD4490000000000 mov dword ptr [0049D44C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042020E(C)
|
:0042021A 8D9424B0000000 lea edx, dword ptr [esp+000000B0]
<===edx="22072008912",试验码
:00420221 8BCD mov ecx, ebp
:00420223 52 push edx
:00420224 E827140000 call 00421650
<===第2个验证Call,跟进!②
:00420229 85C0 test eax, eax
:0042022B 0F85EE010000 jne 0042041F
<===此处不跳就真的玩完了!
:00420231 50 push eax
:00420232 8D8C24740C0000 lea ecx, dword ptr [esp+00000C74]
:00420239 A34CD44900 mov dword ptr [0049D44C], eax
:0042023E E8ED710100 call 00437430
:00420243 8D8C24700C0000 lea ecx, dword ptr [esp+00000C70]
:0042024A C684243C7E00000E mov byte ptr [esp+00007E3C], 0E
:00420252 E8CD920400 call 00469524
<===讨厌的要求注册对话框!
:00420257 83F801 cmp eax, 00000001
:0042025A 0F85E1000000 jne 00420341
:00420260 8D8C24EC1C0000 lea ecx, dword ptr [esp+00001CEC]
:00420267 C684243C7E000018 mov byte ptr [esp+00007E3C], 18
:0042026F E8E5400400 call 00464359
:00420274 8D8C24E81C0000 lea ecx, dword ptr [esp+00001CE8]
:0042027B C684243C7E000017 mov byte ptr [esp+00007E3C], 17
:00420283 E8D1400400 call 00464359
:00420418 E8DA8D0400 call 004691F7

......................(略)

:0042041D EB0A jmp 00420429

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042022B(C)
|
:0042041F C7054CD4490001000000 mov dword ptr [0049D44C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042041D(U)
|
:00420429 A170AD4900 mov eax, dword ptr [0049AD70]
:0042042E 8944241C mov dword ptr [esp+1C], eax
:00420432 89442420 mov dword ptr [esp+20], eax
:00420436 89442444 mov dword ptr [esp+44], eax
:0042043A 89442440 mov dword ptr [esp+40], eax
:0042043E 6802000080 push 80000002
:00420443 8D4C244C lea ecx, dword ptr [esp+4C]
:00420447 C68424407E000026 mov byte ptr [esp+00007E40], 26
:0042044F E8BC8D0100 call 00439210

★★★★★★★★★
①跟进第1个验证Call,可看到如下代码：(陷井!)
:004212F0 81EC80000000 sub esp, 00000080
:004212F6 B077 mov al, 77
<===al=77
:004212F8 53 push ebx
:004212F9 88442406 mov byte ptr [esp+06], al
:004212FD 8844241D mov byte ptr [esp+1D], al
:00421301 B36C mov bl, 6C
<===bl=6C
:00421303 B2C5 mov dl, C5
<===dl=C5
:00421305 B185 mov cl, 85
<===cl=85
:00421307 B0E3 mov al, E3
<===al=E3
:00421309 56 push esi
:0042130A 57 push edi
☆☆☆☆☆☆☆☆☆☆
下面这一段给把固定值存入内存单元[esp+0C]~[esp+7E]

:0042130B C644240C49 mov [esp+0C], 49
:00421310 C644240DEF mov [esp+0D], EF
:00421315 C644240F1D mov [esp+0F], 1D
:0042131A C644241067 mov [esp+10], 67
:0042131F C644241169 mov [esp+11], 69
:00421324 C6442412A1 mov [esp+12], A1
:00421329 C64424131B mov [esp+13], 1B
:0042132E C64424147A mov [esp+14], 7A
:00421333 C64424158C mov [esp+15], 8C
:00421338 C644241647 mov [esp+16], 47
:0042133D C6442417F8 mov [esp+17], F8
:00421342 C644241854 mov [esp+18], 54
:00421347 C644241995 mov [esp+19], 95
:0042134C C644241A97 mov [esp+1A], 97
:00421351 C644241B5F mov [esp+1B], 5F
:00421356 C644241C78 mov [esp+1C], 78
:0042135B C644241DD9 mov [esp+1D], D9
:00421360 C644241EDA mov [esp+1E], DA
:00421365 885C241F mov byte ptr [esp+1F], bl
:00421369 C644242059 mov [esp+20], 59
:0042136E C6442421D7 mov [esp+21], D7
:00421373 C64424226B mov [esp+22], 6B
:00421378 C644242335 mov [esp+23], 35
:0042137D 88542424 mov byte ptr [esp+24], dl
:00421381 884C2426 mov byte ptr [esp+26], cl
:00421385 C644242718 mov [esp+27], 18
:0042138A C64424282A mov [esp+28], 2A
:0042138F C64424290E mov [esp+29], 0E
:00421394 C644242A52 mov [esp+2A], 52
:00421399 C644242BFF mov [esp+2B], FF
:0042139E C644242C00 mov [esp+2C], 00
:004213A3 8844242D mov byte ptr [esp+2D], al
:004213A7 C644242E1B mov [esp+2E], 1B
:004213AC C644242F71 mov [esp+2F], 71
:004213B1 C64424308D mov [esp+30], 8D
:004213B6 C644243134 mov [esp+31], 34
:004213BB C644243263 mov [esp+32], 63
:004213C0 C6442433EB mov [esp+33], EB
:004213C5 C644243491 mov [esp+34], 91
:004213CA C6442435C3 mov [esp+35], C3
:004213CF C644243624 mov [esp+36], 24
:004213D4 C64424370F mov [esp+37], 0F
:004213D9 C6442438B7 mov [esp+38], B7
:004213DE C6442439C2 mov [esp+39], C2
:004213E3 C644243AF8 mov [esp+3A], F8
:004213E8 8844243B mov byte ptr [esp+3B], al
:004213EC C644243CB6 mov [esp+3C], B6
:004213F1 C644243D54 mov [esp+3D], 54
:004213F6 C644243E4C mov [esp+3E], 4C
:004213FB C644243F35 mov [esp+3F], 35
:00421400 C644244054 mov [esp+40], 54
:00421405 C6442441D7 mov [esp+41], D7
:0042140A C6442442C9 mov [esp+42], C9
:0042140F C644244349 mov [esp+43], 49
:00421414 C644244428 mov [esp+44], 28
:00421419 C6442445A3 mov [esp+45], A3
:0042141E 884C2446 mov byte ptr [esp+46], cl
:00421422 C644244711 mov [esp+47], 11
:00421427 C64424480B mov [esp+48], 0B
:0042142C C64424492C mov [esp+49], 2C
:00421431 C644244A68 mov [esp+4A], 68
:00421436 C644244BFB mov [esp+4B], FB
:0042143B C644244CEE mov [esp+4C], EE
:00421440 C644244D7D mov [esp+4D], 7D
:00421445 C644244EF6 mov [esp+4E], F6
:0042144A 885C244F mov byte ptr [esp+4F], bl
:0042144E 88442450 mov byte ptr [esp+50], al
:00421452 C64424519C mov [esp+51], 9C
:00421457 C64424522D mov [esp+52], 2D
:0042145C C6442453E4 mov [esp+53], E4
:00421461 C644245472 mov [esp+54], 72
:00421466 884C2457 mov byte ptr [esp+57], cl
:0042146A 8844245C mov byte ptr [esp+5C], al
:0042146E 884C2476 mov byte ptr [esp+76], cl
:00421472 B02B mov al, 2B
:00421474 B141 mov cl, 41
:00421476 889C2489000000 mov byte ptr [esp+00000089], bl
:0042147D 8B9C2490000000 mov ebx, dword ptr [esp+00000090]
:00421484 8844246E mov byte ptr [esp+6E], al
:00421488 88442477 mov byte ptr [esp+77], al
:0042148C 884C2478 mov byte ptr [esp+78], cl
:00421490 884C247E mov byte ptr [esp+7E], cl
:00421494 8BFB mov edi, ebx
:00421496 83C9FF or ecx, FFFFFFFF
:00421499 33C0 xor eax, eax
:0042149B F2 repnz
:0042149C AE scasb
<===取用户名长度
:0042149D F7D1 not ecx
:0042149F 49 dec ecx
:004214A0 C6442455C3 mov [esp+55], C3
:004214A5 85C9 test ecx, ecx
<===判断有无输入用户名
:004214A7 C6442456BB mov [esp+56], BB
:004214AC C64424581A mov [esp+58], 1A
:004214B1 C644245912 mov [esp+59], 12
:004214B6 C644245A3C mov [esp+5A], 3C
:004214BB C644245B32 mov [esp+5B], 32
:004214C0 C644245D6B mov [esp+5D], 6B
:004214C5 C644245E4F mov [esp+5E], 4F
:004214CA C644245F4D mov [esp+5F], 4D
:004214CF C6442460F4 mov [esp+60], F4
:004214D4 C6442461A9 mov [esp+61], A9
:004214D9 C644246224 mov [esp+62], 24
:004214DE C6442463C8 mov [esp+63], C8
:004214E3 C6442464FA mov [esp+64], FA
:004214E8 C644246578 mov [esp+65], 78
:004214ED C6442466AD mov [esp+66], AD
:004214F2 C644246723 mov [esp+67], 23
:004214F7 C6442468A1 mov [esp+68], A1
:004214FC C6442469E4 mov [esp+69], E4
:00421501 C644246A6D mov [esp+6A], 6D
:00421506 C644246B9A mov [esp+6B], 9A
:0042150B C644246C04 mov [esp+6C], 04
:00421510 C644246DCE mov [esp+6D], CE
:00421515 8854246F mov byte ptr [esp+6F], dl
:00421519 C6442470B6 mov [esp+70], B6
:0042151E 88542471 mov byte ptr [esp+71], dl
:00421522 C6442472EF mov [esp+72], EF
:00421527 C644247393 mov [esp+73], 93
:0042152C C64424745C mov [esp+74], 5C
:00421531 C6442475A8 mov [esp+75], A8
:00421536 C644247937 mov [esp+79], 37
:0042153B C644247A72 mov [esp+7A], 72
:00421540 C644247BFA mov [esp+7B], FA
:00421545 C644247C57 mov [esp+7C], 57
:0042154A C644247D45 mov [esp+7D], 45
:0042154F C644247FA1 mov [esp+7F], A1
:00421554 C684248000000020 mov byte ptr [esp+00000080], 20
:0042155C C68424810000004F mov byte ptr [esp+00000081], 4F
:00421564 C684248200000080 mov byte ptr [esp+00000082], 80
:0042156C C6842483000000B3 mov byte ptr [esp+00000083], B3
:00421574 C6842484000000D5 mov byte ptr [esp+00000084], D5
:0042157C C684248500000023 mov byte ptr [esp+00000085], 23
:00421584 C684248600000002 mov byte ptr [esp+00000086], 02
:0042158C C684248700000064 mov byte ptr [esp+00000087], 64
:00421594 C68424880000003F mov byte ptr [esp+00000088], 3F
:0042159C C684248A000000F1 mov byte ptr [esp+0000008A], F1
:004215A4 C684248B0000000F mov byte ptr [esp+0000008B], 0F
☆☆☆☆☆☆☆☆☆☆
最后的结果在内存中显示为：
00797EC0 49 EF 77 1D 67 69 A1 1B 7A 8C 47 F8 54 95 97 5F
00797ED0 78 D9 DA 6C 59 D7 6B 35 C5 77 85 18 2A 0E 52 FF
00797EE0 00 E3 1B 71 8D 34 63 EB 91 C3 24 0F B7 C2 F8 E3
00797EF0 B6 54 4C 35 54 D7 C9 49 28 A3 85 11 0B 2C 68 FB
00797F00 EE 7D F6 6C E3 9C 2D E4 72 C3 BB 85 1A 12 3C 32
00797F10 E3 6B 4F 4D F4 A9 24 C8 FA 78 AD 23 A1 E4 6D 9A
00797F20 04 CE 2B C5 B6 C5 EF 93 5C A8 85 2B 41 37 72 FA
00797F30 57 45 41 A1 20 4F 80 B3 D5 23 02 64 3F 6C F1 0F

:004215AC 7E4D jle 004215FB
<===若没有输入用户名则此处跳
:004215AE 8D74240C lea esi, dword ptr [esp+0C]
<===赋固定值后的首地址传给esi
:004215B2 8BC3 mov eax, ebx
:004215B4 2BF3 sub esi, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004215F9(C)
|
:004215B6 8A10 mov dl, byte ptr [eax]
<===按位取用户名
dl=53
dl=68
dl=65
......
:004215B8 84D2 test dl, dl
:004215BA 7D04 jge 004215C0
:004215BC F6DA neg dl
:004215BE 8810 mov byte ptr [eax], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004215BA(C)
|
:004215C0 8A1406 mov dl, byte ptr [esi+eax]
<===按位取固定值,从第1位开始
dl=49
dl=EF
dl=77
......
:004215C3 3210 xor dl, byte ptr [eax]
<===dl=49^53=1A
～～～～～～～～～～～～～～～～～～～～～～～～～～～
:004215C5 80FA30 cmp dl, 30
:004215C8 8810 mov byte ptr [eax], dl
<===结果替代存入"ShenGe[BCG]"的位置
:004215CA 7D12 jge 004215DE
:004215CC 0FBED2 movsx edx, dl

:004215CF 83FA30 cmp edx, 00000030
:004215D2 7D0A jge 004215DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004215DC(C)
|
:004215D4 83C203 add edx, 00000003
:004215D7 83FA30 cmp edx, 00000030
:004215DA 8810 mov byte ptr [eax], dl
<===结果替代存入"ShenGe[BCG]"的位置
:004215DC 7CF6 jl 004215D4
～～～～～～～～～～～～～～～～～～～～～～～～～～～
这一段判断dl的值是否大于30,若小于则每次加3使其满足条件
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004215CA(C), :004215D2(C)

∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽
:004215DE 8A10 mov dl, byte ptr [eax]
:004215E0 80FA39 cmp dl, 39
:004215E3 7E12 jle 004215F7
:004215E5 0FBED2 movsx edx, dl
:004215E8 83FA39 cmp edx, 00000039
:004215EB 7E0A jle 004215F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004215F5(C)
|
:004215ED 83EA03 sub edx, 00000003
:004215F0 83FA39 cmp edx, 00000039
:004215F3 8810 mov byte ptr [eax], dl
:004215F5 7FF6 jg 004215ED
∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽∽
这一段判断dl的值是否小于39,若大于则每次减3使其满足条件

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004215E3(C), :004215EB(C)
|
:004215F7 40 inc eax
<===指针指向用户名的下一个字符
:004215F8 49 dec ecx
<===控制是否取完用户名
:004215F9 75BB jne 004215B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004215AC(C)
其实上面这部分就是对用户名进行变换处理，我的用户名"ShenGe[BCG]"经变换
后的结果为"22072008912"

:004215FB 8BB42494000000 mov esi, dword ptr [esp+00000094]
<===esi="12345678",假码
:00421602 8BC3 mov eax, ebx
<===eax="22072008912",变换后的用户名

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421626(C)
*************************************************
:00421604 8A10 mov dl, byte ptr [eax]
:00421606 8A1E mov bl, byte ptr [esi]
:00421608 8ACA mov cl, dl
:0042160A 3AD3 cmp dl, bl
:0042160C 751E jne 0042162C
:0042160E 84C9 test cl, cl
:00421610 7416 je 00421628
:00421612 8A5001 mov dl, byte ptr [eax+01]
:00421615 8A5E01 mov bl, byte ptr [esi+01]
:00421618 8ACA mov cl, dl
:0042161A 3AD3 cmp dl, bl
:0042161C 750E jne 0042162C
:0042161E 83C002 add eax, 00000002
:00421621 83C602 add esi, 00000002
:00421624 84C9 test cl, cl
:00421626 75DC jne 00421604
**************************************************
上面这1段是很经典的比较句式,我就不注释了。
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421610(C)
|
:00421628 33C0 xor eax, eax
<===eax=0
:0042162A EB05 jmp 00421631

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042160C(C), :0042161C(C)
|
:0042162C 1BC0 sbb eax, eax
<===eax=0
:0042162E 83D8FF sbb eax, FFFFFFFF
<===eax=1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042162A(U)
|
:00421631 33C9 xor ecx, ecx
:00421633 5F pop edi
:00421634 85C0 test eax, eax
:00421636 0F94C1 sete cl
<===由eax的结果设置cl的值
:00421639 5E pop esi
:0042163A 8BC1 mov eax, ecx
<===eax=ecx,标志位!
:0042163C 5B pop ebx
:0042163D 81C480000000 add esp, 00000080
:00421643 C20800 ret 0008
正如上面所说,我第1次跟的时候认为这也是软件的一个验证,所以跟进后把试验码改
为22072008912再往下跟,结果才发现不过掉进了作者设的圈套里,真是气死我了!:O !

★★★★★★★★★★★★★★★★★★★★
②跟进第2个验证Call,你会看到如下代码：
:00421650 B8FC2A0000 mov eax, 00002AFC
:00421655 E8F6E00200 call 0044F750
:0042165A 66A1149C4900 mov ax, word ptr [00499C14]
<===ax=2C
:00421660 53 push ebx
:00421661 56 push esi
:00421662 57 push edi
:00421663 668944240E mov word ptr [esp+0E], ax
******************************************
:00421668 B926020000 mov ecx, 00000226
:0042166D 33C0 xor eax, eax
:0042166F 8DBC24D8190000 lea edi, dword ptr [esp+000019D8]
:00421676 F3 repz
:00421677 AB stosd
:00421678 B926020000 mov ecx, 00000226
:0042167D 8D7C2410 lea edi, dword ptr [esp+10]
:00421681 F3 repz
:00421682 AB stosd
:00421683 B926020000 mov ecx, 00000226
:00421688 8DBC24A8080000 lea edi, dword ptr [esp+000008A8]
:0042168F F3 repz
:00421690 AB stosd
:00421691 B926020000 mov ecx, 00000226
:00421696 8DBC2440110000 lea edi, dword ptr [esp+00001140]
:0042169D F3 repz
:0042169E AB stosd
:0042169F B926020000 mov ecx, 00000226
:004216A4 8DBC2470220000 lea edi, dword ptr [esp+00002270]
:004216AB F3 repz
:004216AC AB stosd
********************************************
这1段是给2750个内存单元清零,用以后面的存放数据

:004216AD 83C9FF or ecx, FFFFFFFF
<===ecx=FFFFFFFF

**********************************************************************
* Possible StringData Ref from Code Obj ->
"9GDDCCG9,39DGCFG9,9F9DG29C,D9G2G4FE,E4ECDCGE,6"
->"43C2E39,CCG9D44E,X4G9634W,GG2D9GEX,EE2999DC,9A"
->"32FEED,GG92ED4D,9G399GCC,GG2DE99G,C4D9DE9G,4F4"
->"DDDDE,D9E92E32,DE3G63GG,GDDWCDEC,2966EDDG,ACDD"
->"GF36,EFC4F2G2,DG9E44G9,D2FDGGGD,6GG29ECD,G36GE"
->"9GC,G3D46GEC,F9W22GDG,YYVN855T,D9EGE96E,G999CG"
->"DA,DGGD9XC9,DD43GCW2,236CG2CD,9DGCEDDD,GC9C2D9"
->"G,E9G643D4,G9GWAWED,2GDEGCG4,EEGXGD22,D9D2GD4F"
->",DD9DGDGD,64322E3C,EDEG"
|
:004216B0 BF7C944900 mov edi, 0049947C
<===edi指向上面我们看到的一长串固定值
:004216B5 F2 repnz
:004216B6 AE scasb
<===取这一长串固定值的长度
:004216B7 F7D1 not ecx
<===ecx=798
:004216B9 2BF9 sub edi, ecx
<===调整指针指向第1位
:004216BB 8D9424D8190000 lea edx, dword ptr [esp+000019D8]
:004216C2 8BC1 mov eax, ecx
:004216C4 8BF7 mov esi, edi
:004216C6 C1E902 shr ecx, 02
<===ecx=798 div 04=1E6
:004216C9 8BFA mov edi, edx
:004216CB 8D542410 lea edx, dword ptr [esp+10]
:004216CF F3 repz
:004216D0 A5 movsd
<===从[esi]复制486字节(1E6)的到[edi]中
:004216D1 8BC8 mov ecx, eax
:004216D3 33C0 xor eax, eax
:004216D5 83E103 and ecx, 00000003
:004216D8 F3 repz
:004216D9 A4 movsb
************************************************************************
以下的4部分同上,我就不注释了!
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
* Possible StringData Ref from Code Obj ->"EL4ICGE4,GFA4CGGB,E6GLGGAC,DFG6D6LF,E4CGECAA,C"
->"ADCGGG4,FDLDGDDG,B6GA5FBB,GAFCLG6A,GFAL6LLC,75"
->"T48Y5Y,DFDFDDGL,CEEFD4D4,BCGDGGGL,G64A3G6L,6DG"
->"GDCLG,G4LZCZ5F,CDCA666A,6DDADFEG,GDLFEDLA,CFL6"
->"GLEG,GLCLD6BG,6C6EG4C6,G6CFGGCF,37T448Q4,GC6FC"
->"4D4,G44CCA43,4DDGGBEE,DFDL464D,4GD4GFC3,DAL4A6"
->"6C,BECF66DC,A4BB2GAG,66C4CEDD,L4CDGFAL,LL3DCDG"
->"A,LF43GCED,FDGAGE6D,LGFAFAGF,F6EGLLDF,GLLGDDC3"
->",DDFL6CEC,4CDAFGGA,4DLG"
|
:004216DA BF9C8C4900 mov edi, 00498C9C
:004216DF 83C9FF or ecx, FFFFFFFF
:004216E2 F2 repnz
:004216E3 AE scasb
:004216E4 F7D1 not ecx
<===ecx=7E0
:004216E6 2BF9 sub edi, ecx
:004216E8 8BC1 mov eax, ecx
:004216EA 8BF7 mov esi, edi
:004216EC 8BFA mov edi, edx
:004216EE 8D9424A8080000 lea edx, dword ptr [esp+000008A8]
:004216F5 C1E902 shr ecx, 02
<===ecx=7E0 div 04=1F8
:004216F8 F3 repz
:004216F9 A5 movsd
:004216FA 8BC8 mov ecx, eax
:004216FC 33C0 xor eax, eax
:004216FE 83E103 and ecx, 00000003
:00421701 F3 repz
:00421702 A4 movsb

* Possible StringData Ref from Code Obj ->"DCKJDGDK,DEKC6JGD,EKK6EBKJ,KKJDDJ6J,JKGAKADJ,K"
->"7H6JJKD,AKGHKDKJ,GKD7DK6K,DKJGFKKG,HJD2HKKD,DD"
->"DDH6JK,2GK3KADJ,KBCKDDJK,JACGJJHK,66CJCK3H,JDK"
->"DJKJK,HC3K37GJ,2FJFCKKC,2HKBBKB6,KJJKBG3C,KGJK"
->"BDGD,D6KKJGHC,FKJD2GKK,6DDJKDJH,DG6HH26D,3GG6J"
->"FGG,KKKGKF3J,GFKCCGDK,6HBHKK66,HJK67K6G,9JHGA3"
->"AK,GCDXLFX5,GF2E3KKK,A6E2CIDA,K3DKGDKF,363HH6K"
->"E,KDDKG6CD,J27EJ6JJ,KDCDDDKJ,JE2DBDC7,KKDJ6DAE"
->",3KHCKFGK,3K6J6HCD,DHK6"
|
:00421703 BFC4844900 mov edi, 004984C4
:00421708 83C9FF or ecx, FFFFFFFF
:0042170B F2 repnz
:0042170C AE scasb
:0042170D F7D1 not ecx
<===ecx=7D7
:0042170F 2BF9 sub edi, ecx
:00421711 8BC1 mov eax, ecx
:00421713 8BF7 mov esi, edi
:00421715 8BFA mov edi, edx
:00421717 8D942440110000 lea edx, dword ptr [esp+00001140]
:0042171E C1E902 shr ecx, 02
<===ecx=7D7 div 04=1F5
:00421721 F3 repz
:00421722 A5 movsd
:00421723 8BC8 mov ecx, eax
:00421725 33C0 xor eax, eax
:00421727 83E103 and ecx, 00000003
:0042172A F3 repz
:0042172B A4 movsb

* Possible StringData Ref from Code Obj ->"KK8KKBKE,JEEKDKKD,8FKGEFEB,JKHFK2JK,DGGXBFGK,F"
->"K7HK5C6,6JJFGD8K,58B7XKJK,FXKGFKG7,GGXGBJJK,K2"
->"JJ8JBJ,9BDK8DKK,85C5JHGJ,BXKKFKJK,JFD2KFXF,KJF"
->"5KKXG,K8CXFFKF,8KKJH5DF,CJKJBDKJ,HH8XKKFJ,JCK6"
->"X5FH,FCH8F8GK,8KJFKJFF,K59KHRBK,ACKGC8DC,KHDFK"
->"E5J,95FCKFGK,KKGFKH5K,J786JF9C,KJJ9F5G5,FFXCKH"
->"K8,FB7FECWW,ZFD8I7XK,K5FEJ87K,JKJJHCX9,7KKJDJK"
->"X,9BKF6CXE,GCHECA9L,FXHKE65F,89KGFF6X,DGF7JDJK"
->",7GXEKDKC,K8GJHF7J,JBJD"
|
:0042172C BF90814900 mov edi, 00498190
:00421731 83C9FF or ecx, FFFFFFFF
:00421734 F2 repnz
:00421735 AE scasb
:00421736 F7D1 not ecx
<===ecx=333
:00421738 2BF9 sub edi, ecx
:0042173A 8BC1 mov eax, ecx
:0042173C 8BF7 mov esi, edi
:0042173E 8BFA mov edi, edx
:00421740 C1E902 shr ecx, 02
<===ecx=333 div 04=CC
:00421743 F3 repz
:00421744 A5 movsd
:00421745 8BC8 mov ecx, eax
:00421747 83E103 and ecx, 00000003
:0042174A F3 repz
:0042174B A4 movsb

* Possible StringData Ref from Code Obj ->"XC2C2FXC,H3XLZE2F,XHH2XFZE,CZ3EYFA3,FZFACAX2,E"
->"DG2EG2Y,AZFLHCHE,FDEDECAC,CA9FEI2G,G3XZLZHX,VX"
->"2WFLFF,ZFZVLAXG,ZFC2CC3Z,3A9F2GLZ,22YE4ZVG,GXZ"
->"EEZFD,GCVYVDFF,ZE2ECHZ9,3WA22HXA,Z33DFFVY,CFGC"
->"FEFE,X2HZ2FLC,E22EZF2L,CVKKCK8K,EF2LGZ2Y,XWZLZ"
->"YD2,ZHHFLEV3,FEECYFXZ,2GFLDZAA,L2HADH2F,FCV3F2"
->"AX,8C9X4CHA,FFZXV2EE,LXGGFH9F,ZVEEFCEF,V2VG5AH"
->"X,ZEY2F25C,2ZDXEA32,LX9CYCH3,2XZCFY9D,ZZE2AEAX"
->",VHG9DFFZ,VE232GYC,YGE2"
|
:0042174C BFB8794900 mov edi, 004979B8
:00421751 83C9FF or ecx, FFFFFFFF
:00421754 33C0 xor eax, eax
:00421756 8D942470220000 lea edx, dword ptr [esp+00002270]
:0042175D F2 repnz
:0042175E AE scasb
:0042175F F7D1 not ecx
<===ecx=7D7
:00421761 2BF9 sub edi, ecx
:00421763 8BC1 mov eax, ecx
:00421765 8BF7 mov esi, edi
:00421767 8BFA mov edi, edx
:00421769 8D9424D8190000 lea edx, dword ptr [esp+000019D8]
:00421770 C1E902 shr ecx, 02
<===ecx=7D7 div 04=1F5
:00421773 F3 repz
:00421774 A5 movsd
:00421775 8BC8 mov ecx, eax
:00421777 83E103 and ecx, 00000003
:0042177A F3 repz
:0042177B A4 movsb
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆

:0042177C 8D4C240E lea ecx, dword ptr [esp+0E]
:00421780 51 push ecx
<===ecx指向在内存中表示为:
0079544A 2C 00 45 4C 34 49 43 47 45 34 2C 47 46 41 34 43 ,.EL4ICGE4,GFA4C
0079545A 47 47 42 2C 45 36 47 4C 47 47 41 43 2C 44 46 47 GGB,E6GLGGAC,DFG
0079546A 36 44 36 4C 46 2C 45 34 43 47 45 43 41 41 2C 43 6D6LF,E4CGECAA,C
0079547A 41 44 43 47 47 47 34 2C 46 44 4C 44 47 44 44 47 ADCGGG4,FDLDGDDG
0079548A 2C 42 36 47 41 35 46 42 42 2C 47 41 46 43 4C 47 ,B6GA5FBB,GAFCLG
0079549A 36 41 2C 47 46 41 4C 36 4C 4C 43 2C 37 35 54 34 6A,GFAL6LLC,75T4
.......................(略,好多哦!)
:00421781 52 push edx
<===edx指向在内存中表示为:
00796E14 39 47 44 44 43 43 47 39 2C 33 39 44 47 43 46 47 9GDDCCG9,39DGCFG
00796E24 39 2C 39 46 39 44 47 32 39 43 2C 44 39 47 32 47 9,9F9DG29C,D9G2G
00796E34 34 46 45 2C 45 34 45 43 44 43 47 45 2C 36 34 33 4FE,E4ECDCGE,643
00796E44 43 32 45 33 39 2C 43 43 47 39 44 34 34 45 2C 58 C2E39,CCG9D44E,X
00796E54 34 47 39 36 33 34 57 2C 47 47 32 44 39 47 45 58 4G9634W,GG2D9GEX
00796E64 2C 45 45 32 39 39 39 44 43 2C 39 41 33 32 46 45 ,EE2999DC,9A32FE
................(略,也是很多哦!就是正确的注册码随便挑一个吧!)

:00421782 E851EE0200 call 004505D8
<===这个Call我也跟进去,可是看了半天也没看
出与我们输入的信息有何关系!
★★★★★★★★★★★★★★★★★★★★★★★★★
上面这么多代码看起来很复杂,但以我的菜鸟水平实在看不出与我们所输入的用户名
或注册码有何关系,猜想是故意迷惑我们cracker的视线,我认为最后的结果在每台机
器上应该是一样的.还请高手指正!
:00421787 8BBC24142B0000 mov edi, dword ptr [esp+00002B14]
<===edi="22072008912",试验码
:0042178E 83C408 add esp, 00000008
:00421791 85C0 test eax, eax
:00421793 744A je 004217DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004217DD(C)
|
:00421795 8BF7 mov esi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004217B9(C)
********************************************************************************
:00421797 8A10 mov dl, byte ptr [eax]
<===[eax]="9GDDCCG9",eax指向上面的内存
地址00796E14
:00421799 8A1E mov bl, byte ptr [esi]
<===[esi]="22072008912",试验码
:0042179D 3AD3 cmp dl, bl
:0042179F 751E jne 004217BF
:004217A1 84C9 test cl, cl
:004217A3 7416 je 004217BB
:004217A5 8A5001 mov dl, byte ptr [eax+01]
:004217A8 8A5E01 mov bl, byte ptr [esi+01]
:004217AB 8ACA mov cl, dl
:004217AD 3AD3 cmp dl, bl
:004217AF 750E jne 004217BF
:004217B1 83C002 add eax, 00000002
:004217B4 83C602 add esi, 00000002
:004217B7 84C9 test cl, cl
:004217B9 75DC jne 00421797
***************************************************************************
又是一个经典的比较句式!下面还有很多这种经典的比较,就是说注册码不止一个,有很
多哦!任君挑选! : )
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004217A3(C)
|
:004217BB 33C0 xor eax, eax
<===eax=0
:004217BD EB05 jmp 004217C4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042179F(C), :004217AF(C)
|
:004217BF 1BC0 sbb eax, eax
:004217C1 83D8FF sbb eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004217BD(U)
|
:004217C4 85C0 test eax, eax
:004217C6 0F84A6010000 je 00421972
:004217CC 8D44240E lea eax, dword ptr [esp+0E]
:004217D0 50 push eax
:004217D1 6A00 push 00000000
:004217D3 E800EE0200 call 004505D8
:004217D8 83C408 add esp, 00000008
:004217DB 85C0 test eax, eax
:004217DD 75B6 jne 00421795

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421793(C)
|
:004217DF 8D4C240E lea ecx, dword ptr [esp+0E]
:004217E3 8D542410 lea edx, dword ptr [esp+10]
:004217E7 51 push ecx
:004217E8 52 push edx
:004217E9 E8EAED0200 call 004505D8
:004217EE 83C408 add esp, 00000008
:004217F1 85C0 test eax, eax
:004217F3 744A je 0042183F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042183D(C)
|
:004217F5 8BF7 mov esi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421819(C)
|
:004217F7 8A10 mov dl, byte ptr [eax]
:004217F9 8A1E mov bl, byte ptr [esi]
:004217FB 8ACA mov cl, dl
:004217FD 3AD3 cmp dl, bl
:004217FF 751E jne 0042181F
:00421801 84C9 test cl, cl
:00421803 7416 je 0042181B
:00421805 8A5001 mov dl, byte ptr [eax+01]
:00421808 8A5E01 mov bl, byte ptr [esi+01]
:0042180B 8ACA mov cl, dl
:0042180D 3AD3 cmp dl, bl
:0042180F 750E jne 0042181F
:00421811 83C002 add eax, 00000002
:00421814 83C602 add esi, 00000002
:00421817 84C9 test cl, cl
:00421819 75DC jne 004217F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421803(C)
|
:0042181B 33C0 xor eax, eax
:0042181D EB05 jmp 00421824

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004217FF(C), :0042180F(C)
|
:0042181F 1BC0 sbb eax, eax
:00421821 83D8FF sbb eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042181D(U)
|
:00421824 85C0 test eax, eax
:00421826 0F8446010000 je 00421972
:0042182C 8D44240E lea eax, dword ptr [esp+0E]
:00421830 50 push eax
:00421831 6A00 push 00000000
:00421833 E8A0ED0200 call 004505D8
:00421838 83C408 add esp, 00000008
:0042183B 85C0 test eax, eax
:0042183D 75B6 jne 004217F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004217F3(C)
|
:0042183F 8D4C240E lea ecx, dword ptr [esp+0E]
:00421843 8D9424A8080000 lea edx, dword ptr [esp+000008A8]
:0042184A 51 push ecx
:0042184B 52 push edx
:0042184C E887ED0200 call 004505D8
:00421851 83C408 add esp, 00000008
:00421854 85C0 test eax, eax
:00421856 744A je 004218A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004218A0(C)
|
:00421858 8BF7 mov esi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042187C(C)
|
:0042185A 8A10 mov dl, byte ptr [eax]
:0042185C 8A1E mov bl, byte ptr [esi]
:0042185E 8ACA mov cl, dl
:00421860 3AD3 cmp dl, bl
:00421862 751E jne 00421882
:00421864 84C9 test cl, cl
:00421866 7416 je 0042187E
:00421868 8A5001 mov dl, byte ptr [eax+01]
:0042186B 8A5E01 mov bl, byte ptr [esi+01]
:0042186E 8ACA mov cl, dl
:00421870 3AD3 cmp dl, bl
:00421872 750E jne 00421882
:00421874 83C002 add eax, 00000002
:00421877 83C602 add esi, 00000002
:0042187A 84C9 test cl, cl
:0042187C 75DC jne 0042185A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421866(C)
|
:0042187E 33C0 xor eax, eax
:00421880 EB05 jmp 00421887

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421862(C), :00421872(C)
|
:00421882 1BC0 sbb eax, eax
:00421884 83D8FF sbb eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421880(U)
|
:00421887 85C0 test eax, eax
:00421889 0F84E3000000 je 00421972
:0042188F 8D44240E lea eax, dword ptr [esp+0E]
:00421893 50 push eax
:00421894 6A00 push 00000000
:00421896 E83DED0200 call 004505D8
:0042189B 83C408 add esp, 00000008
:0042189E 85C0 test eax, eax
:004218A0 75B6 jne 00421858

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421856(C)
|
:004218A2 8D4C240E lea ecx, dword ptr [esp+0E]
:004218A6 8D942440110000 lea edx, dword ptr [esp+00001140]
:004218AD 51 push ecx
:004218AE 52 push edx
:004218AF E824ED0200 call 004505D8
:004218B4 83C408 add esp, 00000008
:004218B7 85C0 test eax, eax
:004218B9 744A je 00421905

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421903(C)
|
:004218BB 8BF7 mov esi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004218DF(C)
|
:004218BD 8A10 mov dl, byte ptr [eax]
:004218BF 8A1E mov bl, byte ptr [esi]
:004218C1 8ACA mov cl, dl
:004218C3 3AD3 cmp dl, bl
:004218C5 751E jne 004218E5
:004218C7 84C9 test cl, cl
:004218C9 7416 je 004218E1
:004218CB 8A5001 mov dl, byte ptr [eax+01]
:004218CE 8A5E01 mov bl, byte ptr [esi+01]
:004218D1 8ACA mov cl, dl
:004218D3 3AD3 cmp dl, bl
:004218D5 750E jne 004218E5
:004218D7 83C002 add eax, 00000002
:004218DA 83C602 add esi, 00000002
:004218DD 84C9 test cl, cl
:004218DF 75DC jne 004218BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004218C9(C)
|
:004218E1 33C0 xor eax, eax
:004218E3 EB05 jmp 004218EA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004218C5(C), :004218D5(C)
|
:004218E5 1BC0 sbb eax, eax
:004218E7 83D8FF sbb eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004218E3(U)
|
:004218EA 85C0 test eax, eax
:004218EC 0F8480000000 je 00421972
:004218F2 8D44240E lea eax, dword ptr [esp+0E]
:004218F6 50 push eax
:004218F7 6A00 push 00000000
:004218F9 E8DAEC0200 call 004505D8
:004218FE 83C408 add esp, 00000008
:00421901 85C0 test eax, eax
:00421903 75B6 jne 004218BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004218B9(C)
|
:00421905 8D4C240E lea ecx, dword ptr [esp+0E]
:00421909 8D942470220000 lea edx, dword ptr [esp+00002270]
:00421910 51 push ecx
:00421911 52 push edx
:00421912 E8C1EC0200 call 004505D8
:00421917 83C408 add esp, 00000008
:0042191A 85C0 test eax, eax
:0042191C 7446 je 00421964

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421962(C)
|
:0042191E 8BF7 mov esi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421942(C)
|
:00421920 8A10 mov dl, byte ptr [eax]
:00421922 8A1E mov bl, byte ptr [esi]
:00421924 8ACA mov cl, dl
:00421926 3AD3 cmp dl, bl
:00421928 751E jne 00421948
:0042192A 84C9 test cl, cl
:0042192C 7416 je 00421944
:0042192E 8A5001 mov dl, byte ptr [eax+01]
:00421931 8A5E01 mov bl, byte ptr [esi+01]
:00421934 8ACA mov cl, dl
:00421936 3AD3 cmp dl, bl
:00421938 750E jne 00421948
:0042193A 83C002 add eax, 00000002
:0042193D 83C602 add esi, 00000002
:00421940 84C9 test cl, cl
:00421942 75DC jne 00421920

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042192C(C)
|
:00421944 33C0 xor eax, eax
:00421946 EB05 jmp 0042194D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421928(C), :00421938(C)
|
:00421948 1BC0 sbb eax, eax
:0042194A 83D8FF sbb eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421946(U)
|
:0042194D 85C0 test eax, eax
:0042194F 7421 je 00421972
:00421951 8D44240E lea eax, dword ptr [esp+0E]
:00421955 50 push eax
:00421956 6A00 push 00000000
:00421958 E87BEC0200 call 004505D8
:0042195D 83C408 add esp, 00000008
:00421960 85C0 test eax, eax
:00421962 75BA jne 0042191E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042191C(C)
|
:00421964 5F pop edi
:00421965 5E pop esi
:00421966 33C0 xor eax, eax
:00421968 5B pop ebx
:00421969 81C4FC2A0000 add esp, 00002AFC
:0042196F C20400 ret 0004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004217C6(C), :00421826(C), :00421889(C), :004218EC(C), :0042194F(C)
|
:00421972 5F pop edi
:00421973 5E pop esi
:00421974 B801000000 mov eax, 00000001
<===eax=1!
:00421979 5B pop ebx
:0042197A 81C4FC2A0000 add esp, 00002AFC
:00421980 C20400 ret 0004

【总结】:注册码与用户名无关,程序中内置了许多固定的注册码,随便挑一个就可以了.
软件将注册信息保存在C:\Windows\文件夹下的mgutil_win.ini文件中.
给出一个可用的注册码:
用户名:ShenGe[BCG]
注册码:9GDDCCG9
Cracked By ShenGe[BCG] 2003.07.05