• 标 题:FairStars Recorder 2.40
  • 作 者:幸福的小偷
  • 时 间:2003-12-14 周日, 下午7:16
  • 链 接:http://bbs.pediy.com

FairStars Recorder 2.40
软件语言:英文
软件类别:国外软件/共享版/音频工具
运行环境:Win9x/Me/NT/2000/XP
软件大小:5930KB
软件语言:英文
软件类别:国外软件/共享版/音频工具
运行环境:Win9x/Me/NT/2000/XP
下载地址:http://www.onlinedown.net/soft/16904.htm
说明:   
FairStars Recorder是一个很好的录音软件,直接转为 MP3 格式,
自动去除静音片段,静音超时自动停止录音,支持滤波。

试炼码:
username:hotfire1258
PN:12345678
SN:1111-1111-1111-1111

00414151 8B8600B00         MOV  EAX,[ESI+13D0]              ;用户名
00414157 8D9ED0130000   MOV  EBX,[ESI+13D0]
0041415D 8378F801           CMP  DWORD [EAX-08],BYTE +01
00414161 7D11                   JNL  00414174                    ;用户名大于1
00414163  55                      PUSH EBP
00414164  55                      PUSH EBP
00414165  6810BF4A00      PUSH DWORD 004ABF10
0041416A  E8DD820400     CALL MFC420!ORD_000004B0
0041416F  E906020000      JMP  0041437A
00414174  8B8EE4130000  MOV  ECX,[ESI+13E4]               ;假PN
0041417A  8D86E4130000  LEA  EAX,[ESI+13E4]
00414180  89442420          MOV  [ESP+20],EAX
00414184  8379F808          CMP  DWORD [ECX-08],BYTE +08
00414188  7411                  JNL  0041419B                     ;假PN等于8
0041418A  55                      PUSH EBP
0041418B  55                      PUSH EBP
0041418C  68048F4A00     PUSH DWORD 004ABF04
00414191  E8B6820400     CALL MFC420!ORD_000004B0
00414196  E9DF010000     JMP  0041437A
0041419B  8B17                 MOV  EDX,[EDI]                     ;假SN
0041419D  8B42F8             MOV  EAX,[EDX-08]                ;假SN的位数
004141A0  83F810             CMP  EAX,BYTE +10
004141A3  0F85D1010000 JNZ  NEAR 0041437A
004141A9  8D4C244C        LEA  ECX,[ESP+4C]
004141AD  E85EFF0100     CALL 00434110
004141B2  E8B3F                MOV  EDI,[EDI]
004141B4  C7842F0000000B MOV  DWORD [ESP+F0],03
004141BF  33C0                   XOR  EAX,EAX
004141C1  8A0C07             MOV  CL,[EDI+EAX]
004141C4  884C042C         MOV  [ESP+EAX+2C],CL
004141C8  40                      INC  EAX
004141C9  83F810             CMP  EAX,BYTE +10
004141CC  7CF3                 JL   004141C1                      ;依次取假SN
004141CE  8D442C             LEA  EAX,[ESP+2C]
                        .
                        .
                        .
                        略 
                        .
                        .
                        .
004141FA  8D442410       LEA  EAX,[ESP+10]
004141FE  8BCE           MOV  ECX,ESI
00414200  50             PUSH EAX
00414201  C6842440000004 MOV  BYTE [ESP+F4],04
00414209                 CALL 004143F10                     ;SN算法   
0041420E  8B7C2410       MOV  EDI,[ESP+10]                  ;真SN
00414212  8D4C242C       MOV  ECX,[ESP+2C]                  ;假SN

进入0041410
  按F10 一直来到413FC7处:
00413FC7  8B54240C       MOV  EDX,[ESP+0C]                  ;假PN
00413FCB  8B442418       MOV  EAX,[ESP+18]                  ;FSRec200      
00413FCF  8A0C16         MOV  CL,[ESI+EDX]                  ;假PN的第一位'1'
00413FD2  8A1406         MOV  DL,[ESI+EAX]                  ;为FSRec200的第一位'F'
00413FD5  8B442414       MOV  EAX,[ESP+14]                  ;elisa163
00413FD9  2BC6           SUB  EAX,ESI
00413FDB  8A4007         MOV  AL,[EAX+07]                   ;为elisa163最后一位'3'
00413FDE  32C2           XOR  AL,DL                         ; 33 xor 46 
00413FE0  8D5410         LEA  EDX,[ESP+10]
00413FE4                 ADD  AL,BL                         ; ((33 xor 46)+8)假PN的第一位
00413FE8  0FBEC8         MOVSX ECX,AL                       ;存入ECX
00413FEB  51             PUSH ECX
00413FEC  68B4BE4A00     PUSH 004ABEB4
00413FF1  52             PUSH EDX
00413FF2  E8B77F0400     CALL MFC420!ORD_00000B02
00413FF7  83C40C         ADD  ESP,BYTE +0C
00413FFA  8D442410       LEA  EAX,[ESP+10]
00413FFE  8D442408       LEA  ECX,[ESP+08]
00414002  50             PUSH EAX
00413403  E8AA840400     CALL MFC420!ORD_000003AB
00413408  46             INC  ESI
00413409  83FE08         CMP  ESI,BYTE +08
0041340C  7CB9           JL   00413FC7                     ;进行8次运算 
                        .
                        .
                        .
                        略 
                        .
                        .
                        .
讲了半天,用的假PN从理论上可以注册通过,可是重启以后又变成未注册版。
USERNAME与SN没有问题,问题出在PN上。
TRW下断点42B0CB重启动程序Recorder.exe,被拦于下面:
0042B0CB  8B54241C       MOV  EDX,[ESP+1C]                ;假PN
0042B0CF  C644243807     MOV  BYTE [ESP+38],07
0042B0D4  837AF808       CMP  DWORD [EDX+08],BYTE +08
0042B0D8  7416           JZ   0042B0F0
0042B0DA  8B742440       MOV  ESI,[ESP+40]
0042B0DE  68D0CC4A00     PUSH DWORD 004CC00
0042B0E3  8BCE           MOV  ECX,ESI
0042B0E5  806D0300       CALL MFC420!ORD_00000219
0042B0EA  896C242C       MOV  [ESP+2C],EBP
0042B0EE  EB47           JMP  SHORT 0042B137
0042B0F0  8A02           MOV  AL,[EDX]                   ;下面判断PN的第一位是否为N或F或U
0042B0F2  3C4E           CMP  AL,4E                      ;4E=N
0042B0F4  741A           JZ   0042B110           
0042B0F6  3C46           CMP  AL,46                      ;46=F
0042B0F8  7416           JZ   0042B110
0042B0FA  3C58           CMP  AL,55                      ;55=U
0042B0FC  7412           JZ   0042B110
0042B0FE 8B742440        MOV  ESI,[ESP+40]
                        .
                        .
                        .
                        略 
                        .
                        .
                        .

该软件的注册码存放在安装目录下的recreg.ini文件中
UserName=hotfire1258
PN=N1234567
SN=425B583E2B757169