对象：Super Mp3 Recorder Professional V5.0
介绍：一个非常不错的录音软件，家里刚好有电视卡，正好用它来录一下节目或歌曲。
下载：www.newhua.com
作者：lordor[CCG][BCG][DFCG]
Mail:lordor@sina.com
QQ：88378557
目的：属技术交流，无其它目的，请不要任意散布或用作商业用途。初学破解,如有不对的地方欢迎批评指出。
工具：ollydbg1.09C,fi301,w32Dasm
假设：
用户名：lordor
注册码：98765432109876543210(共20位，为什么，请看下面)
出错后，在内存中搜索出错信息，下内存断点，定位下面信息，或用messageboxa下断
0041AF70 > \6A FF PUSH -1
0041AF72 . 68 30374C00 PUSH smrpro.004C3730 SE handler installation
0041AF77 . 64:A1 0000000>MOV EAX,DWORD PTR FS:[0]
0041AF7D . 50 PUSH EAX
0041AF7E . 64:8925 00000>MOV DWORD PTR FS:[0],ESP
0041AF85 . 83EC 40 SUB ESP,40
0041AF88 . 53 PUSH EBX
0041AF89 . 55 PUSH EBP
0041AF8A . 56 PUSH ESI
0041AF8B . 57 PUSH EDI
0041AF8C . 8BF1 MOV ESI,ECX
0041AF8E . 6A 01 PUSH 1
0041AF90 . 897424 14 MOV DWORD PTR SS:[ESP+14],ESI
0041AF94 . E8 D2F10700 CALL smrpro.0049A16B
0041AF99 . 68 027F0000 PUSH 7F02 /RsrcName = IDC_WAIT
0041AF9E . 6A 00 PUSH 0 |hInst = NULL
0041AFA0 . FF15 80375300 CALL DWORD PTR DS:[<&USER32.LoadCursorA>>; \LoadCursorA
0041AFA6 . 50 PUSH EAX /hCursor
0041AFA7 . FF15 94375300 CALL DWORD PTR DS:[<&USER32.SetCursor>] \SetCursor
0041AFAD . 68 88130000 PUSH 1388 /Timeout = 5000. ms
0041AFB2 . FF15 68325300 CALL DWORD PTR DS:[<&KERNEL32.Sleep>] \Sleep ==>5秒
0041AFB8 . 8B6E 5C MOV EBP,DWORD PTR DS:[ESI+5C] ==>注册码
0041AFBB . BE E4674E00 MOV ESI,smrpro.004E67E4 ASCII "4L14A67H9P72Z569WY90"
0041AFC0 . 8BC5 MOV EAX,EBP ==>注册码地址
0041AFC2 > 8A10 MOV DL,BYTE PTR DS:[EAX] =>注册码依次入dl
0041AFC4 . 8A1E MOV BL,BYTE PTR DS:[ESI] =>密码串依次入
0041AFC6 . 8ACA MOV CL,DL
0041AFC8 . 3AD3 CMP DL,BL
0041AFCA . 75 1E JNZ SHORT smrpro.0041AFEA ==>是否相等
0041AFCC . 84C9 TEST CL,CL
0041AFCE . 74 16 JE SHORT smrpro.0041AFE6
0041AFD0 . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
0041AFD3 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
0041AFD6 . 8ACA MOV CL,DL
0041AFD8 . 3AD3 CMP DL,BL
0041AFDA . 75 0E JNZ SHORT smrpro.0041AFEA
0041AFDC . 83C0 02 ADD EAX,2
0041AFDF . 83C6 02 ADD ESI,2
0041AFE2 . 84C9 TEST CL,CL
0041AFE4 .^ 75 DC JNZ SHORT smrpro.0041AFC2
0041AFE6 > 33DB XOR EBX,EBX
0041AFE8 . EB 05 JMP SHORT smrpro.0041AFEF
0041AFEA > 1BDB SBB EBX,EBX
0041AFEC . 83DB FF SBB EBX,-1
0041AFEF > BE C8674E00 MOV ESI,smrpro.004E67C8 ASCII "#j14NeRo111143000059"
0041AFF4 . 8BC5 MOV EAX,EBP
0041AFF6 > 8A10 MOV DL,BYTE PTR DS:[EAX]
0041AFF8 . 8ACA MOV CL,DL
0041AFFA . 3A16 CMP DL,BYTE PTR DS:[ESI] ==>再与串比较
0041AFFC . 75 1C JNZ SHORT smrpro.0041B01A
0041AFFE . 84C9 TEST CL,CL
0041B000 . 74 14 JE SHORT smrpro.0041B016
0041B002 . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
0041B005 . 8ACA MOV CL,DL
0041B007 . 3A56 01 CMP DL,BYTE PTR DS:[ESI+1]
0041B00A . 75 0E JNZ SHORT smrpro.0041B01A
0041B00C . 83C0 02 ADD EAX,2
0041B00F . 83C6 02 ADD ESI,2
0041B012 . 84C9 TEST CL,CL
0041B014 .^ 75 E0 JNZ SHORT smrpro.0041AFF6
0041B016 > 33D2 XOR EDX,EDX
0041B018 . EB 05 JMP SHORT smrpro.0041B01F
0041B01A > 1BD2 SBB EDX,EDX
0041B01C . 83DA FF SBB EDX,-1
0041B01F > 8BFD MOV EDI,EBP
0041B021 . 83C9 FF OR ECX,FFFFFFFF
0041B024 . 33C0 XOR EAX,EAX
0041B026 . F2:AE REPNE SCAS BYTE PTR ES:[EDI]
0041B028 . F7D1 NOT ECX
0041B02A . 49 DEC ECX
0041B02B . 83F9 14 CMP ECX,14 ==>注册码长度是否为20位
0041B02E . 0F85 E5020000 JNZ smrpro.0041B319
0041B034 . 85DB TEST EBX,EBX
0041B036 . 0F84 DD020000 JE smrpro.0041B319
0041B03C . 85D2 TEST EDX,EDX
0041B03E . 0F84 D5020000 JE smrpro.0041B319
0041B044 . 807D 05 30 CMP BYTE PTR SS:[EBP+5],30 ==>第六位是否为0
0041B048 . 75 16 JNZ SHORT smrpro.0041B060
0041B04A . 807D 06 30 CMP BYTE PTR SS:[EBP+6],30 ==>第七位
0041B04E . 75 10 JNZ SHORT smrpro.0041B060
0041B050 . 807D 07 30 CMP BYTE PTR SS:[EBP+7],30 ==>第八位
0041B054 . 75 0A JNZ SHORT smrpro.0041B060
0041B056 . 807D 08 30 CMP BYTE PTR SS:[EBP+8],30 ==>第九位
0041B05A . 0F84 B9020000 JE smrpro.0041B319
0041B060 > 33C9 XOR ECX,ECX
0041B062 . 8BD5 MOV EDX,EBP ==>注册码入
0041B064 > 8A02 MOV AL,BYTE PTR DS:[EDX] ==>注册码依次入al
0041B066 . 3C 61 CMP AL,61 ==>是否为'a'
0041B068 . 7C 06 JL SHORT smrpro.0041B070 ==>如果注册码是HEX值是小于61或大于66则左移4位，否则减去57（HEX）
0041B06A . 3C 66 CMP AL,66
0041B06C . 7F 02 JG SHORT smrpro.0041B070
0041B06E . 2C 07 SUB AL,7
0041B070 > C0E0 04 SHL AL,4 ==>左移4位
0041B073 . 88440C 44 MOV BYTE PTR SS:[ESP+ECX+44],AL ==>保存
0041B077 . 8A42 01 MOV AL,BYTE PTR DS:[EDX+1] ==>下一位注册码
0041B07A . 3C 61 CMP AL,61
0041B07C . 7C 08 JL SHORT smrpro.0041B086
0041B07E . 3C 66 CMP AL,66
0041B080 . 7F 04 JG SHORT smrpro.0041B086
0041B082 . 2C 57 SUB AL,57
0041B084 . EB 02 JMP SHORT smrpro.0041B088
0041B086 > 2C 30 SUB AL,30 ==>
0041B088 > 8A5C0C 44 MOV BL,BYTE PTR SS:[ESP+ECX+44] ==>前一位保存的注册码
0041B08C . 83C2 02 ADD EDX,2 ==>指向下两位注册码
0041B08F . 02D8 ADD BL,AL ==>两位注册码转换为十六进制，bl=98
0041B091 . 885C0C 44 MOV BYTE PTR SS:[ESP+ECX+44],BL ==>保存
0041B095 . 41 INC ECX
0041B096 . 83F9 0A CMP ECX,0A
0041B099 .^ 7C C9 JL SHORT smrpro.0041B064 ==>循环，20位注册码转换为如下形式：
-------------------------------------------
0012D108 98 76 54 32 10 98 76 54 榲T2榲T
0012D110 32 10 2
-------------------------------------------
0041B09B . 6A 00 PUSH 0
0041B09D . 68 6C614E00 PUSH smrpro.004E616C ASCII "SMRPRO0000"
0041B0A2 . 8D4424 34 LEA EAX,DWORD PTR SS:[ESP+34]
0041B0A6 . 6A 0A PUSH 0A
0041B0A8 . 8D4C24 50 LEA ECX,DWORD PTR SS:[ESP+50] ==>上面转换的注册码地址
0041B0AC . 50 PUSH EAX
0041B0AD . 51 PUSH ECX
0041B0AE . E8 B169FEFF CALL smrpro.00401A64 ==>关键call
0041B0B3 . 8A4424 40 MOV AL,BYTE PTR SS:[ESP+40] ==>串D第1位
0041B0B7 . 83C4 14 ADD ESP,14
0041B0BA . 3C 72 CMP AL,72 ==>
0041B0BC . 0F85 0D020000 JNZ smrpro.0041B2CF
0041B0C2 . 807C24 2D 67 CMP BYTE PTR SS:[ESP+2D],67 ==>第二位
0041B0C7 . 0F85 02020000 JNZ smrpro.0041B2CF
0041B0CD . 807C24 34 63 CMP BYTE PTR SS:[ESP+34],63 ==>第九位
0041B0D2 . 0F85 F7010000 JNZ smrpro.0041B2CF
0041B0D8 . 807C24 35 78 CMP BYTE PTR SS:[ESP+35],78 ==>第十位
0041B0DD . 0F85 EC010000 JNZ smrpro.0041B2CF
0041B0E3 . 8A4424 2F MOV AL,BYTE PTR SS:[ESP+2F]
0041B0E7 . 8A5424 2E MOV DL,BYTE PTR SS:[ESP+2E]
0041B0EB . 8A4C24 30 MOV CL,BYTE PTR SS:[ESP+30]
0041B0EF . 884424 39 MOV BYTE PTR SS:[ESP+39],AL
0041B0F3 . 885424 38 MOV BYTE PTR SS:[ESP+38],DL
0041B0F7 . 8A5424 31 MOV DL,BYTE PTR SS:[ESP+31]
0041B0FB . 8D4424 38 LEA EAX,DWORD PTR SS:[ESP+38]
0041B0FF . 884C24 3A MOV BYTE PTR SS:[ESP+3A],CL
0041B103 . 50 PUSH EAX
0041B104 . 885424 3F MOV BYTE PTR SS:[ESP+3F],DL
0041B108 . C64424 40 00 MOV BYTE PTR SS:[ESP+40],0
0041B10D . E8 4E500400 CALL smrpro.00460160
0041B112 . 8A4C24 36 MOV CL,BYTE PTR SS:[ESP+36]
0041B116 . 8A5424 37 MOV DL,BYTE PTR SS:[ESP+37]
0041B11A . 8BF0 MOV ESI,EAX
0041B11C . 8D4424 3C LEA EAX,DWORD PTR SS:[ESP+3C]
0041B120 . 50 PUSH EAX
0041B121 . 884C24 40 MOV BYTE PTR SS:[ESP+40],CL
0041B125 . 885424 41 MOV BYTE PTR SS:[ESP+41],DL
0041B129 . C64424 42 00 MOV BYTE PTR SS:[ESP+42],0
0041B12E . E8 2D500400 CALL smrpro.00460160
0041B133 . 8BC8 MOV ECX,EAX
0041B135 . 8BC6 MOV EAX,ESI
0041B137 . 99 CDQ
0041B138 . BE 59000000 MOV ESI,59
0041B13D . 83C4 08 ADD ESP,8
0041B140 . F7FE IDIV ESI
0041B142 . BE 0D000000 MOV ESI,0D
0041B147 . 8BC2 MOV EAX,EDX
0041B149 . 99 CDQ
0041B14A . F7FE IDIV ESI
0041B14C . 3BD1 CMP EDX,ECX
0041B14E . 0F85 7B010000 JNZ smrpro.0041B2CF
0041B154 . 68 88614E00 PUSH smrpro.004E6188 ASCII "HotKeyString"
0041B159 . 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]
0041B15D . E8 350A0800 CALL smrpro.0049BB97
0041B162 . 33DB XOR EBX,EBX
0041B164 . 68 7C614E00 PUSH smrpro.004E617C ASCII "UserName"
0041B169 . 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20]
0041B16D . 895C24 5C MOV DWORD PTR SS:[ESP+5C],EBX
0041B171 . E8 210A0800 CALL smrpro.0049BB97
0041B176 . 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10]
0041B17A . C64424 58 01 MOV BYTE PTR SS:[ESP+58],1
0041B17F . 8B77 5C MOV ESI,DWORD PTR DS:[EDI+5C]
0041B182 . E8 C0570900 CALL smrpro.004B0947
0041B187 . 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20]
0041B18B . 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4]
0041B18E . 56 PUSH ESI /Arg3
0041B18F . 51 PUSH ECX |Arg2
0041B190 . 68 E8604E00 PUSH smrpro.004E60E8 |Arg1 = 004E60E8 ASCII "smr"
0041B195 . 8BC8 MOV ECX,EAX |
0041B197 . E8 EACF0800 CALL smrpro.004A8186 \smrpro.004A8186
0041B19C . 8B77 60 MOV ESI,DWORD PTR DS:[EDI+60]
0041B19F . E8 A3570900 CALL smrpro.004B0947
0041B1A4 . 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+1C]
0041B1A8 . 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4]
0041B1AB . 56 PUSH ESI /Arg3
0041B1AC . 52 PUSH EDX |Arg2
0041B1AD . 68 E8604E00 PUSH smrpro.004E60E8 |Arg1 = 004E60E8 ASCII "smr"
0041B1B2 . 8BC8 MOV ECX,EAX |
0041B1B4 . E8 CDCF0800 CALL smrpro.004A8186 \smrpro.004A8186
0041B1B9 . 68 C4674E00 PUSH smrpro.004E67C4
0041B1BE . 68 E8DA4E00 PUSH smrpro.004EDAE8 ASCII "C:\Program Files\Super Mp3 Recorder Professional\scheme.dat"
0041B1C3 . 891D 70DA4E00 MOV DWORD PTR DS:[4EDA70],EBX
0041B1C9 . E8 794B0400 CALL smrpro.0045FD47
0041B1CE . 8BF0 MOV ESI,EAX
0041B1D0 . 83C4 08 ADD ESP,8
0041B1D3 . 3BF3 CMP ESI,EBX
0041B1D5 . 74 18 JE SHORT smrpro.0041B1EF
0041B1D7 . 8B47 5C MOV EAX,DWORD PTR DS:[EDI+5C]
0041B1DA . 50 PUSH EAX
0041B1DB . 68 B4674E00 PUSH smrpro.004E67B4 ASCII "as341%sghn33
"
0041B1E0 . 56 PUSH ESI
0041B1E1 . E8 1E570400 CALL smrpro.00460904
0041B1E6 . 56 PUSH ESI
0041B1E7 . E8 774B0400 CALL smrpro.0045FD63
0041B1EC . 83C4 10 ADD ESP,10
0041B1EF > 8B0D 88774E00 MOV ECX,DWORD PTR DS:[4E7788] smrpro.004E779C
0041B1F5 . 894C24 14 MOV DWORD PTR SS:[ESP+14],ECX
0041B1F9 . 8D5424 14 LEA EDX,DWORD PTR SS:[ESP+14]
0041B1FD . 68 98674E00 PUSH smrpro.004E6798 ASCII "SOFTWARE\SMPPRO\SMPPRO"
0041B202 . 52 PUSH EDX
0041B203 . C64424 60 02 MOV BYTE PTR SS:[ESP+60],2
0041B208 . E8 172E0700 CALL smrpro.0048E024
0041B20D . 33F6 XOR ESI,ESI
0041B20F . 83C4 08 ADD ESP,8
0041B212 . 897424 24 MOV DWORD PTR SS:[ESP+24],ESI
0041B216 . 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14]
0041B21A . 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28]
0041B21E . 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18]
0041B222 . 50 PUSH EAX /pDisposition
0041B223 . 51 PUSH ECX |pHandle
0041B224 . 53 PUSH EBX |pSecurity
0041B225 . 68 3F000F00 PUSH 0F003F |Access = KEY_ALL_ACCESS
0041B22A . 53 PUSH EBX |Options
0041B22B . 53 PUSH EBX |Class
0041B22C . 53 PUSH EBX |Reserved
0041B22D . 52 PUSH EDX |Subkey
0041B22E . 68 02000080 PUSH 80000002 |hKey = HKEY_LOCAL_MACHINE
0041B233 . C64424 7C 03 MOV BYTE PTR SS:[ESP+7C],3 |
0041B238 . 895C24 3C MOV DWORD PTR SS:[ESP+3C],EBX |
0041B23C . FF15 0C2E5300 CALL DWORD PTR DS:[<&ADVAPI32.RegCreateK>; \RegCreateKeyExA
0041B242 . 3BC3 CMP EAX,EBX
0041B244 . 75 48 JNZ SHORT smrpro.0041B28E
0041B246 . 8B7F 5C MOV EDI,DWORD PTR DS:[EDI+5C]
0041B249 . 8B7424 18 MOV ESI,DWORD PTR SS:[ESP+18]
0041B24D . 8B2D 6C325300 MOV EBP,DWORD PTR DS:[<&KERNEL32.lstrlen>; KERNEL32.lstrlenA
0041B253 . 57 PUSH EDI /String
0041B254 . 897424 28 MOV DWORD PTR SS:[ESP+28],ESI |
0041B258 . FFD5 CALL EBP \lstrlenA
0041B25A . 8B1D 082E5300 MOV EBX,DWORD PTR DS:[<&ADVAPI32.RegSetV>; ADVAPI32.RegSetValueExA
0041B260 . 40 INC EAX
0041B261 . 50 PUSH EAX /BufSize
0041B262 . 57 PUSH EDI |Buffer
0041B263 . 6A 01 PUSH 1 |ValueType = REG_SZ
0041B265 . 6A 00 PUSH 0 |Reserved = 0
0041B267 . 68 8C674E00 PUSH smrpro.004E678C |ValueName = "Regcode"
0041B26C . 56 PUSH ESI |hKey
0041B26D . FFD3 CALL EBX \RegSetValueExA
0041B26F . 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10]
0041B273 . 8B78 60 MOV EDI,DWORD PTR DS:[EAX+60]
0041B276 . 57 PUSH EDI /String
0041B277 . FFD5 CALL EBP \lstrlenA
0041B279 . 40 INC EAX
0041B27A . 50 PUSH EAX /BufSize
0041B27B . 57 PUSH EDI |Buffer
0041B27C . 6A 01 PUSH 1 |ValueType = REG_SZ
0041B27E . 6A 00 PUSH 0 |Reserved = 0
0041B280 . 68 7C614E00 PUSH smrpro.004E617C |ValueName = "UserName"
0041B285 . 56 PUSH ESI |hKey
0041B286 . FFD3 CALL EBX \RegSetValueExA
0041B288 . 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10]
0041B28C . 33DB XOR EBX,EBX
0041B28E > 8BCF MOV ECX,EDI
0041B290 . E8 AC190800 CALL smrpro.0049CC41
0041B295 . 3BF3 CMP ESI,EBX
0041B297 . 74 07 JE SHORT smrpro.0041B2A0
0041B299 . 56 PUSH ESI /hKey
0041B29A . FF15 342E5300 CALL DWORD PTR DS:[<&ADVAPI32.RegCloseKe>; \RegCloseKey
0041B2A0 > 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]
0041B2A4 . C64424 58 01 MOV BYTE PTR SS:[ESP+58],1
0041B2A9 . E8 7B080800 CALL smrpro.0049BB29
0041B2AE . 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
0041B2B2 . C64424 58 00 MOV BYTE PTR SS:[ESP+58],0
0041B2B7 . E8 6D080800 CALL smrpro.0049BB29
0041B2BC . 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20]
0041B2C0 . C74424 58 FFF>MOV DWORD PTR SS:[ESP+58],-1
0041B2C8 . E8 5C080800 CALL smrpro.0049BB29
0041B2CD . EB 04 JMP SHORT smrpro.0041B2D3
0041B2CF > 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10]
0041B2D3 > 833D 70DA4E00>CMP DWORD PTR DS:[4EDA70],1
0041B2DA . 75 7F JNZ SHORT smrpro.0041B35B
0041B2DC . A1 6C674E00 MOV EAX,DWORD PTR DS:[4E676C]
0041B2E1 . 85C0 TEST EAX,EAX
0041B2E3 . 74 24 JE SHORT smrpro.0041B309
0041B2E5 . 33C9 XOR ECX,ECX
0041B2E7 > 8A81 5C674E00 MOV AL,BYTE PTR DS:[ECX+4E675C]
0041B2ED . 3C 20 CMP AL,20
0041B2EF . 74 08 JE SHORT smrpro.0041B2F9
0041B2F1 . FEC0 INC AL
0041B2F3 . 8881 5C674E00 MOV BYTE PTR DS:[ECX+4E675C],AL
0041B2F9 > 41 INC ECX
0041B2FA . 83F9 0E CMP ECX,0E
0041B2FD .^ 7C E8 JL SHORT smrpro.0041B2E7
0041B2FF . C705 6C674E00>MOV DWORD PTR DS:[4E676C],0
0041B309 > 6A 30 PUSH 30
0041B30B . 68 44644E00 PUSH smrpro.004E6444 ASCII "Help"
0041B310 . 68 5C674E00 PUSH smrpro.004E675C ASCII "Incorrect code"
0041B315 . 8BCF MOV ECX,EDI
0041B317 . EB 3D JMP SHORT smrpro.0041B356
0041B319 > A1 6C674E00 MOV EAX,DWORD PTR DS:[4E676C]
0041B31E . 85C0 TEST EAX,EAX
0041B320 . 74 24 JE SHORT smrpro.0041B346
0041B322 . 33C9 XOR ECX,ECX
0041B324 > 8A81 5C674E00 MOV AL,BYTE PTR DS:[ECX+4E675C]
0041B32A . 3C 20 CMP AL,20
0041B32C . 74 08 JE SHORT smrpro.0041B336
0041B32E . FEC0 INC AL
0041B330 . 8881 5C674E00 MOV BYTE PTR DS:[ECX+4E675C],AL
0041B336 > 41 INC ECX
0041B337 . 83F9 0E CMP ECX,0E
0041B33A .^ 7C E8 JL SHORT smrpro.0041B324
0041B33C . C705 6C674E00>MOV DWORD PTR DS:[4E676C],0
0041B346 > 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10]
0041B34A . 6A 30 PUSH 30
0041B34C . 68 44644E00 PUSH smrpro.004E6444 ASCII "Help"
0041B351 . 68 5C674E00 PUSH smrpro.004E675C ASCII "Incorrect code"
0041B356 > E8 27E10700 CALL smrpro.00499482
0041B35B > 68 007F0000 PUSH 7F00 /RsrcName = IDC_ARROW
0041B360 . 6A 00 PUSH 0 |hInst = NULL
0041B362 . FF15 80375300 CALL DWORD PTR DS:[<&USER32.LoadCursorA>>; \LoadCursorA
0041B368 . 50 PUSH EAX /hCursor
0041B369 . FF15 94375300 CALL DWORD PTR DS:[<&USER32.SetCursor>] \SetCursor
0041B36F . 8B4C24 50 MOV ECX,DWORD PTR SS:[ESP+50]
0041B373 . 5F POP EDI
关键call:00401A64
--------------------------------
00409120 > \81EC 04010000 SUB ESP,104
00409126 . 53 PUSH EBX
00409127 . 8B9C24 180100>MOV EBX,DWORD PTR SS:[ESP+118]
0040912E . 55 PUSH EBP
0040912F . 56 PUSH ESI
00409130 . 57 PUSH EDI
00409131 . 8BFB MOV EDI,EBX
00409133 . 83C9 FF OR ECX,FFFFFFFF
00409136 . 33C0 XOR EAX,EAX
00409138 . F2:AE REPNE SCAS BYTE PTR ES:[EDI]
0040913A . F7D1 NOT ECX
0040913C . 49 DEC ECX
0040913D . C64424 1C 03 MOV BYTE PTR SS:[ESP+1C],3
00409142 . 8BF9 MOV EDI,ECX
00409144 . C64424 1D 05 MOV BYTE PTR SS:[ESP+1D],5
00409149 . C64424 1E 07 MOV BYTE PTR SS:[ESP+1E],7
0040914E . C64424 1F 0B MOV BYTE PTR SS:[ESP+1F],0B
00409153 . C64424 20 0D MOV BYTE PTR SS:[ESP+20],0D
00409158 . C64424 21 11 MOV BYTE PTR SS:[ESP+21],11
0040915D . C64424 22 13 MOV BYTE PTR SS:[ESP+22],13
00409162 . C64424 23 17 MOV BYTE PTR SS:[ESP+23],17
00409167 . C64424 24 1D MOV BYTE PTR SS:[ESP+24],1D
0040916C . C64424 25 1F MOV BYTE PTR SS:[ESP+25],1F
00409171 . C64424 26 25 MOV BYTE PTR SS:[ESP+26],25
00409176 . C64424 27 29 MOV BYTE PTR SS:[ESP+27],29
0040917B . C64424 28 2B MOV BYTE PTR SS:[ESP+28],2B
00409180 . C64424 29 2F MOV BYTE PTR SS:[ESP+29],2F
00409185 . C64424 2A 35 MOV BYTE PTR SS:[ESP+2A],35
0040918A . C64424 2B 3B MOV BYTE PTR SS:[ESP+2B],3B
0040918F . C64424 2C 3D MOV BYTE PTR SS:[ESP+2C],3D
00409194 . C64424 2D 43 MOV BYTE PTR SS:[ESP+2D],43
00409199 . C64424 2E 47 MOV BYTE PTR SS:[ESP+2E],47
0040919E . C64424 2F 49 MOV BYTE PTR SS:[ESP+2F],49
004091A3 . C64424 30 4F MOV BYTE PTR SS:[ESP+30],4F
004091A8 . C64424 31 53 MOV BYTE PTR SS:[ESP+31],53
004091AD . C64424 32 59 MOV BYTE PTR SS:[ESP+32],59
004091B2 . C64424 33 61 MOV BYTE PTR SS:[ESP+33],61
004091B7 . C64424 34 65 MOV BYTE PTR SS:[ESP+34],65
004091BC . C64424 35 67 MOV BYTE PTR SS:[ESP+35],67
004091C1 . C64424 36 6B MOV BYTE PTR SS:[ESP+36],6B
004091C6 . C64424 37 6D MOV BYTE PTR SS:[ESP+37],6D
004091CB . C64424 38 71 MOV BYTE PTR SS:[ESP+38],71
004091D0 . C64424 39 7F MOV BYTE PTR SS:[ESP+39],7F
004091D5 . C64424 3A 83 MOV BYTE PTR SS:[ESP+3A],83
004091DA . C64424 3B 89 MOV BYTE PTR SS:[ESP+3B],89
004091DF . C64424 3C 8B MOV BYTE PTR SS:[ESP+3C],8B
004091E4 . C64424 3D 0E MOV BYTE PTR SS:[ESP+3D],0E
004091E9 . C64424 3E 97 MOV BYTE PTR SS:[ESP+3E],97
004091EE . C64424 3F 9D MOV BYTE PTR SS:[ESP+3F],9D
004091F3 . C64424 40 A3 MOV BYTE PTR SS:[ESP+40],0A3
004091F8 . C64424 41 A7 MOV BYTE PTR SS:[ESP+41],0A7
004091FD . C64424 42 AD MOV BYTE PTR SS:[ESP+42],0AD
00409202 . C64424 43 B3 MOV BYTE PTR SS:[ESP+43],0B3
00409207 . C64424 44 B5 MOV BYTE PTR SS:[ESP+44],0B5
0040920C . C64424 45 BF MOV BYTE PTR SS:[ESP+45],0BF
00409211 . C64424 46 C1 MOV BYTE PTR SS:[ESP+46],0C1
00409216 . C64424 47 C5 MOV BYTE PTR SS:[ESP+47],0C5
0040921B . C64424 48 C7 MOV BYTE PTR SS:[ESP+48],0C7
00409220 . C64424 49 D3 MOV BYTE PTR SS:[ESP+49],0D3
00409225 . C64424 4A DF MOV BYTE PTR SS:[ESP+4A],0DF
0040922A . C64424 4B E3 MOV BYTE PTR SS:[ESP+4B],0E3
0040922F . C64424 4C E5 MOV BYTE PTR SS:[ESP+4C],0E5
00409234 . C64424 4D E9 MOV BYTE PTR SS:[ESP+4D],0E9
00409239 . C64424 4E EF MOV BYTE PTR SS:[ESP+4E],0EF
0040923E . C64424 4F F1 MOV BYTE PTR SS:[ESP+4F],0F1
00409243 . C64424 50 FB MOV BYTE PTR SS:[ESP+50],0FB
00409248 . 897C24 64 MOV DWORD PTR SS:[ESP+64],EDI
生成密码串,(SS:[ESP+1C])
--------------------------------
0012CFB4 03 05 07 0B 0D 11 13 17 .
0012CFBC 1D 1F 25 29 2B 2F 35 3B %)+/5;
0012CFC4 3D 43 47 49 4F 53 59 61 =CGIOSYa
0012CFCC 65 67 6B 6D 71 7F 83 89 egkmq儔
0012CFD4 8B 0E 97 9D A3 A7 AD B3 ?棟＇
0012CFDC B5 BF C1 C5 C7 D3 DF E3 悼僚怯咩
0012CFE4 E5 E9 EF F1 FB D4 85 00 彘锺?
0012CFEC 01 00 00 00 0E 04 01 00 ....
0012CFF4 C8 D4 00 00 3C D0 12 00 仍.. 0012CFFC 0A 00 00 00 C8 D4 85 00 ....仍?
--------------------------------
0040924C . 78 20 JS SHORT SMRPRO.0040926E 生成密码串,53位
0040924E . 8D9424 DC0000>LEA EDX,DWORD PTR SS:[ESP+DC]
00409255 . 8D7424 6C LEA ESI,DWORD PTR SS:[ESP+6C]
00409259 . 2BD3 SUB EDX,EBX
0040925B . 8BC3 MOV EAX,EBX
0040925D . 2BF3 SUB ESI,EBX
0040925F . 8D5F 01 LEA EBX,DWORD PTR DS:[EDI+1]
00409262 > 8A08 MOV CL,BYTE PTR DS:[EAX]
00409264 . 880C02 MOV BYTE PTR DS:[EDX+EAX],CL
00409267 . 880C06 MOV BYTE PTR DS:[ESI+EAX],CL
0040926A . 40 INC EAX
0040926B . 4B DEC EBX
0040926C .^ 75 F4 JNZ SHORT SMRPRO.00409262 保存串A：SMRPRO0000
0040926E > 33DB XOR EBX,EBX
00409270 . 33C9 XOR ECX,ECX
00409272 . 33C0 XOR EAX,EAX
00409274 . 3BFB CMP EDI,EBX
00409276 . 7E 12 JLE SHORT SMRPRO.0040928A
00409278 > 33D2 XOR EDX,EDX
0040927A . 8A9404 DC0000>MOV DL,BYTE PTR SS:[ESP+EAX+DC]
00409281 . 03D0 ADD EDX,EAX
00409283 . 33CA XOR ECX,EDX
00409285 . 40 INC EAX
00409286 . 3BC7 CMP EAX,EDI
00409288 .^ 7C EE JL SHORT SMRPRO.00409278 SMRPRO0000，先各位与位置数相加，后一位与前一位作xor运算，结果保存在ecx=00000018
0040928A > 33C0 XOR EAX,EAX ecx=00000018
0040928C . 3BFB CMP EDI,EBX
0040928E . 7E 10 JLE SHORT SMRPRO.004092A0
00409290 > 8A5404 6C MOV DL,BYTE PTR SS:[ESP+EAX+6C] SMRPRO0000各位再与cl作xor运算
00409294 . 32D1 XOR DL,CL
00409296 . 41 INC ECX
00409297 . 885404 6C MOV BYTE PTR SS:[ESP+EAX+6C],DL
0040929B . 40 INC EAX
0040929C . 3BC7 CMP EAX,EDI
0040929E .^ 7C F0 JL SHORT SMRPRO.00409290
串B变为：(ESP+6C)
---------------------------------------
0012D004 4B 54 48 4B 4E 52 2E 2F KTHKNR./
0012D00C 10 11 00 01 01 00 00 00 ....
---------------------------------------
004092A0 > 33F6 XOR ESI,ESI
004092A2 . 3BFB CMP EDI,EBX
004092A4 . 7E 1A JLE SHORT SMRPRO.004092C0
004092A6 > 33C0 XOR EAX,EAX
004092A8 . BD 35000000 MOV EBP,35
004092AD . 8A4434 6C MOV AL,BYTE PTR SS:[ESP+ESI+6C] 变换的串B依次入al
004092B1 . 99 CDQ
004092B2 . F7FD IDIV EBP 除以35
004092B4 . 46 INC ESI
004092B5 . 3BF7 CMP ESI,EDI
004092B7 . 889434 A30000>MOV BYTE PTR SS:[ESP+ESI+A3],DL 保存余数
---------------------------------------------
[ESP+A3]:设为串C
0012D03C 16 1F 13 16 19 1D 2E 2F ./
0012D044 10 11 01 00 2B 75 4A 00 .+uJ.
---------------------------------------------
004092BE .^ 7C E6 JL SHORT SMRPRO.004092A6
004092C0 > 8BC1 MOV EAX,ECX ==>ECX=00000022
004092C2 . B9 35000000 MOV ECX,35
004092C7 . 99 CDQ
004092C8 . F7F9 IDIV ECX
004092CA . 8B8424 1C0100>MOV EAX,DWORD PTR SS:[ESP+11C]
004092D1 . 33F6 XOR ESI,ESI
004092D3 . 32C9 XOR CL,CL
004092D5 . 885C24 13 MOV BYTE PTR SS:[ESP+13],BL
004092D9 . 884C24 18 MOV BYTE PTR SS:[ESP+18],CL
004092DD . 885C24 14 MOV BYTE PTR SS:[ESP+14],BL
004092E1 . 895C24 54 MOV DWORD PTR SS:[ESP+54],EBX
004092E5 . 894424 58 MOV DWORD PTR SS:[ESP+58],EAX
004092E9 . 895424 5C MOV DWORD PTR SS:[ESP+5C],EDX 值22保存,[esp+5c]=edx
004092ED . 8B9424 180100>MOV EDX,DWORD PTR SS:[ESP+118] 注册码地址
004092F4 . 2BD0 SUB EDX,EAX
004092F6 . 895424 60 MOV DWORD PTR SS:[ESP+60],EDX
004092FA > 8B5424 60 MOV EDX,DWORD PTR SS:[ESP+60] edx=[esp+60]=18
004092FE . 8B4424 58 MOV EAX,DWORD PTR SS:[ESP+58] eax=[esp+58]
00409302 . 8BBC24 200100>MOV EDI,DWORD PTR SS:[ESP+120] edi=[esp+120]
00409309 . 0FBE0402 MOVSX EAX,BYTE PTR DS:[EDX+EAX] 两位注册码值入eax
0040930D . 8B5424 54 MOV EDX,DWORD PTR SS:[ESP+54] 计数器
00409311 . 3BD7 CMP EDX,EDI
00409313 . 0F83 26010000 JNB SMRPRO.0040943F
00409319 . 8B9424 280100>MOV EDX,DWORD PTR SS:[ESP+128]
00409320 . 85D2 TEST EDX,EDX
00409322 . 74 3F JE SHORT SMRPRO.00409363
00409324 . 8A5C34 6C MOV BL,BYTE PTR SS:[ESP+ESI+6C]
00409328 . 8A9434 DC0000>MOV DL,BYTE PTR SS:[ESP+ESI+DC]
0040932F . 8BFB MOV EDI,EBX
00409331 . 8BEA MOV EBP,EDX
00409333 . 81E7 FF000000 AND EDI,0FF
00409339 . 81E5 FF000000 AND EBP,0FF
0040933F . 33FD XOR EDI,EBP
00409341 . 8B6C24 14 MOV EBP,DWORD PTR SS:[ESP+14]
00409345 . 81E5 FF000000 AND EBP,0FF
0040934B . 884C24 14 MOV BYTE PTR SS:[ESP+14],CL
0040934F . 33FD XOR EDI,EBP
00409351 . 8B6C24 18 MOV EBP,DWORD PTR SS:[ESP+18]
00409355 . 81E5 FF000000 AND EBP,0FF
0040935B . 33FD XOR EDI,EBP
0040935D . 33C7 XOR EAX,EDI
0040935F . 8AC8 MOV CL,AL
00409361 . EB 43 JMP SHORT SMRPRO.004093A6
00409363 > 8A5C34 6C MOV BL,BYTE PTR SS:[ESP+ESI+6C] 变换串B依次入bl
00409367 . 8A9434 DC0000>MOV DL,BYTE PTR SS:[ESP+ESI+DC] 原串SMRPRO0000入dl
0040936E . 8BFB MOV EDI,EBX edi=ebx
00409370 . 8BEA MOV EBP,EDX ebp=edx
00409372 . 81E7 FF000000 AND EDI,0FF
00409378 . 81E5 FF000000 AND EBP,0FF
0040937E . 33FD XOR EDI,EBP edi=edi xor ebp
00409380 . 8B6C24 14 MOV EBP,DWORD PTR SS:[ESP+14] ebp=[esp+14],前前两位注册码
00409384 . 81E5 FF000000 AND EBP,0FF
0040938A . 894424 68 MOV DWORD PTR SS:[ESP+68],EAX 保存eax,[esp+68]=eax
0040938E . 33FD XOR EDI,EBP edi =edi xor ebp，两串两位xor后，再与注册码2位作xor
00409390 . 8B6C24 18 MOV EBP,DWORD PTR SS:[ESP+18] ebp=[esp+18],前一注册码两位串
00409394 . 81E5 FF000000 AND EBP,0FF
0040939A . 884C24 14 MOV BYTE PTR SS:[ESP+14],CL [esp+14]=cl，前一注册码串两位保存
0040939E . 8A4C24 68 MOV CL,BYTE PTR SS:[ESP+68] 当前两位注册码
004093A2 . 33FD XOR EDI,EBP edi= edi xor ebp,两串位xor值，与前前两位xor运算，再与前两位注册码xor运算
004093A4 . 33C7 XOR EAX,EDI eax =eax xor edi，此为关键,eax为当前注册码.(设当前两位注册码位置为n,则两串位对应各位先作xor运算，再与n-2位作xor运算，再与n-1位作xor运算，然后再与当前n位作xor运算)
004093A6 > 8B7C24 58 MOV EDI,DWORD PTR SS:[ESP+58] edi=[esp+58]
004093AA . 8B6C24 64 MOV EBP,DWORD PTR SS:[ESP+64] ebp=[esp+64]，
004093AE . 884C24 18 MOV BYTE PTR SS:[ESP+18],CL 保存当前两位注册码,[esp+18]=cl
004093B2 . 8807 MOV BYTE PTR DS:[EDI],AL 保存xor运算后的数,存在[esp+58]
004093B4 . 8B4424 54 MOV EAX,DWORD PTR SS:[ESP+54] eax=[esp+54]，计数器
004093B8 . 40 INC EAX eax =eax +1
004093B9 . 47 INC EDI edi =edi +1
004093BA . 894424 54 MOV DWORD PTR SS:[ESP+54],EAX [esp+54]=eax
004093BE . 33C0 XOR EAX,EAX eax清空
004093C0 . 8A8434 A40000>MOV AL,BYTE PTR SS:[ESP+ESI+A4] 上面计算的余数依次入al
004093C7 . 897C24 58 MOV DWORD PTR SS:[ESP+58],EDI [esp+58]=edi
004093CB . 8B7C24 5C MOV EDI,DWORD PTR SS:[ESP+5C] 将取密码串第几位,edi=[esp+5c]=22
004093CF . 8A4404 1C MOV AL,BYTE PTR SS:[ESP+EAX+1C] 初始化串,al=[esp+eax+1c]
004093D3 . 02C2 ADD AL,DL al =al+dl
004093D5 . 8A543C 1C MOV DL,BYTE PTR SS:[ESP+EDI+1C] 密码串,dl=[esp+edi+1c=97
004093D9 . 02D3 ADD DL,BL dl =dl+bl
004093DB . 888434 DC0000>MOV BYTE PTR SS:[ESP+ESI+DC],AL 保存，替换SMRPRO0000串
004093E2 . 885434 6C MOV BYTE PTR SS:[ESP+ESI+6C],DL 保存，替换变换串
004093E6 . 46 INC ESI
004093E7 . 3BF5 CMP ESI,EBP
004093E9 .^ 0F85 0BFFFFFF JNZ SMRPRO.004092FA
此时生成十位数，设为串D
--------------------------
008FCE24 80 F7 A0 0B 6A A7 E0 A5 �鱛 jо?
008FCE2C 30 57 00 00 48 CE 8F 00 0W..H螐.
--------------------------
004093EF . 8A4424 13 MOV AL,BYTE PTR SS:[ESP+13]
004093F3 . FEC0 INC AL
004093F5 . 884424 13 MOV BYTE PTR SS:[ESP+13],AL
004093F9 . 75 3D JNZ SHORT SMRPRO.00409438
004093FB . 33D2 XOR EDX,EDX
004093FD . 33C0 XOR EAX,EAX
004093FF . 3BEA CMP EBP,EDX
00409401 . 7E 35 JLE SHORT SMRPRO.00409438
00409403 > 8A9C04 A40000>MOV BL,BYTE PTR SS:[ESP+EAX+A4]
0040940A . FEC3 INC BL
0040940C . 80FB 35 CMP BL,35
0040940F . 889C04 A40000>MOV BYTE PTR SS:[ESP+EAX+A4],BL
00409416 . 75 07 JNZ SHORT SMRPRO.0040941F
00409418 . 889404 A40000>MOV BYTE PTR SS:[ESP+EAX+A4],DL
0040941F > 8A5C04 1C MOV BL,BYTE PTR SS:[ESP+EAX+1C]
00409423 . 005C04 6C ADD BYTE PTR SS:[ESP+EAX+6C],BL
00409427 . 47 INC EDI
00409428 . 83FF 35 CMP EDI,35
0040942B . 75 02 JNZ SHORT SMRPRO.0040942F
0040942D . 33FF XOR EDI,EDI
0040942F > 40 INC EAX
00409430 . 3BC5 CMP EAX,EBP
00409432 .^ 7C CF JL SHORT SMRPRO.00409403
00409434 . 897C24 5C MOV DWORD PTR SS:[ESP+5C],EDI
00409438 > 33F6 XOR ESI,ESI
0040943A .^ E9 BBFEFFFF JMP SMRPRO.004092FA
0040943F > 8B8424 1C0100>MOV EAX,DWORD PTR SS:[ESP+11C]
00409446 . 5F POP EDI
00409447 . 5E POP ESI
00409448 . 5D POP EBP
00409449 . C60402 00 MOV BYTE PTR DS:[EDX+EAX],0
0040944D . 33C0 XOR EAX,EAX
0040944F . 5B POP EBX
00409450 . 81C4 04010000 ADD ESP,104
00409456 . C3 RETN
00409457 90 NOP
00409458 90 NOP
-------------------------------------------------
总结：
先将20注册码按按两位分组，转换为十六进制形式，形成十位数(如：98 76 54 32 10 98 76 54 32 10)，从第1位注册码开始，作这样的运算：设当前位数位置为n,则串1(4B 54 48 4B 4E 52 2E 2F 10 11)各位与串2(53 4D 52 50 52 4F 30 30 30 30)各位对应先作or运算，再与n-2位作xor运算，再与n-1位作xor运算，然后再与当前n位作xor运算，这样生成的十位数，如果第1位，第2位，第九位，第十位各为：72、67、63、78，则注册成功。注册码与用户名无关。另注册码中第6、7、8、9位其中必须有一位不能为0。
注册过程中密码表没什么用，迷弄人的，这样的注册码可以手算出来，没有做注册机意义。
一个可用的注册码：
用户名：lordor
注册码：6a14001000000000431a
注册信息保存在：
[HKEY_LOCAL_MACHINE\SOFTWARE\SMPPRO\SMPPRO]
"Regcode"="6a14001000000000431a"
"UserName"="lordor"
cracked by lordor