windows魔法助手 注册分析
【破解作者】 微笑刺客
【作者邮箱】 yuqli@yeah.net
【使用工具】 PEID v0.93 OllyDbg v1.10 fly修改版
【破解平台】 Win2K
【软件名称】 windows魔法助手 V2.95
【下载地址】 http://www.softreg.com.cn/shareware_view.aspx?id=/8C10F1E1-47C9-4AC8-A42F-7F47C83F5A39/
【编写语言】 Borland Delphi
【软件介绍】 和windows优化大师 差不多不管是界面还是一些基本功能都非常相市~~
【破解声明】 学习破解
【破解过程】 PeID查壳,ASPack 2.12 -> Alexey Solodovnikov,用ASPackDie v1.41轻松搞定,默认另存为UnPacked.exe,再查Borland Delphi
4.0 - 5.0,Dede查的注册按钮事件地址004A913C ,OD载入在004A913C下断,F9运行
注册->输入"12345-12345-12345-12345-12345" 点注册认证 断下
004A913C 55 push ebp //断在这里
004A913D 8BEC mov ebp, esp
004A913F 33C9 xor ecx, ecx
004A9141 51 push ecx
004A9142 51 push ecx
004A9143 51 push ecx
004A9144 51 push ecx
004A9145 51 push ecx
004A9146 51 push ecx
004A9147 51 push ecx
004A9148 51 push ecx
004A9149 53 push ebx
004A914A 8BD8 mov ebx, eax
004A914C 33C0 xor eax, eax
004A914E 55 push ebp
* Possible String Reference to: '殪胗[嬪]?
|
004A914F 6847934A00 push $004A9347
***** TRY
|
004A9154 64FF30 push dword ptr fs:[eax]
004A9157 648920 mov fs:[eax], esp
004A915A 8D55F8 lea edx, [ebp-$08]
* Reference to control fetkey1 : N.A.
|
004A915D 8B830C030000 mov eax, [ebx+$030C]
* Reference to: Controls.TControl.GetText(TControl):TCaption;
| ~~~~~~~~~~
004A9163 E84CC1F9FF call 004452B4 // 看“~~~~~” 知道了吧 函数是取字符串
004A9168 FF75F8 push dword ptr [ebp-$08]
004A916B 685C934A00 push $004A935C
004A9170 8D55F4 lea edx, [ebp-$0C]
* Reference to control fetkey2 : N.A.
|
004A9173 8B8310030000 mov eax, [ebx+$0310]
* Reference to: Controls.TControl.GetText(TControl):TCaption;
|
004A9179 E836C1F9FF call 004452B4 //同上
004A917E FF75F4 push dword ptr [ebp-$0C]
004A9181 685C934A00 push $004A935C
004A9186 8D55F0 lea edx, [ebp-$10]
* Reference to control fetkey3 : N.A.
|
004A9189 8B8314030000 mov eax, [ebx+$0314]
* Reference to: Controls.TControl.GetText(TControl):TCaption;
|
004A918F E820C1F9FF call 004452B4 //同上
004A9194 FF75F0 push dword ptr [ebp-$10]
004A9197 685C934A00 push $004A935C
004A919C 8D55EC lea edx, [ebp-$14]
* Reference to control fetkey4 : N.A.
|
004A919F 8B8318030000 mov eax, [ebx+$0318]
* Reference to: Controls.TControl.GetText(TControl):TCaption;
|
004A91A5 E80AC1F9FF call 004452B4
004A91AA FF75EC push dword ptr [ebp-$14]
004A91AD 685C934A00 push $004A935C
004A91B2 8D55E8 lea edx, [ebp-$18]
* Reference to control fetkey5 : N.A.
|
004A91B5 8B831C030000 mov eax, [ebx+$031C]
* Reference to: Controls.TControl.GetText(TControl):TCaption;
|
004A91BB E8F4C0F9FF call 004452B4 //和上面是同一个函数
004A91C0 FF75E8 push dword ptr [ebp-$18]
004A91C3 8D45FC lea eax, [ebp-$04]
004A91C6 BA09000000 mov edx, $00000009
* Reference to: System.@LStrCatN; //看函数名知道什么意思了
|
004A91CB E8D4B8F5FF call 00404AA4 //连接 12345-12345-12345-12345-12345
004A91D0 8B45FC mov eax, [ebp-$04]
|
004A91D3 E89C280A00 call 0054BA74 //关键 进入
004A91D8 84C0 test al, al
004A91DA 0F8420010000 jz 004A9300
* Possible String Reference to: '注册成功--感谢您对本软件的支持!'
|
004A91E0 B968934A00 mov ecx, $004A9368
004A91E5 BA01000000 mov edx, $00000001
004A91EA B801000000 mov eax, $00000001
|
004A91EF E8C4F70900 call 005489B8
004A91F4 B201 mov dl, $01
004A91F6 A160B04600 mov eax, dword ptr [$0046B060]
* Reference to: Registry.TRegistry.Create(TRegistry;boolean);overload;
|
004A91FB E8601FFCFF call 0046B160
004A9200 8BD8 mov ebx, eax
004A9202 BA02000080 mov edx, $80000002
004A9207 8BC3 mov eax, ebx
* Reference to: Registry.TRegistry.SetRootKey(TRegistry;HKEY);
|
004A9209 E8F21FFCFF call 0046B200
004A920E B101 mov cl, $01
* Possible String Reference to: '\software\GZNSoft' //写入注册表 注册成功进去看看
|
004A9210 BA94934A00 mov edx, $004A9394
004A9215 8BC3 mov eax, ebx
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
0054BA74 55 push ebp
0054BA75 8BEC mov ebp, esp
0054BA77 83C4F0 add esp, -$10
0054BA7A 53 push ebx
0054BA7B 56 push esi
0054BA7C 57 push edi
0054BA7D 33D2 xor edx, edx
0054BA7F 8955F0 mov [ebp-$10], edx
0054BA82 8955F4 mov [ebp-$0C], edx
0054BA85 8945FC mov [ebp-$04], eax //所有字符连接一起
0054BA88 8B45FC mov eax, [ebp-$04]
省略一部分`~~
0054BABE E8218FEBFF call 004049E4
0054BAC3 83F81D cmp eax, +$1D
0054BAC6 0F8508030000 jnz 0054BDD4
0054BACC 8D45F4 lea eax, [ebp-$0C]
0054BACF 8B55FC mov edx, [ebp-$04]
* Reference to: System.@LStrLAsg(void;void;void;void);
|
================================================================
0054BAD2 E8ED8CEBFF call 004047C4
0054BAD7 8B45F4 mov eax, [ebp-$0C] //连接后注册码12345-12345-12345-12345-12345 记为SN[N] N=29
0054BADA 0FB64018 movzx eax, byte ptr [eax+$18] //sn[24]=5
0054BADE 8B55F4 mov edx, [ebp-$0C]
0054BAE1 0FB6521C movzx edx, byte ptr [edx+$1C] //sn[28] =1
0054BAE5 2BC2 sub eax, edx //2数相减
0054BAE7 99 cdq
0054BAE8 33C2 xor eax, edx
0054BAEA 2BC2 sub eax, edx //相当于 取绝对值
0054BAEC 8BD8 mov ebx, eax
0054BAEE 83C330 add ebx, +$30
0054BAF1 83FB39 cmp ebx, +$39
0054BAF4 7E08 jle 0054BAFE
0054BAF6 83FB41 cmp ebx, +$41
0054BAF9 7D03 jnl 0054BAFE
0054BAFB 83C307 add ebx, +$07
0054BAFE 8D45F4 lea eax, [ebp-$0C]
|
0054BB01 E82E91EBFF call 00404C34 //相减结果bl=>字符
0054BB06 885802 mov [eax+$02], bl //bl =>sn[2],'4'->'3'
软件作者就是利用上面的这段代码来计算注册码
所以下面的一样计算 简单
========================================
0054BB09 8B45F4 mov eax, [ebp-$0C] //新sn=12445-12345-12345-12345-12345
0054BB0C 0FB64012 movzx eax, byte ptr [eax+$12] //sn[18]
0054BB10 8B55F4 mov edx, [ebp-$0C]
0054BB13 0FB65216 movzx edx, byte ptr [edx+$16] //sn[22]
0054BB17 2BC2 sub eax, edx //sn[18]-sn[22]
0054BB19 99 cdq
0054BB1A 33C2 xor eax, edx
0054BB1C 2BC2 sub eax, edx
0054BB1E 8BD8 mov ebx, eax //和上面的一样 绝对值 所以下面就不再多说了
0054BB20 83C330 add ebx, +$30
0054BB23 83FB39 cmp ebx, +$39
0054BB26 7E08 jle 0054BB30
0054BB28 83FB41 cmp ebx, +$41
0054BB2B 7D03 jnl 0054BB30
0054BB2D 83C307 add ebx, +$07
0054BB30 8D45F4 lea eax, [ebp-$0C]
|
0054BB33 E8FC90EBFF call 00404C34
0054BB38 885808 mov [eax+$08], bl // bl相减结果=>sn[8]
0054BB3B 8B45F4 mov eax, [ebp-$0C] // 新sn=12445-12445-12345-12345-12345
0054BB3E 0FB6400C movzx eax, byte ptr [eax+$0C] //sn[12]
0054BB42 8B55F4 mov edx, [ebp-$0C]
0054BB45 0FB65210 movzx edx, byte ptr [edx+$10] //sn[16]
0054BB49 2BC2 sub eax, edx //sn[12]-sn[16]
0054BB4B 99 cdq
0054BB4C 33C2 xor eax, edx
0054BB4E 2BC2 sub eax, edx
........
........
|
0054BB65 E8CA90EBFF call 00404C34
0054BB6A 88580E mov [eax+$0E], bl // bl相减结果=>sn[14]
0054BB6D 8B45F4 mov eax, [ebp-$0C] //新sn=12445-12445-12445-12345-12345
0054BB70 0FB64006 movzx eax, byte ptr [eax+$06] //sn[6]
0054BB74 8B55F4 mov edx, [ebp-$0C]
0054BB77 0FB6520A movzx edx, byte ptr [edx+$0A] //sn[10]
0054BB7B 2BC2 sub eax, edx //sn[6]-sn[10]
0054BB7D 99 cdq
.........
...........
0054BB97 E89890EBFF call 00404C34
0054BB9C 885814 mov [eax+$14], bl // bl相减结果=>sn[20]
0054BB9F 8B45F4 mov eax, [ebp-$0C] // 新sn=12445-12445-12445-12445-12345
0054BBA2 0FB600 movzx eax, byte ptr [eax] //sn[0]
0054BBA5 8B55F4 mov edx, [ebp-$0C]
0054BBA8 0FB65204 movzx edx, byte ptr [edx+$04] //sn[4]
0054BBAC 2BC2 sub eax, edx //sn[0]-sn[4]
0054BBAE 99 cdq
0054BBAF 33C2 xor eax, edx
......
......
0054BBC8 E86790EBFF call 00404C34
0054BBCD 88581A mov [eax+$1A], bl // bl相减结果=>sn[26]
0054BBD0 8B45F4 mov eax, [ebp-$0C] // 新sn=12445-12445-12445-12445-12445
0054BBD3 0FB64008 movzx eax, byte ptr [eax+$08] //sn[8]
0054BBD7 8B55F4 mov edx, [ebp-$0C]
0054BBDA 0FB6520A movzx edx, byte ptr [edx+$0A] //sn[10]
0054BBDE 2BC2 sub eax, edx //sn[8]-sn[10]
0054BBE0 99 cdq
.......
.......
0054BBFA E83590EBFF call 00404C34
0054BBFF 885801 mov [eax+$01], bl // bl相减结果=>sn[1]
0054BC02 8B45F4 mov eax, [ebp-$0C] // 新sn=11445-12445-12445-12445-12445
0054BC05 0FB64014 movzx eax, byte ptr [eax+$14] //sn[20]
0054BC09 8B55F4 mov edx, [ebp-$0C]
0054BC0C 0FB65216 movzx edx, byte ptr [edx+$16] //sn[22]
0054BC10 2BC2 sub eax, edx //sn[20]-sn[22]
0054BC12 99 cdq
.........
........
0054BC2C E80390EBFF call 00404C34
0054BC31 885807 mov [eax+$07], bl // bl相减结果=>sn[7]
0054BC34 8B45F4 mov eax, [ebp-$0C] // 新sn=11445-11445-12445-12445-12445
0054BC37 0FB6400E movzx eax, byte ptr [eax+$0E] //sn[14]
0054BC3B 8B55F4 mov edx, [ebp-$0C]
0054BC3E 0FB65210 movzx edx, byte ptr [edx+$10] //sn[16]
0054BC42 2BC2 sub eax, edx //sn[14]-sn[16]
0054BC44 99 cdq
.........
.........
0054BC5E E8D18FEBFF call 00404C34
0054BC63 88580D mov [eax+$0D], bl //bl相减结果=>sn[13]
0054BC66 8B45F4 mov eax, [ebp-$0C] // 新sn=11445-11445-11445-12445-12445
0054BC69 0FB64002 movzx eax, byte ptr [eax+$02] //sn[2]
0054BC6D 8B55F4 mov edx, [ebp-$0C]
0054BC70 0FB65204 movzx edx, byte ptr [edx+$04] //sn[4]
0054BC74 2BC2 sub eax, edx //sn[2]-sn[4]
0054BC76 99 cdq
00.........
...........
|
0054BC90 E89F8FEBFF call 00404C34
0054BC95 885813 mov [eax+$13], bl //bl相减结果=>sn[19]
0054BC98 8B45F4 mov eax, [ebp-$0C] // 新sn=11445-11445-11445-11445-12445
0054BC9B 0FB6401A movzx eax, byte ptr [eax+$1A] //sn[26]
0054BC9F 8B55F4 mov edx, [ebp-$0C]
0054BCA2 0FB6521C movzx edx, byte ptr [edx+$1C] //sn[28]
0054BCA6 2BC2 sub eax, edx //sn[26]-sn[28]
0054BCA8 99 cdq
..........
.........
0054BCC2 E86D8FEBFF call 00404C34
0054BCC7 885819 mov [eax+$19], bl //bl相减结果=>sn[25]
0054BCCA 8B45F4 mov eax, [ebp-$0C] // 新sn=11445-11445-11445-11445-11445
0054BCCD 0FB64013 movzx eax, byte ptr [eax+$13] //sn[19]
0054BCD1 8B55F4 mov edx, [ebp-$0C]
0054BCD4 0FB65212 movzx edx, byte ptr [edx+$12] //sn[18]
0054BCD8 2BC2 sub eax, edx //sn[19]-sn[18]
........
........
0054BCF4 E83B8FEBFF call 00404C34
0054BCF9 885803 mov [eax+$03], bl //bl相减结果=>sn[3]
0054BCFC 8B45F4 mov eax, [ebp-$0C] //新sn=11405-11445-11445-11445-11445
0054BCFF 0FB64018 movzx eax, byte ptr [eax+$18] //sn[24]
0054BD03 8B55F4 mov edx, [ebp-$0C]
0054BD06 0FB65219 movzx edx, byte ptr [edx+$19] //sn[25]
0054BD0A 2BC2 sub eax, edx //sn[24]-sn[25]
...........
...........
0054BD26 E8098FEBFF call 00404C34
0054BD2B 885809 mov [eax+$09], bl //bl相减结果=>sn[9]
0054BD2E 8B45F4 mov eax, [ebp-$0C] //新sn=11405-11405-11445-11445-11445
0054BD31 0FB64006 movzx eax, byte ptr [eax+$06] //sn[6]
0054BD35 8B55F4 mov edx, [ebp-$0C]
0054BD38 0FB65207 movzx edx, byte ptr [edx+$07] //sn[7]
0054BD3C 2BC2 sub eax, edx //sn[6]-sn[7]
.........
.........
0054BD58 E8D78EEBFF call 00404C34
0054BD5D 88580F mov [eax+$0F], bl //bl相减结果=>sn[15]
0054BD60 8B45F4 mov eax, [ebp-$0C] //新sn=11405-11405-11405-11445-11445
0054BD63 0FB6400C movzx eax, byte ptr [eax+$0C] //sn[12]
0054BD67 8B55F4 mov edx, [ebp-$0C]
0054BD6A 0FB6520D movzx edx, byte ptr [edx+$0D] //sn[13]
0054BD6E 2BC2 sub eax, edx //sn[12]-sn[13]
...........
..........
0054BD8A E8A58EEBFF call 00404C34
0054BD8F 885815 mov [eax+$15], bl //bl相减结果=>sn[21]
0054BD92 8B45F4 mov eax, [ebp-$0C] //新sn=11405-11405-11405-11405-11445
0054BD95 0FB600 movzx eax, byte ptr [eax] //sn[0]
0054BD98 8B55F4 mov edx, [ebp-$0C]
0054BD9B 0FB65201 movzx edx, byte ptr [edx+$01] //sn[1]
0054BD9F 2BC2 sub eax, edx //sn[0]-sn[1]
.........
.........
0054BDBB E8748EEBFF call 00404C34
0054BDC0 88581B mov [eax+$1B], bl //bl相减结果=>sn[27]
0054BDC3 8B45F4 mov eax, [ebp-$0C] //新sn=11405-11405-11405-11405-11405
0054BDC6 8B55FC mov edx, [ebp-$04] //原sn=12345-12345-12345-12345-12345
* Reference to: System.@LStrCmp; //比较函数
|
0054BDC9 E85A8DEBFF call 00404B28
0054BDCE 7504 jnz 0054BDD4 不相等就完了`~~
0054BDD0 C645FB01 mov byte ptr [ebp-$05], $01
0054BDD4 33C0 xor eax, eax
*************************************
『算法总结』:
先把输入的注册码连接起来
然后经过一系列的相减运算就完事~~
过程比较复杂点,但是不难 跟一下就完了
可以编写内存注册机
中断地址 0054BDC6
中断次数 1
第一个字节 8B
指令长度 3
内存方式 EAX
象我这般菜鸟 可以去下载来练练
by 微笑刺客~~