课题: SPIP(Scanning Probe Image Processor)个人版 软件注册码学习
作    者:HaIlDuZ 
程序来源:http://www.imagemet.com/ 丹麦 ,下载名称:SPIPinstall.exe 
软件名称:SPIP 3.3.9.0  个人版更新时间:2005.4
评      价:该软件不错,用于扫描探针图像分析类软件。
使用工具:OllyDbg v1.09, Ultraedit-32 ,W32Dasm汉化修改版10.0
使用平台:winXP/98/2k(win98下需要GDIplus.Dll)
作者申明:纯技术交流,无任何商业目的,转贴请保持完整。


开始:
运行显示演示版仅可128乘128像素操作,一段时间后变为64乘64。打开文件显示对话框警告。W32Dasm反汇编察看无警告字符信息,从对话框入手,用OllyDbg 装载,跟踪最终观察到该软件采用keyfile方式,文件名:SPIP.LIC,到程序中打开其文件处如下:

:0049D4EF 68D8CB5A00              push 005ACBD8                       /*注册文件名压栈,”spip.lic“*/
:0049D4F4 8BC8                    mov ecx, eax
:0049D4F6 C68424A000000006        mov byte ptr [esp+000000A0], 06
:0049D4FE FF15C48E5900            Call dword ptr [00598EC4]
:0049D504 50                      push eax
:0049D505 E8B6D50600              call 0050AAC0
:0049D50A 83C408                  add esp, 00000008
:0049D50D 8D4C2424                lea ecx, dword ptr [esp+24]
:0049D511 A3FC686000              mov dword ptr [006068FC], eax
:0049D516 C684249C00000005        mov byte ptr [esp+0000009C], 05
:0049D51E FF15C88E5900            Call dword ptr [00598EC8]
:0049D524 A1FC686000              mov eax, dword ptr [006068FC]
:0049D529 6868DA5900              push 0059DA68
:0049D52E 50                      push eax
:0049D52F FF1530905900            Call dword ptr [00599030]             /*注册文件打开读写方式*/
:0049D535 8BF0                    mov esi, eax
:0049D537 83C408                  add esp, 00000008
:0049D53A 85F6                    test esi, esi
:0049D53C 0F8489000000            je 0049D5CB                           /*无注册文件调到演示版*/
:0049D542 8B0DFC686000            mov ecx, dword ptr [006068FC]
:0049D548 51                      push ecx
:0049D549 E8A2470600              call 00501CF0
:0049D54E A3F4686000              mov dword ptr [006068F4], eax
:0049D553 83C002                  add eax, 00000002
:0049D556 50                      push eax

* Reference To: MFC71.Ordinal:0109, Ord:0109h
                                  |
:0049D557 E85E010E00              Call 0057D6BA
:0049D55C 8B0DF4686000            mov ecx, dword ptr [006068F4]
:0049D562 83C102                  add ecx, 00000002
:0049D565 8BD1                    mov edx, ecx
:0049D567 8BF8                    mov edi, eax
:0049D569 C1E902                  shr ecx, 02
:0049D56C 893DF0686000            mov dword ptr [006068F0], edi
:0049D572 33C0                    xor eax, eax
:0049D574 F3                      repz
:0049D575 AB                      stosd
:0049D576 8BCA                    mov ecx, edx
:0049D578 83E103                  and ecx, 00000003
:0049D57B F3                      repz
:0049D57C AA                      stosb
:0049D57D A1F4686000              mov eax, dword ptr [006068F4]
:0049D582 8B0DF0686000            mov ecx, dword ptr [006068F0]
:0049D588 56                      push esi
:0049D589 50                      push eax
:0049D58A 6A01                    push 00000001
:0049D58C 51                      push ecx

* Reference To: MSVCR71.fread, Ord:02ABh
                                  |
:0049D58D FF1554905900            Call dword ptr [00599054]
:0049D593 56                      push esi

* Reference To: MSVCR71.fclose, Ord:029Ah
                                  |
:0049D594 FF152C905900            Call dword ptr [0059902C]
:0049D59A 8D54243C                lea edx, dword ptr [esp+3C]
:0049D59E 52                      push edx
:0049D59F 8B15F0686000            mov edx, dword ptr [006068F0]
:0049D5A5 8D44243C                lea eax, dword ptr [esp+3C]
:0049D5A9 50                      push eax
:0049D5AA 8D4C243C                lea ecx, dword ptr [esp+3C]
:0049D5AE 51                      push ecx
:0049D5AF 52                      push edx
:0049D5B0 E8EBFFF6FF              call 0040D5A0                           /*关键调用见后*/                     
:0049D5B5 83C42C                  add esp, 0000002C
:0049D5B8 F6D8                    neg al
:0049D5BA 1BC0                    sbb eax, eax
:0049D5BC 25C01F0000              and eax, 00001FC0
:0049D5C1 83C040                  add eax, 00000040
:0049D5C4 A314995F00              mov dword ptr [005F9914], eax
:0049D5C9 EB19                    jmp 0049D5E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049D53C(C)
|
:0049D5CB E8D072FDFF              call 004748A0
:0049D5D0 33C9                    xor ecx, ecx
:0049D5D2 85C0                    test eax, eax
:0049D5D4 0F9CC1                  setl cl
:0049D5D7 49                      dec ecx
:0049D5D8 83E140                  and ecx, 00000040
:0049D5DB 83C140                  add ecx, 00000040
:0049D5DE 890D14995F00            mov dword ptr [005F9914], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049D5C9(U)
|
:0049D5E4 E8C7D5FFFF              call 0049ABB0                        //程序功能限制函数调用见后
...................
....................
/////////////////////////////////////////////////////////////////////////////////////////////////
///关键调用/
:0040D5A0 6AFF                    push FFFFFFFF
:0040D5A2 68BBFC5700              push 0057FCBB
:0040D5A7 64A100000000            mov eax, dword ptr fs:[00000000]
:0040D5AD 50                      push eax
:0040D5AE 64892500000000          mov dword ptr fs:[00000000], esp
:0040D5B5 81EC7C010000            sub esp, 0000017C
:0040D5BB A1B0AB5F00              mov eax, dword ptr [005FABB0]
:0040D5C0 89842478010000          mov dword ptr [esp+00000178], eax
:0040D5C7 F60520BF5F0001          test byte ptr [005FBF20], 01
:0040D5CE 53                      push ebx
:0040D5CF 56                      push esi
:0040D5D0 751D                    jne 0040D5EF
:0040D5D2 A120BF5F00              mov eax, dword ptr [005FBF20]
:0040D5D7 83C801                  or eax, 00000001
:0040D5DA 33DB                    xor ebx, ebx
:0040D5DC A320BF5F00              mov dword ptr [005FBF20], eax
:0040D5E1 891D18BF5F00            mov dword ptr [005FBF18], ebx
:0040D5E7 891D1CBF5F00            mov dword ptr [005FBF1C], ebx
:0040D5ED EB02                    jmp 0040D5F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D5D0(C)
|
:0040D5EF 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D5ED(U)
|

* Reference To: MSVCR71._time64, Ord:0211h
                                  |
:0040D5F1 8B3540905900            mov esi, dword ptr [00599040]
:0040D5F7 53                      push ebx
:0040D5F8 FFD6                    call esi
:0040D5FA A318BF5F00              mov dword ptr [005FBF18], eax
:0040D5FF A0D5675F00              mov al, byte ptr [005F67D5]
:0040D604 83C404                  add esp, 00000004
:0040D607 84C0                    test al, al
:0040D609 89151CBF5F00            mov dword ptr [005FBF1C], edx
:0040D60F 742A                    je 0040D63B
:0040D611 8D442408                lea eax, dword ptr [esp+08]
:0040D615 6840E05900              push 0059E040
:0040D61A 50                      push eax
:0040D61B E8B0FDFFFF              call 0040D3D0
:0040D620 8B08                    mov ecx, dword ptr [eax]
:0040D622 890D18BF5F00            mov dword ptr [005FBF18], ecx
:0040D628 8B5004                  mov edx, dword ptr [eax+04]
:0040D62B 83C408                  add esp, 00000008
:0040D62E 89151CBF5F00            mov dword ptr [005FBF1C], edx
:0040D634 C605D5675F0000          mov byte ptr [005F67D5], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D60F(C)
|
:0040D63B 53                      push ebx
:0040D63C FFD6                    call esi
:0040D63E 8B0D1CBF5F00            mov ecx, dword ptr [005FBF1C]
:0040D644 8B3518BF5F00            mov esi, dword ptr [005FBF18]
:0040D64A 83C404                  add esp, 00000004
:0040D64D 3BCA                    cmp ecx, edx
:0040D64F A39CBE5F00              mov dword ptr [005FBE9C], eax
:0040D654 8915A0BE5F00            mov dword ptr [005FBEA0], edx
:0040D65A 8935A4BE5F00            mov dword ptr [005FBEA4], esi
:0040D660 890DA8BE5F00            mov dword ptr [005FBEA8], ecx
:0040D666 7C15                    jl 0040D67D
:0040D668 7F04                    jg 0040D66E
:0040D66A 3BF0                    cmp esi, eax
:0040D66C 760F                    jbe 0040D67D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D668(C)
|
:0040D66E 8BC6                    mov eax, esi
:0040D670 8BD1                    mov edx, ecx
:0040D672 A39CBE5F00              mov dword ptr [005FBE9C], eax
:0040D677 8915A0BE5F00            mov dword ptr [005FBEA0], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D666(C), :0040D66C(C)
|
:0040D67D 8B35B8FC6000            mov esi, dword ptr [0060FCB8]
:0040D683 8B0DBCFC6000            mov ecx, dword ptr [0060FCBC]
:0040D689 53                      push ebx
:0040D68A 2BC6                    sub eax, esi
:0040D68C 6880510100              push 00015180
:0040D691 1BD1                    sbb edx, ecx
:0040D693 52                      push edx
:0040D694 50                      push eax
:0040D695 E8C6081700              call 0057DF60
:0040D69A 8BB42494010000          mov esi, dword ptr [esp+00000194]
:0040D6A1 3BF3                    cmp esi, ebx
:0040D6A3 8B8C24A0010000          mov ecx, dword ptr [esp+000001A0]
:0040D6AA 8901                    mov dword ptr [ecx], eax
:0040D6AC 7507                    jne 0040D6B5
:0040D6AE 32C0                    xor al, al
:0040D6B0 E927040000              jmp 0040DADC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D6AC(C)
|
:0040D6B5 55                      push ebp
:0040D6B6 8BEE                    mov ebp, esi
:0040D6B8 8D4D01                  lea ecx, dword ptr [ebp+01]
:0040D6BB EB03                    jmp 0040D6C0
:0040D6BD 8D4900                  lea ecx, dword ptr [ecx+00]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D6BB(U), :0040D6C6(C)
|
:0040D6C0 8A4500                  mov al, byte ptr [ebp+00]
:0040D6C3 45                      inc ebp
:0040D6C4 84C0                    test al, al
:0040D6C6 75F8                    jne 0040D6C0
:0040D6C8 2BE9                    sub ebp, ecx                              /*计算注册文件中字符长度*/
:0040D6CA 8D9B00000000            lea ebx, dword ptr [ebx+00000000]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D6E6(U)
|
:0040D6D0 8A442EFF                mov al, byte ptr [esi+ebp-01]
:0040D6D4 3C0A                    cmp al, 0A
:0040D6D6 7408                    je 0040D6E0
:0040D6D8 3C0D                    cmp al, 0D
:0040D6DA 7404                    je 0040D6E0
:0040D6DC 3C20                    cmp al, 20
:0040D6DE 7508                    jne 0040D6E8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D6D6(C), :0040D6DA(C)
|
:0040D6E0 C6442EFF00              mov [esi+ebp-01], 00
:0040D6E5 4D                      dec ebp
:0040D6E6 EBE8                    jmp 0040D6D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D6DE(C)
|
:0040D6E8 57                      push edi
:0040D6E9 8D7DF6                  lea edi, dword ptr [ebp-0A]
:0040D6EC 85FF                    test edi, edi
:0040D6EE 895C241C                mov dword ptr [esp+1C], ebx
:0040D6F2 895C2410                mov dword ptr [esp+10], ebx
:0040D6F6 762A                    jbe 0040D722
:0040D6F8 EB06                    jmp 0040D700
:0040D6FA 8D9B00000000            lea ebx, dword ptr [ebx+00000000]
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D6F8(U), :0040D720(C)
|/*以下计算注册文件中除后10位的校验码*/
:0040D700 33C0                    xor eax, eax
:0040D702 8A0433                  mov al, byte ptr [ebx+esi]
:0040D705 8D542410                lea edx, dword ptr [esp+10]
:0040D709 52                      push edx
:0040D70A 50                      push eax
:0040D70B E8E0FAFFFF              call 0040D1F0                    //计算注册码变码   
:0040D710 8B542424                mov edx, dword ptr [esp+24]
:0040D714 03D0                    add edx, eax
:0040D716 83C408                  add esp, 00000008
:0040D719 43                      inc ebx
:0040D71A 3BDF                    cmp ebx, edi
:0040D71C 8954241C                mov dword ptr [esp+1C], edx
:0040D720 72DE                    jb 0040D700
0040D700  |> 33C0           /XOR EAX,EAX
0040D702  |. 8A0433         |MOV AL,BYTE PTR DS:[EBX+ESI]
0040D705  |. 8D5424 10      |LEA EDX,DWORD PTR SS:[ESP+10]
0040D709  |. 52             |PUSH EDX
0040D70A  |. 50             |PUSH EAX
0040D70B  |. E8 E0FAFFFF    |CALL SPIP.0040D1F0                                  
0040D710  |. 8B5424 24      |MOV EDX,DWORD PTR SS:[ESP+24]
0040D714  |. 03D0           |ADD EDX,EAX                        /*累加校验码*/
0040D716  |. 83C4 08        |ADD ESP,8
0040D719  |. 43             |INC EBX
0040D71A  |. 3BDF           |CMP EBX,EDI
0040D71C  |. 895424 1C      |MOV DWORD PTR SS:[ESP+1C],EDX
0040D720  |.^72 DE          \JB SHORT SPIP.0040D700

/////////////////////////////////////////////////////////
//插入计算注册码变码程序 
//设注册码ASCII为X,顺序号为N则 计算后为((X+N)*2E3H+1)*(X+N)+ 99D722DBH*(X+N) *(X+N) *(X+N)/100000000H/80H*/
:0040D1F0 A098BE5F00              mov al, byte ptr [005FBE98]  // 005FBE98在程序中其它处无赋值。此处为0,因此下面一段不知何用?高手指教
:0040D1F5 84C0                    test al, al
:0040D1F7 56                      push esi
:0040D1F8 7438                    je 0040D232               //调到计算处
:0040D1FA 8A442408                mov al, byte ptr [esp+08]
:0040D1FE 3C0A                    cmp al, 0A
:0040D200 7477                    je 0040D279
:0040D202 3C0D                    cmp al, 0D
:0040D204 7473                    je 0040D279

:0040D206 0FBEC0                  movsx eax, al
:0040D209 8BC8                    mov ecx, eax
:0040D20B 0FAFC8                  imul ecx, eax                
:0040D20E 8BF0                    mov esi, eax
:0040D210 0FAFC8                  imul ecx, eax            
:0040D213 69F60B030000            imul esi, 0000030B
:0040D219 46                      inc esi
:0040D21A 0FAFF0                  imul esi, eax
:0040D21D B87D63DA04              mov eax, 04DA637D
:0040D222 F7E9                    imul ecx
:0040D224 C1FA02                  sar edx, 02
:0040D227 8BC2                    mov eax, edx
:0040D229 03F2                    add esi, edx
:0040D22B C1E81F                  shr eax, 1F
:0040D22E 03C6                    add eax, esi
:0040D230 5E                      pop esi
:0040D231 C3                      ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D1F8(C)
|
:0040D232 8A542408                mov dl, byte ptr [esp+08]
:0040D236 8B74240C                mov esi, dword ptr [esp+0C]
:0040D23A 8B0E                    mov ecx, dword ptr [esi]
:0040D23C 0FBEC2                  movsx eax, dl
:0040D23F 03C1                    add eax, ecx              /*X+N*/
:0040D241 80FA0A                  cmp dl, 0A
:0040D244 7433                    je 0040D279
:0040D246 80FA0D                  cmp dl, 0D
:0040D249 742E                    je 0040D279
:0040D24B 41                      inc ecx
:0040D24C 890E                    mov dword ptr [esi], ecx /*序号计数*/
:0040D24E 8BC8                    mov ecx, eax               
:0040D250 0FAFC8                  imul ecx, eax
:0040D253 8BF0                    mov esi, eax                
:0040D255 0FAFC8                  imul ecx, eax                 
:0040D258 69F6E3020000            imul esi, 000002E3            
:0040D25E 46                      inc esi                       
:0040D25F 0FAFF0                  imul esi, eax
:0040D262 B8DB22D799              mov eax, 99D722DB
:0040D267 F7E9                    imul ecx
:0040D269 03D1                    add edx, ecx
:0040D26B C1FA07                  sar edx, 07
:0040D26E 8BC2                    mov eax, edx
:0040D270 03F2                    add esi, edx
:0040D272 C1E81F                  shr eax, 1F
:0040D275 03C6                    add eax, esi        /*计算后为((X+N)*2E3H+1)*(X+N)+ 99D722DBH*(X+N) *(X+N) *(X+N)/100000000H/80H */
:0040D277 5E                      pop esi
:0040D278 C3                      ret
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D200(C), :0040D204(C), :0040D244(C), :0040D249(C)
|
:0040D279 33C0                    xor eax, eax
:0040D27B 5E                      pop esi
:0040D27C C3                      ret
////////////////////////////////////////////////////////////////////////////////////////////////
/*插入完毕*/

//继续///////////////////////////////////////////////////////
:0040D722 33C0                    xor eax, eax
:0040D724 85FF                    test edi, edi
:0040D726 7602                    jbe 0040D72A
:0040D728 8BC7                    mov eax, edi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D726(C)
|
* Reference To: MSVCR71.sscanf, Ord:0303h
                                  |
:0040D72A 8B1D3C905900            mov ebx, dword ptr [0059903C]
:0040D730 8D4C2418                lea ecx, dword ptr [esp+18]
:0040D734 51                      push ecx
:0040D735 8D3C30                  lea edi, dword ptr [eax+esi]
:0040D738 683CE05900              push 0059E03C
:0040D73D 57                      push edi
:0040D73E FFD3                    call ebx
:0040D740 8B542428                mov edx, dword ptr [esp+28]
:0040D744 8B442424                mov eax, dword ptr [esp+24]              //取注册码后8位//
:0040D748 83C40C                  add esp, 0000000C
:0040D74B 3BC2                    cmp eax, edx                          //与计算比较不等演示版
:0040D74D 0F8578010000            jne 0040D8CB
:0040D753 8D442418                lea eax, dword ptr [esp+18]
:0040D757 50                      push eax
:0040D758 683CE05900              push 0059E03C
:0040D75D 57                      push edi
:0040D75E FFD3                    call ebx
:0040D760 8B4C2428                mov ecx, dword ptr [esp+28]
:0040D764 8B442424                mov eax, dword ptr [esp+24]               //又弄一次不懂望高手指教:取注册码后8位//
:0040D768 83C40C                  add esp, 0000000C
:0040D76B 3BC1                    cmp eax, ecx                            //与计算比较不等演示版
:0040D76D 0F8558010000            jne 0040D8CB
:0040D773 8D542454                lea edx, dword ptr [esp+54]
:0040D777 56                      push esi
:0040D778 52                      push edx
:0040D779 E862FBFFFF              call 0040D2E0                          //从注册码中取日期信息
//////////////////////////////////////////////////////

//插入日期信息调用
:0040D2E0 83EC08                  sub esp, 00000008
:0040D2E3 56                      push esi
:0040D2E4 6A01                    push 00000001
:0040D2E6 6A01                    push 00000001
:0040D2E8 68BC070000              push 000007BC
:0040D2ED 8D4C2410                lea ecx, dword ptr [esp+10]
:0040D2F1 E87AFDFFFF              call 0040D070
:0040D2F6 8B442414                mov eax, dword ptr [esp+14]
:0040D2FA 6810DF5900              push 0059DF10                                       //压入字符“**”
:0040D2FF 50                      push eax

* Reference To: MSVCR71.strstr, Ord:0313h
                                  |
:0040D300 FF1500905900            Call dword ptr [00599000]                          //截取注册码字符**后8位作为日期因此注册码中应有**
:0040D306 8BF0                    mov esi, eax
:0040D308 83C408                  add esp, 00000008
:0040D30B 85F6                    test esi, esi
:0040D30D 7516                    jne 0040D325                                      //没有**演示
:0040D30F 8B442410                mov eax, dword ptr [esp+10]
:0040D313 8B4C2404                mov ecx, dword ptr [esp+04]
:0040D317 8B542408                mov edx, dword ptr [esp+08]
:0040D31B 8908                    mov dword ptr [eax], ecx
:0040D31D 895004                  mov dword ptr [eax+04], edx
:0040D320 5E                      pop esi
:0040D321 83C408                  add esp, 00000008
:0040D324 C3                      ret
.......
.......
///////////////////////////////////////////////////
//插入日期信息结束

//继续
:0040D77E 8B4804                  mov ecx, dword ptr [eax+04]
:0040D781 8B10                    mov edx, dword ptr [eax]
:0040D783 83C408                  add esp, 00000008
:0040D786 51                      push ecx
:0040D787 52                      push edx
:0040D788 8D4C242C                lea ecx, dword ptr [esp+2C]
:0040D78C E8BFC60F00              call 00509E50
:0040D791 8B442428                mov eax, dword ptr [esp+28]
:0040D795 8B0DB8FC6000            mov ecx, dword ptr [0060FCB8]
:0040D79B 8BD0                    mov edx, eax
:0040D79D 2BD1                    sub edx, ecx
:0040D79F 8B4C242C                mov ecx, dword ptr [esp+2C]
:0040D7A3 8BF9                    mov edi, ecx
:0040D7A5 1B3DBCFC6000            sbb edi, dword ptr [0060FCBC]
:0040D7AB 2B059CBE5F00            sub eax, dword ptr [005FBE9C]
:0040D7B1 6A00                    push 00000000
:0040D7B3 1B0DA0BE5F00            sbb ecx, dword ptr [005FBEA0]
:0040D7B9 6880510100              push 00015180
:0040D7BE 57                      push edi
:0040D7BF 52                      push edx
:0040D7C0 C78424A401000000000000  mov dword ptr [esp+000001A4], 00000000
:0040D7CB 89442420                mov dword ptr [esp+20], eax
:0040D7CF 894C2424                mov dword ptr [esp+24], ecx
:0040D7D3 E888071700              call 0057DF60
:0040D7D8 85D2                    test edx, edx
:0040D7DA 0F8FF2000000            jg 0040D8D2
:0040D7E0 7C08                    jl 0040D7EA
:0040D7E2 85C0                    test eax, eax
:0040D7E4 0F83E8000000            jnb 0040D8D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D7E0(C)
|
:0040D7EA A0D4675F00              mov al, byte ptr [005F67D4]
:0040D7EF 84C0                    test al, al
:0040D7F1 0F84A1000000            je 0040D898
:0040D7F7 8D44241C                lea eax, dword ptr [esp+1C]
:0040D7FB 50                      push eax
:0040D7FC 8D4C2428                lea ecx, dword ptr [esp+28]
:0040D800 E85BC80F00              call 0050A060

* Reference To: MSVCR71._localtime64, Ord:016Dh
                                  |
:0040D805 8B3D38905900            mov edi, dword ptr [00599038]
:0040D80B 68B8FC6000              push 0060FCB8
:0040D810 8BE8                    mov ebp, eax
:0040D812 FFD7                    call edi
:0040D814 83C404                  add esp, 00000004
:0040D817 85C0                    test eax, eax
:0040D819 7405                    je 0040D820
:0040D81B 8B580C                  mov ebx, dword ptr [eax+0C]
:0040D81E EB02                    jmp 0040D822

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D819(C)
|
:0040D820 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D81E(U)
|
:0040D822 68B8FC6000              push 0060FCB8
:0040D827 FFD7                    call edi
:0040D829 83C404                  add esp, 00000004
:0040D82C 85C0                    test eax, eax
:0040D82E 7406                    je 0040D836
:0040D830 8B7010                  mov esi, dword ptr [eax+10]
:0040D833 46                      inc esi
:0040D834 EB02                    jmp 0040D838

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D82E(C)
|
:0040D836 33F6                    xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D834(U)
|
:0040D838 68B8FC6000              push 0060FCB8
:0040D83D FFD7                    call edi
:0040D83F 83C404                  add esp, 00000004
:0040D842 85C0                    test eax, eax
:0040D844 740A                    je 0040D850
:0040D846 8B4014                  mov eax, dword ptr [eax+14]
:0040D849 056C070000              add eax, 0000076C
:0040D84E EB02                    jmp 0040D852

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D844(C)
|
:0040D850 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D84E(U)
|
:0040D852 8B4D04                  mov ecx, dword ptr [ebp+04]
:0040D855 53                      push ebx
:0040D856 56                      push esi
:0040D857 50                      push eax
:0040D858 51                      push ecx
:0040D859 8D54246C                lea edx, dword ptr [esp+6C]
:0040D85D 6838DF5900              push 0059DF38
:0040D862 52                      push edx

* Reference To: MSVCR71.sprintf, Ord:0300h
                                  |
:0040D863 FF15F88F5900            Call dword ptr [00598FF8]
:0040D869 8B442438                mov eax, dword ptr [esp+38]
:0040D86D 83C418                  add esp, 00000018
:0040D870 85C0                    test eax, eax
:0040D872 7409                    je 0040D87D
:0040D874 50                      push eax

* Reference To: MFC71.Ordinal:010A, Ord:010Ah
                                  |
:0040D875 E8D4FD1600              Call 0057D64E
:0040D87A 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D872(C)
|
:0040D87D 6A30                    push 00000030
:0040D87F 6818DF5900              push 0059DF18
:0040D884 8D442464                lea eax, dword ptr [esp+64]
:0040D888 50                      push eax
:0040D889 6A00                    push 00000000

* Reference To: USER32.MessageBoxA, Ord:01DEh
                                  |
:0040D88B FF1560925900            Call dword ptr [00599260]
:0040D891 C605D4675F0000          mov byte ptr [005F67D4], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D7F1(C)
|
:0040D898 8B4C2414                mov ecx, dword ptr [esp+14]
:0040D89C 8B542410                mov edx, dword ptr [esp+10]
:0040D8A0 6A00                    push 00000000
:0040D8A2 6880510100              push 00015180
:0040D8A7 51                      push ecx
:0040D8A8 52                      push edx
:0040D8A9 E8B2061700              call 0057DF60
:0040D8AE 8B8C24A4010000          mov ecx, dword ptr [esp+000001A4]
:0040D8B5 8901                    mov dword ptr [ecx], eax
:0040D8B7 8D4C2424                lea ecx, dword ptr [esp+24]
:0040D8BB C7842494010000FFFFFFFF  mov dword ptr [esp+00000194], FFFFFFFF
:0040D8C6 E865C60F00              call 00509F30

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D74D(C), :0040D76D(C)
|
:0040D8CB 32C0                    xor al, al
:0040D8CD E908020000              jmp 0040DADA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D7DA(C), :0040D7E4(C)
|
:0040D8D2 807C2EF40D              cmp byte ptr [esi+ebp-0C], 0D
:0040D8D7 7401                    je 0040D8DA
:0040D8D9 45                      inc ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D8D7(C)
|

* Reference To: MSVCR71.strncpy, Ord:030Fh
                                  |
:0040D8DA 8B3DFC8F5900            mov edi, dword ptr [00598FFC]
:0040D8E0 6A04                    push 00000004
:0040D8E2 8D542EEC                lea edx, dword ptr [esi+ebp-14]
:0040D8E6 52                      push edx
:0040D8E7 680CBF5F00              push 005FBF0C
:0040D8EC FFD7                    call edi
:0040D8EE 6A02                    push 00000002
:0040D8F0 8D442EF0                lea eax, dword ptr [esi+ebp-10]
:0040D8F4 50                      push eax
:0040D8F5 6800BF5F00              push 005FBF00
:0040D8FA FFD7                    call edi
:0040D8FC 6A02                    push 00000002
:0040D8FE 8D4C2EF2                lea ecx, dword ptr [esi+ebp-0E]
:0040D902 51                      push ecx
:0040D903 68F4BE5F00              push 005FBEF4
:0040D908 FFD7                    call edi
:0040D90A 68F0BE5F00              push 005FBEF0
:0040D90F 680CDF5900              push 0059DF0C
:0040D914 680CBF5F00              push 005FBF0C
:0040D919 FFD3                    call ebx
:0040D91B 68ECBE5F00              push 005FBEEC
:0040D920 680CDF5900              push 0059DF0C
:0040D925 6800BF5F00              push 005FBF00
:0040D92A FFD3                    call ebx
:0040D92C 68E8BE5F00              push 005FBEE8
:0040D931 680CDF5900              push 0059DF0C
:0040D936 68F4BE5F00              push 005FBEF4
:0040D93B FFD3                    call ebx
:0040D93D A1F0BE5F00              mov eax, dword ptr [005FBEF0]                   //取注册码中后19位头四位数字转成16进制数
:0040D942 83C448                  add esp, 00000048
:0040D945 3D540B0000              cmp eax, 00000B54                               //要大于B54 否则出错误
:0040D94A 7E05                    jle 0040D951
:0040D94C B8540B0000              mov eax, 00000B54
..............................
................................
///关键调用结束
/////////////////////////////////////////////////////////////////////////////////////////////////////////

//插入程序功能限制函数调用
:0049ABB0 83EC74                  sub esp, 00000074
:0049ABB3 A1B0AB5F00              mov eax, dword ptr [005FABB0]
:0049ABB8 89442470                mov dword ptr [esp+70], eax
:0049ABBC 33C0                    xor eax, eax
:0049ABBE 53                      push ebx
:0049ABBF 89442408                mov dword ptr [esp+08], eax
:0049ABC3 89442404                mov dword ptr [esp+04], eax
:0049ABC7 88442410                mov byte ptr [esp+10], al
:0049ABCB 8D44240C                lea eax, dword ptr [esp+0C]
:0049ABCF 50                      push eax
:0049ABD0 A1F0686000              mov eax, dword ptr [006068F0]
:0049ABD5 8D4C2408                lea ecx, dword ptr [esp+08]
:0049ABD9 51                      push ecx
:0049ABDA 8D542410                lea edx, dword ptr [esp+10]
:0049ABDE 52                      push edx
:0049ABDF 50                      push eax
:0049ABE0 C744241CFEFFFFFF        mov [esp+1C], FFFFFFFE
:0049ABE8 E8B329F7FF              call 0040D5A0
:0049ABED 83C410                  add esp, 00000010
:0049ABF0 84C0                    test al, al
:0049ABF2 756E                    jne 0049AC62
:0049ABF4 813D14995F0080000000    cmp dword ptr [005F9914], 00000080
:0049ABFE 0F8F14020000            jg 0049AE18
:0049AC04 B301                    mov bl, 01
:0049AC06 881DD9686000            mov byte ptr [006068D9], bl
:0049AC0C 881DDA686000            mov byte ptr [006068DA], bl
:0049AC12 881DDB686000            mov byte ptr [006068DB], bl
:0049AC18 881DDD686000            mov byte ptr [006068DD], bl
:0049AC1E 881DDC686000            mov byte ptr [006068DC], bl
:0049AC24 881DD8686000            mov byte ptr [006068D8], bl
:0049AC2A 881DDF686000            mov byte ptr [006068DF], bl
:0049AC30 881DE0686000            mov byte ptr [006068E0], bl
:0049AC36 881DE3686000            mov byte ptr [006068E3], bl
:0049AC3C 881DE4686000            mov byte ptr [006068E4], bl
:0049AC42 881DE6686000            mov byte ptr [006068E6], bl
:0049AC48 881DE8686000            mov byte ptr [006068E8], bl
:0049AC4E 881DE7686000            mov byte ptr [006068E7], bl
:0049AC54 5B                      pop ebx
:0049AC55 8B4C2470                mov ecx, dword ptr [esp+70]
:0049AC59 E850320E00              call 0057DEAE
:0049AC5E 83C474                  add esp, 00000074
:0049AC61 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049ABF2(C)
|
:0049AC62 8B15F0686000            mov edx, dword ptr [006068F0]
:0049AC68 8D4C2410                lea ecx, dword ptr [esp+10]
:0049AC6C 51                      push ecx
:0049AC6D 52                      push edx
:0049AC6E E80D26F7FF              call 0040D280
:0049AC73 83C408                  add esp, 00000008
:0049AC76 84C0                    test al, al
:0049AC78 0F849A010000            je 0049AE18
:0049AC7E 56                      push esi

* Reference To: MSVCR71.strstr, Ord:0313h
 //以下判断注册码中是否含有ABCGIMNORU3TSEPF 对应15个模块功能16功能                                |
:0049AC7F 8B3500905900            mov esi, dword ptr [00599000]
:0049AC85 8D442414                lea eax, dword ptr [esp+14]
:0049AC89 68E8C45A00              push 005AC4E8
:0049AC8E 50                      push eax
:0049AC8F FFD6                    call esi
:0049AC91 83C408                  add esp, 00000008
:0049AC94 85C0                    test eax, eax
:0049AC96 B301                    mov bl, 01
:0049AC98 7406                    je 0049ACA0
:0049AC9A 881DDA686000            mov byte ptr [006068DA], bl    //1模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049AC98(C)
|
:0049ACA0 8D4C2414                lea ecx, dword ptr [esp+14]
:0049ACA4 68E4C45A00              push 005AC4E4
:0049ACA9 51                      push ecx
:0049ACAA FFD6                    call esi
:0049ACAC 83C408                  add esp, 00000008
:0049ACAF 85C0                    test eax, eax
:0049ACB1 7406                    je 0049ACB9
:0049ACB3 881DDF686000            mov byte ptr [006068DF], bl     //2模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049ACB1(C)
|
:0049ACB9 8D542414                lea edx, dword ptr [esp+14]
:0049ACBD 68E0C45A00              push 005AC4E0
:0049ACC2 52                      push edx
:0049ACC3 FFD6                    call esi
:0049ACC5 83C408                  add esp, 00000008
:0049ACC8 85C0                    test eax, eax
:0049ACCA 7406                    je 0049ACD2
:0049ACCC 881DD9686000            mov byte ptr [006068D9], bl    //3模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049ACCA(C)
|
:0049ACD2 8D442414                lea eax, dword ptr [esp+14]
:0049ACD6 6864055A00              push 005A0564
:0049ACDB 50                      push eax
:0049ACDC FFD6                    call esi
:0049ACDE 83C408                  add esp, 00000008
:0049ACE1 85C0                    test eax, eax
:0049ACE3 7406                    je 0049ACEB
:0049ACE5 881DDB686000            mov byte ptr [006068DB], bl      //4模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049ACE3(C)
|
:0049ACEB 8D4C2414                lea ecx, dword ptr [esp+14]
:0049ACEF 68DCC45A00              push 005AC4DC
:0049ACF4 51                      push ecx
:0049ACF5 FFD6                    call esi
:0049ACF7 83C408                  add esp, 00000008
:0049ACFA 85C0                    test eax, eax
:0049ACFC 7406                    je 0049AD04
:0049ACFE 881DDC686000            mov byte ptr [006068DC], bl  //5模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049ACFC(C)
|
:0049AD04 8D542414                lea edx, dword ptr [esp+14]
:0049AD08 68D8C45A00              push 005AC4D8
:0049AD0D 52                      push edx
:0049AD0E FFD6                    call esi
:0049AD10 83C408                  add esp, 00000008
:0049AD13 85C0                    test eax, eax
:0049AD15 7406                    je 0049AD1D
:0049AD17 881DE4686000            mov byte ptr [006068E4], bl //6模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049AD15(C)
|
:0049AD1D 8D442414                lea eax, dword ptr [esp+14]
:0049AD21 68D4C45A00              push 005AC4D4
:0049AD26 50                      push eax
:0049AD27 FFD6                    call esi
:0049AD29 83C408                  add esp, 00000008
:0049AD2C 85C0                    test eax, eax
:0049AD2E 7406                    je 0049AD36
:0049AD30 881DE8686000            mov byte ptr [006068E8], bl  //7模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049AD2E(C)
|
:0049AD36 8D4C2414                lea ecx, dword ptr [esp+14]
:0049AD3A 68D0C45A00              push 005AC4D0
:0049AD3F 51                      push ecx
:0049AD40 FFD6                    call esi
:0049AD42 83C408                  add esp, 00000008
:0049AD45 85C0                    test eax, eax
:0049AD47 7406                    je 0049AD4F
:0049AD49 881DE2686000            mov byte ptr [006068E2], bl   //8模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049AD47(C)
|
:0049AD4F 8D542414                lea edx, dword ptr [esp+14]
:0049AD53 68CCC45A00              push 005AC4CC
:0049AD58 52                      push edx
:0049AD59 FFD6                    call esi
:0049AD5B 83C408                  add esp, 00000008
:0049AD5E 85C0                    test eax, eax
:0049AD60 7406                    je 0049AD68
:0049AD62 881DE0686000            mov byte ptr [006068E0], bl    //9模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049AD60(C)
|
:0049AD68 8D442414                lea eax, dword ptr [esp+14]
:0049AD6C 68C8C45A00              push 005AC4C8
:0049AD71 50                      push eax
:0049AD72 FFD6                    call esi
:0049AD74 83C408                  add esp, 00000008
:0049AD77 85C0                    test eax, eax
:0049AD79 7406                    je 0049AD81
:0049AD7B 881DDD686000            mov byte ptr [006068DD], bl   //10模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049AD79(C)
|
:0049AD81 8D4C2414                lea ecx, dword ptr [esp+14]
:0049AD85 68C4C45A00              push 005AC4C4
:0049AD8A 51                      push ecx
:0049AD8B FFD6                    call esi
:0049AD8D 83C408                  add esp, 00000008
:0049AD90 85C0                    test eax, eax
:0049AD92 7406                    je 0049AD9A
:0049AD94 881DDE686000            mov byte ptr [006068DE], bl   //11模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049AD92(C)
|
:0049AD9A 8D542414                lea edx, dword ptr [esp+14]
:0049AD9E 68C0C45A00              push 005AC4C0
:0049ADA3 52                      push edx
:0049ADA4 FFD6                    call esi
:0049ADA6 83C408                  add esp, 00000008
:0049ADA9 85C0                    test eax, eax
:0049ADAB 7406                    je 0049ADB3
:0049ADAD 881DD8686000            mov byte ptr [006068D8], bl   //12模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049ADAB(C)
|
:0049ADB3 8D442414                lea eax, dword ptr [esp+14]
:0049ADB7 68BCC45A00              push 005AC4BC
:0049ADBC 50                      push eax
:0049ADBD FFD6                    call esi
:0049ADBF 83C408                  add esp, 00000008
:0049ADC2 85C0                    test eax, eax
:0049ADC4 7406                    je 0049ADCC
:0049ADC6 881DE3686000            mov byte ptr [006068E3], bl   //13模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049ADC4(C)
|
:0049ADCC 8D4C2414                lea ecx, dword ptr [esp+14]
:0049ADD0 68B8C45A00              push 005AC4B8
:0049ADD5 51                      push ecx
:0049ADD6 FFD6                    call esi
:0049ADD8 83C408                  add esp, 00000008
:0049ADDB 85C0                    test eax, eax
:0049ADDD 7406                    je 0049ADE5
:0049ADDF 881DE5686000            mov byte ptr [006068E5], bl      //14模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049ADDD(C)
|
:0049ADE5 8D542414                lea edx, dword ptr [esp+14]
:0049ADE9 68B4C45A00              push 005AC4B4
:0049ADEE 52                      push edx
:0049ADEF FFD6                    call esi
:0049ADF1 83C408                  add esp, 00000008
:0049ADF4 85C0                    test eax, eax
:0049ADF6 7406                    je 0049ADFE
:0049ADF8 881DE6686000            mov byte ptr [006068E6], bl       //15模块与功能
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049ADF6(C)
|
:0049ADFE 8D442414                lea eax, dword ptr [esp+14]
:0049AE02 68B0C45A00              push 005AC4B0
:0049AE07 50                      push eax
:0049AE08 FFD6                    call esi
:0049AE0A 83C408                  add esp, 00000008
:0049AE0D 85C0                    test eax, eax
:0049AE0F 5E                      pop esi
:0049AE10 7406                    je 0049AE18
:0049AE12 881DE7686000            mov byte ptr [006068E7], bl      //16模块与功能

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0049ABFE(C), :0049AC78(C), :0049AE10(C)
|
:0049AE18 8B4C2474                mov ecx, dword ptr [esp+74]
:0049AE1C 5B                      pop ebx
:0049AE1D E88C300E00              call 0057DEAE
:0049AE22 83C474                  add esp, 00000074
:0049AE25 C3                      ret
//插入程序功能限制函数调用结束

后面取注册码中##前的注册码为注册名,调用相同计算。过程从略。
给两个注册码
HaIlDuZ##ABCGIMNORU3TSEPF**2025090889000BDA47D0F221AD6
丹麦SPIP(TM)##ABCGIMNORU3TSEPF**2025090889eee0FECF3E7
希望多提意见。(完)
HaIlDuZ
hailduz@hotmail.com
2005.5