（BASE64）冰盾系统安全专家 V3.3 破解教程

标题：（BASE64）冰盾系统安全专家 V3.3 破解教程
作者：kyc
时间：2005-05-27 20:14
链接：http://bbs.pediy.com/showthread.php?threadid=14007

【破解作者】 kyc[dfcg][czg]
【作者邮箱】 muyang008@163.com
【使用工具】 FLYold1.10c
【破解平台】 win2003
【软件名称】冰盾系统安全专家 V3.3
软件大小：  2582 KB
软件语言：  简体中文
软件类别：  国产软件 / 共享版 / 系统安全
应用平台：  Win9x/NT/2000/XP
软件介绍：嵌入式内核技术全面替代硬盘保护卡领跑系统安全软件。本软件可以极其有效的防止病毒、木马及其他恶意代码或人为
           对系统造成的不同程度的危害，真正实现注册表内容防删除、防篡改，文件防删、硬盘防格式化及其它众多系统安全功能，
           如：文件加密、隐藏、黑客软件扫描、病毒预警、系统敏感功能限制等40余项系统底层功能，可全面深层的保护您的计算机免受侵害！
下载地址：http://www.skycn.com/soft/2992.html
【加壳方式】无壳
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------------------------
【破解内容】vc编写保护方式BASE64加密，但注册码以明文出现，如果觉得简单高手就略过吧。

00409A32   |.  68 FFF24200        push Registry.0042F2FF                         ;  SE handler installation
00409A37   |.  64:A1 00000000     mov eax,dword ptr fs:[0]
00409A3D   |.  50                 push eax                                       ;  因为使用了 BASE64加密算法利用PEID显示的地址下断
00409A3E   |.  64:8925 00000000   mov dword ptr fs:[0],esp
00409A45   |.  83EC 30            sub esp,30
00409A48   |.  56                 push esi
00409A49   |.  8BF1               mov esi,ecx
00409A4B   |.  C74424 10 00000000 mov dword ptr ss:[esp+10],0
00409A53   |.  A1 F0CB4300        mov eax,dword ptr ds:[43CBF0]
00409A58   |.  C74424 3C 01000000 mov dword ptr ss:[esp+3C],1
00409A60   |.  894424 04          mov dword ptr ss:[esp+4],eax
00409A64   |.  8D4C24 48          lea ecx,dword ptr ss:[esp+48]                  ;  ecx=机器码
00409A68   |.  C64424 3C 02       mov byte ptr ss:[esp+3C],2
00409A6D   |.  51                 push ecx
00409A6E   |.  8D4C24 10          lea ecx,dword ptr ss:[esp+10]
00409A72   |.  E8 02CB0100        call Registry.00426579
00409A77   |.  8D5424 0C          lea edx,dword ptr ss:[esp+C]                   ;  eDx=机器码
00409A7B   |.  8D4C24 18          lea ecx,dword ptr ss:[esp+18]
00409A7F   |.  52                 push edx                                       ;  eDx=机器码
00409A80   |.  6A 01              push 1
00409A82   |.  6A 00              push 0
00409A84   |.  C64424 48 03       mov byte ptr ss:[esp+48],3
00409A89   |.  E8 E298FFFF        call Registry.00403370                         ;  f7 base64加密

*******************************************************************************************************
00403370   /$  8B4424 0C          mov eax,dword ptr ss:[esp+C]
00403374   |.  56                 push esi
00403375   |.  8BF1               mov esi,ecx
00403377   |.  8B5424 0C          mov edx,dword ptr ss:[esp+C]
0040337B   |.  C706 58174300      mov dword ptr ds:[esi],Registry.00431758
00403381   |.  8B00               mov eax,dword ptr ds:[eax]                     ;  机器码
00403383   |.  8B48 F8            mov ecx,dword ptr ds:[eax-8]                   ;  机器码长度
00403386   |.  51                 push ecx
00403387   |.  50                 push eax
00403388   |.  8B4424 10          mov eax,dword ptr ss:[esp+10]
0040338C   |.  52                 push edx
0040338D   |.  50                 push eax
0040338E   |.  8BCE               mov ecx,esi
00403390   |.  E8 6B000000        call Registry.00403400                        ******f7 base64加密
////////////////////////////////////////////////////////////////////////////////////////////////////////

00403400   /$  64:A1 00000000     mov eax,dword ptr fs:[0]
00403406   |.  6A FF              push -1
00403408   |.  68 A6EC4200        push Registry.0042ECA6
0040340D   |.  50                 push eax
0040340E   |.  8B4424 14          mov eax,dword ptr ss:[esp+14]
00403412   |.  64:8925 00000000   mov dword ptr fs:[0],esp
00403419   |.  53                 push ebx
0040341A   |.  56                 push esi
0040341B   |.  8BF1               mov esi,ecx
0040341D   |.  57                 push edi
0040341E   |.  85C0               test eax,eax
00403420   |.  8D7E 08            lea edi,dword ptr ds:[esi+8]
00403423   |.  8D5E 0C            lea ebx,dword ptr ds:[esi+C]
00403426   |.  C707 00000000      mov dword ptr ds:[edi],0
0040342C   |.  C703 00000000      mov dword ptr ds:[ebx],0
00403432   |.  75 23              jnz short Registry.00403457
00403434   |.  6A 04              push 4
00403436   |.  E8 0A310200        call Registry.00426545
0040343B   |.  83C4 04            add esp,4
0040343E   |.  894424 20          mov dword ptr ss:[esp+20],eax
00403442   |.  85C0               test eax,eax
00403444   |.  C74424 14 00000000 mov dword ptr ss:[esp+14],0
0040344C   |.  74 31              je short Registry.0040347F
0040344E   |.  8BC8               mov ecx,eax
00403450   |.  E8 1BFCFFFF        call Registry.00403070
00403455   |.  EB 2A              jmp short Registry.00403481
00403457   |>  83F8 01            cmp eax,1
0040345A   |.  75 30              jnz short Registry.0040348C
0040345C   |.  6A 60              push 60
0040345E   |.  E8 E2300200        call Registry.00426545
00403463   |.  83C4 04            add esp,4
00403466   |.  894424 20          mov dword ptr ss:[esp+20],eax
0040346A   |.  85C0               test eax,eax
0040346C   |.  C74424 14 01000000 mov dword ptr ss:[esp+14],1
00403474   |.  74 09              je short Registry.0040347F
00403476   |.  8BC8               mov ecx,eax
00403478   |.  E8 C3F2FFFF        call Registry.00402740                         ;  BASE64加密

///////////////////////////////////////////////////////////////////////////////////////
00402740   /$  6A FF              push -1
00402742   |.  68 63EC4200        push Registry.0042EC63                         ;  SE handler installation
00402747   |.  64:A1 00000000     mov eax,dword ptr fs:[0]
0040274D   |.  50                 push eax
0040274E   |.  64:8925 00000000   mov dword ptr fs:[0],esp
00402755   |.  83EC 54            sub esp,54
00402758   |.  53                 push ebx
00402759   |.  55                 push ebp
0040275A   |.  56                 push esi
0040275B   |.  8BE9               mov ebp,ecx
0040275D   |.  57                 push edi
0040275E   |.  896C24 1C          mov dword ptr ss:[esp+1C],ebp
00402762   |.  E8 09090000        call Registry.00403070
00402767   |.  33C0               xor eax,eax
00402769   |.  C745 44 44174300   mov dword ptr ss:[ebp+44],Registry.00431744    ;  ASCII "alB"
00402770   |.  894424 6C          mov dword ptr ss:[esp+6C],eax
00402774   |.  8945 48            mov dword ptr ss:[ebp+48],eax
00402777   |.  C745 4C 11000000   mov dword ptr ss:[ebp+4C],11
0040277E   |.  8945 50            mov dword ptr ss:[ebp+50],eax
00402781   |.  8945 54            mov dword ptr ss:[ebp+54],eax
00402784   |.  8945 58            mov dword ptr ss:[ebp+58],eax
00402787   |.  C745 5C 0A000000   mov dword ptr ss:[ebp+5C],0A
0040278E   |.  B9 10000000        mov ecx,10
00402793   |.  BE 30C14300        mov esi,Registry.0043C130                      ;  ASCII "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
00402798   |.  8D7C24 20          lea edi,dword ptr ss:[esp+20]
0040279C   |.  C745 00 3C174300   mov dword ptr ss:[ebp],Registry.0043173C
004027A3   |.  F3:A5              rep movs dword ptr es:[edi],dword ptr ds:[esi]
004027A5   |.  894424 14          mov dword ptr ss:[esp+14],eax
004027A9   |.  8BC5               mov eax,ebp
004027AB   |.  8D4C24 20          lea ecx,dword ptr ss:[esp+20]
004027AF   |.  C64424 6C 01       mov byte ptr ss:[esp+6C],1
004027B4   |.  2BC1               sub eax,ecx
004027B6   |.  83C0 04            add eax,4
004027B9   |.  A4                 movs byte ptr es:[edi],byte ptr ds:[esi]
004027BA   |.  894424 18          mov dword ptr ss:[esp+18],eax
004027BE   |>  8B5424 14          /mov edx,dword ptr ss:[esp+14]
004027C2   |.  8A4C14 20          |mov cl,byte ptr ss:[esp+edx+20]
004027C6   |.  8D4414 20          |lea eax,dword ptr ss:[esp+edx+20]
004027CA   |.  8B5424 18          |mov edx,dword ptr ss:[esp+18]
004027CE   |.  884C24 10          |mov byte ptr ss:[esp+10],cl
004027D2   |.  880C02             |mov byte ptr ds:[edx+eax],cl
004027D5   |.  8B4424 10          |mov eax,dword ptr ss:[esp+10]
004027D9   |.  8B75 4C            |mov esi,dword ptr ss:[ebp+4C]
004027DC   |.  25 FF000000        |and eax,0FF
004027E1   |.  C1E8 04            |shr eax,4
004027E4   |.  33D2               |xor edx,edx
004027E6   |.  8B4D 48            |mov ecx,dword ptr ss:[ebp+48]
004027E9   |.  F7F6               |div esi
004027EB   |.  85C9               |test ecx,ecx
004027ED   |.  8BDA               |mov ebx,edx
004027EF   |.  74 26              |je short Registry.00402817
004027F1   |.  8B0499             |mov eax,dword ptr ds:[ecx+ebx*4]
004027F4   |.  85C0               |test eax,eax
004027F6   |.  74 1B              |je short Registry.00402813
004027F8   |>  8A50 08            |/mov dl,byte ptr ds:[eax+8]
004027FB   |.  3A5424 10          ||cmp dl,byte ptr ss:[esp+10]
004027FF   |.  74 08              ||je short Registry.00402809
00402801   |.  8B00               ||mov eax,dword ptr ds:[eax]
00402803   |.  85C0               ||test eax,eax
00402805   |.^ 75 F1              |\jnz short Registry.004027F8
00402807   |.  EB 0A              |jmp short Registry.00402813
00402809   |>  85C0               |test eax,eax
0040280B   |.  8BF8               |mov edi,eax
0040280D   |.  0F85 98000000      |jnz Registry.004028AB
00402813   |>  85C9               |test ecx,ecx
00402815   |.  75 2C              |jnz short Registry.00402843
00402817   |>  8D3CB5 00000000    |lea edi,dword ptr ds:[esi*4]
0040281E   |.  57                 |push edi
0040281F   |.  E8 213D0200        |call Registry.00426545
00402824   |.  8BD0               |mov edx,eax
00402826   |.  8BCF               |mov ecx,edi
00402828   |.  8955 48            |mov dword ptr ss:[ebp+48],edx
0040282B   |.  8BFA               |mov edi,edx
0040282D   |.  8BD1               |mov edx,ecx
0040282F   |.  33C0               |xor eax,eax
00402831   |.  C1E9 02            |shr ecx,2
00402834   |.  F3:AB              |rep stos dword ptr es:[edi]
00402836   |.  8BCA               |mov ecx,edx
00402838   |.  83C4 04            |add esp,4
0040283B   |.  83E1 03            |and ecx,3
0040283E   |.  F3:AA              |rep stos byte ptr es:[edi]
00402840   |.  8975 4C            |mov dword ptr ss:[ebp+4C],esi
00402843   |>  8B45 54            |mov eax,dword ptr ss:[ebp+54]
00402846   |.  85C0               |test eax,eax
00402848   |.  75 30              |jnz short Registry.0040287A
0040284A   |.  8B45 5C            |mov eax,dword ptr ss:[ebp+5C]
0040284D   |.  6A 0C              |push 0C
0040284F   |.  8D4D 58            |lea ecx,dword ptr ss:[ebp+58]
00402852   |.  50                 |push eax
00402853   |.  51                 |push ecx
00402854   |.  E8 90000200        |call Registry.004228E9
00402859   |.  8B4D 5C            |mov ecx,dword ptr ss:[ebp+5C]
0040285C   |.  83C0 04            |add eax,4
0040285F   |.  8D1449             |lea edx,dword ptr ds:[ecx+ecx*2]
00402862   |.  49                 |dec ecx
00402863   |.  85C9               |test ecx,ecx
00402865   |.  8D4490 F4          |lea eax,dword ptr ds:[eax+edx*4-C]
00402869   |.  7C 0F              |jl short Registry.0040287A
0040286B   |.  41                 |inc ecx
0040286C   |>  8B55 54            |/mov edx,dword ptr ss:[ebp+54]
0040286F   |.  8910               ||mov dword ptr ds:[eax],edx
00402871   |.  8945 54            ||mov dword ptr ss:[ebp+54],eax
00402874   |.  83E8 0C            ||sub eax,0C
00402877   |.  49                 ||dec ecx
00402878   |.^ 75 F2              |\jnz short Registry.0040286C
0040287A   |>  8B45 54            |mov eax,dword ptr ss:[ebp+54]
0040287D   |.  8A5424 10          |mov dl,byte ptr ss:[esp+10]
00402881   |.  8BF8               |mov edi,eax
00402883   |.  8B08               |mov ecx,dword ptr ds:[eax]
00402885   |.  894D 54            |mov dword ptr ss:[ebp+54],ecx
00402888   |.  8B4D 50            |mov ecx,dword ptr ss:[ebp+50]
0040288B   |.  41                 |inc ecx
0040288C   |.  894D 50            |mov dword ptr ss:[ebp+50],ecx
0040288F   |.  C640 08 00         |mov byte ptr ds:[eax+8],0
00402893   |.  C640 09 00         |mov byte ptr ds:[eax+9],0
00402897   |.  8958 04            |mov dword ptr ds:[eax+4],ebx
0040289A   |.  8850 08            |mov byte ptr ds:[eax+8],dl
0040289D   |.  8B4D 48            |mov ecx,dword ptr ss:[ebp+48]
004028A0   |.  8B1499             |mov edx,dword ptr ds:[ecx+ebx*4]
004028A3   |.  8910               |mov dword ptr ds:[eax],edx
004028A5   |.  8B4D 48            |mov ecx,dword ptr ss:[ebp+48]
004028A8   |.  890499             |mov dword ptr ds:[ecx+ebx*4],eax
004028AB   |>  8B4424 14          |mov eax,dword ptr ss:[esp+14]
004028AF   |.  8847 09            |mov byte ptr ds:[edi+9],al
004028B2   |.  40                 |inc eax
004028B3   |.  83F8 40            |cmp eax,40
004028B6   |.  894424 14          |mov dword ptr ss:[esp+14],eax
004028BA   |.^ 0F8C FEFEFFFF      \jl Registry.004027BE
004028C0   |.  8B4C24 64          mov ecx,dword ptr ss:[esp+64]
004028C4   |.  5F                 pop edi
004028C5   |.  8BC5               mov eax,ebp
004028C7   |.  5E                 pop esi
004028C8   |.  5D                 pop ebp
004028C9   |.  5B                 pop ebx
004028CA   |.  64:890D 00000000   mov dword ptr fs:[0],ecx
004028D1   |.  83C4 60            add esp,60

///////////////////////////////////////////////////////////////////////////
00409A8E   |.  8D4C24 18          lea ecx,dword ptr ss:[esp+18]
00409A92   |.  C64424 3C 04       mov byte ptr ss:[esp+3C],4
00409A97   |.  E8 5499FFFF        call Registry.004033F0
00409A9C   |.  50                 push eax
00409A9D   |.  8D4C24 08          lea ecx,dword ptr ss:[esp+8]
00409AA1   |.  E8 A3CE0100        call Registry.00426949
00409AA6   |.  6A 3D              push 3D
00409AA8   |.  8D4C24 08          lea ecx,dword ptr ss:[esp+8]
00409AAC   |.  E8 70840100        call Registry.00421F21
00409AB1   |.  6A 2B              push 2B
00409AB3   |.  8D4C24 08          lea ecx,dword ptr ss:[esp+8]
00409AB7   |.  E8 65840100        call Registry.00421F21
00409ABC   |.  6A 2F              push 2F
00409ABE   |.  8D4C24 08          lea ecx,dword ptr ss:[esp+8]
00409AC2   |.  E8 5A840100        call Registry.00421F21
00409AC7   |.  51                 push ecx
00409AC8   |.  8D4424 08          lea eax,dword ptr ss:[esp+8]
00409ACC   |.  8BCC               mov ecx,esp
00409ACE   |.  896424 18          mov dword ptr ss:[esp+18],esp
00409AD2   |.  50                 push eax
00409AD3   |.  E8 A1CA0100        call Registry.00426579
00409AD8   |.  8D4C24 0C          lea ecx,dword ptr ss:[esp+C]                   ; |
00409ADC   |.  51                 push ecx                                       ; |Arg1
00409ADD   |.  8BCE               mov ecx,esi                                    ; |
00409ADF   |.  E8 8C020000        call Registry.00409D70                         ; \f7关键算法

/////////////////////////////////////////////////////////////////////////////////
00409D70   /$  6A FF              push -1
00409D72   |.  68 57F34200        push Registry.0042F357                         ;  SE handler installation
00409D77   |.  64:A1 00000000     mov eax,dword ptr fs:[0]
00409D7D   |.  50                 push eax
00409D7E   |.  64:8925 00000000   mov dword ptr fs:[0],esp
00409D85   |.  83EC 08            sub esp,8
00409D88   |.  55                 push ebp
00409D89   |.  56                 push esi
00409D8A   |.  57                 push edi
00409D8B   |.  C74424 10 00000000 mov dword ptr ss:[esp+10],0
00409D93   |.  A1 F0CB4300        mov eax,dword ptr ds:[43CBF0]
00409D98   |.  C74424 1C 01000000 mov dword ptr ss:[esp+1C],1
00409DA0   |.  894424 0C          mov dword ptr ss:[esp+C],eax
00409DA4   |.  8B4C24 28          mov ecx,dword ptr ss:[esp+28]
00409DA8   |.  C64424 1C 02       mov byte ptr ss:[esp+1C],2
00409DAD   |.  8B69 F8            mov ebp,dword ptr ds:[ecx-8]
00409DB0   |.  8D7D 01            lea edi,dword ptr ss:[ebp+1]
00409DB3   |.  57                 push edi
00409DB4   |.  E8 8CC70100        call Registry.00426545
00409DB9   |.  8BCF               mov ecx,edi
00409DBB   |.  8BF0               mov esi,eax
00409DBD   |.  8BD1               mov edx,ecx
00409DBF   |.  33C0               xor eax,eax
00409DC1   |.  8BFE               mov edi,esi
00409DC3   |.  83C4 04            add esp,4
00409DC6   |.  C1E9 02            shr ecx,2
00409DC9   |.  F3:AB              rep stos dword ptr es:[edi]
00409DCB   |.  8BCA               mov ecx,edx
00409DCD   |.  83E1 03            and ecx,3
00409DD0   |.  F3:AA              rep stos byte ptr es:[edi]
00409DD2   |.  33C9               xor ecx,ecx
00409DD4   |.  85ED               test ebp,ebp
00409DD6   |.  7E 37              jle short Registry.00409E0F
00409DD8   |>  8B4424 28          /mov eax,dword ptr ss:[esp+28]
00409DDC   |.  8A0401             |mov al,byte ptr ds:[ecx+eax]
00409DDF   |.  3C 41              |cmp al,41
00409DE1   |.  74 22              |je short Registry.00409E05                    ;  如果RES[I]是41=A或61=a就RES[I]+=1
00409DE3   |.  3C 61              |cmp al,61
00409DE5   |.  74 1E              |je short Registry.00409E05
00409DE7   |.  3C 5A              |cmp al,5A                                     ;  如果RES[I]是5A=Z或7A=z就RES[I]-=1
00409DE9   |.  74 16              |je short Registry.00409E01
00409DEB   |.  3C 7A              |cmp al,7A
00409DED   |.  74 12              |je short Registry.00409E01
00409DEF   |.  0FBED0             |movsx edx,al
00409DF2   |.  81E2 01000080      |and edx,80000001                              ;  res[i] and 80000001
00409DF8   |.  79 05              |jns short Registry.00409DFF
00409DFA   |.  4A                 |dec edx
00409DFB   |.  83CA FE            |or edx,FFFFFFFE
00409DFE   |.  42                 |inc edx
00409DFF   |>  74 04              |je short Registry.00409E05                    ;  res[i] and 80000001等于0就res[i]+1
00409E01   |>  FEC8               |dec al                                        ;  res[i] and 80000001不等于0就res[i]-1
00409E03   |.  EB 02              |jmp short Registry.00409E07
00409E05   |>  FEC0               |inc al
00409E07   |>  880431             |mov byte ptr ds:[ecx+esi],al                  ;  形成真码
00409E0A   |.  41                 |inc ecx
00409E0B   |.  3BCD               |cmp ecx,ebp
00409E0D   |.^ 7C C9              \jl short Registry.00409DD8
00409E0F   |>  56                 push esi
00409E10   |.  8D4C24 10          lea ecx,dword ptr ss:[esp+10]
00409E14   |.  E8 30CB0100        call Registry.00426949
00409E19   |.  56                 push esi
00409E1A   |.  E8 4FC70100        call Registry.0042656E
00409E1F   |.  8B7424 28          mov esi,dword ptr ss:[esp+28]
00409E23   |.  83C4 04            add esp,4
00409E26   |.  8D4424 0C          lea eax,dword ptr ss:[esp+C]
00409E2A   |.  8BCE               mov ecx,esi

////////////////////////////////////////////////////////////////////////////////////////////////////
总结：注册方式为对机器码进行BASE64加密后对其结果进行了一些处理形成注册码，详见注册机C源码。
BASE64C代码参考了网上不知哪位大虾编的。
#include  <stdio.h>
#include  <stdlib.h>
#include  <string.h>
#include  <conio.h>  /*  Windows  special  */
char*  alphabet  =  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
char*  encode(char  data[],  int  length)
{

  int  i,  index,  val;
  int  quad,  trip;    /*  bool  type:  0  or  1  */
   char*  out;
    //out = (char*)malloc((((length+2)/3)*4)*sizeof(char));
    out=new char[(((length+2)/3)*4)*sizeof(char)];
  for  (i=0,  index=0;  i<length;  i+=3,  index+=4)
  {
               quad  =  0;
               trip  =  0;

         val=(0xFF  &  (int)  data[i]);
               val<<=8;
               if((i+1)<length)
         {
                       val|=(0xFF&(int)data[i+1]);
                       trip = 1;
               }
               val<<=8;
               if  ((i+2)<length)
         {
                       val|=(0xFF&(int)data[i+2]);
                       quad  =  1;
               }
               out[index+3]  =  alphabet[(quad ?(val&0x3F):64)];
               val>>=6;
               out[index+2]  =  alphabet[(trip?(val&0x3F):64)];
               val>>=6;
               out[index+1]  =  alphabet[val&0x3F];
               val>>=6;
               out[index+0]  =  alphabet[val&0x3F];

       }

  out[index]  =  '\0';
       return  out;
}
void  init_codes(char  codes[])
{
int  i;
for  (i =0; i< 256; i++)
     codes[i]  = -1;
       for  (i = 'A'; i <= 'Z'; i++)
       codes[i] = i -'A';
       for  (i='a'; i<='z';i++)
       codes[i] = 26 + i- 'a';
       for  (i='0';i<='9'; i++)
       codes[i]= 52+i-'0';
       codes['+'] = 62;
       codes['/'] = 63;
}
char*  decode(char  data[],int  length)
{

  int  value,  ix;
       int  shift  =  0;      /*  #  of  excess  bits  stored  in  accum  */
       int  accum  =  0;      /*  excess  bits  */
       int  index  =  0;
       int  len;

     char  codes[256];

     char*  out;

     len=((length + 3)/4)*3;
       if(length>0 && data[length-1] =='=')
       --len;
       if  (length>1&&data[length-2] =='=')
       --len;

     printf("%d\n",sizeof(char));

     //out  =  (char*)malloc(len  *  sizeof(char));
        out=new char[len*sizeof(char)];
     init_codes(codes);
       for  (ix=0;  ix<length;  ix++)
     {
               value = codes[data[ix] & 0xFF];  /*  ignore  high  byte  of  char  */
               if  (  value  >=  0  )
         {          /*  skip  over  non-code  */
                       accum  <<= 6;                        /*  bits  shift  up  by  6  each  time  thru  */
                       shift  +=  6;                          /*  loop,  with  new  bits  being  put  in  */
                       accum  |=  value;                  /*  at  the  bottom.  */
                       if  (  shift  >=  8  )
             {          /*  whenever  there  are  8  or  more  shifted  in,  */
                               shift  -=  8;                  /*  write  them  out  (from  the  top,  leaving  any  */
                               out[index++]  =  ((accum  >>  shift)  &  0xff);            /*  excess  at  the  bottom  for  next  iterati  on.  */

     }
   }
}

     out[index]  =  '\0';

     if  (index  !=  len)
       printf("miscalculated  data  length!\n");
return  out;
}
char*  fu1(char  *data,  int  length)
{

  int    index;

   char*  out1;

     out1=new char[length*sizeof(char)];
   strcpy(out1,data);
  for  (index=0;  index<length; index++)
  {
    if(out1[index]=='a'||out1[index]=='A')
          out1[index]=out1[index]+1;
    else if(out1[index]=='Z'||out1[index]=='z')
              out1[index]=out1[index]-1;
    else if((out1[index]&0x80000001)==0)
              out1[index]=out1[index]+1;
    else out1[index]=out1[index]-1;
       }

  out1[index-1]  =  '\0';
       return  out1;
}
void   main()
{

  char data1[255]={0},data2[255]={0};
printf("请输入机器码： \n");
  scanf( "%s",  &data2 );

char*  out1;
char*  out2;
char*  res;

out2  =  encode(data2,strlen(data2)); //加密
res   =  fu1(out2,strlen(out2));      //对加密结果简单处理形成真正注册码
out1  =  decode(out2,strlen(out2));  //解密
printf("%s\n%s\n",out2,out1);
printf("您的注册码是：\n%s\n",res);
system("pause");  /*  Windows  special  */

}

注册后虽然出现注册成功，但是，还是没有真正注册上。可能还有什么暗桩但是，没有发现。
不过通过破解学习了BASE64加密解密算法，要不然真难以去理解枯燥的算法。
失误或得罪之处多多包涵。

标题：答复
作者：kyc
时间：2005-05-28 00:20

后记：
注册后在WINDOWS目录下生成REGSUCCESS.ISD文件
具体格式如下：
Copyright by He.Yu.Peng
机器码
注册码
机器码之和加取注册码第LEN（机器码）位*LEN（注册码）
继续跟踪了根目录下的ISEncrypter.exe未注册只能加5KB以下的软件，但是跟踪发现注册成功与否只能加壳5KB以下的软件
**************************************************************************************
00401517    .  6A 04              push 4
00401519    .  51                 push ecx
0040151A    .  8BCF               mov ecx,edi
0040151C    .  E8 10950200        call ISEncryp.0042AA31
00401521    .  8B5424 10          mov edx,dword ptr ss:[esp+10]
00401525    .  68 3C824400        push ISEncryp.0044823C                         ;  ASCII ".EXE"
0040152A    .  52                 push edx
0040152B    .  C78424 48020000 00>mov dword ptr ss:[esp+248],0
00401536    .  E8 697C0100        call ISEncryp.004191A4
0040153B    .  83C4 08            add esp,8
0040153E    .  85C0               test eax,eax
00401540    .  74 13              je short ISEncryp.00401555
00401542    .  6A 00              push 0                                         ; /Arg3 = 00000000
00401544    .  6A 00              push 0                                         ; |Arg2 = 00000000
00401546    .  68 1C824400        push ISEncryp.0044821C                         ; |Arg1 = 0044821C
0040154B    .  E8 632A0300        call ISEncryp.00433FB3                         ; \ISEncryp.00433FB3
00401550    .  E9 6C010000        jmp ISEncryp.004016C1
00401555    >  A1 948C4400        mov eax,dword ptr ds:[448C94]
0040155A    .  894424 14          mov dword ptr ss:[esp+14],eax
0040155E    .  8D4C24 1C          lea ecx,dword ptr ss:[esp+1C]
00401562    .  C68424 40020000 01 mov byte ptr ss:[esp+240],1
0040156A    .  51                 push ecx                                       ; /Arg1
0040156B    .  8BCE               mov ecx,esi                                    ; |
0040156D    .  E8 8E010000        call ISEncryp.00401700                         ; \ISEncryp.00401700
00401572    .  8D5424 1C          lea edx,dword ptr ss:[esp+1C]
00401576    .  68 10824400        push ISEncryp.00448210                         ;  ASCII "ISHP.DLL"
0040157B    .  52                 push edx
0040157C    .  8D4424 1C          lea eax,dword ptr ss:[esp+1C]
00401580    .  68 08824400        push ISEncryp.00448208                         ;  ASCII "%s%s"
00401585    .  50                 push eax
00401586    .  E8 A2980200        call ISEncryp.0042AE2D
0040158B    .  83C4 10            add esp,10
0040158E    .  8D4C24 0C          lea ecx,dword ptr ss:[esp+C]
00401592    .  57                 push edi                                       ; /Arg2
00401593    .  51                 push ecx                                       ; |Arg1
00401594    .  8BCE               mov ecx,esi                                    ; |
00401596    .  E8 55020000        call ISEncryp.004017F0                         ; \ISEncryp.004017F0
0040159B    .  8D5424 0C          lea edx,dword ptr ss:[esp+C]
0040159F    .  68 FC814400        push ISEncryp.004481FC                         ;  ASCII "_New.exe"
004015A4    .  8D4424 1C          lea eax,dword ptr ss:[esp+1C]
004015A8    .  52                 push edx
004015A9    .  50                 push eax
004015AA    .  C68424 4C020000 02 mov byte ptr ss:[esp+24C],2
004015B2    .  E8 09EE0200        call ISEncryp.004303C0
004015B7    .  8B08               mov ecx,dword ptr ds:[eax]
004015B9    .  8D5424 0C          lea edx,dword ptr ss:[esp+C]
004015BD    .  51                 push ecx
004015BE    .  68 F8814400        push ISEncryp.004481F8                         ;  ASCII "%s"
004015C3    .  52                 push edx
004015C4    .  C68424 4C020000 03 mov byte ptr ss:[esp+24C],3
004015CC    .  E8 5C980200        call ISEncryp.0042AE2D
004015D1    .  83C4 0C            add esp,0C
004015D4    .  8D4C24 18          lea ecx,dword ptr ss:[esp+18]
004015D8    .  C68424 40020000 02 mov byte ptr ss:[esp+240],2
004015E0    .  E8 46EB0200        call ISEncryp.0043012B
004015E5    .  68 E4814400        push ISEncryp.004481E4
004015EA    .  68 10040000        push 410
004015EF    .  8BCE               mov ecx,esi
004015F1    .  E8 A7E00200        call ISEncryp.0042F69D
004015F6    .  8BC8               mov ecx,eax
004015F8    .  E8 90E10200        call ISEncryp.0042F78D
004015FD    .  8BCE               mov ecx,esi
004015FF    .  E8 BC0B0000        call ISEncryp.004021C0                         ;  关键算法
/////////////////////////////////////////////////////////////////////////////////////////////////////////////
004021C0   /$  6A FF              push -1
004021C2   |.  68 0B874300        push ISEncryp.0043870B                         ;  SE handler installation
004021C7   |.  64:A1 00000000     mov eax,dword ptr fs:[0]
004021CD   |.  50                 push eax
004021CE   |.  64:8925 00000000   mov dword ptr fs:[0],esp
004021D5   |.  81EC 98020000      sub esp,298
004021DB   |.  53                 push ebx
004021DC   |.  55                 push ebp
004021DD   |.  56                 push esi
004021DE   |.  57                 push edi
004021DF   |.  B9 61000000        mov ecx,61
004021E4   |.  33C0               xor eax,eax
004021E6   |.  8D7C24 20          lea edi,dword ptr ss:[esp+20]
004021EA   |.  68 04010000        push 104                                       ; /BufSize = 104 (260.)
004021EF   |.  F3:AB              rep stos dword ptr es:[edi]                    ; |
004021F1   |.  8D8424 A8010000    lea eax,dword ptr ss:[esp+1A8]                 ; |查找系统目录是否存在REGSUCCESS.ISD
004021F8   |.  33ED               xor ebp,ebp                                    ; |
004021FA   |.  50                 push eax                                       ; |Buffer
004021FB   |.  33DB               xor ebx,ebx                                    ; |EBX=0
004021FD   |.  FF15 FCB14300      call dword ptr ds:[<&KERNEL32.GetWindowsDirect>; \GetWindowsDirectoryA
00402203   |.  BF B8824400        mov edi,ISEncryp.004482B8                      ;  ASCII "\REGSUCCESS.ISD"
00402208   |.  83C9 FF            or ecx,FFFFFFFF
0040220B   |.  33C0               xor eax,eax
0040220D   |.  8D9424 A4010000    lea edx,dword ptr ss:[esp+1A4]
00402214   |.  F2:AE              repne scas byte ptr es:[edi]
00402216   |.  F7D1               not ecx
00402218   |.  2BF9               sub edi,ecx
0040221A   |.  8BF7               mov esi,edi
0040221C   |.  8BFA               mov edi,edx
0040221E   |.  8BD1               mov edx,ecx
00402220   |.  83C9 FF            or ecx,FFFFFFFF
00402223   |.  F2:AE              repne scas byte ptr es:[edi]
00402225   |.  8BCA               mov ecx,edx
00402227   |.  4F                 dec edi
00402228   |.  C1E9 02            shr ecx,2
0040222B   |.  F3:A5              rep movs dword ptr es:[edi],dword ptr ds:[esi]
0040222D   |.  8BCA               mov ecx,edx
0040222F   |.  83E1 03            and ecx,3
00402232   |.  F3:A4              rep movs byte ptr es:[edi],byte ptr ds:[esi]
00402234   |.  8D4C24 10          lea ecx,dword ptr ss:[esp+10]
00402238   |.  E8 F8E60200        call ISEncryp.00430935
0040223D   |.  33F6               xor esi,esi
0040223F   |.  8D8424 A4010000    lea eax,dword ptr ss:[esp+1A4]
00402246   |.  56                 push esi                                       ; /Arg3 => 00000000
00402247   |.  68 00800000        push 8000                                      ; |Arg2 = 00008000
0040224C   |.  50                 push eax                                       ; |Arg1
0040224D   |.  8D4C24 1C          lea ecx,dword ptr ss:[esp+1C]                  ; |
00402251   |.  89B424 BC020000    mov dword ptr ss:[esp+2BC],esi                 ; |
00402258   |.  E8 EAE70200        call ISEncryp.00430A47                         ; \ISEncryp.00430A47
0040225D   |.  85C0               test eax,eax
0040225F   |.  0F84 92000000      je ISEncryp.004022F7
00402265   |.  8D4C24 20          lea ecx,dword ptr ss:[esp+20]
00402269   |.  68 84010000        push 184                                       ; /Arg2 = 00000184
0040226E   |.  51                 push ecx                                       ; |Arg1
0040226F   |.  8D4C24 18          lea ecx,dword ptr ss:[esp+18]                  ; |
00402273   |.  E8 ECE80200        call ISEncryp.00430B64                         ; \ISEncryp.00430B64
00402278   |.  8DBC24 A0000000    lea edi,dword ptr ss:[esp+A0]                  ;  机器码
0040227F   |.  83C9 FF            or ecx,FFFFFFFF
00402282   |.  33C0               xor eax,eax
00402284   |.  33D2               xor edx,edx
00402286   |.  F2:AE              repne scas byte ptr es:[edi]
00402288   |.  F7D1               not ecx
0040228A   |.  49                 dec ecx                                        ;  ecx=机器码长度
0040228B   |.  74 20              je short ISEncryp.004022AD
0040228D   |>  0FBE8414 A0000000  /movsx eax,byte ptr ss:[esp+edx+A0]
00402295   |.  03D8               |add ebx,eax                                   ;  机器码按位相加
00402297   |.  8DBC24 A0000000    |lea edi,dword ptr ss:[esp+A0]
0040229E   |.  83C9 FF            |or ecx,FFFFFFFF
004022A1   |.  33C0               |xor eax,eax
004022A3   |.  42                 |inc edx
004022A4   |.  F2:AE              |repne scas byte ptr es:[edi]
004022A6   |.  F7D1               |not ecx
004022A8   |.  49                 |dec ecx
004022A9   |.  3BD1               |cmp edx,ecx
004022AB   |.^ 72 E0              \jb short ISEncryp.0040228D
004022AD   |>  8DBC24 20010000    lea edi,dword ptr ss:[esp+120]                 ;  注册码
004022B4   |.  83C9 FF            or ecx,FFFFFFFF
004022B7   |.  33C0               xor eax,eax
004022B9   |.  F2:AE              repne scas byte ptr es:[edi]
004022BB   |.  F7D1               not ecx
004022BD   |.  49                 dec ecx                                        ;  注册码长度
004022BE   |.  74 20              je short ISEncryp.004022E0
004022C0   |.  0FBE9414 20010000  movsx edx,byte ptr ss:[esp+edx+120]            ;  EDX=取注册码第LEN（机器码）位
004022C8   |>  03DA               /add ebx,edx                                   ;  相加
004022CA   |.  8DBC24 20010000    |lea edi,dword ptr ss:[esp+120]
004022D1   |.  83C9 FF            |or ecx,FFFFFFFF
004022D4   |.  33C0               |xor eax,eax
004022D6   |.  46                 |inc esi
004022D7   |.  F2:AE              |repne scas byte ptr es:[edi]
004022D9   |.  F7D1               |not ecx
004022DB   |.  49                 |dec ecx
004022DC   |.  3BF1               |cmp esi,ecx
004022DE   |.^ 72 E8              \jb short ISEncryp.004022C8
004022E0   |>  8D4C24 10          lea ecx,dword ptr ss:[esp+10]
004022E4   |.  E8 79E90200        call ISEncryp.00430C62                         ;  CloseHandle
004022E9   |.  3B9C24 A0010000    cmp ebx,dword ptr ss:[esp+1A0]                 ;  结果是否相等
004022F0   |.  75 05              jnz short ISEncryp.004022F7
004022F2   |.  BD 01000000        mov ebp,1
004022F7   |>  8D4C24 10          lea ecx,dword ptr ss:[esp+10]
004022FB   |.  C78424 B0020000 FF>mov dword ptr ss:[esp+2B0],-1
00402306   |.  E8 7FE60200        call ISEncryp.0043098A
0040230B   |.  8B8C24 A8020000    mov ecx,dword ptr ss:[esp+2A8]
00402312   |.  5F                 pop edi
00402313   |.  8BC5               mov eax,ebp
00402315   |.  5E                 pop esi
00402316   |.  5D                 pop ebp
00402317   |.  5B                 pop ebx
00402318   |.  64:890D 00000000   mov dword ptr fs:[0],ecx
0040231F   |.  81C4 A4020000      add esp,2A4
00402325   \.  C3                 retn

////////////////////////////////////////////////////////////////////////////////////////////////////////////
00401604    .  85C0               test eax,eax
00401606    .  75 32              jnz short ISEncryp.0040163A                    ;  关键跳转吗   ***TMD 往哪里跳都是个死胡同
00401608    .  8B07               mov eax,dword ptr ds:[edi]
0040160A    .  8D8C24 20010000    lea ecx,dword ptr ss:[esp+120]
00401611    .  51                 push ecx                                       ; /Arg2
00401612    .  50                 push eax                                       ; |Arg1
00401613    .  E8 6BF20200        call ISEncryp.00430883                         ; \ISEncryp.00430883
00401618    .  81BC24 2C010000 00>cmp dword ptr ss:[esp+12C],1400
00401623    .  7E 15              jle short ISEncryp.0040163A
00401625    .  6A 00              push 0
00401627    .  68 DC814400        push ISEncryp.004481DC
0040162C    .  68 A8814400        push ISEncryp.004481A8
00401631    .  8BCE               mov ecx,esi
00401633    .  E8 35CF0200        call ISEncryp.0042E56D                         ;  未注册版不能加5KB以上的软件
00401638    .  EB 65              jmp short ISEncryp.0040169F
0040163A    >  6A 01              push 1
0040163C    .  51                 push ecx
0040163D    .  8BCC               mov ecx,esp
0040163F    .  896424 20          mov dword ptr ss:[esp+20],esp
00401643    .  55                 push ebp
00401644    .  E8 57E80200        call ISEncryp.0042FEA0
00401649    .  8D5424 14          lea edx,dword ptr ss:[esp+14]                  ; |
0040164D    .  8D4424 1C          lea eax,dword ptr ss:[esp+1C]                  ; |
00401651    .  52                 push edx                                       ; |Arg3
00401652    .  57                 push edi                                       ; |Arg2
00401653    .  50                 push eax                                       ; |Arg1
00401654    .  8D8E 2C060000      lea ecx,dword ptr ds:[esi+62C]                 ; |
0040165A    .  E8 91BD0000        call ISEncryp.0040D3F0                         ; \未注册版不能加5KB以上的软件
0040165F    .  85C0               test eax,eax
00401661    .  74 0B              je short ISEncryp.0040166E
00401663    .  6A 00              push 0

////////////////////////////////////////////////////////////////////////////////////////////////
作者好象根本就没有提供5KB以上加壳算法。