这篇文章是我去年11月份的时候随手写的。一直没机会发表出来,今天整理电脑的时候偶尔发现,刚巧论坛中也有兄弟写了关于这个软件的破文,但分析没写。我就抛砖引玉,把自己的分析过程发表出来,希望对大家有用!


==================================================================================
【工程作者】深海游侠
【作者邮箱】shenhaiyouxia@163.com
==================================================================================
【软件名称】超级电脑助手 V2004 build 08.15
【下载地址】http://www.onlinedown.net/soft/32447.htm
【软件介绍】
软件大小:1069KB
软件语言:简体中文
软件类别:国产软件/共享版/桌面辅助
运行环境:Win9x/Me/NT/2000/XP
加入时间:2004-7-18 20:21:25

本软件主要提供下列功能:桌面时钟,闹钟提醒,网络计时,快捷输入,快捷启动,MP3播放,彩票号码随机选取,系统各类实用信息检测,个性化设置电脑桌面,即时更换桌布,清理垃圾,整理内存,优化IE浏览器,提取图标,抓取图像,万年历等等各种实用个性功能。内容丰富并对注册用户不断添加新的功能。 
==================================================================================
【工程平台】WIN ME
【调试工具】TRW2000 
==================================================================================
【破解过程】
首先查壳--->Borland Delphi 6.0 - 7.0.无壳,直接TRW2000载入,下万能断点,程序断下,按N个F12,程序到这里:
我填写的注册信息:
订单号:1360      (订单号可在他的主页上填表得到,当然也可以随便填写)
注册码:121212

016F:0055D7AA 837DF800         CMP      DWORD [EBP-08],BYTE +00
016F:0055D7AE 7414             JZ       0055D7C4                
016F:0055D7B0 8D55F4           LEA      EDX,[EBP-0C]
016F:0055D7B3 8B8344030000     MOV      EAX,[EBX+0344]
016F:0055D7B9 E816D4EEFF       CALL     0044ABD4
016F:0055D7BE 837DF400         CMP      DWORD [EBP-0C],BYTE +00    ------->是否输入注册信息?
016F:0055D7C2 750F             JNZ      0055D7D3
016F:0055D7C4 B88CD95500       MOV      EAX,0055D98C
016F:0055D7C9 E8B66BEEFF       CALL     00444384                   ------->出错CALL
016F:0055D7CE E938010000       JMP      0055D90B
016F:0055D7D3 8D55F0           LEA      EDX,[EBP-10]
016F:0055D7D6 8B8344030000     MOV      EAX,[EBX+0344]
016F:0055D7DC E8F3D3EEFF       CALL     0044ABD4
016F:0055D7E1 8B45F0           MOV      EAX,[EBP-10]
016F:0055D7E4 50               PUSH     EAX
016F:0055D7E5 8D55E8           LEA      EDX,[EBP-18]
016F:0055D7E8 8B8348030000     MOV      EAX,[EBX+0348]
016F:0055D7EE E8E1D3EEFF       CALL     0044ABD4
016F:0055D7F3 8B45E8           MOV      EAX,[EBP-18]               ------->订单号EAX=1360
016F:0055D7F6 E85DBEEAFF       CALL     00409658                   ------->1360转为十六位的550
016F:0055D7FB B954DB0400       MOV      ECX,0004DB54               ------->ECX=0004DB54
016F:0055D800 99               CDQ     
016F:0055D801 F7F9             IDIV     ECX                        ------->550 mod 0004DB54 = 550
016F:0055D803 8BC2             MOV      EAX,EDX
016F:0055D805 8D55EC           LEA      EDX,[EBP-14]
016F:0055D808 E8A7BDEAFF       CALL     004095B4
016F:0055D80D 8D45EC           LEA      EAX,[EBP-14]
016F:0055D810 50               PUSH     EAX
016F:0055D811 8D55DC           LEA      EDX,[EBP-24]
016F:0055D814 8B8348030000     MOV      EAX,[EBX+0348]
016F:0055D81A E8B5D3EEFF       CALL     0044ABD4
016F:0055D81F 8B45DC           MOV      EAX,[EBP-24]               ------->EAX=1360(注册码第一部分)
016F:0055D822 E831BEEAFF       CALL     00409658                   ------->1360转为十六位的550
016F:0055D827 8D55E0           LEA      EDX,[EBP-20]
016F:0055D82A E85DFBFFFF       CALL     0055D38C                   ------->算法CALL(1),跟进
016F:0055D82F 8B45E0           MOV      EAX,[EBP-20]               ------->经过计算EAX=72924945(过渡码)
016F:0055D832 E821BEEAFF       CALL     00409658                   ------->72924945转为十六位的458BF11
016F:0055D837 8D55E4           LEA      EDX,[EBP-1C]
016F:0055D83A E82DFCFFFF       CALL     0055D46C                   ------->算法CALL(2),跟进
016F:0055D83F 8B55E4           MOV      EDX,[EBP-1C]               ------->EDX=36i5w138|f9846(注册码第二部分)
016F:0055D842 58               POP      EAX 
016F:0055D843 E8CC74EAFF       CALL     00404D14                   ------->1360和36i5w138|f9846两部分连起来
016F:0055D848 8B55EC           MOV      EDX,[EBP-14]               ------->EDX=136036i5w138|f9846 (内存注册机)
016F:0055D84B 58               POP      EAX                        ------->EAX=121212
016F:0055D84C E8FF75EAFF       CALL     00404E50                   ------->比较
016F:0055D851 0F859D000000     JNZ      NEAR 0055D8F4              ------->不等游戏结束
.........下面有注册信息,篇幅问题省略..........


算法CALL(1)
016F:0055D82A E85DFBFFFF       CALL     0055D38C
|
016F:0055D38F 33C9             XOR      ECX,ECX
016F:0055D391 51               PUSH     ECX
016F:0055D392 51               PUSH     ECX
016F:0055D393 51               PUSH     ECX
016F:0055D394 51               PUSH     ECX
016F:0055D395 53               PUSH     EBX
016F:0055D396 56               PUSH     ESI
016F:0055D397 8BF2             MOV      ESI,EDX
016F:0055D399 8BD8             MOV      EBX,EAX               ------>EAX=550,EAX->EBX
016F:0055D39B 33C0             XOR      EAX,EAX
016F:0055D39D 55               PUSH     EBP
016F:0055D39E 685CD45500       PUSH     DWORD 0055D45C
016F:0055D3A3 64FF30           PUSH     DWORD [FS:EAX]
016F:0055D3A6 648920           MOV      [FS:EAX],ESP
016F:0055D3A9 81F3F1250B00     XOR      EBX,000B25F1          ------>EBX=550 xor B25F1=B20A1
016F:0055D3AF 8BC3             MOV      EAX,EBX               ------>EAX->EBX
016F:0055D3B1 33D2             XOR      EDX,EDX
016F:0055D3B3 52               PUSH     EDX
016F:0055D3B4 50               PUSH     EAX
016F:0055D3B5 8D45FC           LEA      EAX,[EBP-04]
016F:0055D3B8 E827C2EAFF       CALL     004095E4              ------>B20A1转为十进制729249存入寄存器
016F:0055D3BD 8B45FC           MOV      EAX,[EBP-04]          ------>EAX=729249
016F:0055D3C0 0FB600           MOVZX    EAX,BYTE [EAX]        ------>EAX=37
016F:0055D3C3 8B55FC           MOV      EDX,[EBP-04]  
016F:0055D3C6 0FB65201         MOVZX    EDX,BYTE [EDX+01]     ------>EDX=32
016F:0055D3CA 03C2             ADD      EAX,EDX               ------>EAX=37+32=69
016F:0055D3CC B905000000       MOV      ECX,05
016F:0055D3D1 99               CDQ     
016F:0055D3D2 F7F9             IDIV     ECX                   ------>69 mod 5=0
016F:0055D3D4 80C234           ADD      DL,34                 ------>34+0=34(ASCII表是数字4)
016F:0055D3D7 8855F8           MOV      [EBP-08],DL           ------>DL=34->[EBP-08](下面用)
016F:0055D3DA 8B45FC           MOV      EAX,[EBP-04]
016F:0055D3DD 0FB64002         MOVZX    EAX,BYTE [EAX+02]     ------>EAX=39
016F:0055D3E1 8B55FC           MOV      EDX,[EBP-04]
016F:0055D3E4 0FB65203         MOVZX    EDX,BYTE [EDX+03]     ------>EDX=32
016F:0055D3E8 03C2             ADD      EAX,EDX               ------>EAX=39+32=6B
016F:0055D3EA B905000000       MOV      ECX,05
016F:0055D3EF 99               CDQ     
016F:0055D3F0 F7F9             IDIV     ECX                   ------>6B mod 5=2
016F:0055D3F2 8BDA             MOV      EBX,EDX
016F:0055D3F4 80C333           ADD      BL,33                 ------>2+33=35(ASCII表是数字5)
016F:0055D3F7 885DF9           MOV      [EBP-07],BL           ------>DL=35->[EBP-07](下面用)
016F:0055D3FA 8D45F4           LEA      EAX,[EBP-0C]
016F:0055D3FD 8A55F8           MOV      DL,[EBP-08]           ------>DL=34(上边计算得来)
016F:0055D400 E82F78EAFF       CALL     00404C34              ------>34以ASCII形式表示为数字4,并存入寄存器
016F:0055D405 8B45F4           MOV      EAX,[EBP-0C]          ------>D EAX=4
016F:0055D408 8D55FC           LEA      EDX,[EBP-04]
016F:0055D40B B91B000000       MOV      ECX,1B
016F:0055D410 E8D77BEAFF       CALL     00404FEC              ------>4和前面的729249连起来:7292494
016F:0055D415 8D45F0           LEA      EAX,[EBP-10]
016F:0055D418 8BD3             MOV      EDX,EBX               ------>EBX=EDX=35(上边计算得来)
016F:0055D41A E81578EAFF       CALL     00404C34              ------>35以ASCII形式表示为数字5,并存入寄存器
016F:0055D41F 8B45F0           MOV      EAX,[EBP-10]          ------>D EAX=5
016F:0055D422 8D55FC           LEA      EDX,[EBP-04]
016F:0055D425 B919000000       MOV      ECX,19
016F:0055D42A E8BD7BEAFF       CALL     00404FEC              ------>5和前面的7292494连起来:72924945(过渡码形成)
016F:0055D42F 8BC6             MOV      EAX,ESI
016F:0055D431 8B55FC           MOV      EDX,[EBP-04]
016F:0055D434 E86F76EAFF       CALL     00404AA8
016F:0055D439 33C0             XOR      EAX,EAX
016F:0055D43B 5A               POP      EDX
016F:0055D43C 59               POP      ECX
016F:0055D43D 59               POP      ECX
016F:0055D43E 648910           MOV      [FS:EAX],EDX
016F:0055D441 6863D45500       PUSH     DWORD 0055D463
016F:0055D446 8D45F0           LEA      EAX,[EBP-10]
016F:0055D449 BA02000000       MOV      EDX,02
016F:0055D44E E82576EAFF       CALL     00404A78
016F:0055D453 8D45FC           LEA      EAX,[EBP-04]
016F:0055D456 E8F975EAFF       CALL     00404A54
016F:0055D45B C3               RET     

算法CALL(2):
016F:0055D83A E82DFCFFFF       CALL     0055D46C
|
016F:0055D46D 8BEC             MOV      EBP,ESP
016F:0055D46F 33C9             XOR      ECX,ECX
016F:0055D471 51               PUSH     ECX
016F:0055D472 51               PUSH     ECX
016F:0055D473 51               PUSH     ECX
016F:0055D474 51               PUSH     ECX
016F:0055D475 51               PUSH     ECX
016F:0055D476 51               PUSH     ECX
016F:0055D477 53               PUSH     EBX
016F:0055D478 56               PUSH     ESI
016F:0055D479 8BF2             MOV      ESI,EDX
016F:0055D47B 8BD8             MOV      EBX,EAX          ----->EAX->EBX=458BF11(过渡码72924945的十六进制)
016F:0055D47D 33C0             XOR      EAX,EAX
016F:0055D47F 55               PUSH     EBP
016F:0055D480 68B8D55500       PUSH     DWORD 0055D5B8
016F:0055D485 64FF30           PUSH     DWORD [FS:EAX]
016F:0055D488 648920           MOV      [FS:EAX],ESP
016F:0055D48B 81F38776FBDD     XOR      EBX,DDFB7687     ----->EBX=458BF11 xor DDFB7687=D9A3C996
016F:0055D491 8BC3             MOV      EAX,EBX
016F:0055D493 33D2             XOR      EDX,EDX
016F:0055D495 52               PUSH     EDX
016F:0055D496 50               PUSH     EAX
016F:0055D497 8D45FC           LEA      EAX,[EBP-04]
016F:0055D49A E845C1EAFF       CALL     004095E4         ----->D9A3C996转为十进制3651389846并存入寄存器
016F:0055D49F 8B45FC           MOV      EAX,[EBP-04]     ----->EAX=3651389846
016F:0055D4A2 0FB600           MOVZX    EAX,BYTE [EAX]   ----->EAX=33
016F:0055D4A5 8B55FC           MOV      EDX,[EBP-04]
016F:0055D4A8 0FB65201         MOVZX    EDX,BYTE [EDX+01]----->EDX=36
016F:0055D4AC 03C2             ADD      EAX,EDX          ----->EAX=33+36=69
016F:0055D4AE B905000000       MOV      ECX,05
016F:0055D4B3 99               CDQ     
016F:0055D4B4 F7F9             IDIV     ECX              ----->69 mod 5=0
016F:0055D4B6 80C266           ADD      DL,66            ----->DL=0+66=66
016F:0055D4B9 8855F8           MOV      [EBP-08],DL      ----->DL=66->[EBP-08](下面用)
016F:0055D4BC 8B45FC           MOV      EAX,[EBP-04]
016F:0055D4BF 0FB64002         MOVZX    EAX,BYTE [EAX+02]----->EAX=35
016F:0055D4C3 8B55FC           MOV      EDX,[EBP-04]
016F:0055D4C6 0FB65203         MOVZX    EDX,BYTE [EDX+03]----->EDX=31
016F:0055D4CA 03C2             ADD      EAX,EDX          ----->EAX=35+31=66
016F:0055D4CC B905000000       MOV      ECX,05
016F:0055D4D1 99               CDQ     
016F:0055D4D2 F7F9             IDIV     ECX              ----->66 mod 5=2
016F:0055D4D4 80C275           ADD      DL,75            ----->DL=2+75=77
016F:0055D4D7 8855F9           MOV      [EBP-07],DL      ----->DL=77->[EBP-07](下面用)
016F:0055D4DA 8B45FC           MOV      EAX,[EBP-04]
016F:0055D4DD 0FB64004         MOVZX    EAX,BYTE [EAX+04]----->EAX=33
016F:0055D4E1 8B55FC           MOV      EDX,[EBP-04]
016F:0055D4E4 0FB65205         MOVZX    EDX,BYTE [EDX+05]----->EDX=38
016F:0055D4E8 03C2             ADD      EAX,EDX          ----->EAX=33+38=6B
016F:0055D4EA B905000000       MOV      ECX,05
016F:0055D4EF 99               CDQ     
016F:0055D4F0 F7F9             IDIV     ECX              ----->6B mod 5=2
016F:0055D4F2 80C27A           ADD      DL,7A            ----->DL=7A+2=7C
016F:0055D4F5 8855FA           MOV      [EBP-06],DL      ----->DL=7A->[EBP-06](下面用)
016F:0055D4F8 8B45FC           MOV      EAX,[EBP-04]
016F:0055D4FB 0FB64006         MOVZX    EAX,BYTE [EAX+06]----->EAX=39
016F:0055D4FF 8B55FC           MOV      EDX,[EBP-04]
016F:0055D502 0FB65207         MOVZX    EDX,BYTE [EDX+07]----->EDX=38
016F:0055D506 03C2             ADD      EAX,EDX          ----->EAX=39+38=71
016F:0055D508 8B55FC           MOV      EDX,[EBP-04]
016F:0055D50B 0FB65208         MOVZX    EDX,BYTE [EDX+08]----->EDX=34
016F:0055D50F 03C2             ADD      EAX,EDX          ----->EAX=71+34=A5
016F:0055D511 B905000000       MOV      ECX,05
016F:0055D516 99               CDQ     
016F:0055D517 F7F9             IDIV     ECX              ----->A5 mod 5=0
016F:0055D519 80C269           ADD      DL,69            ----->DL=0+69=69
016F:0055D51C 8855FB           MOV      [EBP-05],DL      ----->DL=69->[EBP-05]
016F:0055D51F 8D45F4           LEA      EAX,[EBP-0C]
016F:0055D522 8A55F8           MOV      DL,[EBP-08]      ----->DL=[EBP-08]=66(看寄存器上边哪个对应,从而找结果,下同)
016F:0055D525 E80A77EAFF       CALL     00404C34         ----->66以ASCII形式表示为字母f,并存入寄存器
016F:0055D52A 8B45F4           MOV      EAX,[EBP-0C]     ----->D EAX=f
016F:0055D52D 8D55FC           LEA      EDX,[EBP-04]
016F:0055D530 B907000000       MOV      ECX,07           ----->ECX=7(应该是插入位数,插入第7位,下同)
016F:0055D535 E8B27AEAFF       CALL     00404FEC         ----->把字母f插入上边3651389846的第7位:365138f9846
016F:0055D53A 8D45F0           LEA      EAX,[EBP-10]
016F:0055D53D 8A55FB           MOV      DL,[EBP-05]      ----->DL=[EBP-05]=69
016F:0055D540 E8EF76EAFF       CALL     00404C34         ----->69以ASCII形式表示为字母i,并存入寄存器
016F:0055D545 8B45F0           MOV      EAX,[EBP-10]     ----->D EAX=i 
016F:0055D548 8D55FC           LEA      EDX,[EBP-04]     
016F:0055D54B B903000000       MOV      ECX,03           ----->ECX=3
016F:0055D550 E8977AEAFF       CALL     00404FEC         ----->把字母i插入上边365138f9846的第3位:36i5138f9846
016F:0055D555 8D45EC           LEA      EAX,[EBP-14]
016F:0055D558 8A55F9           MOV      DL,[EBP-07]      ----->DL=[EBP-07]=77
016F:0055D55B E8D476EAFF       CALL     00404C34         ----->77以ASCII形式表示为字母w,并存入寄存器
016F:0055D560 8B45EC           MOV      EAX,[EBP-14]     ----->D EAX=w
016F:0055D563 8D55FC           LEA      EDX,[EBP-04]
016F:0055D566 B905000000       MOV      ECX,05           ----->ECX=5
016F:0055D56B E87C7AEAFF       CALL     00404FEC         ----->把字母w插入上边36i5138f9846的第3位:36i5w138f9846
016F:0055D570 8D45E8           LEA      EAX,[EBP-18]     
016F:0055D573 8A55FA           MOV      DL,[EBP-06]      ----->DL=[EBP-06]=7A
016F:0055D576 E8B976EAFF       CALL     00404C34         ----->7A以ASCII形式表示为字符|,并存入寄存器
016F:0055D57B 8B45E8           MOV      EAX,[EBP-18]     ----->D EAX=|
016F:0055D57E 8D55FC           LEA      EDX,[EBP-04]
016F:0055D581 B909000000       MOV      ECX,09           ----->ECX=9
016F:0055D586 E8617AEAFF       CALL     00404FEC         ----->把字符|插入上边36i5w138f9846的第3位:36i5w138|f9846
016F:0055D58B 8BC6             MOV      EAX,ESI
016F:0055D58D 8B55FC           MOV      EDX,[EBP-04]     ----->EDX=36i5w138|f9846(注册码第二部分)
016F:0055D590 E81375EAFF       CALL     00404AA8
016F:0055D595 33C0             XOR      EAX,EAX
016F:0055D597 5A               POP      EDX
016F:0055D598 59               POP      ECX
016F:0055D599 59               POP      ECX
016F:0055D59A 648910           MOV      [FS:EAX],EDX
016F:0055D59D 68BFD55500       PUSH     DWORD 0055D5BF
016F:0055D5A2 8D45E8           LEA      EAX,[EBP-18]
016F:0055D5A5 BA04000000       MOV      EDX,04
016F:0055D5AA E8C974EAFF       CALL     00404A78
016F:0055D5AF 8D45FC           LEA      EAX,[EBP-04]
016F:0055D5B2 E89D74EAFF       CALL     00404A54
016F:0055D5B7 C3               RET     

总结:
1>注册码是以订单号推出.( (订单号我用X表示,过渡码我用Y表示)
sn1=X mod 4DB54
Y=sn1 xor B25F1(再经过分配运算)
sn2=Y xor DDFB7687(再经过分配运算)
sn="sn1" & "sn2"(组合的意思)

2>下面我拿自己的订单号推算一遍:(订单号=1360=H550)
sn1=550 mod 4DB54=550(1360)
Y=550 xor B25F1(再经过分配运算)=458BF11
sn2=458BF11 xor DDFB7687(再经过分配运算)=(36i5w138|f9846)
sn="1360" & "36i5w138|f9846"=136036i5w138|f9846


订单号:1360
注册码:136036i5w138|f9846

3>内存注册机:
中断地址:55D84B
中断次数:1
第一字节:58
字节长度:1
寄存器:EDX

4>恢复注册方法:
删除软件目录下新建的li12u.dll文件,注意他是隐藏的,且只有你注册成功的时候才会自动生成。

5>感评:
这个软件的保护方式比较简单,很适合大家练手,毕竟只有多动手才会成长。
因为赶时间,所以写的乱了些,希望大家能看懂,如果这篇文章对你有帮助,那么我的目的也就达到了!
不论【OCN】论坛是否存在,但你还是永远存在在我心中,因为是你让我步入了CRACK的殿堂!
希望【OCN】的兄弟们事事顺利,CRACK技术更上一层楼!

                                                ------深海游侠
                                                ------2004.11.15
==================================================================================
【工程声明】本过程只供内部学习之用!如要转载请保持过程完整!
==================================================================================