【破文标题】RER DVD to 3GP Converter 3.2.0.0825算法分析
【破文作者】tianxj
【作者邮箱】tianxj_2007@126.com
【作者主页】WwW.ChiNaPYG.CoM
【破解工具】PEiD,OD
【破解平台】Windows XP
【软件名称】RER DVD to 3GP Converter 3.2.0.0825
【软件大小】26217KB
【软件类别】国外软件/视频转换
【软件授权】共享版
【软件语言】英文
【运行环境】Win9x/Me/NT/2000/XP/2003
【更新时间】2008-9-8
【原版下载】华军软件园
【保护方式】注册码
【软件简介】RERDVD的3gp转换器可以转换的DVD文件的移动电话3gp/3g2视频和MP3音频。您可以在完成转换的任务，与3个简单的步骤，您可以享受无损质量，和您最喜爱的视频，音频。
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------
【破解内容】
--------------------------------------------------------------
**************************************************************
一、运行程序，进行注册，输入错误的注册信息进行检测，有提示信息
"Activation Failed! Invalid license code."
**************************************************************
二、用PEiD对DVDto3GPConverter.exe查壳，为 Microsoft Visual C++ 7.0 Method2 [Debug]
**************************************************************
三、运行OD，打开DVDto3GPConverter.exe,用F12暂停发现
==============================================================
0012DBE0 77D505CF ? USER32.MessageBoxExA USER32.77D505CA
0012DBDC
0012DBE4 003C090E hOwner = 003C090E ('Activate RER DVD to 3GP Conve...',class='#32770',parent=008A089
0012DBE8 00464A38 Text =
0012DBEC 00467B38 Title = "Failed"
0012DBF0 00000040 Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0012DBF4 00000000 LanguageID = 0 (LANG_NEUTRAL)
0012DBFC 7C1CE579 ? USER32.MessageBoxA MFC71.7C1CE573
0012DBF8
0012DC00 003C090E hOwner = 003C090E ('Activate RER DVD to 3GP Conve...',class='#32770',parent=008A089
0012DC04 00464A38 Text = "Activation Failed! Invalid license code."
0012DC08 00467B38 Title = "Failed"
0012DC0C 00000040 Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0012DC14 00401EBC ? <JMP.&MFC71.#4104>
DVDto3GP.00401EB7
==============================================================
代码:
00401DA0 . 6A FF PUSH -1 00401DA2 . 68 1D064200 PUSH DVDto3GP.0042061D ; SE 处理程序安装 00401DA7 . 64:A1 0000000>MOV EAX,DWORD PTR FS:[0] 00401DAD . 50 PUSH EAX 00401DAE . 64:8925 00000>MOV DWORD PTR FS:[0],ESP 00401DB5 . 83EC 0C SUB ESP,0C 00401DB8 . 56 PUSH ESI 00401DB9 . 8BF1 MOV ESI,ECX 00401DBB . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4] 00401DBF . FF15 38424200 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199 00401DC5 . 8D4424 04 LEA EAX,DWORD PTR SS:[ESP+4] 00401DC9 . 50 PUSH EAX 00401DCA . 8D4E 74 LEA ECX,DWORD PTR DS:[ESI+74] 00401DCD . C74424 1C 000>MOV DWORD PTR SS:[ESP+1C],0 00401DD5 . E8 96DB0100 CALL <JMP.&MFC71.#3761> ; //取用户名 00401DDA . 51 PUSH ECX 00401DDB . 8D5424 08 LEA EDX,DWORD PTR SS:[ESP+8] 00401DDF . 8BCC MOV ECX,ESP 00401DE1 . 896424 10 MOV DWORD PTR SS:[ESP+10],ESP 00401DE5 . 52 PUSH EDX 00401DE6 . FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 00401DEC . 8B8E C8000000 MOV ECX,DWORD PTR DS:[ESI+C8] 00401DF2 . FF15 28404200 CALL DWORD PTR DS:[<&Control.DvdProxy::RegisteProduct>] ; Control.DvdProxy::RegisteProduct 00401DF8 . 85C0 TEST EAX,EAX 00401DFA . 8B86 CC000000 MOV EAX,DWORD PTR DS:[ESI+CC] 00401E00 . 75 6A JNZ SHORT DVDto3GP.00401E6C 00401E02 . 05 5C010000 ADD EAX,15C 00401E07 . 50 PUSH EAX 00401E08 . 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 00401E0C . FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 00401E12 . 8B8E CC000000 MOV ECX,DWORD PTR DS:[ESI+CC] 00401E18 . 81C1 60010000 ADD ECX,160 00401E1E . 51 PUSH ECX 00401E1F . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C] 00401E23 . C64424 1C 01 MOV BYTE PTR SS:[ESP+1C],1 00401E28 . FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 00401E2E . 6A 40 PUSH 40 00401E30 . 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 00401E34 . C64424 1C 02 MOV BYTE PTR SS:[ESP+1C],2 00401E39 . FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD 00401E3F . 50 PUSH EAX 00401E40 . 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 00401E44 . FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD 00401E4A . 50 PUSH EAX 00401E4B . 8BCE MOV ECX,ESI 00401E4D . E8 0CDB0100 CALL <JMP.&MFC71.#4104> 00401E52 . 8B16 MOV EDX,DWORD PTR DS:[ESI] 00401E54 . 8BCE MOV ECX,ESI 00401E56 . FF92 54010000 CALL DWORD PTR DS:[EDX+154] 00401E5C . 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8] 00401E60 . FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00401E66 . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C] 00401E6A . EB 5E JMP SHORT DVDto3GP.00401ECA 00401E6C > 05 64010000 ADD EAX,164 00401E71 . 50 PUSH EAX 00401E72 . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C] 00401E76 . FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 00401E7C . 8B8E CC000000 MOV ECX,DWORD PTR DS:[ESI+CC] 00401E82 . 81C1 68010000 ADD ECX,168 00401E88 . 51 PUSH ECX 00401E89 . 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 00401E8D . C64424 1C 03 MOV BYTE PTR SS:[ESP+1C],3 00401E92 . FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 00401E98 . 6A 40 PUSH 40 00401E9A . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C] 00401E9E . C64424 1C 04 MOV BYTE PTR SS:[ESP+1C],4 00401EA3 . FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD 00401EA9 . 50 PUSH EAX 00401EAA . 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 00401EAE . FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD 00401EB4 . 50 PUSH EAX 00401EB5 . 8BCE MOV ECX,ESI 00401EB7 . E8 A2DA0100 CALL <JMP.&MFC71.#4104> ; //错误提示 00401EBC . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C] 00401EC0 . FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00401EC6 . 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8] 00401ECA > FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00401ED0 . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4] 00401ED4 . FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00401EDA . 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 00401EDE . 64:890D 00000>MOV DWORD PTR FS:[0],ECX 00401EE5 . 5E POP ESI 00401EE6 . 83C4 18 ADD ESP,18 00401EE9 . C3 RETN ============================================================== 0037ADA0 > 6A FF PUSH -1 0037ADA2 68 E9973800 PUSH Control.003897E9 0037ADA7 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 0037ADAD 50 PUSH EAX 0037ADAE 64:8925 0000000>MOV DWORD PTR FS:[0],ESP 0037ADB5 51 PUSH ECX 0037ADB6 56 PUSH ESI 0037ADB7 57 PUSH EDI 0037ADB8 8BF1 MOV ESI,ECX 0037ADBA 51 PUSH ECX 0037ADBB 8D4424 20 LEA EAX,DWORD PTR SS:[ESP+20] 0037ADBF 8BCC MOV ECX,ESP 0037ADC1 896424 0C MOV DWORD PTR SS:[ESP+C],ESP 0037ADC5 50 PUSH EAX 0037ADC6 C74424 1C 00000>MOV DWORD PTR SS:[ESP+1C],0 0037ADCE FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 0037ADD4 8B4E 0C MOV ECX,DWORD PTR DS:[ESI+C] 0037ADD7 E8 84B9FFFF CALL Control.AVProxy::RegisteProduct ; //F7 0037ADDC 8BF8 MOV EDI,EAX 0037ADDE 85FF TEST EDI,EDI 0037ADE0 75 0A JNZ SHORT Control.0037ADEC 0037ADE2 8B4E 08 MOV ECX,DWORD PTR DS:[ESI+8] 0037ADE5 C741 20 0100000>MOV DWORD PTR DS:[ECX+20],1 0037ADEC 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 0037ADF0 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 0037ADF6 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 0037ADFA 8BC7 MOV EAX,EDI 0037ADFC 5F POP EDI 0037ADFD 64:890D 0000000>MOV DWORD PTR FS:[0],ECX 0037AE04 5E POP ESI 0037AE05 83C4 10 ADD ESP,10 0037AE08 C2 0400 RETN 4 ============================================================== 00376760 > 6A FF PUSH -1 00376762 68 28923800 PUSH Control.00389228 00376767 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 0037676D 50 PUSH EAX 0037676E 64:8925 0000000>MOV DWORD PTR FS:[0],ESP 00376775 81EC 54040000 SUB ESP,454 0037677B A1 F4553900 MOV EAX,DWORD PTR DS:[3955F4] 00376780 53 PUSH EBX 00376781 55 PUSH EBP 00376782 56 PUSH ESI 00376783 898424 5C040000 MOV DWORD PTR SS:[ESP+45C],EAX 0037678A 57 PUSH EDI 0037678B 8BE9 MOV EBP,ECX 0037678D 8D4424 20 LEA EAX,DWORD PTR SS:[ESP+20] 00376791 33DB XOR EBX,EBX 00376793 50 PUSH EAX 00376794 899C24 70040000 MOV DWORD PTR SS:[ESP+470],EBX 0037679B 83CE FF OR ESI,FFFFFFFF 0037679E E8 2DD1FFFF CALL Control.003738D0 003767A3 8BC8 MOV ECX,EAX 003767A5 E8 96C7FFFF CALL Control.PgcConfigData::GetPgcName 003767AA 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34] 003767AE C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],1 003767B6 E8 1B150100 CALL <JMP.&Util.RegUtil::RegUtil> 003767BB 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 003767BF C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],2 003767C7 E8 F40E0100 CALL Control.003876C0 003767CC 51 PUSH ECX 003767CD 8D9424 78040000 LEA EDX,DWORD PTR SS:[ESP+478] 003767D4 8BCC MOV ECX,ESP 003767D6 896424 14 MOV DWORD PTR SS:[ESP+14],ESP 003767DA 52 PUSH EDX 003767DB C68424 74040000>MOV BYTE PTR SS:[ESP+474],3 003767E3 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 003767E9 51 PUSH ECX 003767EA 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28] 003767EE 8BCC MOV ECX,ESP 003767F0 896424 20 MOV DWORD PTR SS:[ESP+20],ESP 003767F4 50 PUSH EAX 003767F5 C68424 78040000>MOV BYTE PTR SS:[ESP+478],4 003767FD FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 00376803 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 00376807 C68424 74040000>MOV BYTE PTR SS:[ESP+474],3 0037680F E8 3C120100 CALL Control.00387A50 ; //F7 00376814 0FB6C0 MOVZX EAX,AL 00376817 3BC3 CMP EAX,EBX 00376819 0F84 50020000 JE Control.00376A6F 0037681F 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 00376823 FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199 00376829 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 0037682D 51 PUSH ECX 0037682E C68424 70040000>MOV BYTE PTR SS:[ESP+470],5 00376836 E8 71140100 CALL <JMP.&Util.AppUtil::GetAppPath> 0037683B 8B10 MOV EDX,DWORD PTR DS:[EAX] 0037683D 68 DCB33800 PUSH Control.0038B3DC ; ASCII "config.ini" 00376842 52 PUSH EDX 00376843 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28] 00376847 68 CCB33800 PUSH Control.0038B3CC ; ASCII "%s\config\%s" 0037684C 50 PUSH EAX 0037684D C68424 80040000>MOV BYTE PTR SS:[ESP+480],6 00376855 FF15 E0B03800 CALL DWORD PTR DS:[<&MFC71.#2322>] ; MFC71.7C146A9D 0037685B 83C4 14 ADD ESP,14 0037685E 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 00376862 C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],5 0037686A FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00376870 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18] 00376874 E8 45140100 CALL <JMP.&Util.ProfileUtil::ProfileUtil> 00376879 51 PUSH ECX 0037687A 8BCC MOV ECX,ESP 0037687C 896424 14 MOV DWORD PTR SS:[ESP+14],ESP 00376880 68 10B43800 PUSH Control.0038B410 ; ASCII "RegPath" 00376885 C68424 74040000>MOV BYTE PTR SS:[ESP+474],7 0037688D FF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C 00376893 51 PUSH ECX 00376894 8BCC MOV ECX,ESP 00376896 896424 40 MOV DWORD PTR SS:[ESP+40],ESP 0037689A 68 C4B33800 PUSH Control.0038B3C4 ; ASCII "convert" 0037689F C68424 78040000>MOV BYTE PTR SS:[ESP+478],8 003768A7 FF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C 003768AD 51 PUSH ECX 003768AE 8D5424 28 LEA EDX,DWORD PTR SS:[ESP+28] 003768B2 8BCC MOV ECX,ESP 003768B4 896424 38 MOV DWORD PTR SS:[ESP+38],ESP 003768B8 52 PUSH EDX 003768B9 C68424 7C040000>MOV BYTE PTR SS:[ESP+47C],9 003768C1 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 003768C7 8D4424 34 LEA EAX,DWORD PTR SS:[ESP+34] 003768CB 50 PUSH EAX 003768CC 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 003768D0 C68424 7C040000>MOV BYTE PTR SS:[ESP+47C],7 003768D8 E8 DB130100 CALL <JMP.&Util.ProfileUtil::GetContentFromProfile> 003768DD 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] 003768E1 C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],0A 003768E9 E8 E8130100 CALL <JMP.&Util.RegUtil::RegUtil> 003768EE 33C0 XOR EAX,EAX 003768F0 B9 00010000 MOV ECX,100 003768F5 8D7C24 60 LEA EDI,DWORD PTR SS:[ESP+60] 003768F9 F3:AB REP STOS DWORD PTR ES:[EDI] 003768FB 8D4C24 60 LEA ECX,DWORD PTR SS:[ESP+60] 003768FF 51 PUSH ECX 00376900 8D8C24 78040000 LEA ECX,DWORD PTR SS:[ESP+478] 00376907 C68424 70040000>MOV BYTE PTR SS:[ESP+470],0B 0037690F FF15 D0B03800 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD 00376915 50 PUSH EAX 00376916 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 0037691A E8 A10F0100 CALL Control.003878C0 0037691F 8D5424 60 LEA EDX,DWORD PTR SS:[ESP+60] 00376923 52 PUSH EDX 00376924 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34] 00376928 FF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C 0037692E 51 PUSH ECX 0037692F 8D4424 34 LEA EAX,DWORD PTR SS:[ESP+34] 00376933 8BCC MOV ECX,ESP 00376935 896424 30 MOV DWORD PTR SS:[ESP+30],ESP 00376939 50 PUSH EAX 0037693A C68424 74040000>MOV BYTE PTR SS:[ESP+474],0C 00376942 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 00376948 C68424 70040000>MOV BYTE PTR SS:[ESP+470],0D 00376950 51 PUSH ECX 00376951 8BCC MOV ECX,ESP 00376953 896424 40 MOV DWORD PTR SS:[ESP+40],ESP 00376957 68 B8B53800 PUSH Control.0038B5B8 ; ASCII "SerialCode" 0037695C FF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C 00376962 51 PUSH ECX 00376963 8D5424 34 LEA EDX,DWORD PTR SS:[ESP+34] 00376967 8BCC MOV ECX,ESP 00376969 896424 1C MOV DWORD PTR SS:[ESP+1C],ESP 0037696D 52 PUSH EDX 0037696E C68424 7C040000>MOV BYTE PTR SS:[ESP+47C],0E 00376976 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 0037697C 68 01000080 PUSH 80000001 00376981 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34] 00376985 C68424 7C040000>MOV BYTE PTR SS:[ESP+47C],0C 0037698D E8 7A130100 CALL <JMP.&Util.RegUtil::SetRegContent> 00376992 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] 00376996 8BF0 MOV ESI,EAX 00376998 FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199 0037699E 8D4C24 40 LEA ECX,DWORD PTR SS:[ESP+40] 003769A2 FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199 003769A8 8D4C24 44 LEA ECX,DWORD PTR SS:[ESP+44] 003769AC FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199 003769B2 8D4C24 48 LEA ECX,DWORD PTR SS:[ESP+48] 003769B6 FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199 003769BC 8D4C24 5C LEA ECX,DWORD PTR SS:[ESP+5C] 003769C0 FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199 003769C6 895C24 4C MOV DWORD PTR SS:[ESP+4C],EBX 003769CA 895C24 58 MOV DWORD PTR SS:[ESP+58],EBX 003769CE 895C24 54 MOV DWORD PTR SS:[ESP+54],EBX 003769D2 83EC 24 SUB ESP,24 003769D5 8D4424 60 LEA EAX,DWORD PTR SS:[ESP+60] 003769D9 8BCC MOV ECX,ESP 003769DB 896424 50 MOV DWORD PTR SS:[ESP+50],ESP 003769DF 50 PUSH EAX 003769E0 C68424 94040000>MOV BYTE PTR SS:[ESP+494],0F 003769E8 C74424 78 64000>MOV DWORD PTR SS:[ESP+78],64 003769F0 E8 0BF6FFFF CALL Control.00376000 003769F5 8B4D 00 MOV ECX,DWORD PTR SS:[EBP] 003769F8 E8 3D120100 CALL <JMP.&Convert.AVConverterBridge::SetProductInfo> 003769FD 8D4C24 5C LEA ECX,DWORD PTR SS:[ESP+5C] 00376A01 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00376A07 8D4C24 48 LEA ECX,DWORD PTR SS:[ESP+48] 00376A0B FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00376A11 8D4C24 44 LEA ECX,DWORD PTR SS:[ESP+44] 00376A15 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00376A1B 8D4C24 40 LEA ECX,DWORD PTR SS:[ESP+40] 00376A1F FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00376A25 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] 00376A29 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00376A2F 8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+30] 00376A33 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00376A39 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] 00376A3D C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],0A 00376A45 E8 80120100 CALL <JMP.&Util.RegUtil::~RegUtil> 00376A4A 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 00376A4E FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00376A54 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18] 00376A58 C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],5 00376A60 E8 4D120100 CALL <JMP.&Util.ProfileUtil::~ProfileUtil> 00376A65 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 00376A69 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00376A6F 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 00376A73 C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],2 00376A7B E8 80A5FFFF CALL Control.DvdData::Check 00376A80 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34] 00376A84 C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],1 00376A8C E8 39120100 CALL <JMP.&Util.RegUtil::~RegUtil> 00376A91 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20] 00376A95 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00376A9B 8D8C24 74040000 LEA ECX,DWORD PTR SS:[ESP+474] 00376AA2 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00376AA8 8B8C24 64040000 MOV ECX,DWORD PTR SS:[ESP+464] 00376AAF 64:890D 0000000>MOV DWORD PTR FS:[0],ECX 00376AB6 8B8C24 60040000 MOV ECX,DWORD PTR SS:[ESP+460] 00376ABD 8BC6 MOV EAX,ESI 00376ABF E8 CD150100 CALL Control.00388091 00376AC4 5F POP EDI 00376AC5 5E POP ESI 00376AC6 5D POP EBP 00376AC7 5B POP EBX 00376AC8 81C4 60040000 ADD ESP,460 00376ACE C2 0400 RETN 4 ============================================================== 00387A50 6A FF PUSH -1 00387A52 68 22AD3800 PUSH Control.0038AD22 00387A57 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 00387A5D 50 PUSH EAX 00387A5E 64:8925 0000000>MOV DWORD PTR FS:[0],ESP 00387A65 81EC B8000000 SUB ESP,0B8 00387A6B 53 PUSH EBX 00387A6C 55 PUSH EBP 00387A6D 56 PUSH ESI 00387A6E 8BF1 MOV ESI,ECX 00387A70 57 PUSH EDI 00387A71 897424 14 MOV DWORD PTR SS:[ESP+14],ESI 00387A75 51 PUSH ECX 00387A76 8D8424 E0000000 LEA EAX,DWORD PTR SS:[ESP+E0] 00387A7D 8BCC MOV ECX,ESP 00387A7F 896424 14 MOV DWORD PTR SS:[ESP+14],ESP 00387A83 50 PUSH EAX 00387A84 C78424 D8000000>MOV DWORD PTR SS:[ESP+D8],1 00387A8F 33FF XOR EDI,EDI 00387A91 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 00387A97 8BCE MOV ECX,ESI 00387A99 E8 32FCFFFF CALL Control.003876D0 ; //注册码是否符合要求的格式 00387A9E 84C0 TEST AL,AL 00387AA0 0F84 49010000 JE Control.00387BEF 00387AA6 8B2D 80B13800 MOV EBP,DWORD PTR DS:[<&MSVCR71.toupper>] ; MSVCR71.toupper 00387AAC 33DB XOR EBX,EBX 00387AAE 8D7424 68 LEA ESI,DWORD PTR SS:[ESP+68] 00387AB2 83FF 04 CMP EDI,4 00387AB5 75 04 JNZ SHORT Control.00387ABB 00387AB7 33FF XOR EDI,EDI 00387AB9 EB 23 JMP SHORT Control.00387ADE 00387ABB 53 PUSH EBX 00387ABC 8D8C24 E0000000 LEA ECX,DWORD PTR SS:[ESP+E0] 00387AC3 FF15 54B13800 CALL DWORD PTR DS:[<&MFC71.#865>] ; //逐位取试练码ASC值 00387AC9 0FBEC8 MOVSX ECX,AL 00387ACC 51 PUSH ECX 00387ACD FFD5 CALL EBP 00387ACF 0FBED0 MOVSX EDX,AL 00387AD2 83EA 41 SUB EDX,41 ; //EDX=EDX-41 00387AD5 83C4 04 ADD ESP,4 00387AD8 8916 MOV DWORD PTR DS:[ESI],EDX 00387ADA 47 INC EDI 00387ADB 83C6 04 ADD ESI,4 00387ADE 43 INC EBX 00387ADF 83FB 18 CMP EBX,18 00387AE2 ^ 7C CE JL SHORT Control.00387AB2 ; //循环,分别将试练码中的字母的ASC值减41h保存 00387AE4 68 80000000 PUSH 80 00387AE9 51 PUSH ECX 00387AEA 8D8424 E0000000 LEA EAX,DWORD PTR SS:[ESP+E0] 00387AF1 8BCC MOV ECX,ESP 00387AF3 896424 18 MOV DWORD PTR SS:[ESP+18],ESP 00387AF7 50 PUSH EAX 00387AF8 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575 00387AFE 8D8C24 C0000000 LEA ECX,DWORD PTR SS:[ESP+C0] 00387B05 51 PUSH ECX 00387B06 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20] 00387B0A E8 81FCFFFF CALL Control.00387790 00387B0F 8B5424 68 MOV EDX,DWORD PTR SS:[ESP+68] 00387B13 8B4C24 70 MOV ECX,DWORD PTR SS:[ESP+70] 00387B17 8B4424 6C MOV EAX,DWORD PTR SS:[ESP+6C] 00387B1B 895424 18 MOV DWORD PTR SS:[ESP+18],EDX 00387B1F 8B5424 74 MOV EDX,DWORD PTR SS:[ESP+74] 00387B23 894C24 20 MOV DWORD PTR SS:[ESP+20],ECX 00387B27 8B4C24 7C MOV ECX,DWORD PTR SS:[ESP+7C] 00387B2B 894424 1C MOV DWORD PTR SS:[ESP+1C],EAX 00387B2F 8B4424 78 MOV EAX,DWORD PTR SS:[ESP+78] 00387B33 895424 24 MOV DWORD PTR SS:[ESP+24],EDX 00387B37 8B9424 80000000 MOV EDX,DWORD PTR SS:[ESP+80] 00387B3E 894C24 2C MOV DWORD PTR SS:[ESP+2C],ECX 00387B42 8B8C24 88000000 MOV ECX,DWORD PTR SS:[ESP+88] 00387B49 894424 28 MOV DWORD PTR SS:[ESP+28],EAX 00387B4D 8B8424 84000000 MOV EAX,DWORD PTR SS:[ESP+84] 00387B54 895424 30 MOV DWORD PTR SS:[ESP+30],EDX 00387B58 8B9424 8C000000 MOV EDX,DWORD PTR SS:[ESP+8C] 00387B5F 894C24 38 MOV DWORD PTR SS:[ESP+38],ECX 00387B63 8B8C24 94000000 MOV ECX,DWORD PTR SS:[ESP+94] 00387B6A 894424 34 MOV DWORD PTR SS:[ESP+34],EAX 00387B6E 8B8424 90000000 MOV EAX,DWORD PTR SS:[ESP+90] 00387B75 895424 3C MOV DWORD PTR SS:[ESP+3C],EDX 00387B79 8B9424 98000000 MOV EDX,DWORD PTR SS:[ESP+98] 00387B80 894C24 44 MOV DWORD PTR SS:[ESP+44],ECX 00387B84 8B8C24 A0000000 MOV ECX,DWORD PTR SS:[ESP+A0] 00387B8B 894424 40 MOV DWORD PTR SS:[ESP+40],EAX 00387B8F 8B8424 9C000000 MOV EAX,DWORD PTR SS:[ESP+9C] 00387B96 895424 48 MOV DWORD PTR SS:[ESP+48],EDX 00387B9A 8B9424 A4000000 MOV EDX,DWORD PTR SS:[ESP+A4] 00387BA1 894C24 50 MOV DWORD PTR SS:[ESP+50],ECX 00387BA5 894424 4C MOV DWORD PTR SS:[ESP+4C],EAX 00387BA9 895424 54 MOV DWORD PTR SS:[ESP+54],EDX 00387BAD B3 01 MOV BL,1 00387BAF 33C9 XOR ECX,ECX 00387BB1 8B6C0C 18 MOV EBP,DWORD PTR SS:[ESP+ECX+18] ; //试练码第i位运算值 00387BB5 8B840C B8000000 MOV EAX,DWORD PTR SS:[ESP+ECX+B8] ; //根据"ER DVD to 3GP Converter"算出来的4个常数 00387BBC 8B7C0C 28 MOV EDI,DWORD PTR SS:[ESP+ECX+28] ; //试练码第i+5位运算值 00387BC0 8B740C 48 MOV ESI,DWORD PTR SS:[ESP+ECX+48] ; //试练码第i+10位运算值 00387BC4 8B540C 38 MOV EDX,DWORD PTR SS:[ESP+ECX+38] ; //试练码第i+15位运算值 00387BC8 03C5 ADD EAX,EBP 00387BCA 03C7 ADD EAX,EDI 00387BCC 03C6 ADD EAX,ESI 00387BCE 03C2 ADD EAX,EDX ; //四数之和 00387BD0 99 CDQ 00387BD1 BE 1A000000 MOV ESI,1A 00387BD6 F7FE IDIV ESI 00387BD8 3B940C A8000000 CMP EDX,DWORD PTR SS:[ESP+ECX+A8] ; //除以1Ah的的余数和试练码第i+20位运算值比较 00387BDF 89540C 58 MOV DWORD PTR SS:[ESP+ECX+58],EDX 00387BE3 75 0A JNZ SHORT Control.00387BEF ; //不等则跳 00387BE5 83C1 04 ADD ECX,4 00387BE8 83F9 10 CMP ECX,10 00387BEB ^ 7C C4 JL SHORT Control.00387BB1 ; //循环 00387BED EB 02 JMP SHORT Control.00387BF1 00387BEF 32DB XOR BL,BL 00387BF1 8D8C24 D8000000 LEA ECX,DWORD PTR SS:[ESP+D8] 00387BF8 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00387BFE 8D8C24 DC000000 LEA ECX,DWORD PTR SS:[ESP+DC] 00387C05 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 00387C0B 8B8C24 C8000000 MOV ECX,DWORD PTR SS:[ESP+C8] 00387C12 5F POP EDI 00387C13 5E POP ESI 00387C14 5D POP EBP 00387C15 8AC3 MOV AL,BL 00387C17 64:890D 0000000>MOV DWORD PTR FS:[0],ECX 00387C1E 5B POP EBX 00387C1F 81C4 C4000000 ADD ESP,0C4 00387C25 C2 0800 RETN 8 ============================================================== 003876D0 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 003876D6 6A FF PUSH -1 003876D8 68 F9AC3800 PUSH Control.0038ACF9 003876DD 50 PUSH EAX 003876DE 64:8925 0000000>MOV DWORD PTR FS:[0],ESP 003876E5 53 PUSH EBX 003876E6 56 PUSH ESI 003876E7 57 PUSH EDI 003876E8 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 003876EC C74424 14 00000>MOV DWORD PTR SS:[ESP+14],0 003876F4 33FF XOR EDI,EDI ; //EDI=0 003876F6 FF15 D0B03800 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD 003876FC 8D50 01 LEA EDX,DWORD PTR DS:[EAX+1] 003876FF 90 NOP 00387700 8A08 MOV CL,BYTE PTR DS:[EAX] 00387702 40 INC EAX 00387703 84C9 TEST CL,CL 00387705 ^ 75 F9 JNZ SHORT Control.00387700 00387707 2BC2 SUB EAX,EDX 00387709 83F8 18 CMP EAX,18 0038770C 75 62 JNZ SHORT Control.00387770 ; //注册码长度必须为24位 0038770E 8B1D 80B13800 MOV EBX,DWORD PTR DS:[<&MSVCR71.toupper>] ; MSVCR71.toupper 00387714 33F6 XOR ESI,ESI ; //ESI=0 00387716 EB 08 JMP SHORT Control.00387720 00387718 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP] 0038771F 90 NOP 00387720 56 PUSH ESI 00387721 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20] 00387725 FF15 54B13800 CALL DWORD PTR DS:[<&MFC71.#865>] ; //逐位取试练码ASC值 0038772B 0FBEC0 MOVSX EAX,AL 0038772E 50 PUSH EAX 0038772F FFD3 CALL EBX 00387731 83C4 04 ADD ESP,4 00387734 83FF 04 CMP EDI,4 00387737 75 08 JNZ SHORT Control.00387741 ; //每隔4位不跳 00387739 3C 2D CMP AL,2D 0038773B 75 33 JNZ SHORT Control.00387770 ; //不是“-”就跳 0038773D 33FF XOR EDI,EDI ; //EDI=0 0038773F EB 09 JMP SHORT Control.0038774A 00387741 3C 41 CMP AL,41 00387743 7C 2B JL SHORT Control.00387770 ; //小于41h则跳,即"A" 00387745 3C 5A CMP AL,5A 00387747 7F 27 JG SHORT Control.00387770 ; //大于5Ah则跳,即"Z" 00387749 47 INC EDI 0038774A 46 INC ESI 0038774B 83FE 18 CMP ESI,18 0038774E ^ 7C D0 JL SHORT Control.00387720 ; //循环 00387750 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 00387754 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1 0038775A B0 01 MOV AL,1 0038775C 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 00387760 64:890D 0000000>MOV DWORD PTR FS:[0],ECX 00387767 5F POP EDI 00387768 5E POP ESI 00387769 5B POP EBX 0038776A 83C4 0C ADD ESP,0C 0038776D C2 0400 RETN 4
【破解总结】
--------------------------------------------------------------
【算法总结】
1.注册码形式为XXXX-XXXX-XXXX-XXXX-XXXX,X为英文大写字母
2.前4组字母可以是任意字母,第5组字母是根据前4组字母运算所得
--------------------------------------------------------------
【算法注册机】
Private Sub Command1_Click()
Dim C(24), X(4), n, i As Integer
Dim M(24) As String
For n = 1 To 20
C(n) = Int(Rnd() * 26 + 65)
M(n) = Chr(C(n))
Next
X(1) = &H4
X(2) = &H14
X(3) = &HA
X(4) = &H0
For i = 1 To 4
C(i + 20) = ((C(i) + C(i + 5) + C(i + 10) + C(i + 15) - &H41 * 4 + X(i)) Mod &H1A) + &H41
M(i + 20) = Chr(C(i + 20))
Next
Text1.Text = M(1) & M(2) & M(3) & M(4) & "-" & M(6) & M(7) & M(8) & M(9) & "-" & M(11) & M(12) & M(13) & M(14) & "-" & M(16)
& M(17) & M(18) & M(19) & "-" & M(21) & M(22) & M(23) & M(24)
End Sub
--------------------------------------------------------------
【注册信息】
保存在
[HKEY_USERS\S-1-5-21-4062119504-2798039762-1529167351-500\Software\RER Soft, Inc.\DVD to 3GP Converter]
删除可以重新玩 ^_^
--------------------------------------------------------------
感谢飘云老大、猫老大、Nisy老大以及很多前辈们的学习教程以及所有帮助过我的论坛兄弟姐妹们！谢谢
提前祝我的论坛兄弟姐妹们中秋节快乐！！
--------------------------------------------------------------
【版权声明】破文是学习的手记，兴趣是成功的源泉；本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!