【破文标题】Magic Photo Editor 4.9 算法分析
【破文作者】tianxj
【作者邮箱】tianxj_2007@126.com
【作者主页】WwW.ChiNaPYG.CoM
【破解工具】PEiD,OD
【破解平台】雨林木风Windows XP sp3
【软件名称】Magic Photo Editor 4.9
【软件大小】3167KB
【软件类别】国外软件/图像处理
【软件授权】共享版
【软件语言】英文
【运行环境】Win9x/Me/NT/2000/XP/2003
【更新时间】2009-1-12
【原版下载】华军软件园
【保护方式】注册码
【软件简介】一个图片编辑工具。可以轻松地将一张图片中的某些部份合成到另一张图片中，成为一张有特殊效果的图片。
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------
【破解内容】
--------------------------------------------------------------
**************************************************************
一、运行程序，进行注册，输入错误的注册信息进行检测，有提示信息
**************************************************************
二、用PEiD对MagicPhoto.exe查壳，为 Borland Delphi 6.0 - 7.0
**************************************************************
三、运行OD，打开MagicPhoto.exe，右键超级字串参考查找ASCII.
==============================================================
代码:
004831B4 /. 55 PUSH EBP 004831B5 |. 8BEC MOV EBP,ESP 004831B7 |. B9 05000000 MOV ECX,5 004831BC |> 6A 00 /PUSH 0 004831BE |. 6A 00 |PUSH 0 004831C0 |. 49 |DEC ECX 004831C1 |.^ 75 F9 \JNZ SHORT MagicPho.004831BC 004831C3 |. 51 PUSH ECX 004831C4 |. 53 PUSH EBX 004831C5 |. 56 PUSH ESI 004831C6 |. 8BD8 MOV EBX,EAX 004831C8 |. 33C0 XOR EAX,EAX 004831CA |. 55 PUSH EBP 004831CB |. 68 72334800 PUSH MagicPho.00483372 004831D0 |. 64:FF30 PUSH DWORD PTR FS:[EAX] 004831D3 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP 004831D6 |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300] 004831DC |. 8B10 MOV EDX,DWORD PTR DS:[EAX] 004831DE |. FF52 50 CALL DWORD PTR DS:[EDX+50] 004831E1 |. 3C 01 CMP AL,1 004831E3 |. 0F85 18010000 JNZ MagicPho.00483301 004831E9 |. 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8] 004831EC |. 8BB3 00030000 MOV ESI,DWORD PTR DS:[EBX+300] 004831F2 |. 8BC6 MOV EAX,ESI 004831F4 |. E8 8F39FBFF CALL MagicPho.00436B88 004831F9 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; //假码 004831FC |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4] 004831FF |. E8 EC54F8FF CALL MagicPho.004086F0 00483204 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] ; //假码 00483207 |. 8BC6 MOV EAX,ESI 00483209 |. E8 AA39FBFF CALL MagicPho.00436BB8 0048320E |. 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C] 00483211 |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300] 00483217 |. E8 6C39FBFF CALL MagicPho.00436B88 0048321C |. 837D F4 00 CMP DWORD PTR SS:[EBP-C],0 00483220 |. 0F84 CF000000 JE MagicPho.004832F5 ; //假码为空则跳 00483226 |. 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14] 00483229 |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300] 0048322F |. E8 5439FBFF CALL MagicPho.00436B88 00483234 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] ; //假码 00483237 |. 8D55 F0 LEA EDX,DWORD PTR SS:[EBP-10] 0048323A |. E8 6152F8FF CALL MagicPho.004084A0 0048323F |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10] ; //假码 00483242 |. E8 4DA4FFFF CALL MagicPho.0047D694 ; //关键CALL 00483247 |. 84C0 TEST AL,AL 00483249 |. 0F84 9A000000 JE MagicPho.004832E9 0048324F |. 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18] 00483252 |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300] 00483258 |. E8 2B39FBFF CALL MagicPho.00436B88 0048325D |. 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18] ; //假码 00483260 |. E8 E713F8FF CALL MagicPho.0040464C ; //取假码长度 00483265 |. 83F8 0B CMP EAX,0B 00483268 |. 75 7F JNZ SHORT MagicPho.004832E9 ; //假码长度不等于11则跳 0048326A |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C] 0048326D |. 50 PUSH EAX 0048326E |. 8D55 DC LEA EDX,DWORD PTR SS:[EBP-24] 00483271 |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300] 00483277 |. E8 0C39FBFF CALL MagicPho.00436B88 0048327C |. 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24] 0048327F |. 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20] 00483282 |. E8 1952F8FF CALL MagicPho.004084A0 00483287 |. 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20] ; //假码 0048328A |. B9 01000000 MOV ECX,1 0048328F |. BA 0B000000 MOV EDX,0B 00483294 |. E8 0B16F8FF CALL MagicPho.004048A4 ; //取假码第11位 00483299 |. 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] ; //假码第11位 0048329C |. BA 88334800 MOV EDX,MagicPho.00483388 ; U 004832A1 |. E8 EA14F8FF CALL MagicPho.00404790 004832A6 |. 75 41 JNZ SHORT MagicPho.004832E9 ; //假码第11位不为"U"则跳 004832A8 |. 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C] 004832AB |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300] 004832B1 |. E8 D238FBFF CALL MagicPho.00436B88 004832B6 |. 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C] 004832B9 |. 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28] 004832BC |. E8 DF51F8FF CALL MagicPho.004084A0 004832C1 |. 8B55 D8 MOV EDX,DWORD PTR SS:[EBP-28] 004832C4 |. B8 94334800 MOV EAX,MagicPho.00483394 ; magic.bin 004832C9 |. E8 FEA4FFFF CALL MagicPho.0047D7CC 004832CE |. A1 149B4800 MOV EAX,DWORD PTR DS:[489B14] 004832D3 |. BA A8334800 MOV EDX,MagicPho.004833A8 ; Y 004832D8 |. E8 0B11F8FF CALL MagicPho.004043E8 004832DD |. B8 B4334800 MOV EAX,MagicPho.004833B4 ; Successfully Registered! 004832E2 |. E8 35D4FAFF CALL MagicPho.0043071C 004832E7 |. EB 22 JMP SHORT MagicPho.0048330B 004832E9 |> B8 D8334800 MOV EAX,MagicPho.004833D8 ; Invalid SerialNumber! 004832EE |. E8 29D4FAFF CALL MagicPho.0043071C 004832F3 |. EB 16 JMP SHORT MagicPho.0048330B 004832F5 |> B8 D8334800 MOV EAX,MagicPho.004833D8 ; Invalid SerialNumber! 004832FA |. E8 1DD4FAFF CALL MagicPho.0043071C 004832FF |. EB 0A JMP SHORT MagicPho.0048330B 00483301 |> B8 F8334800 MOV EAX,MagicPho.004833F8 ; Already Registered! 00483306 |. E8 11D4FAFF CALL MagicPho.0043071C 0048330B |> A1 5CAD4800 MOV EAX,DWORD PTR DS:[48AD5C] 00483310 |. E8 D708FDFF CALL MagicPho.00453BEC 00483315 |. 33C0 XOR EAX,EAX 00483317 |. 5A POP EDX 00483318 |. 59 POP ECX 00483319 |. 59 POP ECX 0048331A |. 64:8910 MOV DWORD PTR FS:[EAX],EDX 0048331D |. 68 79334800 PUSH MagicPho.00483379 00483322 |> 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C] 00483325 |. E8 6A10F8FF CALL MagicPho.00404394 0048332A |. 8D45 D8 LEA EAX,DWORD PTR SS:[EBP-28] 0048332D |. E8 6210F8FF CALL MagicPho.00404394 00483332 |. 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24] 00483335 |. E8 5A10F8FF CALL MagicPho.00404394 0048333A |. 8D45 E0 LEA EAX,DWORD PTR SS:[EBP-20] 0048333D |. BA 02000000 MOV EDX,2 00483342 |. E8 7110F8FF CALL MagicPho.004043B8 00483347 |. 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18] 0048334A |. BA 02000000 MOV EDX,2 0048334F |. E8 6410F8FF CALL MagicPho.004043B8 00483354 |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10] 00483357 |. E8 3810F8FF CALL MagicPho.00404394 0048335C |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 0048335F |. BA 02000000 MOV EDX,2 00483364 |. E8 4F10F8FF CALL MagicPho.004043B8 00483369 |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 0048336C |. E8 2310F8FF CALL MagicPho.00404394 00483371 \. C3 RETN 00483372 .^ E9 450AF8FF JMP MagicPho.00403DBC 00483377 .^ EB A9 JMP SHORT MagicPho.00483322 00483379 . 5E POP ESI 0048337A . 5B POP EBX 0048337B . 8BE5 MOV ESP,EBP 0048337D . 5D POP EBP 0048337E . C3 RETN
==============================================================
代码:
0047D694 /$ 55 PUSH EBP 0047D695 |. 8BEC MOV EBP,ESP 0047D697 |. B9 04000000 MOV ECX,4 0047D69C |> 6A 00 /PUSH 0 0047D69E |. 6A 00 |PUSH 0 0047D6A0 |. 49 |DEC ECX 0047D6A1 |.^ 75 F9 \JNZ SHORT MagicPho.0047D69C 0047D6A3 |. 51 PUSH ECX 0047D6A4 |. 53 PUSH EBX 0047D6A5 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX 0047D6A8 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //假码 0047D6AB |. E8 8471F8FF CALL MagicPho.00404834 0047D6B0 |. 33C0 XOR EAX,EAX 0047D6B2 |. 55 PUSH EBP 0047D6B3 |. 68 BDD74700 PUSH MagicPho.0047D7BD 0047D6B8 |. 64:FF30 PUSH DWORD PTR FS:[EAX] 0047D6BB |. 64:8920 MOV DWORD PTR FS:[EAX],ESP 0047D6BE |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 0047D6C1 |. E8 B2FDFFFF CALL MagicPho.0047D478 0047D6C6 |. 8D4D EC LEA ECX,DWORD PTR SS:[EBP-14] 0047D6C9 |. 33D2 XOR EDX,EDX 0047D6CB |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; //用户名 0047D6CE |. E8 1DFBFFFF CALL MagicPho.0047D1F0 ; //将用户名重新排序 0047D6D3 |. 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14] ; //重新排序后的用户名 0047D6D6 |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 0047D6D9 |. E8 4E6DF8FF CALL MagicPho.0040442C 0047D6DE |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 0047D6E1 |. 50 PUSH EAX 0047D6E2 |. B9 0A000000 MOV ECX,0A 0047D6E7 |. BA 01000000 MOV EDX,1 0047D6EC |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //假码 0047D6EF |. E8 B071F8FF CALL MagicPho.004048A4 ; //取假码第1-10位 0047D6F4 |. 8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18] 0047D6F7 |. 66:BA 0001 MOV DX,100 ; //DX=100 0047D6FB |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //假码第1-10位 0047D6FE |. E8 1DFFFFFF CALL MagicPho.0047D620 ; //将假码变形 0047D703 |. 8B55 E8 MOV EDX,DWORD PTR SS:[EBP-18] ; //变形后的假码 0047D706 |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 0047D709 |. E8 1E6DF8FF CALL MagicPho.0040442C 0047D70E |. 8D4D E4 LEA ECX,DWORD PTR SS:[EBP-1C] 0047D711 |. 33D2 XOR EDX,EDX 0047D713 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //变形后的假码 0047D716 |. E8 D5FAFFFF CALL MagicPho.0047D1F0 ; //将变形后的假码重新排序 0047D71B |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C] ; //重新排序后的假码 0047D71E |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 0047D721 |. E8 066DF8FF CALL MagicPho.0040442C 0047D726 |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 0047D729 |. 50 PUSH EAX 0047D72A |. B9 04000000 MOV ECX,4 0047D72F |. BA 0A000000 MOV EDX,0A 0047D734 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //重新排序后的假码 0047D737 |. E8 6871F8FF CALL MagicPho.004048A4 ; //取重新排序后的假码第10-13位 0047D73C |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10] 0047D73F |. 50 PUSH EAX 0047D740 |. B9 06000000 MOV ECX,6 0047D745 |. BA 05000000 MOV EDX,5 0047D74A |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //重新排序后的假码 0047D74D |. E8 5271F8FF CALL MagicPho.004048A4 ; //取重新排序后的假码第5-10位 0047D752 |. 8D45 E0 LEA EAX,DWORD PTR SS:[EBP-20] 0047D755 |. 50 PUSH EAX 0047D756 |. B9 04000000 MOV ECX,4 0047D75B |. BA 01000000 MOV EDX,1 0047D760 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; //用户名 0047D763 |. E8 3C71F8FF CALL MagicPho.004048A4 ; //取用户名第1-4位 0047D768 |. 8B55 E0 MOV EDX,DWORD PTR SS:[EBP-20] ; //用户名第1-4位 0047D76B |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] ; //重新排序后的假码第10-13位 0047D76E |. E8 1572F8FF CALL MagicPho.00404988 0047D773 |. 85C0 TEST EAX,EAX 0047D775 |. 7F 25 JG SHORT MagicPho.0047D79C 0047D777 |. 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24] 0047D77A |. 50 PUSH EAX 0047D77B |. B9 06000000 MOV ECX,6 0047D780 |. BA 05000000 MOV EDX,5 0047D785 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; //用户名 0047D788 |. E8 1771F8FF CALL MagicPho.004048A4 ; //取用户名第5-10位 0047D78D |. 8B55 DC MOV EDX,DWORD PTR SS:[EBP-24] ; //用户名第5-10位 0047D790 |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10] ; //重新排序后的假码第5-10位 0047D793 |. E8 F071F8FF CALL MagicPho.00404988 ; //关键比较 0047D798 |. 85C0 TEST EAX,EAX 0047D79A |. 7E 04 JLE SHORT MagicPho.0047D7A0 ; //关键跳转 0047D79C |> B3 01 MOV BL,1 0047D79E |. EB 02 JMP SHORT MagicPho.0047D7A2 0047D7A0 |> 33DB XOR EBX,EBX 0047D7A2 |> 33C0 XOR EAX,EAX 0047D7A4 |. 5A POP EDX 0047D7A5 |. 59 POP ECX 0047D7A6 |. 59 POP ECX 0047D7A7 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX 0047D7AA |. 68 C4D74700 PUSH MagicPho.0047D7C4 0047D7AF |> 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24] 0047D7B2 |. BA 09000000 MOV EDX,9 0047D7B7 |. E8 FC6BF8FF CALL MagicPho.004043B8 0047D7BC \. C3 RETN 0047D7BD .^ E9 FA65F8FF JMP MagicPho.00403DBC 0047D7C2 .^ EB EB JMP SHORT MagicPho.0047D7AF 0047D7C4 . 8BC3 MOV EAX,EBX 0047D7C6 . 5B POP EBX 0047D7C7 . 8BE5 MOV ESP,EBP 0047D7C9 . 5D POP EBP 0047D7CA . C3 RETN
==============================================================
代码:
0047D1F0 /$ 55 PUSH EBP 0047D1F1 |. 8BEC MOV EBP,ESP 0047D1F3 |. 51 PUSH ECX 0047D1F4 |. B9 0A000000 MOV ECX,0A 0047D1F9 |> 6A 00 /PUSH 0 0047D1FB |. 6A 00 |PUSH 0 0047D1FD |. 49 |DEC ECX 0047D1FE |.^ 75 F9 \JNZ SHORT MagicPho.0047D1F9 0047D200 |. 874D FC XCHG DWORD PTR SS:[EBP-4],ECX 0047D203 |. 53 PUSH EBX 0047D204 |. 56 PUSH ESI 0047D205 |. 8BF1 MOV ESI,ECX 0047D207 |. 8BDA MOV EBX,EDX 0047D209 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX 0047D20C |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //用户名 0047D20F |. E8 2076F8FF CALL MagicPho.00404834 0047D214 |. 33C0 XOR EAX,EAX 0047D216 |. 55 PUSH EBP 0047D217 |. 68 6AD44700 PUSH MagicPho.0047D46A 0047D21C |. 64:FF30 PUSH DWORD PTR FS:[EAX] 0047D21F |. 64:8920 MOV DWORD PTR FS:[EAX],ESP 0047D222 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //用户名 0047D225 |. E8 2274F8FF CALL MagicPho.0040464C ; //取用户名长度 0047D22A |. 84DB TEST BL,BL 0047D22C |. 0F84 0C010000 JE MagicPho.0047D33E 0047D232 |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 0047D235 |. 50 PUSH EAX 0047D236 |. B9 01000000 MOV ECX,1 0047D23B |. BA 03000000 MOV EDX,3 0047D240 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D243 |. E8 5C76F8FF CALL MagicPho.004048A4 0047D248 |. FF75 F8 PUSH DWORD PTR SS:[EBP-8] 0047D24B |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 0047D24E |. 50 PUSH EAX 0047D24F |. B9 01000000 MOV ECX,1 0047D254 |. BA 09000000 MOV EDX,9 0047D259 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D25C |. E8 4376F8FF CALL MagicPho.004048A4 0047D261 |. FF75 F4 PUSH DWORD PTR SS:[EBP-C] 0047D264 |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10] 0047D267 |. 50 PUSH EAX 0047D268 |. B9 01000000 MOV ECX,1 0047D26D |. BA 04000000 MOV EDX,4 0047D272 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D275 |. E8 2A76F8FF CALL MagicPho.004048A4 0047D27A |. FF75 F0 PUSH DWORD PTR SS:[EBP-10] 0047D27D |. 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14] 0047D280 |. 50 PUSH EAX 0047D281 |. B9 01000000 MOV ECX,1 0047D286 |. BA 01000000 MOV EDX,1 0047D28B |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D28E |. E8 1176F8FF CALL MagicPho.004048A4 0047D293 |. FF75 EC PUSH DWORD PTR SS:[EBP-14] 0047D296 |. 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18] 0047D299 |. 50 PUSH EAX 0047D29A |. B9 01000000 MOV ECX,1 0047D29F |. BA 06000000 MOV EDX,6 0047D2A4 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D2A7 |. E8 F875F8FF CALL MagicPho.004048A4 0047D2AC |. FF75 E8 PUSH DWORD PTR SS:[EBP-18] 0047D2AF |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C] 0047D2B2 |. 50 PUSH EAX 0047D2B3 |. B9 01000000 MOV ECX,1 0047D2B8 |. BA 08000000 MOV EDX,8 0047D2BD |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D2C0 |. E8 DF75F8FF CALL MagicPho.004048A4 0047D2C5 |. FF75 E4 PUSH DWORD PTR SS:[EBP-1C] 0047D2C8 |. 8D45 E0 LEA EAX,DWORD PTR SS:[EBP-20] 0047D2CB |. 50 PUSH EAX 0047D2CC |. B9 01000000 MOV ECX,1 0047D2D1 |. BA 05000000 MOV EDX,5 0047D2D6 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D2D9 |. E8 C675F8FF CALL MagicPho.004048A4 0047D2DE |. FF75 E0 PUSH DWORD PTR SS:[EBP-20] 0047D2E1 |. 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24] 0047D2E4 |. 50 PUSH EAX 0047D2E5 |. B9 01000000 MOV ECX,1 0047D2EA |. BA 07000000 MOV EDX,7 0047D2EF |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D2F2 |. E8 AD75F8FF CALL MagicPho.004048A4 0047D2F7 |. FF75 DC PUSH DWORD PTR SS:[EBP-24] 0047D2FA |. 8D45 D8 LEA EAX,DWORD PTR SS:[EBP-28] 0047D2FD |. 50 PUSH EAX 0047D2FE |. B9 01000000 MOV ECX,1 0047D303 |. BA 0A000000 MOV EDX,0A 0047D308 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D30B |. E8 9475F8FF CALL MagicPho.004048A4 0047D310 |. FF75 D8 PUSH DWORD PTR SS:[EBP-28] 0047D313 |. 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C] 0047D316 |. 50 PUSH EAX 0047D317 |. B9 01000000 MOV ECX,1 0047D31C |. BA 02000000 MOV EDX,2 0047D321 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D324 |. E8 7B75F8FF CALL MagicPho.004048A4 0047D329 |. FF75 D4 PUSH DWORD PTR SS:[EBP-2C] 0047D32C |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 0047D32F |. BA 0A000000 MOV EDX,0A 0047D334 |. E8 D373F8FF CALL MagicPho.0040470C 0047D339 |. E9 07010000 JMP MagicPho.0047D445 0047D33E |> 8D45 D0 LEA EAX,DWORD PTR SS:[EBP-30] 0047D341 |. 50 PUSH EAX 0047D342 |. B9 01000000 MOV ECX,1 0047D347 |. BA 04000000 MOV EDX,4 0047D34C |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //用户名 0047D34F |. E8 5075F8FF CALL MagicPho.004048A4 ; //取用户名第4位 0047D354 |. FF75 D0 PUSH DWORD PTR SS:[EBP-30] 0047D357 |. 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34] 0047D35A |. 50 PUSH EAX 0047D35B |. B9 01000000 MOV ECX,1 0047D360 |. BA 0A000000 MOV EDX,0A 0047D365 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D368 |. E8 3775F8FF CALL MagicPho.004048A4 ; //取用户名第10位 0047D36D |. FF75 CC PUSH DWORD PTR SS:[EBP-34] 0047D370 |. 8D45 C8 LEA EAX,DWORD PTR SS:[EBP-38] 0047D373 |. 50 PUSH EAX 0047D374 |. B9 01000000 MOV ECX,1 0047D379 |. BA 01000000 MOV EDX,1 0047D37E |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D381 |. E8 1E75F8FF CALL MagicPho.004048A4 ; //取用户名第1位 0047D386 |. FF75 C8 PUSH DWORD PTR SS:[EBP-38] 0047D389 |. 8D45 C4 LEA EAX,DWORD PTR SS:[EBP-3C] 0047D38C |. 50 PUSH EAX 0047D38D |. B9 01000000 MOV ECX,1 0047D392 |. BA 03000000 MOV EDX,3 0047D397 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D39A |. E8 0575F8FF CALL MagicPho.004048A4 ; //取用户名第3位 0047D39F |. FF75 C4 PUSH DWORD PTR SS:[EBP-3C] 0047D3A2 |. 8D45 C0 LEA EAX,DWORD PTR SS:[EBP-40] 0047D3A5 |. 50 PUSH EAX 0047D3A6 |. B9 01000000 MOV ECX,1 0047D3AB |. BA 07000000 MOV EDX,7 0047D3B0 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D3B3 |. E8 EC74F8FF CALL MagicPho.004048A4 ; //取用户名第7位 0047D3B8 |. FF75 C0 PUSH DWORD PTR SS:[EBP-40] 0047D3BB |. 8D45 BC LEA EAX,DWORD PTR SS:[EBP-44] 0047D3BE |. 50 PUSH EAX 0047D3BF |. B9 01000000 MOV ECX,1 0047D3C4 |. BA 05000000 MOV EDX,5 0047D3C9 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D3CC |. E8 D374F8FF CALL MagicPho.004048A4 ; //取用户名第5位 0047D3D1 |. FF75 BC PUSH DWORD PTR SS:[EBP-44] 0047D3D4 |. 8D45 B8 LEA EAX,DWORD PTR SS:[EBP-48] 0047D3D7 |. 50 PUSH EAX 0047D3D8 |. B9 01000000 MOV ECX,1 0047D3DD |. BA 08000000 MOV EDX,8 0047D3E2 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D3E5 |. E8 BA74F8FF CALL MagicPho.004048A4 ; //取用户名第8位 0047D3EA |. FF75 B8 PUSH DWORD PTR SS:[EBP-48] 0047D3ED |. 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C] 0047D3F0 |. 50 PUSH EAX 0047D3F1 |. B9 01000000 MOV ECX,1 0047D3F6 |. BA 06000000 MOV EDX,6 0047D3FB |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D3FE |. E8 A174F8FF CALL MagicPho.004048A4 ; //取用户名第6位 0047D403 |. FF75 B4 PUSH DWORD PTR SS:[EBP-4C] 0047D406 |. 8D45 B0 LEA EAX,DWORD PTR SS:[EBP-50] 0047D409 |. 50 PUSH EAX 0047D40A |. B9 01000000 MOV ECX,1 0047D40F |. BA 02000000 MOV EDX,2 0047D414 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D417 |. E8 8874F8FF CALL MagicPho.004048A4 ; //取用户名第2位 0047D41C |. FF75 B0 PUSH DWORD PTR SS:[EBP-50] 0047D41F |. 8D45 AC LEA EAX,DWORD PTR SS:[EBP-54] 0047D422 |. 50 PUSH EAX 0047D423 |. B9 01000000 MOV ECX,1 0047D428 |. BA 09000000 MOV EDX,9 0047D42D |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0047D430 |. E8 6F74F8FF CALL MagicPho.004048A4 ; //取用户名第9位 0047D435 |. FF75 AC PUSH DWORD PTR SS:[EBP-54] 0047D438 |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 0047D43B |. BA 0A000000 MOV EDX,0A 0047D440 |. E8 C772F8FF CALL MagicPho.0040470C 0047D445 |> 8BC6 MOV EAX,ESI 0047D447 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] ; //重新排序后的用户名 0047D44A |. E8 996FF8FF CALL MagicPho.004043E8 0047D44F |. 33C0 XOR EAX,EAX 0047D451 |. 5A POP EDX 0047D452 |. 59 POP ECX 0047D453 |. 59 POP ECX 0047D454 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX 0047D457 |. 68 71D44700 PUSH MagicPho.0047D471 0047D45C |> 8D45 AC LEA EAX,DWORD PTR SS:[EBP-54] 0047D45F |. BA 15000000 MOV EDX,15 0047D464 |. E8 4F6FF8FF CALL MagicPho.004043B8 0047D469 \. C3 RETN 0047D46A .^ E9 4D69F8FF JMP MagicPho.00403DBC 0047D46F .^ EB EB JMP SHORT MagicPho.0047D45C 0047D471 . 5E POP ESI 0047D472 . 5B POP EBX 0047D473 . 8BE5 MOV ESP,EBP 0047D475 . 5D POP EBP 0047D476 . C3 RETN
==============================================================
代码:
0047D620 /$ 53 PUSH EBX 0047D621 |. 56 PUSH ESI 0047D622 |. 57 PUSH EDI 0047D623 |. 55 PUSH EBP 0047D624 |. 83C4 F8 ADD ESP,-8 0047D627 |. 8BF9 MOV EDI,ECX 0047D629 |. 8BEA MOV EBP,EDX ; //EBP=EDX 0047D62B |. 890424 MOV DWORD PTR SS:[ESP],EAX 0047D62E |. 8BC7 MOV EAX,EDI 0047D630 |. 8B1424 MOV EDX,DWORD PTR SS:[ESP] ; //假码第1-10位 0047D633 |. E8 B06DF8FF CALL MagicPho.004043E8 0047D638 |. 8BC7 MOV EAX,EDI 0047D63A |. E8 5D72F8FF CALL MagicPho.0040489C 0047D63F |. 8B1424 MOV EDX,DWORD PTR SS:[ESP] ; //假码 0047D642 |. 8A12 MOV DL,BYTE PTR DS:[EDX] ; //取假码第一位 0047D644 |. 8810 MOV BYTE PTR DS:[EAX],DL ; //保存 0047D646 |. 8B0424 MOV EAX,DWORD PTR SS:[ESP] 0047D649 |. E8 FE6FF8FF CALL MagicPho.0040464C ; //取假码长度 0047D64E |. 2C 02 SUB AL,2 0047D650 |. 72 3A JB SHORT MagicPho.0047D68C 0047D652 |. 40 INC EAX 0047D653 |. 884424 04 MOV BYTE PTR SS:[ESP+4],AL ; //AL=9 0047D657 |. B3 02 MOV BL,2 ; //BL=2 0047D659 |> 8BC7 /MOV EAX,EDI 0047D65B |. E8 3C72F8FF |CALL MagicPho.0040489C 0047D660 |. 8BF3 |MOV ESI,EBX 0047D662 |. 81E6 FF000000 |AND ESI,0FF 0047D668 |. 8B1424 |MOV EDX,DWORD PTR SS:[ESP] 0047D66B |. 8A5432 FF |MOV DL,BYTE PTR DS:[EDX+ESI-1] ; //从第2位起,依次取假码的ASCII码 0047D66F |. 0FB7CD |MOVZX ECX,BP ; //ECX=BP,BP初始值为100 0047D672 |. C1E9 08 |SHR ECX,8 ; //ECX右移8位 0047D675 |. 32D1 |XOR DL,CL ; //DL=DL xor CL 0047D677 |. 885430 FF |MOV BYTE PTR DS:[EAX+ESI-1],DL ; //保存异或结果 0047D67B |. 8B07 |MOV EAX,DWORD PTR DS:[EDI] 0047D67D |. 0FB64430 FF |MOVZX EAX,BYTE PTR DS:[EAX+ESI-1] ; //取异或结果 0047D682 |. 66:03E8 |ADD BP,AX ; //BP=BP+AX 0047D685 |. 43 |INC EBX 0047D686 |. FE4C24 04 |DEC BYTE PTR SS:[ESP+4] 0047D68A |.^ 75 CD \JNZ SHORT MagicPho.0047D659 ; //循环 0047D68C |> 59 POP ECX 0047D68D |. 5A POP EDX 0047D68E |. 5D POP EBP 0047D68F |. 5F POP EDI 0047D690 |. 5E POP ESI 0047D691 |. 5B POP EBX 0047D692 \. C3 RETN
**************************************************************
【破解总结】
本程序将用户名和注册码都变形后比较，是无法作内存注册机的，如果看不懂算法流程只有走爆破之路，如果再设计几个暗桩就比较完美了，值得学习。
--------------------------------------------------------------
【算法总结】
--------------------------------------------------------------
【算法注册机】
〖易语言代码〗
.版本 2
.子程序 _按钮1_被单击
.局部变量 A, 整数型
.局部变量 B, 整数型
.局部变量 C, 整数型
.局部变量 D, 整数型
.局部变量 X, 文本型
.局部变量 i, 整数型
.如果 (取文本长度 (编辑框1.内容) ＝ 0)
编辑框2.内容 ＝ “请输入用户名！”
.否则
X ＝ 编辑框1.内容
B ＝ 256
.计次循环首 (取文本长度 (X) － 1, i)
A ＝ 取代码 (X, i ＋ 1)
C ＝ 右移 (B, 8)
D ＝ 位异或 (A, C)
X ＝ 文本替换 (X, i ＋ 1, 1, 字符 (D))
B ＝ B ＋ D
.计次循环尾 ()
编辑框2.内容 ＝ 文本替换 (X, 11, 1, “U”)
--------------------------------------------------------------
感谢飘云老大、猫老大、Nisy老大以及很多前辈们的学习教程以及徐超等所有帮助过我的论坛兄弟姐妹们！谢谢
--------------------------------------------------------------
【版权声明】破文是学习的手记，兴趣是成功的源泉；本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
--------------------------------------------------------------
牛年祝愿天下朋友：工作舒心，薪水合心，被窝暖心，朋友知心，爱人同心，一切都顺心，永远都开心，事事都称心!