【软件名称】: mp4格式转换器
【下载地址】: http://www.onlinedown.net/soft/94444.htm
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
是delphi程序，无壳无反调试。只需要输入注册码，从帮助文件中看注册码是9位。
用DeDe打开后，只有两个窗口：主窗口和一个注册窗口。因此很容易定位到注册相关的代码。
004A568C /$ 55 push ebp
004A568D |. 8BEC mov ebp,esp
004A568F |. B9 04000000 mov ecx,4
004A5694 |> 6A 00 /push 0
004A5696 |. 6A 00 |push 0
004A5698 |. 49 |dec ecx
004A5699 |.^ 75 F9 \jnz short mp4格式?004A5694
004A569B |. 51 push ecx
004A569C |. 53 push ebx
004A569D |. 56 push esi
004A569E |. 8955 FC mov [local.1],edx ; local1变量，存储伪码。psw
004A56A1 |. 8BD8 mov ebx,eax
004A56A3 |. 8B45 FC mov eax,[local.1]
004A56A6 |. E8 55EFF5FF call mp4格式?00404600 ; * Reference to: System.@LStrAddRef(void;void):Pointer;
004A56AB |. 33C0 xor eax,eax
004A56AD |. 55 push ebp
004A56AE |. 68 B3574A00 push mp4格式?004A57B3
004A56B3 |. 64:FF30 push dword ptr fs:[eax]
004A56B6 |. 64:8920 mov dword ptr fs:[eax],esp
004A56B9 |. C645 FB 00 mov byte ptr ss:[ebp-5],0
004A56BD |. 68 CC574A00 push mp4格式?004A57CC ; I1ls
004A56C2 |. 68 DC574A00 push mp4格式?004A57DC ; g1
004A56C7 |. FF75 FC push [local.1]
004A56CA |. 68 CC574A00 push mp4格式?004A57CC ; I1ls
004A56CF |. 8D45 E0 lea eax,[local.8]
004A56D2 |. BA 03000000 mov edx,3
004A56D7 |. E8 F4EDF5FF call mp4格式?004044D0 ; * Reference to: System.@LStrCatN;
004A56DC |. 8B45 E0 mov eax,[local.8] ; 变量1，str1=g1+伪码+I1ls
004A56DF |. 8D55 E4 lea edx,[local.7]
004A56E2 |. E8 75EAFFFF call mp4格式?004A415C ; * Reference to : TWebBrowser._PROC_004A415C()//这是一个md5加密函数，这个函数嵌套非常多，一开始没有跟进去，因为函数调用后得到一个32位的值，猜测可能是MD5加密，经过验证确实是。
004A56E7 |. 8B45 E4 mov eax,[local.7] ; 变量2，str2= (ASCII "0149bd85803413a6bb5c8212cf74e2ce")
004A56EA |. 8D55 E8 lea edx,[local.6] ; str1
004A56ED |. E8 1E2CF6FF call mp4格式?00408310 ; * Reference to: SysUtils.UpperCase(AnsiString):AnsiString;
004A56F2 |. FF75 E8 push [local.6] ; str2=UpperCase(str2)
004A56F5 |. 68 DC574A00 push mp4格式?004A57DC ; g1
004A56FA |. 8D45 EC lea eax,[local.5]
004A56FD |. BA 03000000 mov edx,3
004A5702 |. E8 C9EDF5FF call mp4格式?004044D0 ; * Reference to: System.@LStrCatN;
004A5707 |. 8B45 EC mov eax,[local.5] ; str3=I1ls+str2+g1
004A570A |. 8D55 F0 lea edx,[local.4]
004A570D |. E8 4AEAFFFF call mp4格式?004A415C ; * Reference to : TWebBrowser._PROC_004A415C()
004A5712 |. 8B45 F0 mov eax,[local.4] ; str4= (ASCII "16783c95a826b47f64045215840aa319")
004A5715 |. 8D55 F4 lea edx,[local.3] ; str3
004A5718 |. E8 F32BF6FF call mp4格式?00408310 ; * Reference to: SysUtils.UpperCase(AnsiString):AnsiString;
004A571D |. 837D F4 00 cmp [local.3],0 ; str4=uppercase(str4)
004A5721 |. 75 06 jnz short mp4格式?004A5729 ; str4!=null
004A5723 |. C643 0C 00 mov byte ptr ds:[ebx+C],0
004A5727 |. EB 67 jmp short mp4格式?004A5790
004A5729 |> 8BC3 mov eax,ebx
004A572B |. E8 5CFEFFFF call mp4格式?004A558C ; 连接网络，下面看
004A5730 |. 8B45 F4 mov eax,[local.3] ; str4
004A5733 |. 8B53 08 mov edx,dword ptr ds:[ebx+8] ; str5 (ASCII "A5A33B0AB9644E84A4614841E2FF924D") 函数返回的
004A5736 |. E8 21EEF5FF call mp4格式?0040455C ; * Reference to: System.@LStrCmp;
004A573B 75 04 jnz short mp4格式?004A5741 ；把str4和mp4格式?004A558C返回的str5比较，相等就注册成功。这里改为nop爆破。
004A573D |. B0 01 mov al,1
004A573F |. EB 02 jmp short mp4格式?004A5743
004A5741 |> 33C0 xor eax,eax
004A5743 |> 84C0 test al,al
004A5745 |. 75 06 jnz short mp4格式?004A574D
004A5747 |. C643 0C 00 mov byte ptr ds:[ebx+C],0
004A574B |. EB 43 jmp short mp4格式?004A5790
004A574D |> B2 01 mov dl,1
004A574F |. A1 CC734100 mov eax,dword ptr ds:[4173CC]
004A5754 |. E8 B3DBF5FF call mp4格式?0040330C ; * Reference to: InStack.TInStack.Create(TInStack;boolean);
004A5759 |. 8BF0 mov esi,eax
TWebBrowser._PROC_004A415C()这个函数的功能纯粹一开始是猜测出来的，后来查看详细的代码，找到了MD5需要的特征串。
下面看看mp4格式?004A558C 函数
004A558C /$ 55 push ebp
004A558D |. 8BEC mov ebp,esp
004A558F |. 33C9 xor ecx,ecx
004A5591 |. 51 push ecx
004A5592 |. 51 push ecx
004A5593 |. 51 push ecx
004A5594 |. 51 push ecx
004A5595 |. 53 push ebx
004A5596 |. 8BD8 mov ebx,eax
004A5598 |. 33C0 xor eax,eax
004A559A |. 55 push ebp
004A559B |. 68 1F564A00 push mp4格式?004A561F
004A55A0 |. 64:FF30 push dword ptr fs:[eax]
004A55A3 |. 64:8920 mov dword ptr fs:[eax],esp
004A55A6 |. 837B 08 00 cmp dword ptr ds:[ebx+8],0
004A55AA |. 75 58 jnz short mp4格式?004A5604
004A55AC |. 68 34564A00 push mp4格式?004A5634 ; I1ls
004A55B1 |. 68 44564A00 push mp4格式?004A5644 ; password=1233
004A55B6 |. 8D45 F0 lea eax,[local.4] ; 定义变量
004A55B9 |. 50 push eax
004A55BA |. B9 5C564A00 mov ecx,mp4格式?004A565C ; /d.asp
004A55BF |. BA 50000000 mov edx,50
004A55C4 |. B8 6C564A00 mov eax,mp4格式?004A566C ; taobao.fstgw.com
004A55C9 |. E8 E6ECFFFF call mp4格式?004A42B4 ;又调用一个函数，下面看。 服务器返回了 "E2D45534CC3E7B8B1B7715713BC2E036"，str1
004A55CE |. FF75 F0 push [local.4] ；下面又是对这个字符串进行同第一段中同样的处理，最后得到的就是第一段中说的str5
004A55D1 |. 68 88564A00 push mp4格式?004A5688 ; g1
004A55D6 |. 8D45 F4 lea eax,[local.3]
004A55D9 |. BA 03000000 mov edx,3
004A55DE |. E8 EDEEF5FF call mp4格式?004044D0 ; * Reference to: System.@LStrCatN;
004A55E3 |. 8B45 F4 mov eax,[local.3] ; str1=I1ls+str1+g1
004A55E6 |. 8D55 F8 lea edx,[local.2]
004A55E9 |. E8 6EEBFFFF call mp4格式?004A415C ; * Reference to : TWebBrowser._PROC_004A415C()
004A55EE |. 8B45 F8 mov eax,[local.2] ; (ASCII "a5a33b0ab9644e84a4614841e2ff924d")
004A55F1 |. 8D55 FC lea edx,[local.1] ; str1
004A55F4 |. E8 172DF6FF call mp4格式?00408310 ; * Reference to: SysUtils.UpperCase(AnsiString):AnsiString;
004A55F9 |. 8B55 FC mov edx,[local.1] ; str1=UpperCast(str1)
004A55FC |. 8D43 08 lea eax,dword ptr ds:[ebx+8]
004A55FF |. E8 A0EBF5FF call mp4格式?004041A4 ; * Reference to: System.@LStrAsg(void;void;void;void);
004A5604 |> 33C0 xor eax,eax
004A5606 |. 5A pop edx
004A5607 |. 59 pop ecx
004A5608 |. 59 pop ecx
004A5609 |. 64:8910 mov dword ptr fs:[eax],edx
call mp4格式?004A42B4 函数
这个函数从004a42b4开始，比较长。功能是调用WININET.DLL中相关的函数从taobao.fstgw.com中的/d.asp，获得返回内容。
经过测试返回内容为E2D45534CC3E7B8B1B7715713BC2E036
猜测也是一个md5加密。但是除了通过HttpAddRequestHeadersA传递了password=1233，没发现传递其他内容
004A42B4 /$ 55 push ebp
004A42B5 |. 8BEC mov ebp,esp
004A42B7 |. 81C4 04F0FFFF add esp,-0FFC
004A42BD |. 50 push eax
004A42BE |. 83C4 CC add esp,-34
004A42C1 |. 53 push ebx
004A42C2 |. 56 push esi
004A42C3 |. 57 push edi
004A42C4 |. 33DB xor ebx,ebx
004A42C6 |. 899D D0EFFFFF mov [local.1036],ebx
004A42CC |. 899D CCEFFFFF mov [local.1037],ebx
004A42D2 |. 899D D4EFFFFF mov [local.1035],ebx
004A42D8 |. 895D EC mov [local.5],ebx
004A42DB |. 895D E8 mov [local.6],ebx
004A42DE |. 895D E4 mov [local.7],ebx
004A42E1 |. 895D D8 mov [local.10],ebx
004A42E4 |. 894D F8 mov [local.2],ecx
004A42E7 |. 8BF2 mov esi,edx
004A42E9 |. 8945 FC mov [local.1],eax
004A42EC |. 8B7D 08 mov edi,[arg.1]
004A42EF |. 8B45 FC mov eax,[local.1]
004A42F2 |. E8 0903F6FF call mp4格式?00404600 ; * Reference to: System.@LStrAddRef(void;void):Pointer;
004A42F7 |. 8B45 F8 mov eax,[local.2] ; * Reference to: System.@LStrAddRef(void;void):Pointer;
004A42FA |. E8 0103F6FF call mp4格式?00404600
004A42FF |. 8B45 0C mov eax,[arg.2] ; arg2="password=1233"
004A4302 |. E8 F902F6FF call mp4格式?00404600 ; * Reference to: System.@LStrAddRef(void;void):Pointer;
004A4307 |. 33C0 xor eax,eax
004A4309 |. 55 push ebp
004A430A |. 68 29454A00 push mp4格式?004A4529
004A430F |. 64:FF30 push dword ptr fs:[eax]
004A4312 |. 64:8920 mov dword ptr fs:[eax],esp
004A4315 |. 8BC7 mov eax,edi ; * Reference to: System.@LStrClr(void;void);
004A4317 |. E8 34FEF5FF call mp4格式?00404150
004A431C |. 8D95 D4EFFFFF lea edx,[local.1035]
004A4322 |. 33C0 xor eax,eax
004A4324 |. E8 9BE7F5FF call mp4格式?00402AC4 ; * Reference to: System.ParamStr(Integer):String;取得程序绝对路径
004A4329 |. 8B85 D4EFFFFF mov eax,[local.1035] ; local存放绝对路径文件名
004A432F |. 8D55 D8 lea edx,[local.10]
004A4332 |. E8 FD49F6FF call mp4格式?00408D34 ; * Reference to: SysUtils.ExtractFileName(AnsiString):AnsiString;
004A4337 |. 6A 00 push 0
004A4339 |. 6A 00 push 0
004A433B |. 6A 00 push 0
004A433D |. 6A 00 push 0
004A433F |. 8B45 D8 mov eax,[local.10] ; local10存放文件名
004A4342 |. E8 C902F6FF call mp4格式?00404610 ; * Reference to: System.@LStrToPChar(String):PAnsiChar;
004A4347 |. 50 push eax //这行以上的内容，似乎没什么用
004A4348 |. E8 F7BEF8FF call <jmp.&wininet.InternetOpenA> ; 初始化WININET.DLL。它在其他的Win32网络函数之前被调用。
004A434D |. 8BD8 mov ebx,eax ; 返回的一个类型为HINTERNET的句柄
004A434F |. 85DB test ebx,ebx
004A4351 |. 0F84 8A010000 je mp4格式?004A44E1 ; 失败，退出
004A4357 |. 6A 00 push 0
004A4359 |. 6A 00 push 0
004A435B |. 6A 03 push 3
004A435D |. 6A 00 push 0
004A435F |. 6A 00 push 0
004A4361 |. 56 push esi
004A4362 |. 8B45 FC mov eax,[local.1] ; taobao.fstgw.com
004A4365 |. E8 A602F6FF call mp4格式?00404610 ; * Reference to: System.@LStrToPChar(String):PAnsiChar;
004A436A |. 50 push eax
004A436B |. 53 push ebx
004A436C |. E8 CBBEF8FF call <jmp.&wininet.InternetConnectA> ; 函数连接到一个HTTP，FTP或Gopher服务器
004A4371 |. 8BF0 mov esi,eax ; 返回值
004A4373 |. 85F6 test esi,esi
004A4375 |. 0F84 60010000 je mp4格式?004A44DB
004A437B |. 6A 00 push 0
004A437D |. 68 00000080 push 80000000
004A4382 |. 6A 00 push 0
004A4384 |. 6A 00 push 0
004A4386 |. 68 3C454A00 push mp4格式?004A453C ; HTTP/1.0
004A438B |. 8B45 F8 mov eax,[local.2]
004A438E |. E8 7D02F6FF call mp4格式?00404610 ; * Reference to: System.@LStrToPChar(String):PAnsiChar;
004A4393 |. 50 push eax
004A4394 |. 68 48454A00 push mp4格式?004A4548 ; POST
004A4399 |. 56 push esi
004A439A |. E8 85BEF8FF call <jmp.&wininet.HttpOpenRequestA> ; 创建一个请求句柄并且把参数存储在句柄中，即通知了服务器只有文本文件可以被接收。
004A439F |. 8945 F4 mov [local.3],eax ; local3里存储句柄
004A43A2 |. 837D F4 00 cmp [local.3],0
004A43A6 |. 0F84 29010000 je mp4格式?004A44D5 ; 创建失败，退出
004A43AC |. 8D45 EC lea eax,[local.5]
004A43AF |. BA 58454A00 mov edx,mp4格式?004A4558 ; Content-Type: application/x-www-form-urlencoded\r\n
004A43B4 |. E8 2FFEF5FF call mp4格式?004041E8 ; * Reference to: System.@LStrLAsg(void;void;void;void);
004A43B9 |. 68 000000A0 push A0000000
004A43BE |. 8B45 EC mov eax,[local.5]
004A43C1 |. E8 4A00F6FF call mp4格式?00404410 ; * Reference to: System.@LStrLen(String):Integer;
004A43C6 |. 50 push eax
004A43C7 |. 8B45 EC mov eax,[local.5]
004A43CA |. E8 4102F6FF call mp4格式?00404610 ; * Reference to: System.@LStrToPChar(String):PAnsiChar;
004A43CF |. 50 push eax
004A43D0 |. 8B45 F4 mov eax,[local.3]
004A43D3 |. 50 push eax
004A43D4 |. E8 43BEF8FF call <jmp.&wininet.HttpAddRequestHeadersA>
004A43D9 |. 83F8 01 cmp eax,1
004A43DC |. 1BC0 sbb eax,eax
004A43DE |. 40 inc eax
004A43DF |. 8845 F3 mov byte ptr ss:[ebp-D],al
004A43E2 |. 8BC7 mov eax,edi
004A43E4 |. E8 67FDF5FF call mp4格式?00404150 ; * Reference to: System.@LStrClr(void;void);
004A43E9 |. 807D F3 00 cmp byte ptr ss:[ebp-D],0
004A43ED |. 0F84 D9000000 je mp4格式?004A44CC
004A43F3 |. 8D45 E8 lea eax,[local.6] ; local6：DVJ
004A43F6 |. 8B55 0C mov edx,[arg.2] ; ASCII "password=1233"
004A43F9 |. E8 EAFDF5FF call mp4格式?004041E8 ; * Reference to: System.@LStrLAsg(void;void;void;void);
004A43FE |. 8B45 E8 mov eax,[local.6]
004A4401 |. E8 0A00F6FF call mp4格式?00404410 ; * Reference to: System.@LStrLen(String):Integer;
004A4406 |. 8945 E0 mov [local.8],eax ; local8=length（password=1233）
004A4409 |. 8B45 E0 mov eax,[local.8]
004A440C |. 50 push eax ; local6=password=1233
004A440D |. 8B45 E8 mov eax,[local.6] ; * Reference to: System.@LStrToPChar(String):PAnsiChar;
004A4410 |. E8 FB01F6FF call mp4格式?00404610 ; exa！=0
004A4415 |. 50 push eax
004A4416 |. 6A 00 push 0
004A4418 |. 6A 00 push 0
004A441A |. 8B45 F4 mov eax,[local.3]
004A441D |. 50 push eax
004A441E |. E8 09BEF8FF call <jmp.&wininet.HttpSendRequestA>
004A4423 |. 83F8 01 cmp eax,1
004A4426 |. 1BC0 sbb eax,eax
004A4428 |. 40 inc eax
004A4429 |. 8845 F3 mov byte ptr ss:[ebp-D],al
004A442C |. 807D F3 00 cmp byte ptr ss:[ebp-D],0
004A4430 |. 0F84 96000000 je mp4格式?004A44CC
004A4436 |. C645 F2 01 mov byte ptr ss:[ebp-E],1
004A443A |. 56 push esi
004A443B |. 57 push edi
004A443C |. BE 8C454A00 mov esi,mp4格式?004A458C
004A4441 |. 8DBD D8EFFFFF lea edi,[local.1034]
004A4447 |. B9 00040000 mov ecx,400
004A444C |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[es>
004A444E |. 5F pop edi
004A444F |. 5E pop esi
004A4450 |. EB 6A jmp short mp4格式?004A44BC
004A4452 |> 8D45 DC /lea eax,[local.9]
004A4455 |. 50 |push eax
004A4456 |. 68 00100000 |push 1000
004A445B |. 8D85 D8EFFFFF |lea eax,[local.1034] ; E2D45534CC3E7B8B1B7715713BC2E036
004A4461 |. 50 |push eax
004A4462 |. 8B45 F4 |mov eax,[local.3]
004A4465 |. 50 |push eax
004A4466 |. E8 E1BDF8FF |call <jmp.&wininet.InternetReadFile>
004A446B |. 83F8 01 |cmp eax,1
004A446E |. 1BC0 |sbb eax,eax
004A4470 |. 40 |inc eax
004A4471 |. 8845 F2 |mov byte ptr ss:[ebp-E],al
004A4474 |. 8D85 D0EFFFFF |lea eax,[local.1036]
004A447A |. 50 |push eax
004A447B |. 8D85 CCEFFFFF |lea eax,[local.1037]
004A4481 |. 8D95 D8EFFFFF |lea edx,[local.1034]
004A4487 |. B9 00100000 |mov ecx,1000
004A448C |. E8 2FFFF5FF |call mp4格式?004043C0 ; * Reference to: System.@LStrFromArray(String;String;PAnsiChar;Integer);
004A4491 |. 8B85 CCEFFFFF |mov eax,[local.1037]
004A4497 |. 8B4D DC |mov ecx,[local.9] ; 长度？
004A449A |. BA 01000000 |mov edx,1
004A449F |. E8 CC01F6FF |call mp4格式?00404670 ; * Reference to: System.@LStrCopy;
004A44A4 |. 8B95 D0EFFFFF |mov edx,[local.1036]
004A44AA |. 8D45 E4 |lea eax,[local.7]
004A44AD |. E8 66FFF5FF |call mp4格式?00404418 ; * Reference to: System.@LStrCat;
004A44B2 |. 837D DC 00 |cmp [local.9],0
004A44B6 |. 75 04 |jnz short mp4格式?004A44BC
004A44B8 |. C645 F2 00 |mov byte ptr ss:[ebp-E],0
004A44BC |> 807D F2 00 cmp byte ptr ss:[ebp-E],0
004A44C0 |.^ 75 90 \jnz short mp4格式?004A4452
004A44C2 |. 8BC7 mov eax,edi
004A44C4 |. 8B55 E4 mov edx,[local.7]
004A44C7 |. E8 D8FCF5FF call mp4格式?004041A4 ; * Reference to: System.@LStrAsg(void;void;void;void);
004A44CC |> 8B45 F4 mov eax,[local.3]
004A44CF |. 50 push eax
004A44D0 |. E8 5FBDF8FF call <jmp.&wininet.InternetCloseHandle>
004A44D5 |> 56 push esi
004A44D6 |. E8 59BDF8FF call <jmp.&wininet.InternetCloseHandle>
004A44DB |> 53 push ebx
004A44DC |. E8 53BDF8FF call <jmp.&wininet.InternetCloseHandle>
004A44E1 |> 33C0 xor eax,eax
004A44E3 |. 5A pop edx
004A44E4 |. 59 pop ecx
004A44E5 |. 59 pop ecx
004A44E6 |. 64:8910 mov dword ptr fs:[eax],edx
004A44E9 |. 68 30454A00 push mp4格式?004A4530
004A44EE |> 8D85 CCEFFFFF lea eax,[local.1037]
004A44F4 |. BA 03000000 mov edx,3
004A44F9 |. E8 76FCF5FF call mp4格式?00404174 ; 下面的都是结束处理
004A44FE |. 8D45 D8 lea eax,[local.10]
004A4501 |. E8 4AFCF5FF call mp4格式?00404150
算法分析。
验证方式使用了 f(注册码）= f(网络返回的值)
过程为：
对注册码进行了两次加密
1、str1=注册码；
2、str1=g1+str1+I1ls
3、str1=MD5（str1）；
4、str1=UpperCase（str1）//全部转换为大写
5、str1=I1ls+str1+g1
6、str1=MD5（str1）；
7、str1=UpperCase（str1）//全部转换为大写
从网络获取了一个字符串str2=E2D45534CC3E7B8B1B7715713BC2E036
1、str2=I1ls+str2+g1
2、str2=MD5（str2）；
3、str2=UpperCase（str2）//全部转换为大写
然后比较str1与str2
对网络编程不熟悉，猜测应该是传递一个字符串给taobao.fstgw.com中的/d.asp处理，但是没有找到相关位置。
PS：点击主界面中的注册按钮时，会到c盘根目录查找msisnet.dll文件。这实际就是一个文本文件。跟踪代码发现，只要在文件中写入一个0，就表示注册成功了。
PS2：Delphi的程序怎么修改呢？比如这个程序标题是： mp4格式转换器 email xxxxx@163.com。怎么改这个标题？
- 标 题：mp4格式转换器注册算法分析，顺便请教个问题
- 作 者：darksied
- 时 间：2011-07-18 17:58:23
- 链 接：http://bbs.pediy.com/showthread.php?t=137376
