<span class="pediy"><span class="pediy">
修改现有程序成KEYGEN
dOsKey[Nuke Group]
做过KEYGEN的CRACKER可以都遇到过这种情况：生成注册码的算法十分复杂。虽然可以逆向分析出整个算法，但是需要很长时间。而程序内部已经包含了算注册码的函数的时候，我们可以使用程序内部的算码函数来实现我们自己的KEYGEN，以达到四两拨千斤的效果。
目标程序是某个国产手机写码软件。第一次运行的时候程序要求输入根据机器码得来的用户名和注册码。用FI扫描后得知目标软件无壳，用VC6写的，目前很少国产软件不加壳了，看来我们很幸运，省略了脱壳的步骤。接下来我们用OllyDbg载入目标软件，F9运行。在目标程序中输入用户名“DOSKEY”和注册码U20-111111111111，点OK，弹出有“注册失败！”的提示窗口。不管它，切换回OllyDbg按F12暂停在主线程。然后按CTRL+F12直到OllyDbg状态为“Till return”，切换回目标程序点消息框的确定按钮。目标程序的进程再次被OllyDbg暂停住，一直按CTRL+F12返回到主线程我们就来到这里：
代码:<hr> 0042675F /$ 55 <font color=#000099>PUSH <font color=#0000FF>EBP 00426760 |. 8BEC <font color=#000099>MOV <font color=#0000FF>EBP, <font color=#0000FF>ESP 00426762 |. E8 91140000 <font color=#000099>CALL 2210.00427BF8 00426767 |. 8B40 04 <font color=#000099>MOV <font color=#0000FF>EAX, <font color=#0000FF>DWORD <font color=#0000FF>PTR <font color=#0000FF>DS:[<font color=#0000FF>EAX+4] 0042676A |. 85C0 <font color=#000099>TEST <font color=#0000FF>EAX, <font color=#0000FF>EAX 0042676C |. 74 15 <font color=#000099>JE <font color=#0000FF>SHORT 2210.00426783 0042676E |. FF75 10 <font color=#000099>PUSH <font color=#0000FF>DWORD <font color=#0000FF>PTR <font color=#0000FF>SS:[<font color=#0000FF>EBP+10] 00426771 |. 8B10 <font color=#000099>MOV <font color=#0000FF>EDX, <font color=#0000FF>DWORD <font color=#0000FF>PTR <font color=#0000FF>DS:[<font color=#0000FF>EAX] 00426773 |. 8BC8 <font color=#000099>MOV <font color=#0000FF>ECX, <font color=#0000FF>EAX 00426775 |. FF75 0C <font color=#000099>PUSH <font color=#0000FF>DWORD <font color=#0000FF>PTR <font color=#0000FF>SS:[<font color=#0000FF>EBP+C] 00426778 |. FF75 08 <font color=#000099>PUSH <font color=#0000FF>DWORD <font color=#0000FF>PTR <font color=#0000FF>SS:[<font color=#0000FF>EBP+8] 0042677B |. FF92 8C000000 <font color=#000099>CALL <font color=#0000FF>DWORD <font color=#0000FF>PTR <font color=#0000FF>DS:[<font color=#0000FF>EDX+8C] 00426781 |. EB 10 <font color=#000099>JMP <font color=#0000FF>SHORT 2210.00426793 <= 返回到这里，上面就是调用MessageBox显示消息框的CALL 00426783 |> FF75 10 <font color=#000099>PUSH <font color=#0000FF>DWORD <font color=#0000FF>PTR <font color=#0000FF>SS:[<font color=#0000FF>EBP+10] ; /Arg3 00426786 |. 33C9 <font color=#000099>XOR <font color=#0000FF>ECX, <font color=#0000FF>ECX ; | 00426788 |. FF75 0C <font color=#000099>PUSH <font color=#0000FF>DWORD <font color=#0000FF>PTR <font color=#0000FF>SS:[<font color=#0000FF>EBP+C] ; |Arg2 0042678B |. FF75 08 <font color=#000099>PUSH <font color=#0000FF>DWORD <font color=#0000FF>PTR <font color=#0000FF>SS:[<font color=#0000FF>EBP+8] ; |Arg1 0042678E |. E8 E5FEFFFF <font color=#000099>CALL 2210.00426678 ; \2210.00426678 00426793 |> 5D <font color=#000099>POP <font color=#0000FF>EBP 00426794 \. C2 0C00 <font color=#000099>RETN 0C<hr>
