<span class="pediy"><span class="pediy">
to PowerBoy: 看来你对这个也有兴趣了，好，朋友们大家一起来。
以下是我对3.29注册算法的分析：
点“注册”以后有两次对注册码的验算，第一次为：
0050930F mov edx,dword ptr ss:[ebp-74] 注册码
00509312 mov ecx,cr-un-Go.00509480 ; ASCII "111"
00509317 mov eax,dword ptr ss:[ebp-10] 申请码加姓加公司名后缀中的两位
0050931A call cr-un-Go.004E1BBC <====关键call之一，比较注册码的后7位，正确时写入注册表
0050931F mov byte ptr ss:[ebp-5],al 存结果
00509322 cmp byte ptr ss:[ebp-5],0 检查结果
00509326 je short cr-un-Go.00509368
第二次为：
0050935D mov edx,dword ptr ss:[ebp-80] 注册码
00509360 mov eax,dword ptr ss:[ebp-10] 申请码加姓加公司名后缀中的两位
00509363 call cr-un-Go.004E17B0 <====关键call之二，比较注册码的前16位，不对的话注册表又被更改
跟进0050931A call cr-un-Go.004E1BBC：
004E1C36 mov ecx,eax
004E1C38 xor eax,eax
004E1C3A mov al,cl 申请码加姓的一位
004E1C3C imul dword ptr ss:[ebp-18] 乘以上次的余数
004E1C3F add eax,68911 加上常数68911
004E1C44 mov ecx,0F4240
004E1C49 xor edx,edx
004E1C4B div ecx 除以常数0F4240
004E1C4D mov dword ptr ss:[ebp-18],edx 存余数
004E1C50 inc ebx
004E1C51 xor eax,eax
004E1C53 mov al,bl
004E1C55 mov edx,dword ptr ss:[ebp-4]
004E1C58 mov al,byte ptr ds:[edx+eax-1] 取申请码加姓的一位，即取"25963613朱"的一位
004E1C5C test al,al
004E1C5E jnz short un-GoodN.004E1C36
004E1C60 mov eax,dword ptr ss:[ebp-18] 上面的结果：000EFC95
004E1C63 xor edx,edx
004E1C65 push edx ; /Arg2 => 00000000
004E1C66 push eax ; |Arg1
004E1C67 lea eax,dword ptr ss:[ebp-30] ; |
004E1C6A call un-GoodN.00408F6C ; \按10进制打印上面的结果，得到"982165"
004E1C6F lea edx,dword ptr ss:[ebp-44]
004E1C72 mov eax,dword ptr ss:[ebp-30]
004E1C75 call un-GoodN.00408B18 复制"982165"
004E1C7A mov edx,dword ptr ss:[ebp-44]
004E1C7D lea eax,dword ptr ss:[ebp-30]
004E1C80 call un-GoodN.0040435C 没看出什么变化
004E1C85 mov dword ptr ss:[ebp-40],28753F59
004E1C8C mov dword ptr ss:[ebp-3C],20681261
004E1C93 mov dword ptr ss:[ebp-38],2A316962
004E1C9A mov dword ptr ss:[ebp-34],2E311871
004E1CA1 xor esi,esi
004E1CA3 mov bl,4
004E1CA5 xor eax,eax
004E1CA7 mov al,bl
004E1CA9 mov edx,dword ptr ss:[ebp-4]
004E1CAC movzx eax,byte ptr ds:[edx+eax-1] 取申请码加姓的一位，但从第四位开始取
004E1CB1 add esi,eax
004E1CB3 shl esi,8
004E1CB6 dec ebx
004E1CB7 cmp bl,1
004E1CBA jnz short un-GoodN.004E1CA5
004E1CBC mov eax,dword ptr ss:[ebp-4]
004E1CBF movzx eax,byte ptr ds:[eax]
004E1CC2 add esi,eax 到此取出申请码的前四位36393532，存于esi中
004E1CC4 xor edi,edi
004E1CC6 mov bl,8
004E1CC8 xor eax,eax
004E1CCA mov al,bl
004E1CCC mov edx,dword ptr ss:[ebp-4]
004E1CCF movzx eax,byte ptr ds:[edx+eax-1]
004E1CD4 add edi,eax
004E1CD6 shl edi,8
004E1CD9 dec ebx
004E1CDA cmp bl,5
004E1CDD jnz short un-GoodN.004E1CC8
004E1CDF mov eax,dword ptr ss:[ebp-4]
004E1CE2 movzx eax,byte ptr ds:[eax+4]
004E1CE6 add edi,eax 到此取出申请码的后四位33313633，存于edi中
004E1CE8 xor eax,eax
004E1CEA mov dword ptr ss:[ebp-18],eax
004E1CED lea edx,dword ptr ss:[ebp-58]
004E1CF0 mov eax,un-GoodN.004E248C ; ASCII "718B1C252E2F7E5E8F6328ED65617C95B47DAF"
004E1CF5 call un-GoodN.004DCB68 计算004DCB68，得一数
004E1CFA lea eax,dword ptr ss:[ebp-58]
004E1CFD lea edx,dword ptr ss:[ebp-48]
004E1D00 call un-GoodN.004DCBDC 变换04DCBDC，得一字符串"AStCa3pYweA0PZWK"
004E1D05 mov bl,20
004E1D07 add dword ptr ss:[ebp-18],9E3719B5
004E1D0E mov eax,edi
004E1D10 shl eax,4
004E1D13 add esi,eax
004E1D15 mov eax,dword ptr ss:[ebp-3C]
004E1D18 xor eax,edi
004E1D1A add esi,eax
004E1D1C mov eax,edi
004E1D1E shr eax,5
004E1D21 xor eax,dword ptr ss:[ebp-18]
004E1D24 add esi,eax
004E1D26 add esi,dword ptr ss:[ebp-40]
004E1D29 mov eax,esi
004E1D2B shl eax,4
004E1D2E add edi,eax
004E1D30 mov eax,dword ptr ss:[ebp-34]
004E1D33 xor eax,esi
004E1D35 add edi,eax
004E1D37 mov eax,esi
004E1D39 shr eax,5
004E1D3C xor eax,dword ptr ss:[ebp-18]
004E1D3F add edi,eax
004E1D41 add edi,dword ptr ss:[ebp-38]
004E1D44 dec bl
004E1D46 jnz short un-GoodN.004E1D07 循环对esi、edi中的申请码计算
004E1D48 mov eax,esi
004E1D4A and eax,3FFFFFFF
004E1D4F add eax,2
004E1D52 xor edx,edx
004E1D54 mov dword ptr ss:[ebp-20],eax 存申请码变换结果
004E1D57 mov dword ptr ss:[ebp-1C],edx 存申请码变换结果
004E1D5A mov eax,esi
004E1D5C shr eax,1E
004E1D5F add eax,24F80050
004E1D64 add eax,2
004E1D67 xor edx,edx
004E1D69 mov dword ptr ss:[ebp-28],eax 存申请码变换结果
004E1D6C mov dword ptr ss:[ebp-24],edx 存申请码变换结果
004E1D6F push dword ptr ss:[ebp-1C] ; /Arg2
004E1D72 push dword ptr ss:[ebp-20] ; |Arg1
004E1D75 call un-GoodN.004E0E00 ; \un-GoodN.004E0E00 计算
004E1D7A mov dword ptr ss:[ebp-20],eax 存结果
004E1D7D mov dword ptr ss:[ebp-1C],edx
004E1D80 push dword ptr ss:[ebp-24] ; /Arg2
004E1D83 push dword ptr ss:[ebp-28] ; |Arg1
004E1D86 call un-GoodN.004E0E00 ; \un-GoodN.004E0E00 计算
004E1D8B mov dword ptr ss:[ebp-28],eax 存结果
004E1D8E mov dword ptr ss:[ebp-24],edx
004E1D91 lea edx,dword ptr ss:[ebp-58]
004E1D94 mov eax,un-GoodN.004E24BC ;ASCII "CCB3EF10FF82041FEC05EBCB3B523362992AB75ADD33CF49F"
004E1D99 call un-GoodN.004DCB68 计算004DCB68，得一数
004E1D9E lea eax,dword ptr ss:[ebp-58]
004E1DA1 lea edx,dword ptr ss:[ebp-5C]
004E1DA4 call un-GoodN.004DCBDC 变换004DCBDC，得一字符串 "wsra022ajLlcEEW9"
004E1DA9 push dword ptr ss:[ebp-24] ; /Arg2
004E1DAC push dword ptr ss:[ebp-28] ; |Arg1
004E1DAF lea edx,dword ptr ss:[ebp-64] ; |
004E1DB2 mov eax,8 ; |
004E1DB7 call un-GoodN.00408FBC ; \un-GoodN.00408FBC 按16进制打印
004E1DBC mov eax,dword ptr ss:[ebp-64] 打印的结果 "50E5BF2B"
004E1DBF lea edx,dword ptr ss:[ebp-60]
004E1DC2 call un-GoodN.00408B18 复制 "50E5BF2B"
004E1DC7 mov eax,dword ptr ss:[ebp-60]
004E1DCA push eax
004E1DCB push dword ptr ss:[ebp-1C] ; /Arg2
004E1DCE push dword ptr ss:[ebp-20] ; |Arg1
004E1DD1 lea edx,dword ptr ss:[ebp-6C] ; |
004E1DD4 mov eax,8 ; |
004E1DD9 call un-GoodN.00408FBC ; \un-GoodN.00408FBC 按16进制打印
004E1DDE mov eax,dword ptr ss:[ebp-6C] 打印的结果 "5B6BCC3D"
004E1DE1 lea edx,dword ptr ss:[ebp-68]
004E1DE4 call un-GoodN.00408B18 复制 "5B6BCC3D"
004E1DE9 mov edx,dword ptr ss:[ebp-68]
004E1DEC lea eax,dword ptr ss:[ebp-2C]
004E1DEF pop ecx
004E1DF0 call un-GoodN.004045D0 连接字符串
004E1DF5 lea ecx,dword ptr ss:[ebp-70]
004E1DF8 mov eax,dword ptr ss:[ebp-2C] 连接的结果 "5B6BCC3D50E5BF2B"
004E1DFB mov dl,byte ptr ds:[eax+2] '6'
004E1DFE mov eax,dword ptr ss:[ebp-2C]
004E1E01 call un-GoodN.004E29C4 去掉其中的'6'，得到"5BBCC3D50E5BF2B"
004E1E06 mov edx,dword ptr ss:[ebp-70]
004E1E09 lea eax,dword ptr ss:[ebp-2C]
004E1E0C call un-GoodN.0040435C 没看出什么变化
004E1E11 lea ecx,dword ptr ss:[ebp-74]
004E1E14 mov edx,dword ptr ss:[ebp-30] 最开始的变换结果 "982165"
004E1E17 mov eax,dword ptr ss:[ebp-2C] 上面的结果 "5BBCC3D50E5BF2B"
004E1E1A call un-GoodN.004DD8E8 字符串变换 得到"FC3C63988AAA46B00FF5D5DB8131CD3F"
004E1E1F mov edx,dword ptr ss:[ebp-74]
004E1E22 lea eax,dword ptr ss:[ebp-30]
004E1E25 call un-GoodN.0040435C
004E1E2A lea ecx,dword ptr ss:[ebp-78]
004E1E2D mov eax,dword ptr ss:[ebp-30]
004E1E30 mov dl,byte ptr ds:[eax+D] '6'
004E1E33 mov eax,dword ptr ss:[ebp-30] 字符串 "FC3C63988AAA46B00FF5D5DB8131CD3F"
004E1E36 call un-GoodN.004E29C4 去掉其中的'6'得"FC3C3988AAA4B00FF5D5DB8131CD3F"
004E1E3B mov edx,dword ptr ss:[ebp-78]
004E1E3E lea eax,dword ptr ss:[ebp-30]
004E1E41 call un-GoodN.0040435C
004E1E46 mov eax,dword ptr ds:[51B81C]
004E1E4B mov eax,dword ptr ds:[eax]
004E1E4D mov eax,dword ptr ds:[eax+430]
004E1E53 cmp byte ptr ds:[eax+40],0
004E1E57 je un-GoodN.004E239D
以上是对申请码进行变换，很长，不必求逆。
004E1E5D lea edx,dword ptr ss:[ebp-2C] 结果的地址 "42318675423186754231576"
004E1E60 mov eax,dword ptr ss:[ebp-8] 注册码 "12345678123456781234567"
004E1E63 call un-GoodN.004E2744 注册码变换 变换方法1-4，5-8 9-12 13-16 17-20 22-23 位互换
004E1E94 lea eax,dword ptr ss:[ebp-80] 跳到这儿
004E1E97 push eax
004E1E98 lea eax,dword ptr ss:[ebp-84]
004E1E9E mov ecx,un-GoodN.004E2504 ; ASCII " "
004E1EA3 mov edx,dword ptr ss:[ebp-2C] "42318675423186754231576"
004E1EA6 call un-GoodN.004045D0 加5个空格，变成 "42318675423186754231576 "
004E1EAB mov eax,dword ptr ss:[ebp-84]
004E1EB1 mov ecx,7
004E1EB6 mov edx,11
004E1EBB call un-GoodN.004047E4 从第17位开始取7位，得"4231576"
004E1EC0 mov eax,dword ptr ss:[ebp-80] "4231576"
004E1EC3 lea ecx,dword ptr ss:[ebp-7C]
004E1EC6 mov edx,un-GoodN.004E2514 常数"34A5CC48D1AB3"
004E1ECB call un-GoodN.004DD8E8 字符串变换，得 "D27394B424FD17B0"
004E1ED0 mov eax,dword ptr ss:[ebp-7C] "D27394B424FD17B0"
004E1ED3 push eax 入栈
以上是对注册码进行变换，只取其后7位进行验证。
004E1ED4 lea eax,dword ptr ss:[ebp-8C]
004E1EDA push eax
004E1EDB lea eax,dword ptr ss:[ebp-90]
004E1EE1 mov ecx,un-GoodN.004E252C ; ASCII "2AB75ADD"
004E1EE6 mov edx,dword ptr ss:[ebp-30] 申请码结果"FC3C3988AAA4B00FF5D5DB8131CD3F"
004E1EE9 call un-GoodN.004045D0 连接成 "FC3C3988AAA4B00FF5D5DB8131CD3F2AB75ADD"
004E1EEE mov eax,dword ptr ss:[ebp-90]
004E1EF4 mov ecx,7
004E1EF9 mov edx,1
004E1EFE call un-GoodN.004047E4 取前7位得 "FC3C398"
004E1F03 mov eax,dword ptr ss:[ebp-8C] ASCII "FC3C398"
004E1F09 lea ecx,dword ptr ss:[ebp-88]
004E1F0F mov edx,un-GoodN.004E2514 ; ASCII "34A5CC48D1AB3"
004E1F14 call un-GoodN.004DD8E8 字符串变换，得 "EF9F176831E87F88"
004E1F19 mov edx,dword ptr ss:[ebp-88] 申请码结果"EF9F176831E87F88"
004E1F1F pop eax 注册码结果"9E4165ADC409583C"
004E1F20 call un-GoodN.004046D0 <====关键比较，字符串比较
004E1F25 jnz un-GoodN.004E2382 关键跳，这儿不跳就会将信息写入注册表
[分析]
调位后的注册码后7位和申请码变码的前7位经相同的变换然后比较是否相同，可以推断，如果它们本身相等，则变换后的结果肯定相等，因此调位后的后7位就是"FC3C398"。
关键call之二：
004E180C lea edx,dword ptr ss:[ebp-28]
004E180F mov eax,un-GoodN.004E1B00 ; ASCII "97D31761231075EDB894FF0ADB7"
004E1814 call un-GoodN.004DCB68 字符串常数变成数
004E1819 lea eax,dword ptr ss:[ebp-28]
004E181C lea edx,dword ptr ss:[ebp-18]
004E181F call un-GoodN.004DCBDC 数变成一个新的字符串"TgdJVMAiTSOATA3i"
004E1824 lea edx,dword ptr ss:[ebp-28]
004E1827 mov eax,un-GoodN.004E1B24 ; ASCII "F7C2D6309172AEB32AB5F063061034A5CC48D1AB3"
004E182C call un-GoodN.004DCB68 字符串常数变成数
004E1831 lea eax,dword ptr ss:[ebp-28]
004E1834 lea edx,dword ptr ss:[ebp-2C]
004E1837 call un-GoodN.004DCBDC 数变成一个新的字符串"A0HZK47KDAqB0Dxk"
004E183C lea edx,dword ptr ss:[ebp-28]
004E183F mov eax,dword ptr ss:[ebp-4] 申请码加姓
004E1842 call un-GoodN.004DCB68 算出一个数
004E1847 lea eax,dword ptr ss:[ebp-28]
004E184A lea edx,dword ptr ss:[ebp-10]
004E184D call un-GoodN.004DCBDC 得到字符串[ebp-10]->"HpSdQp99TTmmaZiW"
004E1852 lea edx,dword ptr ss:[ebp-28]
004E1855 mov eax,un-GoodN.004E1B58 ; ASCII "ACB1920BA09950750056A8A047A5"
004E185A call un-GoodN.004DCB68
004E185F lea eax,dword ptr ss:[ebp-28]
004E1862 lea edx,dword ptr ss:[ebp-30]
004E1865 call un-GoodN.004DCBDC 又得到一个字符串"A1SNrtrHV0DqGV1Q"
004E186A lea edx,dword ptr ss:[ebp-14]
004E186D mov eax,dword ptr ss:[ebp-8]
004E1870 call un-GoodN.004E2744 注册码各位调整得 "42318675423186754231576" 方法同上
004E1875 lea eax,dword ptr ss:[ebp-14]
004E1878 push eax
004E1879 mov ecx,10
004E187E mov edx,1
004E1883 mov eax,dword ptr ss:[ebp-14]
004E1886 call un-GoodN.004047E4 取调整位置后的注册码的前16位"4231867542318675"
004E188B lea ecx,dword ptr ss:[ebp-34]
004E188E mov edx,dword ptr ss:[ebp-10] 申请码结果"HpSdQp99TTmmaZiW"
004E1891 mov eax,dword ptr ss:[ebp-14] 注册码结果"4231867542318675"
004E1894 call un-GoodN.004DDAD0 计算得一个数 C9 7A B7 7A 59 EC FD 27
004E1899 mov eax,dword ptr ss:[ebp-34]
004E189C lea edx,dword ptr ss:[ebp-28]
004E189F call un-GoodN.004DCB68 计算得数1
EBP-28 > 4C535DA6
EBP-24 > E19F86CE
EBP-20 > 9ED97FF4
EBP-1C > 6E611BC5
004E18A4 lea eax,dword ptr ss:[ebp-28]
004E18A7 push eax 数1入栈
004E18A8 lea edx,dword ptr ss:[ebp-44]
004E18AB mov eax,un-GoodN.004E1B80 内部常数 02 2D 9B 1D 05 1E 19 48
004E18B0 call un-GoodN.004DCB68 变换，得到
EBP-44 > 0AE260A7
EBP-40 > CD5125BB
EBP-3C > 3AB49665
EBP-38 > 3B24DC3D
004E18B5 lea eax,dword ptr ss:[ebp-44] 常数变来的数
004E18B8 pop edx 数1出栈
004E18B9 call un-GoodN.004DCC58 <====关键比较，大数比较，不相等就会把注册信息修改
004E18BE mov byte ptr ss:[ebp-9],al 存结果，作为一个标志
[分析]
注册码前16位与申请码结果运算结果和内部常数作相同的变换，再比较是否相等，因此它们本身是应该相等的。即004E1894 call un-GoodN.004DDAD0一步的结果应为 02 2D 9B 1D 05 1E 19 48。
到这里为止，想跟出注册码关键是对call un-GoodN.004DDAD0求逆，而这个就是又臭又长的计算啦。
