新手的破解: Composer for Ring Tone 手机铃声编辑软件 (24千字)
软件名称: Composer for Ring Tone软件 www.newhua.com
软件用途: 这个东东是大众软件03期中介绍的一个手机铃声编辑器,据说挺好用的,可惜对我没有!
工具: TRW2000 1.22 , W32dasm ,FileInfo v2.43
过程:
1) 用W32dasm反编译Ringtone.exe,结果如下:
2) bpx getwindowtexta
3) name:fengy
key :fengy-1980-1980314
* Referenced by a CALL at Addresses:
|:00415045 , :0041F277 , :0044A7F0 , :0044AA17 , :0044B730
|
:0043C91E 8B4138 mov eax, dword ptr [ecx+38]
:0043C921 85C0 test eax, eax
:0043C923 7513 jne 0043C938
:0043C925 FF742408 push [esp+08]
:0043C929 FF742408 push [esp+08]
:0043C92D FF711C push [ecx+1C]
* Reference To: USER32.GetWindowTextA, Ord:015Eh
|
:0043C930 FF1554A54600 Call dword ptr [0046A554] << get text for reg
:0043C936 EB12 jmp 0043C94A
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C923(C)
|
:0043C938 FF742408 push [esp+08]
:0043C93C 8B10 mov edx, dword ptr [eax]
:0043C93E 8BC8 mov ecx, eax
:0043C940 FF742408 push [esp+08]
:0043C944 FF9284000000 call dword ptr [edx+00000084]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C936(U)
|
:0043C94A C20800 ret 0008 << 41504A ret
****************************************************************
:00414FEF 90 nop
:00414FF0 6AFF push FFFFFFFF
:00414FF2 68386F4600 push 00466F38
:00414FF7 64A100000000 mov eax, dword ptr fs:[00000000]
:00414FFD 50 push eax
:00414FFE 64892500000000 mov dword ptr fs:[00000000], esp
:00415005 83EC20 sub esp, 00000020
:00415008 A1DC4E4800 mov eax, dword ptr [00484EDC]
:0041500D 53 push ebx
:0041500E 56 push esi
:0041500F 8BF1 mov esi, ecx
:00415011 89442408 mov dword ptr [esp+08], eax
:00415015 33DB xor ebx, ebx
:00415017 8D4C240C lea ecx, dword ptr [esp+0C]
:0041501B 895C2430 mov dword ptr [esp+30], ebx
:0041501F E8BCD9FEFF call 004029E0
:00415024 8B86D4000000 mov eax, dword ptr [esi+000000D4]
:0041502A C644243001 mov [esp+30], 01
:0041502F 83F803 cmp eax, 00000003
:00415032 0F8F90000000 jg 004150C8
:00415038 8D4C2418 lea ecx, dword ptr [esp+18]
:0041503C 6A0F push 0000000F
:0041503E 51 push ecx
:0041503F 8D8E98000000 lea ecx, dword ptr [esi+00000098]
:00415045 E8D4780200 call 0043C91E
:0041504A 8D542408 lea edx, dword ptr [esp+08] << after getwindowtexta
:0041504E 8D4E5C lea ecx, dword ptr [esi+5C]
:00415051 52 push edx
:00415052 E8E2520200 call 0043A339
:00415057 51 push ecx << bad regcode
:00415058 8D44240C lea eax, dword ptr [esp+0C] << [ecx]--> "fengy"
:0041505C 8BCC mov ecx, esp << eax ---> code length
:0041505E 89642414 mov dword ptr [esp+14], esp
:00415062 50 push eax
:00415063 E82A800200 call 0043D092
:00415068 8D4C241C lea ecx, dword ptr [esp+1C]
:0041506C 51 push ecx
:0041506D 8D4C2414 lea ecx, dword ptr [esp+14] << name : "fengy"
:00415071 E8AAD9FEFF call 00402A20 << 重要的call,注册码的生成和校验
:00415076 3BC3 cmp eax, ebx << 分界点(成功/失败)
:00415078 7448 je 004150C2
:0041507A 51 push ecx
:0041507B 8D54240C lea edx, dword ptr [esp+0C]
:0041507F 8BCC mov ecx, esp
:00415081 89642414 mov dword ptr [esp+14], esp
:00415085 52 push edx
:00415086 E807800200 call 0043D092
:0041508B 51 push ecx
:0041508C 8D442420 lea eax, dword ptr [esp+20]
:00415090 8BCC mov ecx, esp
:00415092 8964241C mov dword ptr [esp+1C], esp
:00415096 50 push eax
:00415097 C644243C02 mov [esp+3C], 02
:0041509C E8EA820200 call 0043D38B
:004150A1 8BCE mov ecx, esi
:004150A3 C644243801 mov [esp+38], 01
:004150A8 E863000000 call 00415110
:004150AD 53 push ebx
:004150AE 53 push ebx
* Possible Reference to Dialog:
|
:004150AF 6860454800 push 00484560 << "thank..."
:004150B4 E8E20F0300 call 0044609B
:004150B9 8BCE mov ecx, esi
:004150BB E845960200 call 0043E705
:004150C0 EB12 jmp 004150D4
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415078(C)
|
:004150C2 FF86D4000000 inc dword ptr [esi+000000D4]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415032(C)
|
:004150C8 53 push ebx
:004150C9 53 push ebx
* Possible Reference to Dialog:
|
:004150CA 6854454800 push 00484554 << "wrong key"
:004150CF E8C70F0300 call 0044609B
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004150C0(U)
|
:004150D4 8D4C240C lea ecx, dword ptr [esp+0C]
:004150D8 885C2430 mov byte ptr [esp+30], bl
:004150DC E82FD9FEFF call 00402A10
:004150E1 8D4C2408 lea ecx, dword ptr [esp+08]
:004150E5 C7442430FFFFFFFF mov [esp+30], FFFFFFFF
:004150ED E82B820200 call 0043D31D
:004150F2 8B4C2428 mov ecx, dword ptr [esp+28]
:004150F6 5E pop esi
:004150F7 64890D00000000 mov dword ptr fs:[00000000], ecx
:004150FE 5B pop ebx
:004150FF 83C42C add esp, 0000002C
:00415102 C3 ret
******************************************************************
* Referenced by a CALL at Addresses:
|:00415071 , :0041AA74
|
:00402A20 6AFF push FFFFFFFF
:00402A22 68C8594600 push 004659C8
:00402A27 64A100000000 mov eax, dword ptr fs:[00000000]
:00402A2D 50 push eax
:00402A2E 64892500000000 mov dword ptr fs:[00000000], esp
:00402A35 83EC0C sub esp, 0000000C
:00402A38 53 push ebx
:00402A39 55 push ebp
:00402A3A 56 push esi
:00402A3B 57 push edi
:00402A3C A1DC4E4800 mov eax, dword ptr [00484EDC]
:00402A41 C744242400000000 mov [esp+24], 00000000
:00402A49 89442410 mov dword ptr [esp+10], eax
:00402A4D 89442414 mov dword ptr [esp+14], eax
:00402A51 8B74242C mov esi, dword ptr [esp+2C] << esi -->name "fengy"
:00402A55 C644242402 mov [esp+24], 02
* Possible Reference to Dialog:
|
:00402A5A BF20364800 mov edi, 00483620 << "SpongeUk"
:00402A5F 8BC6 mov eax, esi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402A86(C)
|
:00402A61 8A10 mov dl, byte ptr [eax]
:00402A63 8A1F mov bl, byte ptr [edi]
:00402A65 8ACA mov cl, dl
:00402A67 83CDFF or ebp, FFFFFFFF
:00402A6A 3AD3 cmp dl, bl <<'f' cmp 'S'
:00402A6C 751E jne 00402A8C << jmp
:00402A6E 84C9 test cl, cl
:00402A70 7416 je 00402A88
:00402A72 8A5001 mov dl, byte ptr [eax+01]
:00402A75 8A5F01 mov bl, byte ptr [edi+01]
:00402A78 8ACA mov cl, dl
:00402A7A 3AD3 cmp dl, bl
:00402A7C 750E jne 00402A8C
:00402A7E 83C002 add eax, 00000002
:00402A81 83C702 add edi, 00000002
:00402A84 84C9 test cl, cl
:00402A86 75D9 jne 00402A61
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402A70(C)
|
:00402A88 33C0 xor eax, eax
:00402A8A EB04 jmp 00402A90
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402A6C(C), :00402A7C(C)
|
:00402A8C 1BC0 sbb eax, eax
:00402A8E 1BC5 sbb eax, ebp
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402A8A(U)
|
:00402A90 85C0 test eax, eax << eax =01
:00402A92 7569 jne 00402AFD << jmp
:00402A94 8B442430 mov eax, dword ptr [esp+30]
* Possible StringData Ref from Data Obj ->"YTNAGO-29775-5868020"
|
:00402A98 BF08364800 mov edi, 00483608
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402ABF(C)
|
:00402A9D 8A10 mov dl, byte ptr [eax]
:00402A9F 8A1F mov bl, byte ptr [edi]
:00402AA1 8ACA mov cl, dl
:00402AA3 3AD3 cmp dl, bl
:00402AA5 751E jne 00402AC5
:00402AA7 84C9 test cl, cl
:00402AA9 7416 je 00402AC1
:00402AAB 8A5001 mov dl, byte ptr [eax+01]
:00402AAE 8A5F01 mov bl, byte ptr [edi+01]
:00402AB1 8ACA mov cl, dl
:00402AB3 3AD3 cmp dl, bl
:00402AB5 750E jne 00402AC5
:00402AB7 83C002 add eax, 00000002
:00402ABA 83C702 add edi, 00000002
:00402ABD 84C9 test cl, cl
:00402ABF 75DC jne 00402A9D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402AA9(C)
|
:00402AC1 33C0 xor eax, eax
:00402AC3 EB04 jmp 00402AC9
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402AA5(C), :00402AB5(C)
|
:00402AC5 1BC0 sbb eax, eax
:00402AC7 1BC5 sbb eax, ebp
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402AC3(U)
|
:00402AC9 85C0 test eax, eax
:00402ACB 7530 jne 00402AFD
:00402ACD 8D4C2414 lea ecx, dword ptr [esp+14]
:00402AD1 C644242401 mov [esp+24], 01
:00402AD6 E842A80300 call 0043D31D
:00402ADB 8D4C2410 lea ecx, dword ptr [esp+10]
:00402ADF C644242400 mov [esp+24], 00
:00402AE4 E834A80300 call 0043D31D
:00402AE9 8D4C2430 lea ecx, dword ptr [esp+30]
:00402AED 896C2424 mov dword ptr [esp+24], ebp
:00402AF1 E827A80300 call 0043D31D
:00402AF6 8BC5 mov eax, ebp
:00402AF8 E92A020000 jmp 00402D27
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402A92(C), :00402ACB(C)
|
* Possible Reference to Dialog:
|
:00402AFD BF20774800 mov edi, 00487720 << move [edi] = 0x0
:00402B02 8BC6 mov eax, esi << [eax]->"fengy"
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402B26(C)
|
:00402B04 8A10 mov dl, byte ptr [eax]
:00402B06 8A1F mov bl, byte ptr [edi]
:00402B08 8ACA mov cl, dl
:00402B0A 3AD3 cmp dl, bl <<dl 'f' cmp bl 0x0
:00402B0C 751E jne 00402B2C << jmp
:00402B0E 84C9 test cl, cl
:00402B10 7416 je 00402B28
:00402B12 8A5001 mov dl, byte ptr [eax+01]
:00402B15 8A5F01 mov bl, byte ptr [edi+01]
:00402B18 8ACA mov cl, dl
:00402B1A 3AD3 cmp dl, bl
:00402B1C 750E jne 00402B2C
:00402B1E 83C002 add eax, 00000002
:00402B21 83C702 add edi, 00000002
:00402B24 84C9 test cl, cl
:00402B26 75DC jne 00402B04
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402B10(C)
|
:00402B28 33C0 xor eax, eax
:00402B2A EB04 jmp 00402B30
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402B0C(C), :00402B1C(C)
|
:00402B2C 1BC0 sbb eax, eax
:00402B2E 1BC5 sbb eax, ebp
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402B2A(U)
|
:00402B30 85C0 test eax, eax << eax =01
:00402B32 0F84C4010000 je 00402CFC << no jmp
:00402B38 8A4E01 mov cl, byte ptr [esi+01] << "fengy" ->'e'
:00402B3B 8A5602 mov dl, byte ptr [esi+02] << "fengy" ->'n'
:00402B3E 3ACA cmp cl, dl
:00402B40 750D jne 00402B4F << jmp
:00402B42 8A06 mov al, byte ptr [esi]
:00402B44 8A5E03 mov bl, byte ptr [esi+03]
:00402B47 3AC3 cmp al, bl
:00402B49 0F84AD010000 je 00402CFC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402B40(C)
|
:00402B4F 0FBE06 movsx eax, byte ptr [esi] << 'f' 0x66
:00402B52 0FBEC9 movsx ecx, cl << ecx = 'e'0x65
:00402B55 8D0480 lea eax, dword ptr [eax+4*eax] << 0x1FE
:00402B58 8D0480 lea eax, dword ptr [eax+4*eax] << 0x9F6
:00402B5B 8D3C80 lea edi, dword ptr [eax+4*eax] << 0x31CE
:00402B5E 0FBEC2 movsx eax, dl << dl= [esi+02]='n' 0x6E
:00402B61 8D0480 lea eax, dword ptr [eax+4*eax] << 0x226
:00402B64 8D1480 lea edx, dword ptr [eax+4*eax] << 0xABE
:00402B67 8D04CD00000000 lea eax, dword ptr [8*ecx+00000000] << ecx =0x65; eax= 0x65* 8 =0x328
:00402B6E 2BC1 sub eax, ecx << 0x328-0x65 = 0x2c3
:00402B70 0FBE4E04 movsx ecx, byte ptr [esi+04] << ecx = 'y' 0x79
:00402B74 8D0440 lea eax, dword ptr [eax+2*eax] << 0x2c3*3 =0x849
:00402B77 C1E207 shl edx, 07 << edx=0xABE left move 7 = 0x55F00
:00402B7A 8D0480 lea eax, dword ptr [eax+4*eax] << eax = 0x849*5 =0x296D
:00402B7D 8D14FA lea edx, dword ptr [edx+8*edi] << edx =edi(0x31CE)*8+0x55f00 = 0x6ED70
:00402B80 8D0480 lea eax, dword ptr [eax+4*eax] << 0x296D*5 = 0xCF21
:00402B83 8D1482 lea edx, dword ptr [edx+4*eax] << edx =33C84+6ED70 =A29F4
:00402B86 8D0449 lea eax, dword ptr [ecx+2*ecx] << eax = 0x16B
:00402B89 8D04C0 lea eax, dword ptr [eax+8*eax] << eax = 0xCC3
:00402B8C C1E003 shl eax, 03 << eax = 6618
:00402B8F 2BC1 sub eax, ecx << eax = 6618-79= 659f
:00402B91 B9A0860100 mov ecx, 000186A0
:00402B96 8D0480 lea eax, dword ptr [eax+4*eax] << eax = 1FC1B
:00402B99 8D0482 lea eax, dword ptr [edx+4*eax] << eax = A29F4+7F06C =121A60
:00402B9C 99 cdq << edx = 0
:00402B9D F7F9 idiv ecx << eax/ecx = eax =0b edx =15180
:00402B9F 81C2A3340000 add edx, 000034A3 << edx = 18623
:00402BA5 52 push edx
:00402BA6 8D542414 lea edx, dword ptr [esp+14] <<
