SnagIt! v5.2.1. (三） (9千字)
0045AB20 83C40C add esp, 0000000C0045AB23 85C0 test eax, eax
0045AB25 74CF je 0045AAF6
0045AB27 8D45D0 lea eax, dword ptr [ebp-30]
0045AB2A 50 push eax
0045AB2B 8D459C lea eax, dword ptr [ebp-64]
0045AB2E 50 push eax
0045AB2F E89CF20100 call 00479DD0
we must pay more attention on this callee, it work for finishing the
construction of the string2 and accomplish full key generation and key
check! just go into it!
00479DF3 8BD0 mov edx, eax
00479DF5 81E2FFFF0000 and edx, 0000FFFF
00479DFB 40 inc eax
00479DFC 884C1404 mov byte ptr [esp+edx+04], cl
00479E00 41 inc ecx
00479E01 6683F946 cmp cx, 0046
00479E05 76EC jbe 00479DF3
messy code to puzzle you!
00479E07 53 push ebx
00479E08 8B9C2488000000 mov ebx, dword ptr [esp+00000088]
00479E0F 56 push esi
00479E10 89442408 mov dword ptr [esp+08], eax
00479E14 57 push edi
00479E15 8D430C lea eax, dword ptr [ebx+0C]
00479E18 6A02 push 00000002
00479E1A 50 push eax
00479E1B E820FFFFFF call 00479D40
00479E20 8BB42494000000 mov esi, dword ptr [esp+00000094]
00479E27 8D4C2414 lea ecx, dword ptr [esp+14]
00479E2B 6A02 push 00000002
00479E2D 51 push ecx
00479E2E 56 push esi
00479E2F 89442420 mov dword ptr [esp+20], eax
00479E33 E8B8FEFFFF call 00479CF0
this piece of code take the last two chars and convert them to hexadecimal
format, and combine them to a byte. afterward,storing the result as a word into
the string2 series. now the string2 is look like '01 00 xx xx xl 00' which
xl denote to the hex-format of the last two bytes of the fake key.
00479E38 8D5308 lea edx, dword ptr [ebx+08]
00479E3B 6A04 push 00000004
00479E3D 52 push edx
00479E3E E8FDFEFFFF call 00479D40
00479E43 89442428 mov dword ptr [esp+28], eax
00479E47 8D442428 lea eax, dword ptr [esp+28]
00479E4B 6A02 push 00000002
00479E4D 50 push eax
00479E4E 56 push esi
00479E4F E89CFEFFFF call 00479CF0
the fronter functions of the above two calls is use to do the same work
'convert' and 'combine' with the reciprocal 3~6 chars. and the second call
stores the result two bytes into the string2. and here finish constructing
the string2. now it looks like this:
char *string = "01 00 xx xx xl 00 ab cd"; which ab and cd denote to the
result yield by the above two calls.
00479E54 8D4C2458 lea ecx, dword ptr [esp+58]
00479E58 51 push ecx
00479E59 E882000000 call 00479EE0
the call at 479ee0 initialize the four chaining variables of MD5 HASH according
with the standard MD5.
00479E5E 33D2 xor edx, edx
00479E60 8D7E02 lea edi, dword ptr [esi+02]
00479E63 668B16 mov dx, word ptr [esi]
00479E66 8D44245C lea eax, dword ptr [esp+5C]
00479E6A 52 push edx
00479E6B 57 push edi
00479E6C 50 push eax
00479E6D E89E000000 call 00479F10
the above call intent to hide the string2 by convey it from the origin
local memeory to another place. but i catch it! :)
00479E72 8D4C2468 lea ecx, dword ptr [esp+68]
00479E76 8D542458 lea edx, dword ptr [esp+58]
00479E7A 51 push ecx
00479E7B 52 push edx
00479E7C E84F010000 call 00479FD0
standard MD5 HASH digest! to processing the string2. the edx pointed to
the result address. here the string3 was yielded.
00479E81 B90C000000 mov ecx, 0000000C
00479E86 33C0 xor eax, eax
00479E88 F3 repz
00479E89 AB stosd
00479E8A 66AB stosw
00479E8C 83C440 add esp, 00000040
00479E8F 33FF xor edi, edi
Referenced by a (U)nconditional or (C)onditional Jump at Address:
:00479EC5(C)
00479E91 8BF7 mov esi, edi
00479E93 81E6FFFF0000 and esi, 0000FFFF
00479E99 8BC6 mov eax, esi
00479E9B D1E8 shr eax, 1
00479E9D 8A0C18 mov cl, byte ptr [eax+ebx]
00479EA0 51 push ecx
00479EA1 E80AFFFFFF call 00479DB0
00479EA6 8A543424 mov dl, byte ptr [esp+esi+24]
00479EAA 25FF000000 and eax, 000000FF
00479EAF 83E20F and edx, 0000000F
00479EB2 83C404 add esp, 00000004
00479EB5 0FBE4C1410 movsx ecx, byte ptr [esp+edx+10]
00479EBA 3BC8 cmp ecx, eax
00479EBC 7515 jne 00479ED3
00479EBE 83C702 add edi, 00000002
00479EC1 6683FF10 cmp di, 0010
00479EC5 72CA jb 00479E91
this paragraph is the core checking code, cl contained the first 8 fake
key that we entered before. and it picked out bytes from the string3 by each
iteration step 2,that's mean it selected the odd number chars of string3. 1,
3, 5, 7, 9 till 15. and move the byte just picked to the dl. and dl with 0fh,
looking up the hex table to yield the real RegCode. finally compary every yielded
RegCode with cl about 8 times, if any of check was not match then game over.
so here we can get the first 8 bytes of the real RegCode. and combine it with
the last 6 byte of the fake key which wo base on to calculate the first part of
the RegCode,we conclude our Regcode now!
below snippet is the outer range of the main routine related to the upper
code before the core checking routine... why i mention this? the SnagIt! has
a version check by checking the value of the last byte of the reg code, as the
above slim operations.
xor di, di
mov di, last_byte
add di, 0ffbfh
cmp di, 050h
ja @good
add di, 0ch
ja @good
call MessageBoxA, ...offset " your register key are \
out of time".
so do remeber that , never let the last number yielded from the convert and combine
operation with the entered last two chars less than 85d.
.
.
.
0045AB43 6683FF50 cmp di, 0050
0045AB47 7319 jnb 0045AB62
0045AB49 83C70C add edi, 0000000C
0045AB4C 6683FF50 cmp di, 0050
0045AB50 7310 jnb 0045AB62
0045AB52 885DF3 mov byte ptr [ebp-0D], bl
0045AB55 C645F20B mov [ebp-0E], 0B
0045AB59 EB07 jmp 0045AB62
.
.
.
here you are one of worked key set.
userName: arbiter
userCode: 963B851E7D508F
that all over the work. cause of my poor english, i just can do this essay
like this. i've try my best. so i beg your pardon for any errors and uncompat -
ibilities among this essay.
at the same time, despite some of the errors and shortages, i hope you would
learn somethings from it!
my greeting fly to all of the guys of the kanxue forum. and all the crackers
in china!
arbiter.
