请近，我写破文很少，不要骂我哈。：） (7千字)
File Protector 2000name: Free User
Company: [CCG]
Product: 748748
:0040C62F E80C1C0000 call 0040E240 /进入
:0040E240 8B4C2404 mov ecx, dword ptr [esp+04]
:0040E244 83EC08 sub esp, 00000008
:0040E247 B02D mov al, 2D /初始化"al"="2d"="-"
:0040E249 8A5104 mov dl, byte ptr [ecx+04] /取Product第5位到“dl”中
:0040E24C 53 push ebx
:0040E24D 3AD0 cmp dl, al /Product第5位是“-”吗？
:0040E24F 0F85AA020000 jne 0040E4FF /出错！
:0040E255 384107 cmp byte ptr [ecx+07], al /第8位是“-”吗？
:0040E258 0F85A1020000 jne 0040E4FF
:0040E25E 38410B cmp byte ptr [ecx+0B], al /第12位是“-”吗？
:0040E261 0F8598020000 jne 0040E4FF
:0040E267 38410D cmp byte ptr [ecx+0D], al /第14位
:0040E26A 0F858F020000 jne 0040E4FF
:0040E270 38411C cmp byte ptr [ecx+1C], al /第29位
:0040E273 0F8586020000 jne 0040E4FF
:0040E279 8A410F mov al, byte ptr [ecx+0F] /取出Product的第16位到“al”
:0040E27C 3C30 cmp al, 30 /30=0
:0040E27E 0F8C7B020000 jl 0040E4FF /小于30就跳
:0040E284 3C46 cmp al, 46 /46=F
:0040E286 0F8F73020000 jg 0040E4FF /大于“F”就跳，此时Product的合法范围在（Hex）30~46之间。
:0040E28C 8A4110 mov al, byte ptr [ecx+10]
:0040E28F 3C30 cmp al, 30
:0040E291 0F8C68020000 jl 0040E4FF
:0040E297 3C46 cmp al, 46
:0040E299 0F8F60020000 jg 0040E4FF
:0040E29F 8A4111 mov al, byte ptr [ecx+11]
:0040E2A2 3C30 cmp al, 30
:0040E2A4 0F8C55020000 jl 0040E4FF
:0040E2AA 3C46 cmp al, 46
:0040E2AC 0F8F4D020000 jg 0040E4FF
:0040E2B2 8A4112 mov al, byte ptr [ecx+12]
:0040E2B5 3C30 cmp al, 30
:0040E2B7 0F8C42020000 jl 0040E4FF
:0040E2BD 3C46 cmp al, 46
:0040E2BF 0F8F3A020000 jg 0040E4FF
:0040E2C5 8A4115 mov al, byte ptr [ecx+15]
:0040E2C8 3C30 cmp al, 30
:0040E2CA 0F8C2F020000 jl 0040E4FF
:0040E2D0 3C46 cmp al, 46
:0040E2D2 0F8F27020000 jg 0040E4FF
:0040E2D8 8A4116 mov al, byte ptr [ecx+16]
:0040E2DB 3C30 cmp al, 30
:0040E2DD 0F8C1C020000 jl 0040E4FF
:0040E2E3 3C46 cmp al, 46
:0040E2E5 0F8F14020000 jg 0040E4FF
:0040E2EB 8A4117 mov al, byte ptr [ecx+17]
:0040E2EE 3C30 cmp al, 30
:0040E2F0 0F8C09020000 jl 0040E4FF
:0040E2F6 3C46 cmp al, 46
:0040E2F8 0F8F01020000 jg 0040E4FF
:0040E2FE 8A4119 mov al, byte ptr [ecx+19]
:0040E301 3C30 cmp al, 30
:0040E303 0F8CF6010000 jl 0040E4FF
:0040E309 3C46 cmp al, 46
:0040E30B 0F8FEE010000 jg 0040E4FF
:0040E311 803946 cmp byte ptr [ecx], 46 /Product第1位等于46（F）吗？
:0040E314 0F85E5010000 jne 0040E4FF /不等就跳
:0040E31A 80790150 cmp byte ptr [ecx+01], 50 /第2位50（P）
:0040E31E 0F85DB010000 jne 0040E4FF
:0040E324 80790231 cmp byte ptr [ecx+02], 31 /第3位31（1）
:0040E328 0F85D1010000 jne 0040E4FF
:0040E32E 80790338 cmp byte ptr [ecx+03], 38 /第4位38（8）
:0040E332 0F85C7010000 jne 0040E4FF
:0040E338 8A5105 mov dl, byte ptr [ecx+05] /算法，不想看！
:0040E33B 8A5908 mov bl, byte ptr [ecx+08]
:0040E33E 88542410 mov byte ptr [esp+10], dl
:0040E342 8A5117 mov dl, byte ptr [ecx+17]
:0040E345 02C2 add al, dl
:0040E347 8A5116 mov dl, byte ptr [ecx+16]
:0040E34A 02C2 add al, dl
:0040E34C 8A5115 mov dl, byte ptr [ecx+15]
:0040E34F 02C2 add al, dl
:0040E351 8A5112 mov dl, byte ptr [ecx+12]
:0040E354 02C2 add al, dl
:0040E356 8A5111 mov dl, byte ptr [ecx+11]
:0040E359 02C2 add al, dl
:0040E35B 8A5110 mov dl, byte ptr [ecx+10]
:0040E35E 02C2 add al, dl
:0040E360 8A510F mov dl, byte ptr [ecx+0F]
:0040E363 02C2 add al, dl
:0040E365 8A542410 mov dl, byte ptr [esp+10]
:0040E369 32C2 xor al, dl
:0040E36B 8A510C mov dl, byte ptr [ecx+0C]
:0040E36E 32C3 xor al, bl
:0040E370 32C2 xor al, dl
:0040E372 3423 xor al, 23
:0040E374 8AD0 mov dl, al
:0040E376 C0EA04 shr dl, 04
:0040E379 80C230 add dl, 30
:0040E37C 80FA39 cmp dl, 39
:0040E37F 88542404 mov byte ptr [esp+04], dl
:0040E383 7607 jbe 0040E38C
:0040E385 80C207 add dl, 07
:0040E388 88542404 mov byte ptr [esp+04], dl
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E383(C)
|
:0040E38C 240F and al, 0F
:0040E38E 0430 add al, 30
:0040E390 3C39 cmp al, 39
:0040E392 88442408 mov byte ptr [esp+08], al
:0040E396 7606 jbe 0040E39E
:0040E398 0407 add al, 07
:0040E39A 88442408 mov byte ptr [esp+08], al
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E396(C)
|
:0040E39E 0FBE4113 movsx eax, byte ptr [ecx+13] /取Product第14位到EAX中
:0040E3A2 8B542404 mov edx, dword ptr [esp+04]
:0040E3A6 81E2FF000000 and edx, 000000FF /正确的Product！
:0040E3AC 3BC2 cmp eax, edx /？EDX ，和输入的Product第14位相等吗？
:0040E3AE 0F854B010000 jne 0040E4FF
:0040E3B4 8A5114 mov dl, byte ptr [ecx+14] /输入Product的第15位到DL中
:0040E3B7 56 push esi /弹出的是？？？
:0040E3B8 8B74240C mov esi, dword ptr [esp+0C]
:0040E3BC 0FBEC2 movsx eax, dl /DL=>EAX
:0040E3BF 81E6FF000000 and esi, 000000FF /正确的Product到ESI中，
:0040E3C5 3BC6 cmp eax, esi /第15位正确与否！
:0040E3C7 5E pop esi /压入的是？？？
:0040E3C8 0F8531010000 jne 0040E4FF /不能跳走！
.
.
.
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E4C9(C)
|
:0040E4D2 0FBE511D movsx edx, byte ptr [ecx+1D]
:0040E4D6 8B442404 mov eax, dword ptr [esp+04]
:0040E4DA 25FF000000 and eax, 000000FF
:0040E4DF 3BD0 cmp edx, eax
:0040E4E1 751C jne 0040E4FF
:0040E4E3 0FBE491E movsx ecx, byte ptr [ecx+1E]
:0040E4E7 8B542408 mov edx, dword ptr [esp+08]
:0040E4EB 33C0 xor eax, eax
:0040E4ED 81E2FF000000 and edx, 000000FF
:0040E4F3 5B pop ebx
:0040E4F4 3BCA cmp ecx, edx /至此可找出全部的Product。输入后成功，也不知道还有没有校验。
:0040E4F6 0F94C0 sete al
:0040E4F9 83C408 add esp, 00000008
:0040E4FC C20400 ret 0004
8086[CCG] 17:16 2001-7-10
