天音怒放3.0的注册过程暨DeDe使用教程(一)。写注册机的事情还是留给大家练手吧.偶要上学去了.:) (27千字)
主页：http://www.crack007.com ( ^-^ )
破解
破解工具：TRW2000 1.22 W32dASM 8.93 Dede 3.02简体中文版 fi2.49a Caspr1.10
难度：★★
软件下载地址： http://hn.skycn.net/down/typlayer.zip
软件简介：
天音怒放是一款全功能的多媒体和MP3播放器。支持MP3, CD, WAV, MIDI, AVI, MPEG Video, Windows Media, QuickTime，MPEG4等格式，
有众多令人心动的功能：歌词库能保存您喜爱的歌词,CD转录器将您喜欢的歌从CD转换为MP3, 10频段均衡器增强音乐的音色，自动保存播放清
单。
主程序由fi侦测出是用ASPack v2.11加的壳。这个Esay，用Caspr1.10轻松搞定。在此不得不额外在多嘴一句，那个ajj[CCG]编写的
CasprGui很好使。我对其是怎么编写的十分有兴趣。因为我也想编写一些有关加参数DOS程序的外壳(Shell/GUI)。希望大家尤其是ajj[CCG]大
哥能给我提供一些资料。OK，言归正转。让我们继续聊聊这个软件的加密过程。
由于他是采用Delphi编写的软件，因此Dede此时就派上了大用场。在对付Delphi程序时，DeDe相对 W32dASM 而言有着非常大的优势。其中
最有用的莫过于他能分析出程序所采用的具体的控件和相关delphi函数。这样在遇到某些Call的时候我们可以非常快的判断出某段代码有什么
作用，避免了钻 Call 的牛角尖，节省了大量的时间和精力。这在后面我们将会看到。
经过Dede对脱壳文件的处理之后，在窗体部分我们会看到一个TRegisterForm的模块，内容如下：
object RegisterForm: TRegisterForm
......
object Label2: TLabel
Left = 20
Top = 72
Width = 31
Height = 13
Caption = 'Name:' <----姓名编辑框
Transparent = True
end
object Label3: TLabel
Left = 20
Top = 100
Width = 28
Height = 13
Caption = 'Code:' <----注册码编辑框
Transparent = True
end
object bnRegister: TButton
Left = 176
Top = 132
Width = 65
Height = 25
Caption = '&OK' <----确认按钮
ModalResult = 1
TabOrder = 3
OnClick = bnRegisterClick <----非常重要，程序就是从这个动作(OnClick)开始注册过程！
end 让我们记下它的名称：bnRegisterClick
.....
让我们再来到程序一栏，找到TRegisterForm，单击，在右边的时间栏里我们就会看到bnRegisterClick这个事件。双击可从此RVA处进行反
汇编，得到内容如下：
***** TRY
|
004E708A 64FF30 push dword ptr fs:[eax]
004E708D 648920 mov fs:[eax], esp
004E7090 B201 mov dl, $01
* Reference to class TProcessRegister <----开始注册流程
|
004E7092 A104A44E00 mov eax, dword ptr [$4EA404]
* Reference to: system.TObject.Create(TObject;Boolean);
|
004E7097 E820BFF1FF call 00402FBC
004E709C 8BD8 mov ebx, eax
004E709E 8BC3 mov eax, ebx
|
004E70A0 E80F770000 call 004EE7B4
004E70A5 8D55F8 lea edx, [ebp-$08]
* Reference to control TRegisterForm.edUserName : TEdit <----从UserName : TEdit里获取用户名
|
004E70A8 8B86EC020000 mov eax, [esi+$02EC]
* Reference to: controls.TControl.GetText(TControl):System.String;
|
004E70AE E80DF8F4FF call 004368C0
004E70B3 8B55F8 mov edx, [ebp-$08]
* Reference to field TProcessRegister.OFFS_0154
|
004E70B6 8D8354010000 lea eax, [ebx+$0154]
* Reference to: system.@LStrAsg;
|
004E70BC E863CCF1FF call 00403D24
004E70C1 8D55F4 lea edx, [ebp-$0C]
* Reference to control TRegisterForm.edRegCode : TEdit <----从RegCode : TEdit里获取注册码
|
004E70C4 8B86F0020000 mov eax, [esi+$02F0]
* Reference to: controls.TControl.GetText(TControl):System.String; // 这就是DeDe的好处，一目了然，
| 再往后你会体会得更深刻！ *^_^*
004E70CA E8F1F7F4FF call 004368C0
004E70CF 8B55F4 mov edx, [ebp-$0C]
004E70D2 8BC3 mov eax, ebx
|
004E70D4 E8EB760000 call 004EE7C4 <----在此行双击进入此Call
* Reference to field TProcessRegister.OFFS_015C
|
004E70D9 80BB5C01000000 cmp byte ptr [ebx+$015C], $00 <---很经典的比对，不是么？
004E70E0 0F84C8000000 jz 004E71AE
004E70E6 6A00 push $00
004E70E8 668B0D10724E00 mov cx, word ptr [$4E7210]
004E70EF B202 mov dl, $02
* Possible String Reference to: '谢谢你选择了天音怒放'
|
004E70F1 B81C724E00 mov eax, $004E721C
|
004E70F6 E8496AF7FF call 0045DB44
004E70FB 8D55F0 lea edx, [ebp-$10]
----------------------------------call 004EE7C4---------------------------------------------
***** TRY
|
004EE7F9 64FF30 push dword ptr fs:[eax]
004EE7FC 648920 mov fs:[eax], esp
* Reference to field TProcessRegister.OFFS_0158
|
004EE7FF 8D8658010000 lea eax, [esi+$0158]
004EE805 8BD3 mov edx, ebx
* Reference to: system.@LStrAsg;
|
004EE807 E81855F1FF call 00403D24
004EE80C 8BC3 mov eax, ebx
* Reference to: system.@LStrLen:Integer; <---- LStrLen:Integer，顾名思义，就是取子串的长度，
返回一个整数值（保存在EAX）。也就说下面的那个
Call 你不用跟进去就知道是干什么的。方便吧！
004EE80E E83D57F1FF call 00403F50
004EE813 83F80E cmp eax, +$0E
004EE816 0F8C0C040000 jl 004EEC28 <----这两句要求注册码的位数大于14(=0Eh)位
004EE81C 8D45C4 lea eax, [ebp-$3C]
004EE81F 8A13 mov dl, byte ptr [ebx]
004EE821 885001 mov [eax+$01], dl
004EE824 C60001 mov byte ptr [eax], $01
004EE827 8D55C4 lea edx, [ebp-$3C]
004EE82A 8D45C0 lea eax, [ebp-$40]
* Reference to: system.@PStrCpy; <---- PStrCpy 复制字串
|
004EE82D E8F242F1FF call 00402B24
004EE832 8D45BC lea eax, [ebp-$44]
004EE835 8A5301 mov dl, byte ptr [ebx+$01]
004EE838 885001 mov [eax+$01], dl
004EE83B C60001 mov byte ptr [eax], $01
004EE83E 8D55BC lea edx, [ebp-$44]
004EE841 8D45C0 lea eax, [ebp-$40]
004EE844 B102 mov cl, $02 <---- 注意赋给 cl 的规律
* Reference to: system.@PStrNCat; <---- PStrNCat 字串合并
|
004EE846 E8A942F1FF call 00402AF4
004EE84B 8D55C0 lea edx, [ebp-$40]
004EE84E 8D45B8 lea eax, [ebp-$48]
* Reference to: system.@PStrCpy;
|
004EE851 E8CE42F1FF call 00402B24
004EE856 8D45BC lea eax, [ebp-$44]
004EE859 8A5302 mov dl, byte ptr [ebx+$02]
004EE85C 885001 mov [eax+$01], dl
004EE85F C60001 mov byte ptr [eax], $01
004EE862 8D55BC lea edx, [ebp-$44]
004EE865 8D45B8 lea eax, [ebp-$48]
004EE868 B103 mov cl, $03 <---- 取 3 个字符
* Reference to: system.@PStrNCat;
|
004EE86A E88542F1FF call 00402AF4
004EE86F 8D55B8 lea edx, [ebp-$48]
004EE872 8D45F0 lea eax, [ebp-$10]
* Reference to: system.@LStrFromString(String;ShortString); <---- 获取子串
|
004EE875 E87A56F1FF call 00403EF4
004EE87A 8D45C4 lea eax, [ebp-$3C]
004EE87D 8A5304 mov dl, byte ptr [ebx+$04]
004EE880 885001 mov [eax+$01], dl
004EE883 C60001 mov byte ptr [eax], $01
004EE886 8D55C4 lea edx, [ebp-$3C]
004EE889 8D45C0 lea eax, [ebp-$40]
* Reference to: system.@PStrCpy;
|
004EE88C E89342F1FF call 00402B24
004EE891 8D45BC lea eax, [ebp-$44]
004EE894 8A5305 mov dl, byte ptr [ebx+$05]
004EE897 885001 mov [eax+$01], dl
004EE89A C60001 mov byte ptr [eax], $01
004EE89D 8D55BC lea edx, [ebp-$44]
004EE8A0 8D45C0 lea eax, [ebp-$40]
004EE8A3 B102 mov cl, $02 <---- 注意赋给 cl 的规律
* Reference to: system.@PStrNCat;
|
004EE8A5 E84A42F1FF call 00402AF4
004EE8AA 8D55C0 lea edx, [ebp-$40]
004EE8AD 8D45B8 lea eax, [ebp-$48]
* Reference to: system.@PStrCpy;
|
004EE8B0 E86F42F1FF call 00402B24
004EE8B5 8D45BC lea eax, [ebp-$44]
004EE8B8 8A5306 mov dl, byte ptr [ebx+$06]
004EE8BB 885001 mov [eax+$01], dl
004EE8BE C60001 mov byte ptr [eax], $01
004EE8C1 8D55BC lea edx, [ebp-$44]
004EE8C4 8D45B8 lea eax, [ebp-$48]
004EE8C7 B103 mov cl, $03
* Reference to: system.@PStrNCat;
|
004EE8C9 E82642F1FF call 00402AF4
004EE8CE 8D55B8 lea edx, [ebp-$48]
004EE8D1 8D45B0 lea eax, [ebp-$50]
* Reference to: system.@PStrCpy;
|
004EE8D4 E84B42F1FF call 00402B24
004EE8D9 8D45BC lea eax, [ebp-$44]
004EE8DC 8A5307 mov dl, byte ptr [ebx+$07]
004EE8DF 885001 mov [eax+$01], dl
004EE8E2 C60001 mov byte ptr [eax], $01
004EE8E5 8D55BC lea edx, [ebp-$44]
004EE8E8 8D45B0 lea eax, [ebp-$50]
004EE8EB B104 mov cl, $04
* Reference to: system.@PStrNCat;
|
004EE8ED E80242F1FF call 00402AF4
004EE8F2 8D55B0 lea edx, [ebp-$50]
004EE8F5 8D45A8 lea eax, [ebp-$58]
* Reference to: system.@PStrCpy;
|
004EE8F8 E82742F1FF call 00402B24
004EE8FD 8D45BC lea eax, [ebp-$44]
004EE900 8A5308 mov dl, byte ptr [ebx+$08]
004EE903 885001 mov [eax+$01], dl
004EE906 C60001 mov byte ptr [eax], $01
004EE909 8D55BC lea edx, [ebp-$44]
004EE90C 8D45A8 lea eax, [ebp-$58]
004EE90F B105 mov cl, $05 <---- 取 5 个字符
* Reference to: system.@PStrNCat;
|
004EE911 E8DE41F1FF call 00402AF4
004EE916 8D55A8 lea edx, [ebp-$58]
004EE919 8D45EC lea eax, [ebp-$14]
* Reference to: system.@LStrFromString(String;ShortString);
|
004EE91C E8D355F1FF call 00403EF4
004EE921 8D45C4 lea eax, [ebp-$3C]
004EE924 8A530A mov dl, byte ptr [ebx+$0A]
004EE927 885001 mov [eax+$01], dl
004EE92A C60001 mov byte ptr [eax], $01
004EE92D 8D55C4 lea edx, [ebp-$3C]
004EE930 8D45C0 lea eax, [ebp-$40]
* Reference to: system.@PStrCpy;
|
004EE933 E8EC41F1FF call 00402B24
004EE938 8D45BC lea eax, [ebp-$44]
004EE93B 8A530B mov dl, byte ptr [ebx+$0B]
004EE93E 885001 mov [eax+$01], dl
004EE941 C60001 mov byte ptr [eax], $01
004EE944 8D55BC lea edx, [ebp-$44]
004EE947 8D45C0 lea eax, [ebp-$40]
004EE94A B102 mov cl, $02 <---- 注意赋给 cl 的规律
* Reference to: system.@PStrNCat;
|
004EE94C E8A341F1FF call 00402AF4
004EE951 8D55C0 lea edx, [ebp-$40]
004EE954 8D45B8 lea eax, [ebp-$48]
* Reference to: system.@PStrCpy;
|
004EE957 E8C841F1FF call 00402B24
004EE95C 8D45BC lea eax, [ebp-$44]
004EE95F 8A530C mov dl, byte ptr [ebx+$0C]
004EE962 885001 mov [eax+$01], dl
004EE965 C60001 mov byte ptr [eax], $01
004EE968 8D55BC lea edx, [ebp-$44]
004EE96B 8D45B8 lea eax, [ebp-$48]
004EE96E B103 mov cl, $03
* Reference to: system.@PStrNCat;
|
004EE970 E87F41F1FF call 00402AF4
004EE975 8D55B8 lea edx, [ebp-$48]
004EE978 8D45B0 lea eax, [ebp-$50]
* Reference to: system.@PStrCpy;
|
004EE97B E8A441F1FF call 00402B24
004EE980 8D45BC lea eax, [ebp-$44]
004EE983 8A530D mov dl, byte ptr [ebx+$0D]
004EE986 885001 mov [eax+$01], dl
004EE989 C60001 mov byte ptr [eax], $01
004EE98C 8D55BC lea edx, [ebp-$44]
004EE98F 8D45B0 lea eax, [ebp-$50]
004EE992 B104 mov cl, $04 <---- 取 4 个字符
* Reference to: system.@PStrNCat;
|
004EE994 E85B41F1FF call 00402AF4
004EE999 8D55B0 lea edx, [ebp-$50]
004EE99C 8D45E8 lea eax, [ebp-$18]
* Reference to: system.@LStrFromString(String;ShortString); <---- 根据上下文我们可以依稀认为注册码的形式为
| xxx-xxxxx-xxxx-xxx
004EE99F E85055F1FF call 00403EF4 ^^^^这部分可能有也可能没有
004EE9A4 33D2 xor edx, edx
004EE9A6 8B45F0 mov eax, [ebp-$10]
* Reference to: sysutils.StrToIntDef(System.AnsiString;System.Integer):System.Integer; <----字符串转数字
|
004EE9A9 E8FAA9F1FF call 004093A8
004EE9AE 8945FC mov [ebp-$04], eax
004EE9B1 33D2 xor edx, edx
004EE9B3 8B45EC mov eax, [ebp-$14]
* Reference to: sysutils.StrToIntDef(System.AnsiString;System.Integer):System.Integer; <----字符串转数字
|
004EE9B6 E8EDA9F1FF call 004093A8
004EE9BB 8945F8 mov [ebp-$08], eax
004EE9BE 33D2 xor edx, edx
004EE9C0 8B45E8 mov eax, [ebp-$18]
* Reference to: sysutils.StrToIntDef(System.AnsiString;System.Integer):System.Integer; <----字符串转数字
|
004EE9C3 E8E0A9F1FF call 004093A8
004EE9C8 8BD8 mov ebx, eax
004EE9CA 837DFC00 cmp dword ptr [ebp-$04], +$00 <---- 下面这几行要求注册码不能为空
004EE9CE 0F8454020000 jz 004EEC28
004EE9D4 837DF800 cmp dword ptr [ebp-$08], +$00
004EE9D8 0F844A020000 jz 004EEC28
004EE9DE 85DB test ebx, ebx
004EE9E0 0F8442020000 jz 004EEC28 <---- 跳则死！
|
004EE9E6 E83589F1FF call 00407320 ---| 这里是一个小暗桩。主要作用是判断
004EE9EB 2B8650010000 sub eax, dword ptr [esi+$0150] |__前后两次执行设计代码的时间间隔。
004EE9F1 3DF4010000 cmp eax, $000001F4 | 如果间隔过长（大于500 ms），则认
004EE9F6 0F872C020000 jnbe 004EEC28 ---| 为程序被跟踪。注册失败。
004EE9FC 8B45F8 mov eax, [ebp-$08] ---|
004EE9FF 0345FC add eax, [ebp-$04] |-- xxxxx + xxx + 8BF
004EEA02 05F88B0000 add eax, +$00008BF8 ---|
004EEA07 B910270000 mov ecx, $00002710 <---- 2170h = 10000d
004EEA0C 99 cdq
004EEA0D F7F9 idiv ecx <---- 求余，edx 保存余数
004EEA0F 8BCA mov ecx, edx <---- 保存余数到 ecx
004EEA11 8BF9 mov edi, ecx <---- 保存余数到 edi
004EEA13 81E101000080 and ecx, $80000001 <---- 将余数和80000001做与运算，Ecx保存结果
004EEA19 7905 jns 004EEA20
004EEA1B 49 dec ecx
004EEA1C 83C9FE or ecx, -$02
004EEA1F 41 inc ecx
004EEA20 2BF9 sub edi, ecx ---|
004EEA22 8BC3 mov eax, ebx |__ 要求注册码符合以下条件：
004EEA24 03C0 add eax, eax | 余数 - ecx = 2 * xxxx
004EEA26 3BF8 cmp edi, eax ---|
004EEA28 0F85FA010000 jnz 004EEC28
004EEA2E B201 mov dl, $01
* Reference to class TBitmap
|
004EEA30 A1D8C54100 mov eax, dword ptr [$41C5D8]
|
004EEA35 E8EE46F3FF call 00423128
004EEA3A 8945E4 mov [ebp-$1C], eax
* Possible String Reference to: 'CDROM'
|
004EEA3D B974EC4E00 mov ecx, $004EEC74
004EEA42 8B15DC444F00 mov edx, [$4F44DC]
004EEA48 8B45E4 mov eax, [ebp-$1C]
* Reference to: graphics.TBitmap.LoadFromResourceName(TBitmap;Windows.THandle;System.AnsiString);
|
004EEA4B E89851F3FF call 00423BE8
004EEA50 B201 mov dl, $01
* Reference to class TMemoryStream
|
004EEA52 A18C074100 mov eax, dword ptr [$41078C]
* Reference to: system.TObject.Create(TObject;Boolean);
|
004EEA57 E86045F1FF call 00402FBC
004EEA5C 8BD8 mov ebx, eax
004EEA5E 8BD3 mov edx, ebx
004EEA60 8B45E4 mov eax, [ebp-$1C]
004EEA63 8B08 mov ecx, [eax]
* Possible reference to virtual method TBitmap.OFFS_54
|
004EEA65 FF5154 call dword ptr [ecx+$54]
004EEA68 33C9 xor ecx, ecx
004EEA6A BA40000000 mov edx, $00000040
004EEA6F 8BC3 mov eax, ebx
004EEA71 8B38 mov edi, [eax]
* Reference to method TMemoryStream.Seek(Longint,Word)
|
004EEA73 FF570C call dword ptr [edi+$0C]
* Reference to field TProcessRegister.OFFS_0160
|
004EEA76 8D9660010000 lea edx, [esi+$0160]
004EEA7C B930000000 mov ecx, $00000030
004EEA81 8BC3 mov eax, ebx
004EEA83 8B38 mov edi, [eax]
* Reference to method TMemoryStream.Read(Pointer,Longint)
|
004EEA85 FF5704 call dword ptr [edi+$04]
004EEA88 8B45E4 mov eax, [ebp-$1C]
* Reference to: system.TObject.Free(TObject);
|
004EEA8B E85C45F1FF call 00402FEC
004EEA90 8BC3 mov eax, ebx
* Reference to: system.TObject.Free(TObject);
|
004EEA92 E85545F1FF call 00402FEC
|
004EEA97 E88488F1FF call 00407320
004EEA9C 2B8650010000 sub eax, dword ptr [esi+$0150]
004EEAA2 3DF4010000 cmp eax, $000001F4 <---- 不能跳！原理同上。
004EEAA7 0F877B010000 jnbe 004EEC28
004EEAAD C745D800000000 mov dword ptr [ebp-$28], $00000000
004EEAB4 C745DC00000000 mov dword ptr [ebp-$24], $00000000
004EEABB 8D55D4 lea edx, [ebp-$2C]
* Reference to field TProcessRegister.OFFS_0154
|
004EEABE 8B8654010000 mov eax, [esi+$0154] <---- 获得注册名
* Reference to: sysutils.UpperCase(System.AnsiString):System.AnsiString; <---- UpperCase 字符小写变大写
|
004EEAC4 E80BA4F1FF call 00408ED4
004EEAC9 8B45D4 mov eax, [ebp-$2C]
* Reference to: system.@LStrLen:Integer; <---- LStrLen:Integer 获取注册名长度
|
004EEACC E87F54F1FF call 00403F50
004EEAD1 8BD8 mov ebx, eax
004EEAD3 4B dec ebx
004EEAD4 85DB test ebx, ebx <---- 要求注册名长度不能为 0
004EEAD6 7C2F jl 004EEB07
004EEAD8 43 inc ebx
004EEAD9 33C9 xor ecx, ecx
004EEADB 8BC1 mov eax, ecx ----|
004EEADD BF0C000000 mov edi, $0000000C |
004EEAE2 99 cdq |
004EEAE3 F7FF idiv edi | 这段循环的主要作用是：
004EEAE5 8B849660010000 mov eax, [esi+edx*4+$0160] |
004EEAEC 8B55D4 mov edx, [ebp-$2C] | 在esi+$0160 处有一个码表，每 4
004EEAEF 0FB6140A movzx edx, byte ptr [edx+ecx] |
004EEAF3 F7EA imul edx |--- 个字节为一单位，共有 12 值。
004EEAF5 33D2 xor edx, edx |
004EEAF7 0345D8 add eax, [ebp-$28] | 依次取注册名的 ASCII 与之相乘，
004EEAFA 1355DC adc edx, [ebp-$24] |
004EEAFD 8945D8 mov [ebp-$28], eax | 并将结果进行累加
004EEB00 8955DC mov [ebp-$24], edx |
004EEB03 41 inc ecx |
004EEB04 4B dec ebx |
004EEB05 75D4 jnz 004EEADB ----|
004EEB07 B8FFFFFFFF mov eax, $FFFFFFFF
004EEB0C BAFFFFFF7F mov edx, $7FFFFFFF
004EEB11 52 push edx
004EEB12 50 push eax
004EEB13 6A00 push $00
004EEB15 6836010000 push $00000136
004EEB1A 8B45D8 mov eax, [ebp-$28]
004EEB1D 8B55DC mov edx, [ebp-$24]
|
004EEB20 E82781F1FF call 00406C4C <--- 将结果乘以 0136h
004EEB25 290424 sub dword ptr [esp], eax
004EEB28 19542404 sbb [esp+$04], edx 7FFFFFFFh - 相乘后的结果
004EEB2C 58 pop eax
004EEB2D 5A pop edx
004EEB2E 52 push edx
004EEB2F 50 push eax
004EEB30 8D45F4 lea eax, [ebp-$0C]
* Reference to: sysutils.IntToStr(System.Int64):System.AnsiString;overload; <---- 整数转字符串
|
004EEB33 E8BCA7F1FF call 004092F4
004EEB38 8D45D0 lea eax, [ebp-$30]
004EEB3B 50 push eax
004EEB3C B903000000 mov ecx, $00000003
004EEB41 BA07000000 mov edx, $00000007 <---- 从第 7 位开始取，共取 3 个
004EEB46 8B45F4 mov eax, [ebp-$0C] 假设为 yyy
* Reference to: system.@LStrCopy;
|
004EEB49 E80A56F1FF call 00404158
004EEB4E 8D45CC lea eax, [ebp-$34]
004EEB51 50 push eax
004EEB52 B905000000 mov ecx, $00000005
004EEB57 BA0A000000 mov edx, $0000000A <---- 从第 A 位开始取，共取 5 个
004EEB5C 8B45F4 mov eax, [ebp-$0C] 假设为 yyyyy
* Reference to: system.@LStrCopy;
|
004EEB5F E8F455F1FF call 00404158
004EEB64 8D45C8 lea eax, [ebp-$38]
004EEB67 50 push eax
004EEB68 B902000000 mov ecx, $00000002
004EEB6D BA0F000000 mov edx, $0000000F <---- 从第 F 位开始取，共取 2 个
004EEB72 8B45F4 mov eax, [ebp-$0C] 假设为 yy
* Reference to: system.@LStrCopy;
|
004EEB75 E8DE55F1FF call 00404158
004EEB7A 8B45D0 mov eax, [ebp-$30]
* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer; <---- 字符转数字
|
004EEB7D E8A6A7F1FF call 00409328
004EEB82 8BD8 mov ebx, eax
004EEB84 8B45CC mov eax, [ebp-$34]
* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer; <---- 字符转数字
|
004EEB87 E89CA7F1FF call 00409328
004EEB8C 8BF8 mov edi, eax
004EEB8E 8B45C8 mov eax, [ebp-$38]
* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer; <---- 字符转数字
|
004EEB91 E892A7F1FF call 00409328
004EEB96 8B55F8 mov edx, [ebp-$08] ---|
004EEB99 33D0 xor edx, eax | 此处要求注册码符合以下条件：
004EEB9B 3BFA cmp edi, edx |
004EEB9D 0F8585000000 jnz 004EEC28 |-- yy xor yyyyy = xxxxx
004EEBA3 3345FC xor eax, [ebp-$04] |
004EEBA6 3BD8 cmp ebx, eax | yy xor yyy = xxx
004EEBA8 757E jnz 004EEC28 ---|
* Reference to field TProcessRegister.OFFS_015C
|
004EEBAA C6865C01000001 mov byte ptr [esi+$015C], $01
004EEBB1 8D45A4 lea eax, [ebp-$5C]
* Possible String Reference to: 'Player.ini'
|
004EEBB4 B984EC4E00 mov ecx, $004EEC84
004EEBB9 8B1580D44F00 mov edx, [$4FD480]
......
****** END
到这里，该注册码的前三部分就已经分析完毕了。大概步骤就是由注册名得出前两部分的注册码yyy-yyyyy（见004EEAD9 和 004EEB96 ）
，然后由后两部分再推出第三部分注册码yyy（见004EEA0D）。
那么是否到此就基本结束了呢？我们可以具体验证一下。填入注册名Crack007,注册码887-32717-4718，显示“谢谢你选择了天音怒放”。
好像是没多大问题了。但关闭后再运行软件，依旧显示未注册版本。怎么回事呢？让我们仔细想一想，问题究竟出在哪里。
在假定前面分析正确的基础上我们设想，如果软件在启动时没有在其他地方进行比对，而是单单进入刚才我们所分析的地方，那么应该是
没有什么问题的。但现在出了问题，就说明软件在启动时还在其他地方进行了注册码的比对。那么到底是在哪里呢？
我们很容易得知软件的注册信息保存在其安装目录下的Player.ini文件当中。具体格式为：
[Register]
Name=Crack007
Code=887-32717-4718
因此我们用w32dasm对其反汇编后在字符串参考里面找Name。为什么不选用player.ini做搜索的关键词呢？因为player.ini还包含有其他信
息，调用的地方比较多，不利于我们的跟踪。因此我们最好选用Name或Code来查看。
