Search32最新版V5.08注册算法笔记 (二) (15千字)
Search32最新版V5.08注册算法笔记 (二) （续上篇）++........................
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:100014FB(C)
|
:10001475 0FBE0C33 movsx ecx, byte ptr [ebx+esi]将输入的注册码的第一个字符送ecx;
:10001479 51 push ecx
:1000147A E8D7970000 call 1000AC56//将注册码字符查表，0～9数字对应“84”,返回eax=4;
:1000147F 83C404 add esp, 00000004
:10001482 85C0 test eax, eax
:10001484 7512 jne 10001498
------------------------------------------------------------------------------------------------------------------------------
将输入的注册码按奇数和偶数位分两组，并按不同次序排列;
如果注册码的形式是：
a1 a2 a3 a4 a5 a6 a7 a8 a9 a10 a11 a12 a13 a14 a15 a16 a17 a18 a19 a20 a21 a22 a23 a24
则分组后排列为：
奇数位组: a1 a3 a5 a7 a9 a11 a13 a15 a17 a 19 a21 a23
偶数位组: a24 a 20 a16 a12 a8 a4 a2 a6 a10 a14 a18 a20 （以a2为对称中心）
^
---------------------------------------------------------------------------------------------------------------------------------
:100014F8 43 inc ebx
:100014F9 3BD8 cmp ebx, eax
:100014FB 0F8274FFFFFF jb 10001475
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1000146F(C)
|
:10001501 8D7C2448 lea edi, dword ptr [esp+48]//指向偶数位组地址: 0070f01c;
:10001505 83C9FF or ecx, FFFFFFFF
:10001508 33C0 xor eax, eax
:1000150A C6442C4800 mov [esp+ebp+48], 00
:1000150F F2 repnz
:10001510 AE scasb//计算偶数位组中（从70f01c开始）后半部分的长度;
:10001511 8B542420 mov edx, dword ptr [esp+20]
:10001515 F7D1 not ecx
:10001517 49 dec ecx
:10001518 C644142800 mov [esp+edx+28], 00
:1000151D 83E1FE and ecx, FFFFFFFE
:10001520 83F90A cmp ecx, 0000000A//该长度与“A”比较;
:10001523 0F828C020000 jb 100017B5//小于则失败; ****
:10001529 8D442448 lea eax, dword ptr [esp+48]//指向偶数位组地址: 0070f01c;
:1000152D 50 push eax
:1000152E E818970000 call 1000AC4B//偶数位组后半部分的计算, 结果送eax;
//比方这部分的ASI字符的形式是: 00000083450, 那么
//eax返回83450的HEX值; 假如该ASCII字符大于
//FFFFFFFFh=4294967295, 则返回的eax就不是此规律了;
:10001533 8B7C2428 mov edi, dword ptr [esp+28]
:10001537 8BD8 mov ebx, eax//eax送ebx保存;
:10001539 A1086C0110 mov eax, dword ptr [10016C08]//置数;
:1000153E 83C9FF or ecx, FFFFFFFF
:10001541 33D8 xor ebx, eax
:10001543 33C0 xor eax, eax
........................
:1000155D 8BCD mov ecx, ebp
:1000155F 4F dec edi
:10001560 C1E902 shr ecx, 02
:10001563 F3 repz
:10001564 A5 movsd
:10001565 8BCD mov ecx, ebp
:10001567 83E103 and ecx, 00000003
:1000156A F3 repz
:1000156B A4 movsb//将“SRCH32_D.DLL”移动并接到奇数位组的后面,得新奇数位组字串;
:1000156C 8DBC24A8000000 lea edi, dword ptr [esp+000000A8]//指向新ID字串;
:10001573 83C9FF or ecx, FFFFFFFF
:10001576 F2 repnz
:10001577 AE scasb
:10001578 F7D1 not ecx
:1000157A 49 dec ecx//得新ID字串的长度，我的是20h;
:1000157B 8D7C2428 lea edi, dword ptr [esp+28]//指向奇数位组字串;
:1000157F 8BD1 mov edx, ecx
:10001581 83C9FF or ecx, FFFFFFFF
:10001584 F2 repnz
:10001585 AE scasb
:10001586 F7D1 not ecx
:10001588 49 dec ecx//计算它的长度;
:10001589 83FA20 cmp edx, 00000020//新ID字串的长度与20h比较;
:1000158C 894C2418 mov dword ptr [esp+18], ecx
:10001590 0F821F020000 jb 100017B5//小于的话，命运就惨了！！****
:10001596 85D2 test edx, edx
:10001598 7617 jbe 100015B1
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:100015AF(C)
|
:1000159A 0FBE8C04A8000000 movsx ecx, byte ptr [esp+eax+000000A8]//新ID字串第一字节送ecx;
:100015A2 8B7C241C mov edi, dword ptr [esp+1C]
:100015A6 03F9 add edi, ecx//将它的HEX值按字节累加;
:100015A8 40 inc eax
:100015A9 3BC2 cmp eax, edx
:100015AB 897C241C mov dword ptr [esp+1C], edi//累加的结果保存起来。假定为十六进数为T;
:100015AF 72E9 jb 1000159A
........................
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:100015B6(C)
|
:100015D8 8BB424A8000000 mov esi, dword ptr [esp+000000A8]//指向新ID字串;
:100015DF B804000000 mov eax, 00000004//初始eax;
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:100015C0(C), :100015D6(U)
|
:100015E4 3BC2 cmp eax, edx
:100015E6 7310 jnb 100015F8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:100015F6(C)
|
:100015E8 8BAC04A8000000 mov ebp, dword ptr [esp+eax+000000A8]
:100015EF 83C004 add eax, 00000004
:100015F2 33F5 xor esi, ebp//将新ID字串的5～8位和1～4位做异或, 再将结果与9～12位异或;
//类推，直到完成, 结果存esi。 假定为十六进数为M;
:100015F4 3BC2 cmp eax, edx
:100015F6 72F0 jb 100015E8
......................................
<<<从:1000161E 到 :1000163A 是将奇数位组字串求异或，结果存ebp。 假定为十六进数为N;算法同上>>>
....................................
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1000162D(C)
|
:1000163C 8D542468 lea edx, dword ptr [esp+68]
:10001640 6A0A push 0000000A
:10001642 52 push edx
:10001643 8BC6 mov eax, esi
:10001645 33D2 xor edx, edx
:10001647 B9FFFFFF7F mov ecx, 7FFFFFFF
:1000164C F7F1 div ecx//新ID 字串异或值除ecx, 得余数edx;
:1000164E 33EB xor ebp, ebx//N与ebx异或，结果假定为数Y;
:10001650 52 push edx
:10001651 E8FFF60000 call 10010D55//将M转成10进制数－－假定为数A;
:10001656 8B5C2428 mov ebx, dword ptr [esp+28]//指向T;
:1000165A 8B3D086C0110 mov edi, dword ptr [10016C08]
:10001660 8D9424B4010000 lea edx, dword ptr [esp+000001B4]
:10001667 6A0A push 0000000A
:10001669 52 push edx
:1000166A 53 push ebx
:1000166B 33F7 xor esi, edi//M与edi异或，结果假定为数X;
:1000166D E8E3F60000 call 10010D55//将T的值转成10进制数－－假定为数B;
:10001672 8DBC2480000000 lea edi, dword ptr [esp+00000080]
:10001679 83C9FF or ecx, FFFFFFFF
:1000167C 33C0 xor eax, eax
:1000167E 83C418 add esp, 00000018
:10001681 F2 repnz
:10001682 AE scasb
:10001683 F7D1 not ecx
:10001685 49 dec ecx//计算数A的长度;
:10001686 8DBC24A8010000 lea edi, dword ptr [esp+000001A8]
:1000168D 894C2424 mov dword ptr [esp+24], ecx//数A的长度保存;
:10001691 83C9FF or ecx, FFFFFFFF
:10001694 F2 repnz
:10001695 AE scasb
:10001696 F7D1 not ecx
:10001698 49 dec ecx//计算数B的长度;
:10001699 8BC3 mov eax, ebx
:1000169B 894C2418 mov dword ptr [esp+18], ecx//B的长度保存;
:1000169F 33D2 xor edx, edx
:100016A1 B905000000 mov ecx, 00000005
:100016A6 F7F1 div ecx//将T除以5, 得余数edx;
:100016A8 85D2 test edx, edx
:100016AA 8954241C mov dword ptr [esp+1C], edx//将余数edx保存-->J;
:100016AE 7504 jne 100016B4//不等于0则跳走;
:100016B0 894C241C mov dword ptr [esp+1C], ecx//余数等于0则将5保存。
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:100016AE(C)
|
:100016B4 33DB xor ebx, ebx
:100016B6 33FF xor edi, edi
:100016B8 3BF5 cmp esi, ebp//X与Y比较;
:100016BA C644241400 mov [esp+14], 00
:100016BF 0F85F0000000 jne 100017B5//不相等就完了; ****
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:10001796(C), :1000179E(U)
|
:100016C5 8A443C68 mov al, byte ptr [esp+edi+68]//数A的第一个字节送al;
:100016C9 8A4C241C mov cl, byte ptr [esp+1C]//数J送cl;
:100016CD 02C1 add al, cl
:100016CF 0FBED0 movsx edx, al//相加的结果送edx--->K;
:100016D2 52 push edx
:100016D3 88442416 mov byte ptr [esp+16], al
:100016D7 E87A950000 call 1000AC56//al如果是数字，返回的eax=4;否则，eax=0;
:100016DC 83C404 add esp, 00000004
:100016DF 85C0 test eax, eax
:100016E1 7505 jne 100016E8
:100016E3 80442412F7 add byte ptr [esp+12], F7//如果K不是数字，K加F7-->P;
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:100016E1(C)
|
:100016E8 8A442412 mov al, byte ptr [esp+12]//数P送al;
:100016EC 8A4C1C28 mov cl, byte ptr [esp+ebx+28]//指向奇数位组字串的第一个字节;
:100016F0 3AC1 cmp al, cl//两数比较;
:100016F2 0F85BD000000 jne 100017B5//不等就死了; ****
:100016F8 43 inc ebx
:100016F9 83FB0E cmp ebx, 0000000E
:100016FC 0F83A1000000 jnb 100017A3
:10001702 0FBE4C1C28 movsx ecx, byte ptr [esp+ebx+28]//指向奇数位组字串的第二个字节;
:10001707 51 push ecx
:10001708 E849950000 call 1000AC56
:1000170D 83C404 add esp, 00000004
:10001710 85C0 test eax, eax
:10001712 750A jne 1000171E
:10001714 43 inc ebx
:10001715 83FB0E cmp ebx, 0000000E
:10001718 0F8385000000 jnb 100017A3
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001712(C)
|
:1000171E 8B742424 mov esi, dword ptr [esp+24]//A的长度送esi;
:10001722 47 inc edi
:10001723 3BFE cmp edi, esi
:10001725 7202 jb 10001729
:10001727 33FF xor edi, edi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001725(C)
|
:10001729 8BC7 mov eax, edi
:1000172B 33D2 xor edx, edx
:1000172D F7742418 div [esp+18]//除以B的长度;
:10001731 8A4C3C68 mov cl, byte ptr [esp+edi+68]//数A的第二个字节送al;
:10001735 8A442414 mov al, byte ptr [esp+14]
:10001739 6A0A push 0000000A
:1000173B 8A9414AC010000 mov dl, byte ptr [esp+edx+000001AC]//数B的第二个字节送dl;
:10001742 32D1 xor dl, cl//上面两数异或;
:10001744 B90A000000 mov ecx, 0000000A
:10001749 02C2 add al, dl
:1000174B 88442418 mov byte ptr [esp+18], al//累加的结果送[esp+18];
:1000174F 8D442416 lea eax, dword ptr [esp+16]
:10001753 50 push eax
:10001754 8B44241C mov eax, dword ptr [esp+1C]//指向id 偶数第一位;
:10001758 25FF000000 and eax, 000000FF
:1000175D 99 cdq
:1000175E F7F9 idiv ecx//除以Ah=10（十进制），得余数edx;
:10001760 52 push edx
:10001761 E8EFF50000 call 10010D55// 将edx 做ascii 字符调整, 保存于 [esp+1E];
:10001766 8A54241E mov dl, byte ptr [esp+1E]//送dl;
:1000176A 8A441C34 mov al, byte ptr [esp+ebx+34]//指向奇数位组的偶数第一位;
:1000176E 83C40C add esp, 0000000C
:10001771 3AD0 cmp dl, al//比较，不等就失败;
:10001773 7540 jne 100017B5
:10001775 43 inc ebx
:10001776 83FB0E cmp ebx, 0000000E
:10001779 7328 jnb 100017A3
:1000177B 0FBE441C28 movsx eax, byte ptr [esp+ebx+28]
:10001780 50 push eax
:10001781 E8D0940000 call 1000AC56
:10001786 83C404 add esp, 00000004
:10001789 85C0 test eax, eax
:1000178B 7506 jne 10001793
:1000178D 43 inc ebx
:1000178E 83FB0E cmp ebx, 0000000E//循环14次;
:10001791 7310 jnb 100017A3
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1000178B(C)
|
:10001793 47 inc edi
:10001794 3BFE cmp edi, esi
:10001796 0F8229FFFFFF jb 100016C5
:1000179C 33FF xor edi, edi
:1000179E E922FFFFFF jmp 100016C5
......//上面是循环的计算和判断//......
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:100016FC(C), :10001718(C), :10001779(C), :10001791(C)
|
:100017A3 5F pop edi/<---------------如果走到这里就成功了！
:100017A4 5E pop esi
:100017A5 5D pop ebp
:100017A6 B801000000 mov eax, 00000001
:100017AB 5B pop ebx
:100017AC 81C4DC020000 add esp, 000002DC
:100017B2 C20800 ret 0008
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:10001371(C), :10001380(C), :100013A1(C), :100013BD(C), :1000143C(C)
|:10001523(C), :10001590(C), :100016BF(C), :100016F2(C), :10001773(C)
|
:100017B5 5F pop edi//<---------------跳到这里就game over了！
:100017B6 5E pop esi
:100017B7 5D pop ebp
:100017B8 33C0 xor eax, eax
:100017BA 5B pop ebx
:100017BB 81C4DC020000 add esp, 000002DC
:100017C1 C20800 ret 0008
---------------------------------------
[5] 小花絮---->
1） RegName 和 Password 以加密的方式写在它的配置文件 Search32.ini中。
2）KEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\TRTData
的 Data9 键值 是安装时间记录。
[6] 我的体会：
本来想算出它的注册码，实在太烦琐了。感谢您花时间从头看到尾！
虽然没有算出注册码，但是长了不少见识。只能盼望高手搞定它的注册机了。
愿与各位朋友交流。^_^
<完>
★☆ moonlite 于2001-8-6☆★
