[原创]010 Editor V6.0.2 算法分析+kengen
【文章标题】010 Editor V6.0.2 算法分析+kengen
【文章作者】lacoucou
【软件名称】010 Editor V6.0.2 32bit
【软件大小】13.1 MB
【原版下载】http://www.sweetscape.com/download/010editor/
【保护方式】序列号
【软件简介】010 Editor是一个全新的十六进位文件编辑器，它有别於传统的十六进位编辑器在於它可用’范本’来解析二进位文件, 从而让你读懂和编辑它. 它还可用来比较一切可视的二进位文件.
【作者声明】本文仅供研究学习，本人对因这篇文章而导致的一切后果，不承担任何法律责任。本文中的不足之处请各位多多指教。
【分析过程】
1.定位关键点----字符串定位，过程略。
005780E0 <Check> > \6A FF PUSH -0x1 005780E2 . 68 324B7000 PUSH 010Edito.00704B32 005780E7 . 64:A1 0000000>MOV EAX,DWORD PTR FS:[0] 005780ED . 50 PUSH EAX 005780EE . 83EC 1C SUB ESP,0x1C 005780F1 . 53 PUSH EBX 005780F2 . 55 PUSH EBP 005780F3 . 56 PUSH ESI 005780F4 . 57 PUSH EDI 005780F5 . A1 40488B00 MOV EAX,DWORD PTR DS:[0x8B4840] ; 7ACAF566 005780FA . 33C4 XOR EAX,ESP 005780FC . 50 PUSH EAX 005780FD . 8D4424 30 LEA EAX,DWORD PTR SS:[ESP+0x30] 00578101 . 64:A3 0000000>MOV DWORD PTR FS:[0],EAX ; seh 00578107 . 8BF1 MOV ESI,ECX 00578109 . 33DB XOR EBX,EBX 0057810B . 895C24 20 MOV DWORD PTR SS:[ESP+0x20],EBX 0057810F . A1 C0978B00 MOV EAX,DWORD PTR DS:[<&QtCore4.?shared_> 00578114 . 894424 18 MOV DWORD PTR SS:[ESP+0x18],EAX 00578118 . B9 01000000 MOV ECX,0x1 0057811D . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 00578121 . A1 C0978B00 MOV EAX,DWORD PTR DS:[<&QtCore4.?shared_> 00578126 . 895C24 38 MOV DWORD PTR SS:[ESP+0x38],EBX 0057812A . 894424 1C MOV DWORD PTR SS:[ESP+0x1C],EAX 0057812E . BA 01000000 MOV EDX,0x1 00578133 . F0:0FC110 LOCK XADD DWORD PTR DS:[EAX],EDX 00578137 . 8B4E 68 MOV ECX,DWORD PTR DS:[ESI+0x68] 0057813A . 8B3D F0AC8B00 MOV EDI,DWORD PTR DS:[<&QtGui4.?text@QLi>; QtGui4.?text@QLineEdit@@QBE?AVQString@@XZ 00578140 . 8D4424 24 LEA EAX,DWORD PTR SS:[ESP+0x24] 00578144 . 50 PUSH EAX ; QString 对象 用户名 00578145 . C64424 3C 01 MOV BYTE PTR SS:[ESP+0x3C],0x1 0057814A . FFD7 CALL EDI ; <&QtGui4.?text@QLineEdit@@QBE?AVQString@@XZ> 0057814C . 8B08 MOV ECX,DWORD PTR DS:[EAX] 0057814E . 3959 08 CMP DWORD PTR DS:[ECX+0x8],EBX ; 取用户名 00578151 . 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+0x24] 00578155 . 0F94C3 SETE BL 00578158 . 83C8 FF OR EAX,0xFFFFFFFF 0057815B . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 0057815F . 8B2D CC978B00 MOV EBP,DWORD PTR DS:[<&QtCore4.?free@QS>; QtCore4.?free@QString@@CAXPAUData@1@@Z 00578165 . 75 0A JNZ SHORT 010Edito.00578171 00578167 . 8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+0x24] 0057816B . 51 PUSH ECX 0057816C . FFD5 CALL EBP ; <&QtCore4.?free@QString@@CAXPAUData@1@@Z> 0057816E . 83C4 04 ADD ESP,0x4 00578171 > 84DB TEST BL,BL ; 判断用户名是否为空 00578173 . 0F84 8D000000 JE 010Edito.00578206 00578179 . 6A FF PUSH -0x1 0057817B . 68 54CC7400 PUSH 010Edito.0074CC54 ; please enter a name. 00578180 . FF15 84978B00 CALL DWORD PTR DS:[<&QtCore4.?fromAscii_>; QtCore4.?fromAscii_helper@QString@@CAPAUData@1@PBDH@Z 00578186 . 894424 28 MOV DWORD PTR SS:[ESP+0x28],EAX 0057818A . 8D5424 28 LEA EDX,DWORD PTR SS:[ESP+0x28] 0057818E . 52 PUSH EDX 0057818F . C64424 44 02 MOV BYTE PTR SS:[ESP+0x44],0x2 00578194 . E8 7E95E8FF CALL 010Edito.00401717 00578199 . 8B4424 2C MOV EAX,DWORD PTR SS:[ESP+0x2C] 0057819D . 83C4 0C ADD ESP,0xC 005781A0 . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 005781A5 . 83C9 FF OR ECX,0xFFFFFFFF 005781A8 . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 005781AC . 75 0A JNZ SHORT 010Edito.005781B8 005781AE . 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+0x20] 005781B2 . 52 PUSH EDX 005781B3 . FFD5 CALL EBP 005781B5 . 83C4 04 ADD ESP,0x4 005781B8 > 8B76 68 MOV ESI,DWORD PTR DS:[ESI+0x68] 005781BB . 6A 07 PUSH 0x7 005781BD . 8BCE MOV ECX,ESI 005781BF . FF15 B0B38B00 CALL DWORD PTR DS:[<&QtGui4.?setFocus@QW>; QtGui4.?setFocus@QWidget@@QAEXW4FocusReason@Qt@@@Z 005781C5 . 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+0x1C] 005781C9 . C64424 38 00 MOV BYTE PTR SS:[ESP+0x38],0x0 005781CE . 83C9 FF OR ECX,0xFFFFFFFF 005781D1 . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 005781D5 . 75 0A JNZ SHORT 010Edito.005781E1 005781D7 . 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+0x1C] 005781DB . 52 PUSH EDX 005781DC . FFD5 CALL EBP 005781DE . 83C4 04 ADD ESP,0x4 005781E1 > 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+0x18] 005781E5 . C74424 38 FFF>MOV DWORD PTR SS:[ESP+0x38],-0x1 005781ED . 83C9 FF OR ECX,0xFFFFFFFF 005781F0 . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 005781F4 . 0F85 34080000 JNZ 010Edito.00578A2E 005781FA . 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+0x18] 005781FE . 52 PUSH EDX 005781FF . FFD5 CALL EBP 00578201 . E9 25080000 JMP 010Edito.00578A2B 00578206 > 8B4E 70 MOV ECX,DWORD PTR DS:[ESI+0x70] 00578209 . 8D4424 2C LEA EAX,DWORD PTR SS:[ESP+0x2C] 0057820D . 50 PUSH EAX 0057820E . FFD7 CALL EDI ; (QtGui4.?text@QLineEdit@@QBE?AVQString@@XZ) 00578210 . 8B08 MOV ECX,DWORD PTR DS:[EAX] 00578212 . 8379 08 00 CMP DWORD PTR DS:[ECX+0x8],0x0 ; 注册码长度 00578216 . 8B2D 84978B00 MOV EBP,DWORD PTR DS:[<&QtCore4.?fromAsc>; QtCore4.?fromAscii_helper@QString@@CAPAUData@1@PBDH@Z 0057821C . BB 01000000 MOV EBX,0x1 00578221 . C64424 38 03 MOV BYTE PTR SS:[ESP+0x38],0x3 00578226 . 895C24 20 MOV DWORD PTR SS:[ESP+0x20],EBX 0057822A . 74 56 JE SHORT 010Edito.00578282 0057822C . 6A FF PUSH -0x1 0057822E . 68 F04F7300 PUSH 010Edito.00734FF0 00578233 . FFD5 CALL EBP ; <&QtCore4.?fromAscii_helper@QString@@CAPAUData@1@PBDH@Z> 00578235 . 83C4 08 ADD ESP,0x8 00578238 . 894424 24 MOV DWORD PTR SS:[ESP+0x24],EAX 0057823C . 8B4E 70 MOV ECX,DWORD PTR DS:[ESI+0x70] 0057823F . 8D5424 28 LEA EDX,DWORD PTR SS:[ESP+0x28] 00578243 . 52 PUSH EDX 00578244 . C74424 3C 040>MOV DWORD PTR SS:[ESP+0x3C],0x4 0057824C . C74424 24 030>MOV DWORD PTR SS:[ESP+0x24],0x3 00578254 . FFD7 CALL EDI ; 还是注册码？ 00578256 . 6A 01 PUSH 0x1 00578258 . 6A 00 PUSH 0x0 0057825A . 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+0x2C] 0057825E . 51 PUSH ECX 0057825F . BB 07000000 MOV EBX,0x7 00578264 . 8BC8 MOV ECX,EAX 00578266 . C74424 44 050>MOV DWORD PTR SS:[ESP+0x44],0x5 0057826E . 895C24 2C MOV DWORD PTR SS:[ESP+0x2C],EBX 00578272 . FF15 40978B00 CALL DWORD PTR DS:[<&QtCore4.?indexOf@QS>; QtCore4.?indexOf@QString@@QBEHABV1@HW4CaseSensitivity@Qt@@@Z 00578278 . C64424 17 00 MOV BYTE PTR SS:[ESP+0x17],0x0 0057827D . 83F8 FF CMP EAX,-0x1 00578280 . 74 05 JE SHORT 010Edito.00578287 00578282 > C64424 17 01 MOV BYTE PTR SS:[ESP+0x17],0x1 00578287 > C74424 38 040>MOV DWORD PTR SS:[ESP+0x38],0x4 0057828F . F6C3 04 TEST BL,0x4 00578292 . 74 22 JE SHORT 010Edito.005782B6 00578294 . 8B5424 28 MOV EDX,DWORD PTR SS:[ESP+0x28] ; Qstring_PASS 对象首地址 00578298 . 83E3 FB AND EBX,0xFFFFFFFB 0057829B . 895C24 20 MOV DWORD PTR SS:[ESP+0x20],EBX 0057829F . 83C8 FF OR EAX,0xFFFFFFFF 005782A2 . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 005782A6 . 75 0E JNZ SHORT 010Edito.005782B6 005782A8 . 8B4C24 28 MOV ECX,DWORD PTR SS:[ESP+0x28] 005782AC . 51 PUSH ECX 005782AD . FF15 CC978B00 CALL DWORD PTR DS:[<&QtCore4.?free@QStri>; QtCore4.?free@QString@@CAXPAUData@1@@Z 005782B3 . 83C4 04 ADD ESP,0x4 005782B6 > C74424 38 030>MOV DWORD PTR SS:[ESP+0x38],0x3 005782BE . F6C3 02 TEST BL,0x2 005782C1 . 74 22 JE SHORT 010Edito.005782E5 005782C3 . 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+0x24] 005782C7 . 83E3 FD AND EBX,0xFFFFFFFD 005782CA . 895C24 20 MOV DWORD PTR SS:[ESP+0x20],EBX 005782CE . 83C8 FF OR EAX,0xFFFFFFFF 005782D1 . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 005782D5 . 75 0E JNZ SHORT 010Edito.005782E5 005782D7 . 8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+0x24] 005782DB . 51 PUSH ECX 005782DC . FF15 CC978B00 CALL DWORD PTR DS:[<&QtCore4.?free@QStri>; QtCore4.?free@QString@@CAXPAUData@1@@Z 005782E2 . 83C4 04 ADD ESP,0x4 005782E5 > C74424 38 010>MOV DWORD PTR SS:[ESP+0x38],0x1 005782ED . F6C3 01 TEST BL,0x1 005782F0 . 74 1B JE SHORT 010Edito.0057830D 005782F2 . 8B5424 2C MOV EDX,DWORD PTR SS:[ESP+0x2C] 005782F6 . 83C8 FF OR EAX,0xFFFFFFFF 005782F9 . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 005782FD . 75 0E JNZ SHORT 010Edito.0057830D 005782FF . 8B4C24 2C MOV ECX,DWORD PTR SS:[ESP+0x2C] 00578303 . 51 PUSH ECX 00578304 . FF15 CC978B00 CALL DWORD PTR DS:[<&QtCore4.?free@QStri>; QtCore4.?free@QString@@CAXPAUData@1@@Z 0057830A . 83C4 04 ADD ESP,0x4 0057830D > 807C24 17 00 CMP BYTE PTR SS:[ESP+0x17],0x0 00578312 . 0F84 8F000000 JE 010Edito.005783A7 00578318 . 6A FF PUSH -0x1 0057831A . 68 24CC7400 PUSH 010Edito.0074CC24 ; please completely enter your password. 0057831F . FFD5 CALL EBP 00578321 . 894424 2C MOV DWORD PTR SS:[ESP+0x2C],EAX 00578325 . 8D5424 2C LEA EDX,DWORD PTR SS:[ESP+0x2C] 00578329 . 52 PUSH EDX 0057832A . C64424 44 06 MOV BYTE PTR SS:[ESP+0x44],0x6 0057832F . E8 E393E8FF CALL 010Edito.00401717 00578334 . 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+0x30] 00578338 . 8B3D CC978B00 MOV EDI,DWORD PTR DS:[<&QtCore4.?free@QS>; QtCore4.?free@QString@@CAXPAUData@1@@Z 0057833E . 83C4 0C ADD ESP,0xC 00578341 . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 00578346 . 83C9 FF OR ECX,0xFFFFFFFF 00578349 . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 0057834D . 75 0A JNZ SHORT 010Edito.00578359 0057834F . 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+0x24] 00578353 . 52 PUSH EDX 00578354 . FFD7 CALL EDI 00578356 . 83C4 04 ADD ESP,0x4 00578359 > 8B76 68 MOV ESI,DWORD PTR DS:[ESI+0x68] 0057835C . 6A 07 PUSH 0x7 0057835E . 8BCE MOV ECX,ESI 00578360 . FF15 B0B38B00 CALL DWORD PTR DS:[<&QtGui4.?setFocus@QW>; QtGui4.?setFocus@QWidget@@QAEXW4FocusReason@Qt@@@Z 00578366 . 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+0x1C] 0057836A . C64424 38 00 MOV BYTE PTR SS:[ESP+0x38],0x0 0057836F . 83C9 FF OR ECX,0xFFFFFFFF 00578372 . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 00578376 . 75 0A JNZ SHORT 010Edito.00578382 00578378 . 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+0x1C] 0057837C . 52 PUSH EDX 0057837D . FFD7 CALL EDI 0057837F . 83C4 04 ADD ESP,0x4 00578382 > 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+0x18] 00578386 . C74424 38 FFF>MOV DWORD PTR SS:[ESP+0x38],-0x1 0057838E . 83C9 FF OR ECX,0xFFFFFFFF 00578391 . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 00578395 . 0F85 93060000 JNZ 010Edito.00578A2E 0057839B . 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+0x18] 0057839F . 52 PUSH EDX 005783A0 . FFD7 CALL EDI 005783A2 . E9 84060000 JMP 010Edito.00578A2B 005783A7 > 8B4E 70 MOV ECX,DWORD PTR DS:[ESI+0x70] 005783AA . 8D4424 2C LEA EAX,DWORD PTR SS:[ESP+0x2C] 005783AE . 50 PUSH EAX 005783AF . FFD7 CALL EDI ; 注册码 005783B1 . 8B1D B8978B00 MOV EBX,DWORD PTR DS:[<&QtCore4.??4QStri>; QtCore4.??4QString@@QAEAAV0@ABV0@@Z 005783B7 . 50 PUSH EAX 005783B8 . 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+0x20] 005783BC . C64424 3C 07 MOV BYTE PTR SS:[ESP+0x3C],0x7 005783C1 . FFD3 CALL EBX ; <&QtCore4.??4QString@@QAEAAV0@ABV0@@Z> 005783C3 . 8B4C24 2C MOV ECX,DWORD PTR SS:[ESP+0x2C] 005783C7 . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 005783CC . 83CA FF OR EDX,0xFFFFFFFF 005783CF . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 005783D3 . 75 0E JNZ SHORT 010Edito.005783E3 005783D5 . 8B4424 2C MOV EAX,DWORD PTR SS:[ESP+0x2C] 005783D9 . 50 PUSH EAX 005783DA . FF15 CC978B00 CALL DWORD PTR DS:[<&QtCore4.?free@QStri>; QtCore4.?free@QString@@CAXPAUData@1@@Z 005783E0 . 83C4 04 ADD ESP,0x4 005783E3 > 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+0x1C] 005783E7 . 51 PUSH ECX 005783E8 . 8BCE MOV ECX,ESI 005783EA . E8 3918E9FF CALL 010Edito.00409C28 005783EF . 85C0 TEST EAX,EAX 005783F1 . 74 3D JE SHORT 010Edito.00578430 005783F3 . 6A 13 PUSH 0x13 005783F5 . 8D5424 30 LEA EDX,DWORD PTR SS:[ESP+0x30] 005783F9 . 52 PUSH EDX 005783FA . 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+0x24] 005783FE . FF15 AC978B00 CALL DWORD PTR DS:[<&QtCore4.?left@QStri>; QtCore4.?left@QString@@QBE?AV1@H@Z 00578404 . 50 PUSH EAX 00578405 . 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+0x20] 00578409 . C64424 3C 08 MOV BYTE PTR SS:[ESP+0x3C],0x8 0057840E . FFD3 CALL EBX 00578410 . 8B4424 2C MOV EAX,DWORD PTR SS:[ESP+0x2C] 00578414 . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 00578419 . 83C9 FF OR ECX,0xFFFFFFFF 0057841C . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 00578420 . 75 0E JNZ SHORT 010Edito.00578430 00578422 . 8B5424 2C MOV EDX,DWORD PTR SS:[ESP+0x2C] 00578426 . 52 PUSH EDX 00578427 . FF15 CC978B00 CALL DWORD PTR DS:[<&QtCore4.?free@QStri>; QtCore4.?free@QString@@CAXPAUData@1@@Z 0057842D . 83C4 04 ADD ESP,0x4 00578430 > 8B4E 68 MOV ECX,DWORD PTR DS:[ESI+0x68] 00578433 . 8D4424 2C LEA EAX,DWORD PTR SS:[ESP+0x2C] 00578437 . 50 PUSH EAX ; 用户名 00578438 . FFD7 CALL EDI 0057843A . 8B0D CC4D8B00 MOV ECX,DWORD PTR DS:[0x8B4DCC] 00578440 . 50 PUSH EAX 00578441 . C64424 3C 09 MOV BYTE PTR SS:[ESP+0x3C],0x9 00578446 . E8 DF06E9FF CALL 010Edito.00408B2A 0057844B . 8B4C24 2C MOV ECX,DWORD PTR SS:[ESP+0x2C] 0057844F . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 00578454 . 83CA FF OR EDX,0xFFFFFFFF 00578457 . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 0057845B . 75 0E JNZ SHORT 010Edito.0057846B 0057845D . 8B4424 2C MOV EAX,DWORD PTR SS:[ESP+0x2C] 00578461 . 50 PUSH EAX 00578462 . FF15 CC978B00 CALL DWORD PTR DS:[<&QtCore4.?free@QStri>; QtCore4.?free@QString@@CAXPAUData@1@@Z 00578468 . 83C4 04 ADD ESP,0x4 0057846B > 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+0x1C] 0057846F . 51 PUSH ECX ; 注册码 00578470 . 8B0D CC4D8B00 MOV ECX,DWORD PTR DS:[0x8B4DCC] 00578476 . E8 60A1E8FF CALL 010Edito.004025DB 0057847B . 8B0D CC4D8B00 MOV ECX,DWORD PTR DS:[0x8B4DCC] 00578481 . 68 23400000 PUSH 0x4023 00578486 . 6A 07 PUSH 0x7 00578488 . E8 7E11E9FF CALL 010Edito.0040960B ; 第一次验证 0057848D . 8B0D CC4D8B00 MOV ECX,DWORD PTR DS:[0x8B4DCC] 00578493 . 68 23400000 PUSH 0x4023 00578498 . 6A 07 PUSH 0x7 0057849A . 8BD8 MOV EBX,EAX 0057849C . E8 D807E9FF CALL 010Edito.00408C79 ; 第二次验证 005784A1 . 8B0D CC4D8B00 MOV ECX,DWORD PTR DS:[0x8B4DCC] ; 结合下边看只有eax==0xDB才是正确的 005784A7 . 33D2 XOR EDX,EDX 005784A9 . 8BF8 MOV EDI,EAX ; edi 005784AB . 8B41 34 MOV EAX,DWORD PTR DS:[ECX+0x34] 005784AE . 85C0 TEST EAX,EAX 005784B0 . 0F94C2 SETE DL 005784B3 . 895424 2C MOV DWORD PTR SS:[ESP+0x2C],EDX 005784B7 . 81FB E7000000 CMP EBX,0xE7 ; E7是老版本的 005784BD . 0F84 8F010000 JE 010Edito.00578652 005784C3 . 8379 2C 00 CMP DWORD PTR DS:[ECX+0x2C],0x0 005784C7 . 0F84 85010000 JE 010Edito.00578652 005784CD . 6A 00 PUSH 0x0 005784CF . E8 22CCE8FF CALL 010Edito.004050F6 005784D4 . 85C0 TEST EAX,EAX 005784D6 . 0F8D D6000000 JGE 010Edito.005785B2 005784DC . 6A 0A PUSH 0xA 005784DE . 50 PUSH EAX 005784DF . 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+0x28] 005784E3 . 50 PUSH EAX 005784E4 . FF15 8C978B00 CALL DWORD PTR DS:[<&QtCore4.?number@QSt>; QtCore4.?number@QString@@SA?AV1@JH@Z 005784EA . 8BF0 MOV ESI,EAX 005784EC . 6A FF PUSH -0x1 005784EE . 68 18CB7400 PUSH 010Edito.0074CB18 ; could not contact the webserver. please check your internet connection. if your internet connection is currently working, the server may be down. if this problem persists, please visit 'http://www.sweetscape.com/support/' ( 005784F3 . C64424 4C 0A MOV BYTE PTR SS:[ESP+0x4C],0xA 005784F8 . FFD5 CALL EBP 005784FA . 894424 38 MOV DWORD PTR SS:[ESP+0x38],EAX 005784FE . 56 PUSH ESI 005784FF . 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+0x3C] 00578503 . 51 PUSH ECX 00578504 . 8D5424 44 LEA EDX,DWORD PTR SS:[ESP+0x44] 00578508 . 52 PUSH EDX 00578509 . C64424 58 0B MOV BYTE PTR SS:[ESP+0x58],0xB 0057850E . E8 AFCDE8FF CALL 010Edito.004052C2 00578513 . 68 DCD27300 PUSH 010Edito.0073D2DC ; ). 00578518 . 50 PUSH EAX 00578519 . 8D4424 54 LEA EAX,DWORD PTR SS:[ESP+0x54] 0057851D . B3 0C MOV BL,0xC 0057851F . 50 PUSH EAX 00578520 . 885C24 64 MOV BYTE PTR SS:[ESP+0x64],BL 00578524 . E8 F417E9FF CALL 010Edito.00409D1D 00578529 . 50 PUSH EAX 0057852A . C64424 68 0D MOV BYTE PTR SS:[ESP+0x68],0xD 0057852F . E8 14E3E8FF CALL 010Edito.00406848 00578534 . 8B4C24 5C MOV ECX,DWORD PTR SS:[ESP+0x5C] 00578538 . 8B35 CC978B00 MOV ESI,DWORD PTR DS:[<&QtCore4.?free@QS>; QtCore4.?free@QString@@CAXPAUData@1@@Z 0057853E . 83C4 30 ADD ESP,0x30 00578541 . 885C24 38 MOV BYTE PTR SS:[ESP+0x38],BL 00578545 . 83CA FF OR EDX,0xFFFFFFFF 00578548 . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 0057854C . 75 0A JNZ SHORT 010Edito.00578558 0057854E . 8B4424 2C MOV EAX,DWORD PTR SS:[ESP+0x2C] 00578552 . 50 PUSH EAX 00578553 . FFD6 CALL ESI 00578555 . 83C4 04 ADD ESP,0x4 00578558 > 8B4C24 28 MOV ECX,DWORD PTR SS:[ESP+0x28] 0057855C . C64424 38 0B MOV BYTE PTR SS:[ESP+0x38],0xB 00578561 . 83CA FF OR EDX,0xFFFFFFFF 00578564 . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 00578568 . 75 0A JNZ SHORT 010Edito.00578574 0057856A . 8B4424 28 MOV EAX,DWORD PTR SS:[ESP+0x28] 0057856E . 50 PUSH EAX 0057856F . FFD6 CALL ESI 00578571 . 83C4 04 ADD ESP,0x4 00578574 > 8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+0x24] 00578578 . C64424 38 0A MOV BYTE PTR SS:[ESP+0x38],0xA 0057857D . 83CA FF OR EDX,0xFFFFFFFF 00578580 . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 00578584 . 75 0A JNZ SHORT 010Edito.00578590 00578586 . 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+0x24] 0057858A . 50 PUSH EAX 0057858B . FFD6 CALL ESI 0057858D . 83C4 04 ADD ESP,0x4 00578590 > 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+0x20] 00578594 . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 00578599 . 83CA FF OR EDX,0xFFFFFFFF 0057859C . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 005785A0 . 0F85 51040000 JNZ 010Edito.005789F7 005785A6 . 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+0x20] 005785AA . 50 PUSH EAX 005785AB . FFD6 CALL ESI 005785AD . E9 42040000 JMP 010Edito.005789F4 005785B2 > 0F85 80000000 JNZ 010Edito.00578638 005785B8 . 6A FF PUSH -0x1 005785BA . 68 10CA7400 PUSH 010Edito.0074CA10 ; 010 editor has detected that you have entered an invalid license. please check to see if your license is entered correctly and try again. if this problem persists, please visit 'http://www.sweetscape.com/support/'. 005785BF . FFD5 CALL EBP 005785C1 . 894424 2C MOV DWORD PTR SS:[ESP+0x2C],EAX 005785C5 . 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+0x2C] 005785C9 . 51 PUSH ECX 005785CA . C64424 44 0E MOV BYTE PTR SS:[ESP+0x44],0xE 005785CF . E8 74E2E8FF CALL 010Edito.00406848 005785D4 . 8B5424 30 MOV EDX,DWORD PTR SS:[ESP+0x30] 005785D8 . 8B35 CC978B00 MOV ESI,DWORD PTR DS:[<&QtCore4.?free@QS>; QtCore4.?free@QString@@CAXPAUData@1@@Z 005785DE . 83C4 0C ADD ESP,0xC 005785E1 . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 005785E6 . 83C8 FF OR EAX,0xFFFFFFFF 005785E9 . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 005785ED . 75 0A JNZ SHORT 010Edito.005785F9 005785EF . 8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+0x24] 005785F3 . 51 PUSH ECX 005785F4 . FFD6 CALL ESI 005785F6 . 83C4 04 ADD ESP,0x4 005785F9 > 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+0x1C] 005785FD . C64424 38 00 MOV BYTE PTR SS:[ESP+0x38],0x0 00578602 . 83C8 FF OR EAX,0xFFFFFFFF 00578605 . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 00578609 . 75 0A JNZ SHORT 010Edito.00578615 0057860B . 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+0x1C] 0057860F . 51 PUSH ECX 00578610 . FFD6 CALL ESI 00578612 . 83C4 04 ADD ESP,0x4 00578615 > 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+0x18] 00578619 . C74424 38 FFF>MOV DWORD PTR SS:[ESP+0x38],-0x1 00578621 . 83C8 FF OR EAX,0xFFFFFFFF 00578624 . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 00578628 . 0F85 00040000 JNZ 010Edito.00578A2E 0057862E . 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+0x18] 00578632 . 51 PUSH ECX 00578633 . E9 F1030000 JMP 010Edito.00578A29 00578638 > 8B0D CC4D8B00 MOV ECX,DWORD PTR DS:[0x8B4DCC] 0057863E . 68 23400000 PUSH 0x4023 00578643 . 6A 07 PUSH 0x7 00578645 . E8 2F06E9FF CALL 010Edito.00408C79 0057864A . 8B0D CC4D8B00 MOV ECX,DWORD PTR DS:[0x8B4DCC] 00578650 . 8BF8 MOV EDI,EAX 00578652 > 81FF DB000000 CMP EDI,0xDB ; 关键就是edi的值了 00578658 . 75 38 JNZ SHORT 010Edito.00578692 0057865A . 6A FF PUSH -0x1 0057865C . 68 CCC97400 PUSH 010Edito.0074C9CC ; password accepted. thank you for purchasing 010 editor! 00578661 . FFD5 CALL EBP 00578663 . 894424 2C MOV DWORD PTR SS:[ESP+0x2C],EAX 00578667 . 8D5424 2C LEA EDX,DWORD PTR SS:[ESP+0x2C] 0057866B . 52 PUSH EDX 0057866C . C64424 44 0F MOV BYTE PTR SS:[ESP+0x44],0xF 00578671 . E8 E696E8FF CALL 010Edito.00401D5C 00578676 . 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+0x30] 0057867A . 83C4 0C ADD ESP,0xC 0057867D . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 00578682 . 83C9 FF OR ECX,0xFFFFFFFF 00578685 . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 00578689 . 75 73 JNZ SHORT 010Edito.005786FE 0057868B . 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+0x24] 0057868F . 52 PUSH EDX 00578690 . EB 63 JMP SHORT 010Edito.005786F5 00578692 > 81FF ED000000 CMP EDI,0xED 00578698 . 0F84 44020000 JE 010Edito.005788E2 0057869E . 81FF 0C020000 CMP EDI,0x20C 005786A4 . 0F84 38020000 JE 010Edito.005788E2 005786AA . 6A FF PUSH -0x1 005786AC . 81FB 93000000 CMP EBX,0x93 005786B2 . 0F85 AC010000 JNZ 010Edito.00578864 ; 跳到错误 005786B8 . 83FF 71 CMP EDI,0x71 005786BB . 0F85 25010000 JNZ 010Edito.005787E6 005786C1 . 68 88C97400 PUSH 010Edito.0074C988 ; password accepted. your trial period has been extended. 005786C6 . FFD5 CALL EBP 005786C8 . 894424 2C MOV DWORD PTR SS:[ESP+0x2C],EAX 005786CC . 8D4424 2C LEA EAX,DWORD PTR SS:[ESP+0x2C] 005786D0 . 50 PUSH EAX 005786D1 . C64424 44 13 MOV BYTE PTR SS:[ESP+0x44],0x13 005786D6 . E8 8196E8FF CALL 010Edito.00401D5C 005786DB . 8B4C24 30 MOV ECX,DWORD PTR SS:[ESP+0x30] 005786DF . 83C4 0C ADD ESP,0xC 005786E2 . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 005786E7 . 83CA FF OR EDX,0xFFFFFFFF 005786EA . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 005786EE . 75 0E JNZ SHORT 010Edito.005786FE 005786F0 . 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+0x24] 005786F4 . 50 PUSH EAX 005786F5 > FF15 CC978B00 CALL DWORD PTR DS:[<&QtCore4.?free@QStri>; QtCore4.?free@QString@@CAXPAUData@1@@Z 005786FB . 83C4 04 ADD ESP,0x4 005786FE > 8B0D CC4D8B00 MOV ECX,DWORD PTR DS:[0x8B4DCC] 00578704 . E8 C0B5E8FF CALL 010Edito.00403CC9 00578709 . 84C0 TEST AL,AL 0057870B . 0F85 80000000 JNZ 010Edito.00578791 00578711 . 6A FF PUSH -0x1 00578713 . 68 10C97400 PUSH 010Edito.0074C910 ; could not change password. you may need to be logged in as an administrator to change the password. 00578718 . FFD5 CALL EBP 0057871A . 894424 2C MOV DWORD PTR SS:[ESP+0x2C],EAX 0057871E . 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+0x2C] 00578722 . 51 PUSH ECX 00578723 . C64424 44 16 MOV BYTE PTR SS:[ESP+0x44],0x16 00578728 . E8 EA8FE8FF CALL 010Edito.00401717 0057872D . 8B5424 30 MOV EDX,DWORD PTR SS:[ESP+0x30] 00578731 . 8B35 CC978B00 MOV ESI,DWORD PTR DS:[<&QtCore4.?free@QS>; QtCore4.?free@QString@@CAXPAUData@1@@Z 00578737 . 83C4 0C ADD ESP,0xC 0057873A . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 0057873F . 83C8 FF OR EAX,0xFFFFFFFF 00578742 . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 00578746 . 75 0A JNZ SHORT 010Edito.00578752 00578748 . 8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+0x24] 0057874C . 51 PUSH ECX 0057874D . FFD6 CALL ESI 0057874F . 83C4 04 ADD ESP,0x4 00578752 > 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+0x1C] 00578756 . C64424 38 00 MOV BYTE PTR SS:[ESP+0x38],0x0 0057875B . 83C8 FF OR EAX,0xFFFFFFFF 0057875E . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 00578762 . 75 0A JNZ SHORT 010Edito.0057876E 00578764 . 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+0x1C] 00578768 . 51 PUSH ECX 00578769 . FFD6 CALL ESI 0057876B . 83C4 04 ADD ESP,0x4 0057876E > 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+0x18] 00578772 . C74424 38 FFF>MOV DWORD PTR SS:[ESP+0x38],-0x1 0057877A . 83C8 FF OR EAX,0xFFFFFFFF 0057877D . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 00578781 . 0F85 A7020000 JNZ 010Edito.00578A2E 00578787 . 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+0x18] 0057878B . 51 PUSH ECX 0057878C . E9 98020000 JMP 010Edito.00578A29 00578791 > 8B16 MOV EDX,DWORD PTR DS:[ESI] 00578793 . 8B82 CC000000 MOV EAX,DWORD PTR DS:[EDX+0xCC] 00578799 . 8BCE MOV ECX,ESI 0057879B . FFD0 CALL EAX 0057879D . 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+0x1C] 005787A1 . C64424 38 00 MOV BYTE PTR SS:[ESP+0x38],0x0 005787A6 . 83CA FF OR EDX,0xFFFFFFFF 005787A9 . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 005787AD . 75 0E JNZ SHORT 010Edito.005787BD 005787AF . 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+0x1C] 005787B3 . 50 PUSH EAX 005787B4 . FF15 CC978B00 CALL DWORD PTR DS:[<&QtCore4.?free@QStri>; QtCore4.?free@QString@@CAXPAUData@1@@Z 005787BA . 83C4 04 ADD ESP,0x4 005787BD > 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+0x18] 005787C1 . C74424 38 FFF>MOV DWORD PTR SS:[ESP+0x38],-0x1 005787C9 . 83CA FF OR EDX,0xFFFFFFFF 005787CC . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 005787D0 . 0F85 58020000 JNZ 010Edito.00578A2E 005787D6 . 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+0x18] 005787DA . 50 PUSH EAX 005787DB . FF15 CC978B00 CALL DWORD PTR DS:[<&QtCore4.?free@QStri>; QtCore4.?free@QString@@CAXPAUData@1@@Z 005787E1 . E9 45020000 JMP 010Edito.00578A2B 005787E6 > 68 C8C87400 PUSH 010Edito.0074C8C8 ; password accepted but the trial period is already over. 005787EB . FFD5 CALL EBP 005787ED . 894424 2C MOV DWORD PTR SS:[ESP+0x2C],EAX 005787F1 . 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+0x2C] 005787F5 . 51 PUSH ECX 005787F6 . C64424 44 14 MOV BYTE PTR SS:[ESP+0x44],0x14 005787FB . E8 5C95E8FF CALL 010Edito.00401D5C 00578800 . 8B5424 30 MOV EDX,DWORD PTR SS:[ESP+0x30] 00578804 . 8B35 CC978B00 MOV ESI,DWORD PTR DS:[<&QtCore4.?free@QS>; QtCore4.?free@QString@@CAXPAUData@1@@Z 0057880A . 83C4 0C ADD ESP,0xC 0057880D . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 00578812 . 83C8 FF OR EAX,0xFFFFFFFF 00578815 . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 00578819 . 75 0A JNZ SHORT 010Edito.00578825 0057881B . 8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+0x24] 0057881F . 51 PUSH ECX 00578820 . FFD6 CALL ESI 00578822 . 83C4 04 ADD ESP,0x4 00578825 > 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+0x1C] 00578829 . C64424 38 00 MOV BYTE PTR SS:[ESP+0x38],0x0 0057882E . 83C8 FF OR EAX,0xFFFFFFFF 00578831 . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 00578835 . 75 0A JNZ SHORT 010Edito.00578841 00578837 . 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+0x1C] 0057883B . 51 PUSH ECX 0057883C . FFD6 CALL ESI 0057883E . 83C4 04 ADD ESP,0x4 00578841 > 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+0x18] 00578845 . C74424 38 FFF>MOV DWORD PTR SS:[ESP+0x38],-0x1 0057884D . 83C8 FF OR EAX,0xFFFFFFFF 00578850 . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 00578854 . 0F85 D4010000 JNZ 010Edito.00578A2E 0057885A . 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+0x18] 0057885E . 51 PUSH ECX 0057885F . E9 C5010000 JMP 010Edito.00578A29 00578864 > 68 18C87400 PUSH 010Edito.0074C818 ; invalid name or password. please enter your name and password exactly as given when you purchased 010 editor (make sure no quotes are included). 00578869 . FFD5 CALL EBP 0057886B . 894424 2C MOV DWORD PTR SS:[ESP+0x2C],EAX 0057886F . 8D5424 2C LEA EDX,DWORD PTR SS:[ESP+0x2C] 00578873 . 52 PUSH EDX 00578874 . C64424 44 15 MOV BYTE PTR SS:[ESP+0x44],0x15 00578879 . E8 DE94E8FF CALL 010Edito.00401D5C 0057887E . 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+0x30] 00578882 . 8B35 CC978B00 MOV ESI,DWORD PTR DS:[<&QtCore4.?free@QS>; QtCore4.?free@QString@@CAXPAUData@1@@Z 00578888 . 83C4 0C ADD ESP,0xC 0057888B . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 00578890 . 83C9 FF OR ECX,0xFFFFFFFF 00578893 . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 00578897 . 75 0A JNZ SHORT 010Edito.005788A3 00578899 . 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+0x24] 0057889D . 52 PUSH EDX 0057889E . FFD6 CALL ESI 005788A0 . 83C4 04 ADD ESP,0x4 005788A3 > 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+0x1C] 005788A7 . C64424 38 00 MOV BYTE PTR SS:[ESP+0x38],0x0 005788AC . 83C9 FF OR ECX,0xFFFFFFFF 005788AF . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 005788B3 . 75 0A JNZ SHORT 010Edito.005788BF 005788B5 . 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+0x1C] 005788B9 . 52 PUSH EDX 005788BA . FFD6 CALL ESI 005788BC . 83C4 04 ADD ESP,0x4 005788BF > 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+0x18] 005788C3 . C74424 38 FFF>MOV DWORD PTR SS:[ESP+0x38],-0x1 005788CB . 83C9 FF OR ECX,0xFFFFFFFF 005788CE . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 005788D2 . 0F85 56010000 JNZ 010Edito.00578A2E 005788D8 . 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+0x18] 005788DC . 52 PUSH EDX 005788DD . E9 47010000 JMP 010Edito.00578A29 005788E2 > E8 E2B3E8FF CALL 010Edito.00403CC9 005788E7 . 6A FF PUSH -0x1 005788E9 . 8BCE MOV ECX,ESI 005788EB . E8 7AC7E8FF CALL 010Edito.0040506A 005788F0 . 68 C0C77400 PUSH 010Edito.0074C7C0 ; The password you entered is for an earlier version of this program. 005788F5 . 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+0x1C] 005788F9 . FF15 3C978B00 CALL DWORD PTR DS:[<&QtCore4.??4QString@>; QtCore4.??4QString@@QAEAAV0@PBD@Z 005788FF . 837C24 2C 00 CMP DWORD PTR SS:[ESP+0x2C],0x0 00578904 . 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+0x18] 00578908 . 74 07 JE SHORT 010Edito.00578911 0057890A . 68 B8C67400 PUSH 010Edito.0074C6B8 ; tNotchesVisible@QDial@@QAEX_N@Z 0057890F . EB 05 JMP SHORT 010Edito.00578916 00578911 > 68 60C67400 PUSH 010Edito.0074C660 ; You will have to purchase an upgrade to continue using this software. 00578916 > FF15 88978B00 CALL DWORD PTR DS:[<&QtCore4.??YQString@>; QtCore4.?append@QString@@QAEAAV1@PBD@Z 0057891C . 81FF 0C020000 CMP EDI,0x20C 00578922 . 75 0F JNZ SHORT 010Edito.00578933 00578924 . 68 14C67400 PUSH 010Edito.0074C614 ; You may continue to use this program as a trial version. 00578929 . 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+0x1C] 0057892D . FF15 88978B00 CALL DWORD PTR DS:[<&QtCore4.??YQString@>; QtCore4.?append@QString@@QAEAAV1@PBD@Z 00578933 > 68 A0C57400 PUSH 010Edito.0074C5A0 ; If you decide to purchase an upgrade, please click the "Purchase an upgrade" link below or you 00578938 . 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+0x1C] 0057893C . FF15 88978B00 CALL DWORD PTR DS:[<&QtCore4.??YQString@>; QtCore4.?append@QString@@QAEAAV1@PBD@Z 00578942 . 6A FF PUSH -0x1 00578944 . 68 20BA7400 PUSH 010Edito.0074BA20 ; http://www.sweetscape.com/download/previous/ 00578949 . FFD5 CALL EBP 0057894B . 894424 2C MOV DWORD PTR SS:[ESP+0x2C],EAX 0057894F . 8D4424 2C LEA EAX,DWORD PTR SS:[ESP+0x2C] 00578953 . 50 PUSH EAX 00578954 . 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+0x34] 00578958 . 68 50C57400 PUSH 010Edito.0074C550 ; may download previous versions of 010 Editor from the website " 0057895D . 51 PUSH ECX 0057895E . C64424 4C 10 MOV BYTE PTR SS:[ESP+0x4C],0x10 00578963 . E8 268FE8FF CALL 010Edito.0040188E 00578968 . 68 CCB97400 PUSH 010Edito.0074B9CC ; ". Thank you! 0057896D . 50 PUSH EAX 0057896E . 8D5424 48 LEA EDX,DWORD PTR SS:[ESP+0x48] 00578972 . B3 11 MOV BL,0x11 00578974 . 52 PUSH EDX 00578975 . 885C24 58 MOV BYTE PTR SS:[ESP+0x58],BL 00578979 . E8 9F13E9FF CALL 010Edito.00409D1D 0057897E . 83C4 20 ADD ESP,0x20 00578981 . 50 PUSH EAX 00578982 . 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+0x1C] 00578986 . C64424 3C 12 MOV BYTE PTR SS:[ESP+0x3C],0x12 0057898B . FF15 D8978B00 CALL DWORD PTR DS:[<&QtCore4.?append@QSt>; QtCore4.?append@QString@@QAEAAV1@ABV1@@Z 00578991 . 8B4424 2C MOV EAX,DWORD PTR SS:[ESP+0x2C] 00578995 . 8B35 CC978B00 MOV ESI,DWORD PTR DS:[<&QtCore4.?free@QS>; QtCore4.?free@QString@@CAXPAUData@1@@Z 0057899B . 885C24 38 MOV BYTE PTR SS:[ESP+0x38],BL 0057899F . 83C9 FF OR ECX,0xFFFFFFFF 005789A2 . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 005789A6 . 75 0A JNZ SHORT 010Edito.005789B2 005789A8 . 8B5424 2C MOV EDX,DWORD PTR SS:[ESP+0x2C] 005789AC . 52 PUSH EDX 005789AD . FFD6 CALL ESI 005789AF . 83C4 04 ADD ESP,0x4 005789B2 > 8B4424 28 MOV EAX,DWORD PTR SS:[ESP+0x28] 005789B6 . C64424 38 10 MOV BYTE PTR SS:[ESP+0x38],0x10 005789BB . 83C9 FF OR ECX,0xFFFFFFFF 005789BE . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 005789C2 . 75 0A JNZ SHORT 010Edito.005789CE 005789C4 . 8B5424 28 MOV EDX,DWORD PTR SS:[ESP+0x28] 005789C8 . 52 PUSH EDX 005789C9 . FFD6 CALL ESI 005789CB . 83C4 04 ADD ESP,0x4 005789CE > 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+0x24] 005789D2 . C64424 38 01 MOV BYTE PTR SS:[ESP+0x38],0x1 005789D7 . 83C9 FF OR ECX,0xFFFFFFFF 005789DA . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 005789DE . 75 0A JNZ SHORT 010Edito.005789EA 005789E0 . 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+0x24] 005789E4 . 52 PUSH EDX 005789E5 . FFD6 CALL ESI 005789E7 . 83C4 04 ADD ESP,0x4 005789EA > 8D4424 18 LEA EAX,DWORD PTR SS:[ESP+0x18] 005789EE . 50 PUSH EAX 005789EF . E8 6893E8FF CALL 010Edito.00401D5C 005789F4 > 83C4 04 ADD ESP,0x4 005789F7 > 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+0x1C] 005789FB . 83CA FF OR EDX,0xFFFFFFFF 005789FE . C64424 38 00 MOV BYTE PTR SS:[ESP+0x38],0x0 00578A03 . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 00578A07 . 75 0A JNZ SHORT 010Edito.00578A13 00578A09 . 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+0x1C] 00578A0D . 50 PUSH EAX 00578A0E . FFD6 CALL ESI 00578A10 . 83C4 04 ADD ESP,0x4 00578A13 > 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+0x18] 00578A17 . 83CA FF OR EDX,0xFFFFFFFF 00578A1A . 895424 38 MOV DWORD PTR SS:[ESP+0x38],EDX 00578A1E . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 00578A22 . 75 0A JNZ SHORT 010Edito.00578A2E 00578A24 . 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+0x18] 00578A28 . 50 PUSH EAX 00578A29 > FFD6 CALL ESI 00578A2B > 83C4 04 ADD ESP,0x4 00578A2E > 8B4C24 30 MOV ECX,DWORD PTR SS:[ESP+0x30] 00578A32 . 64:890D 00000>MOV DWORD PTR FS:[0],ECX 00578A39 . 59 POP ECX 00578A3A . 5F POP EDI 00578A3B . 5E POP ESI 00578A3C . 5D POP EBP 00578A3D . 5B POP EBX 00578A3E . 83C4 28 ADD ESP,0x28 00578A41 . C3 RETN
QT的这个代码量真是吓死人。
00578144 . 50 PUSH EAX ; QString 对象 用户名 00578145 . C64424 3C 01 MOV BYTE PTR SS:[ESP+0x3C],0x1 0057814A . FFD7 CALL EDI ; <&QtGui4.?text@QLineEdit@@QBE?AVQString@@XZ>
QT中获取QLineEdit中的文本用text()函数 ，该函数返回一个QString的对象。
QString对象大致上是下边的样子：
clsss QString
{
Data* data;
}
struct Data
{
+0
+4
+8 //长度
+0xc //数据地址
+0x10 //
+0x12 //数据 unicode
};这个不必深究，拿到数据就行。
看看验证的函数：
0065FBE0 > \56 PUSH ESI 0065FBE1 . 8BF1 MOV ESI,ECX 0065FBE3 . 837E 2C 00 CMP DWORD PTR DS:[ESI+0x2C],0x0 0065FBE7 . 74 09 JE SHORT 010Edito.0065FBF2 0065FBE9 . B8 13010000 MOV EAX,0x113 0065FBEE . 5E POP ESI 0065FBEF . C2 0800 RETN 0x8 0065FBF2 > 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+0xC] 0065FBF6 . 57 PUSH EDI 0065FBF7 . 8B7C24 0C MOV EDI,DWORD PTR SS:[ESP+0xC] 0065FBFB . 50 PUSH EAX 0065FBFC . 57 PUSH EDI 0065FBFD . E8 099ADAFF CALL 010Edito.0040960B ; 第二次调用 0065FC02 . 83F8 2D CMP EAX,0x2D ; Switch (cases 2D..E7) 0065FC05 . 0F84 99000000 JE 010Edito.0065FCA4 ; 返回DB 就是正确的 0065FC0B . 83F8 4E CMP EAX,0x4E 0065FC0E . 74 70 JE SHORT 010Edito.0065FC80 ; 重新计算 0065FC10 . 3D E7000000 CMP EAX,0xE7 0065FC15 . 74 5F JE SHORT 010Edito.0065FC76 ; 返回177 0065FC17 . 57 PUSH EDI ; Default case of switch 0065FC02 0065FC18 . 8BCE MOV ECX,ESI 0065FC1A . E8 4429DAFF CALL 010Edito.00402563 0065FC1F . 83F8 17 CMP EAX,0x17 ; Switch (cases 17..138) 0065FC22 . 74 48 JE SHORT 010Edito.0065FC6C 0065FC24 . 83F8 2A CMP EAX,0x2A 0065FC27 . 74 26 JE SHORT 010Edito.0065FC4F 0065FC29 . 3D 38010000 CMP EAX,0x138 0065FC2E . 75 46 JNZ SHORT 010Edito.0065FC76 0065FC30 . 8BCE MOV ECX,ESI ; Case 138 of switch 0065FC1F 0065FC32 . E8 E394DAFF CALL 010Edito.0040911A 0065FC37 . 2D A3010000 SUB EAX,0x1A3 0065FC3C . F7D8 NEG EAX 0065FC3E . 1BC0 SBB EAX,EAX 0065FC40 . 25 36FFFFFF AND EAX,0xFFFFFF36 0065FC45 . 5F POP EDI 0065FC46 . 05 F9000000 ADD EAX,0xF9 0065FC4B . 5E POP ESI 0065FC4C . C2 0800 RETN 0x8 0065FC4F > 8BCE MOV ECX,ESI ; Case 2A of switch 0065FC1F 0065FC51 . E8 C494DAFF CALL 010Edito.0040911A 0065FC56 . 2D A3010000 SUB EAX,0x1A3 0065FC5B . F7D8 NEG EAX 0065FC5D . 1BC0 SBB EAX,EAX 0065FC5F . 83E0 7E AND EAX,0x7E 0065FC62 . 5F POP EDI 0065FC63 . 05 F9000000 ADD EAX,0xF9 0065FC68 . 5E POP ESI 0065FC69 . C2 0800 RETN 0x8 0065FC6C > 5F POP EDI ; Case 17 of switch 0065FC1F 0065FC6D . B8 71000000 MOV EAX,0x71 0065FC72 . 5E POP ESI 0065FC73 . C2 0800 RETN 0x8 0065FC76 > 5F POP EDI ; Default case of switch 0065FC1F 0065FC77 . B8 77010000 MOV EAX,0x177 0065FC7C . 5E POP ESI 0065FC7D . C2 0800 RETN 0x8 0065FC80 > 57 PUSH EDI ; Case 4E of switch 0065FC02 0065FC81 . 8BCE MOV ECX,ESI 0065FC83 . E8 DB28DAFF CALL 010Edito.00402563 0065FC88 . 83F8 17 CMP EAX,0x17 0065FC8B . 74 0D JE SHORT 010Edito.0065FC9A 0065FC8D . 5F POP EDI 0065FC8E . 83F8 2A CMP EAX,0x2A 0065FC91 . B8 ED000000 MOV EAX,0xED 0065FC96 . 5E POP ESI 0065FC97 . C2 0800 RETN 0x8 0065FC9A > 5F POP EDI 0065FC9B . B8 0C020000 MOV EAX,0x20C 0065FCA0 . 5E POP ESI 0065FCA1 . C2 0800 RETN 0x8 0065FCA4 > 5F POP EDI ; Case 2D of switch 0065FC02 0065FCA5 . B8 DB000000 MOV EAX,0xDB 0065FCAA . 5E POP ESI 0065FCAB . C2 0800 RETN 0x8
这个函数只有返回DB才能跳到注册成功的地方，所以sub_0040960B 就要返回0x2D;
0065E050 <算法？> > \6A FF PUSH -0x1 ; 算法 0065E052 . 68 49BC7100 PUSH 010Edito.0071BC49 0065E057 . 64:A1 0000000>MOV EAX,DWORD PTR FS:[0] 0065E05D . 50 PUSH EAX 0065E05E . 83EC 18 SUB ESP,0x18 0065E061 . A1 40488B00 MOV EAX,DWORD PTR DS:[0x8B4840] 0065E066 . 33C4 XOR EAX,ESP 0065E068 . 894424 14 MOV DWORD PTR SS:[ESP+0x14],EAX 0065E06C . 53 PUSH EBX 0065E06D . 55 PUSH EBP 0065E06E . 56 PUSH ESI 0065E06F . 57 PUSH EDI 0065E070 . A1 40488B00 MOV EAX,DWORD PTR DS:[0x8B4840] 0065E075 . 33C4 XOR EAX,ESP 0065E077 . 50 PUSH EAX 0065E078 . 8D4424 2C LEA EAX,DWORD PTR SS:[ESP+0x2C] 0065E07C . 64:A3 0000000>MOV DWORD PTR FS:[0],EAX 0065E082 . 8BF1 MOV ESI,ECX 0065E084 . 8B46 04 MOV EAX,DWORD PTR DS:[ESI+0x4] 0065E087 . 33ED XOR EBP,EBP 0065E089 . 8D5E 04 LEA EBX,DWORD PTR DS:[ESI+0x4] 0065E08C . 896E 30 MOV DWORD PTR DS:[ESI+0x30],EBP 0065E08F . 896E 18 MOV DWORD PTR DS:[ESI+0x18],EBP 0065E092 . 896E 34 MOV DWORD PTR DS:[ESI+0x34],EBP 0065E095 . 3968 08 CMP DWORD PTR DS:[EAX+0x8],EBP ; 用户名长度 0065E098 . 0F84 E1020000 JE 010Edito.0065E37F 0065E09E . 8B4E 08 MOV ECX,DWORD PTR DS:[ESI+0x8] 0065E0A1 . 3969 08 CMP DWORD PTR DS:[ECX+0x8],EBP ; 注册码长度 0065E0A4 . 0F84 D5020000 JE 010Edito.0065E37F 0065E0AA . 8D5424 1C LEA EDX,DWORD PTR SS:[ESP+0x1C] 0065E0AE . 52 PUSH EDX 0065E0AF . 8BCE MOV ECX,ESI 0065E0B1 . E8 C4AADAFF CALL 010Edito.00408B7A ; 直接拿到了注册码数值 0012AD78 12 34 56 9C 9A BC DE 00 00 00 0065E0B6 . BF C0BA8A00 MOV EDI,010Edito.008ABAC0 ; 999 0065E0BB . EB 03 JMP SHORT 010Edito.0065E0C0 0065E0BD 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 0065E0C0 > 8B07 MOV EAX,DWORD PTR DS:[EDI] 0065E0C2 . 50 PUSH EAX 0065E0C3 . 8BCB MOV ECX,EBX 0065E0C5 . FF15 58978B00 CALL DWORD PTR DS:[<&QtCore4.??8QString@>; QtCore4.??8QString@@QBE_NPBD@Z 0065E0CB . 84C0 TEST AL,AL 0065E0CD . 0F85 AD010000 JNZ 010Edito.0065E280 0065E0D3 . 83C7 04 ADD EDI,0x4 0065E0D6 . 81FF C4BA8A00 CMP EDI,010Edito.008ABAC4 0065E0DC .^ 7C E2 JL SHORT 010Edito.0065E0C0 0065E0DE . 8A4424 1F MOV AL,BYTE PTR SS:[ESP+0x1F] ; 78位 （1开始） byte3 0065E0E2 . 8A5C24 21 MOV BL,BYTE PTR SS:[ESP+0x21] ; 11,12位 bl=byte5 0065E0E6 . 3C 9C CMP AL,0x9C ; Switch (cases 9C..FC) 0065E0E8 . 75 7A JNZ SHORT 010Edito.0065E164 0065E0EA . 8A5424 23 MOV DL,BYTE PTR SS:[ESP+0x23] ; Dl=byte7; Case 9C of switch 0065E0E6 0065E0EE . 325424 1D XOR DL,BYTE PTR SS:[ESP+0x1D] ; 34位 Byte1 DL=byte7^byte1 0065E0F2 . 8A4C24 22 MOV CL,BYTE PTR SS:[ESP+0x22] ; 13 14位 byte6 0065E0F6 . 324C24 1C XOR CL,BYTE PTR SS:[ESP+0x1C] ; 13 14 与1 2位异或 cl=byte6^byte0 0065E0FA . 66:0FB6C2 MOVZX AX,DL 0065E0FE . 884C24 18 MOV BYTE PTR SS:[ESP+0x18],CL ; cl为13 14位于1 2位异或结果 esp+18=12ad74 0065E102 . B9 00010000 MOV ECX,0x100 0065E107 . 66:0FAFC1 IMUL AX,CX ; (byte7^byte1)*100 0065E10B . 8AD3 MOV DL,BL ; 11 12 bl=byte5 0065E10D . 325424 1E XOR DL,BYTE PTR SS:[ESP+0x1E] ; 11,12与5 6异或 DL=byte5^byte2 0065E111 . 66:0FB6CA MOVZX CX,DL ; cx=byte5^byte2 0065E115 . 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+0x18] 0065E119 . 66:03C1 ADD AX,CX ; (byte7^byte1)*100 + byte5^byte2 0065E11C . 52 PUSH EDX 0065E11D . 0FB7F8 MOVZX EDI,AX 0065E120 . E8 BA8BDAFF CALL 010Edito.00406CDF ; DL=byte6^byte0 0065E125 . 0FB6C0 MOVZX EAX,AL ; AL=(DL^18)+3d)^a7 0065E128 . 57 PUSH EDI ; EDI=(byte7^byte1)*100 + byte5^byte2 0065E129 . 8946 1C MOV DWORD PTR DS:[ESI+0x1C],EAX 0065E12C . E8 3997DAFF CALL 010Edito.0040786A ; AX=(((EDI ^ 0x7892) + 0x4D30) ^ 0x3421) % 11 )==0?eax=(((EDI ^ 0x7892) + 0x4D30) ^ 0x3421) / 11 ):eax=0 0065E131 . 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+0x1C] ; ((byte6^byte0)^18)+3d)^a7 0065E134 . 0FB7C0 MOVZX EAX,AX 0065E137 . 83C4 08 ADD ESP,0x8 0065E13A . 8946 20 MOV DWORD PTR DS:[ESI+0x20],EAX ; EAX=AX=(((((byte7^byte1)*100 + byte5^byte2) ^ 0x7892) + 0x4D30) ^ 0x3421) % 11 )==0?0:eax 0065E13D . 85C9 TEST ECX,ECX ; ECX=((byte6^byte0)^18)+3d)^a7 0065E13F . 0F84 3B010000 JE 010Edito.0065E280 ; ecx!=0 0065E145 . 85C0 TEST EAX,EAX 0065E147 . 0F84 33010000 JE 010Edito.0065E280 ; eax不能等于0 也就是sub_0040786A不能返回0 即使余数不为0(((((byte7^byte1)*100 + byte5^byte2) ^ 0x7892) + 0x4D30) ^ 0x3421) / 11 ) 0065E14D . 3D E8030000 CMP EAX,0x3E8 ; eax不能大于3E8 0065E152 . 0F87 28010000 JA 010Edito.0065E280 ; eax>0 <3e8 0065E158 . 83F9 02 CMP ECX,0x2 ; ECX=((byte6^byte0)^18)+3d)^a7 0065E15B . 1BFF SBB EDI,EDI ; CF位 EDI只能是0或者-1 0065E15D . 23F9 AND EDI,ECX ; ecx>=2 edi=0 ecx<2 edi=ecx 0065E15F . E9 B3000000 JMP 010Edito.0065E217 0065E164 3C FC CMP AL,0xFC 0065E166 75 18 JNZ SHORT 010Edito.0065E180 0065E168 B8 01000000 MOV EAX,0x1 ; Case FC of switch 0065E0E6 0065E16D BF FF000000 MOV EDI,0xFF 0065E172 897E 1C MOV DWORD PTR DS:[ESI+0x1C],EDI 0065E175 8946 20 MOV DWORD PTR DS:[ESI+0x20],EAX 0065E178 8946 30 MOV DWORD PTR DS:[ESI+0x30],EAX 0065E17B E9 97000000 JMP 010Edito.0065E217 0065E180 3C AC CMP AL,0xAC 0065E182 0F85 F8000000 JNZ 010Edito.0065E280 0065E188 8A4C24 23 MOV CL,BYTE PTR SS:[ESP+0x23] ; Case AC of switch 0065E0E6 0065E18C 324C24 1D XOR CL,BYTE PTR SS:[ESP+0x1D] 0065E190 B8 00010000 MOV EAX,0x100 0065E195 66:0FB6D1 MOVZX DX,CL 0065E199 66:0FAFD0 IMUL DX,AX 0065E19D 8ACB MOV CL,BL 0065E19F 324C24 1E XOR CL,BYTE PTR SS:[ESP+0x1E] 0065E1A3 C746 1C 02000>MOV DWORD PTR DS:[ESI+0x1C],0x2 0065E1AA 66:0FB6C1 MOVZX AX,CL 0065E1AE 66:03D0 ADD DX,AX 0065E1B1 0FB7C2 MOVZX EAX,DX 0065E1B4 50 PUSH EAX 0065E1B5 E8 B096DAFF CALL 010Edito.0040786A 0065E1BA 0FB7C0 MOVZX EAX,AX 0065E1BD 83C4 04 ADD ESP,0x4 0065E1C0 8946 20 MOV DWORD PTR DS:[ESI+0x20],EAX 0065E1C3 85C0 TEST EAX,EAX 0065E1C5 0F84 B5000000 JE 010Edito.0065E280 0065E1CB 3D E8030000 CMP EAX,0x3E8 0065E1D0 0F87 AA000000 JA 010Edito.0065E280 0065E1D6 0FB64C24 25 MOVZX ECX,BYTE PTR SS:[ESP+0x25] 0065E1DB 0FB64424 20 MOVZX EAX,BYTE PTR SS:[ESP+0x20] 0065E1E0 0FB6D3 MOVZX EDX,BL 0065E1E3 33CA XOR ECX,EDX 0065E1E5 0FB65424 24 MOVZX EDX,BYTE PTR SS:[ESP+0x24] 0065E1EA 33C2 XOR EAX,EDX 0065E1EC 0FB65424 1C MOVZX EDX,BYTE PTR SS:[ESP+0x1C] 0065E1F1 C1E1 08 SHL ECX,0x8 0065E1F4 03C8 ADD ECX,EAX 0065E1F6 0FB64424 22 MOVZX EAX,BYTE PTR SS:[ESP+0x22] 0065E1FB C1E1 08 SHL ECX,0x8 0065E1FE 33C2 XOR EAX,EDX 0065E200 03C8 ADD ECX,EAX 0065E202 68 278C5B00 PUSH 010Edito.005B8C27 0065E207 51 PUSH ECX 0065E208 E8 7CB3DAFF CALL 010Edito.00409589 0065E20D 8BE8 MOV EBP,EAX ; eax是处理用户名的参数3 不走这里 0065E20F 83C4 08 ADD ESP,0x8 0065E212 896E 34 MOV DWORD PTR DS:[ESI+0x34],EBP 0065E215 8BFD MOV EDI,EBP 0065E217 > 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+0x14] ; 0065E15F处跳过来 0065E21B . 50 PUSH EAX 0065E21C . 8D4E 04 LEA ECX,DWORD PTR DS:[ESI+0x4] 0065E21F . FF15 5C968B00 CALL DWORD PTR DS:[<&QtCore4.?toUtf8@QSt>; QtCore4.?toUtf8@QString@@QBE?AVQByteArray@@XZ 0065E225 . 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+0x14] 0065E229 . C74424 34 000>MOV DWORD PTR SS:[ESP+0x34],0x0 0065E231 . FF15 A8968B00 CALL DWORD PTR DS:[<&QtCore4.?detach@QBy>; QtCore4.?detach@QByteArray@@QAEXXZ 0065E237 . 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14] 0065E23B . 8B41 0C MOV EAX,DWORD PTR DS:[ECX+0xC] 0065E23E . 8B56 20 MOV EDX,DWORD PTR DS:[ESI+0x20] 0065E241 . 33C9 XOR ECX,ECX 0065E243 . 807C24 1F FC CMP BYTE PTR SS:[ESP+0x1F],0xFC 0065E248 . 52 PUSH EDX ; (((((byte7^byte1)*100 + byte5^byte2) ^ 0x7892) + 0x4D30) ^ 0x3421) / 11 ) 0065E249 . 0F95C1 SETNE CL ; if ZF=1 then cl=0 0065E24C . 57 PUSH EDI ; （((byte6^byte0)^18)+3d)^a7 )>=2 ? 0:（((byte6^byte0)^18)+3d)^a7 ) 0065E24D . 51 PUSH ECX ; 是否是FC 0065E24E . 50 PUSH EAX 0065E24F . E8 9846DAFF CALL 010Edito.004028EC ; 处理用户名的 0065E254 . 83C4 10 ADD ESP,0x10 0065E257 . 384424 20 CMP BYTE PTR SS:[ESP+0x20],AL ; 第五字节 910位与al相等 byte5=al 0065E25B . 74 2D JE SHORT 010Edito.0065E28A ; 要相等 0065E25D > 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+0x14] 0065E261 . C74424 34 FFF>MOV DWORD PTR SS:[ESP+0x34],-0x1 0065E269 . 83C8 FF OR EAX,0xFFFFFFFF 0065E26C . F0:0FC102 LOCK XADD DWORD PTR DS:[EDX],EAX 0065E270 . 75 0E JNZ SHORT 010Edito.0065E280 0065E272 . 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14] 0065E276 . 51 PUSH ECX ; /block 0065E277 . FF15 98978B00 CALL DWORD PTR DS:[<&QtCore4.?qFree@@YAX>; \free 0065E27D . 83C4 04 ADD ESP,0x4 0065E280 > B8 E7000000 MOV EAX,0xE7 ; Default case of switch 0065E0E6 0065E285 . E9 FA000000 JMP 010Edito.0065E384 ; 结束 0065E28A > 8BD0 MOV EDX,EAX 0065E28C . C1EA 08 SHR EDX,0x8 0065E28F . 3ADA CMP BL,DL ; 从低往高第二字节等于BL bl=byte5 0065E291 . 74 2D JE SHORT 010Edito.0065E2C0 ; 要相等 0065E293 > 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+0x14] 0065E297 . C74424 34 FFF>MOV DWORD PTR SS:[ESP+0x34],-0x1 0065E29F . 83C9 FF OR ECX,0xFFFFFFFF 0065E2A2 . F0:0FC108 LOCK XADD DWORD PTR DS:[EAX],ECX 0065E2A6 .^ 75 D8 JNZ SHORT 010Edito.0065E280 0065E2A8 . 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+0x14] 0065E2AC . 52 PUSH EDX ; /block 0065E2AD . FF15 98978B00 CALL DWORD PTR DS:[<&QtCore4.?qFree@@YAX>; \free 0065E2B3 . 83C4 04 ADD ESP,0x4 0065E2B6 . B8 E7000000 MOV EAX,0xE7 0065E2BB . E9 C4000000 JMP 010Edito.0065E384 0065E2C0 > 8BC8 MOV ECX,EAX 0065E2C2 . C1E9 10 SHR ECX,0x10 0065E2C5 . 384C24 22 CMP BYTE PTR SS:[ESP+0x22],CL ; 低到高 第3字节等于cl（13,14位）byte6= 0065E2C9 .^ 75 92 JNZ SHORT 010Edito.0065E25D 0065E2CB . 8BD0 MOV EDX,EAX 0065E2CD . C1EA 18 SHR EDX,0x18 0065E2D0 . 385424 23 CMP BYTE PTR SS:[ESP+0x23],DL ; byte7 =用户名返回值最高位 0065E2D4 .^ 75 BD JNZ SHORT 010Edito.0065E293 0065E2D6 . 8A4C24 1F MOV CL,BYTE PTR SS:[ESP+0x1F] ; byte3 0065E2DA . 80F9 9C CMP CL,0x9C ; Switch (cases 9C..FC) 0065E2DD . 75 4E JNZ SHORT 010Edito.0065E32D 0065E2DF . 8B4424 3C MOV EAX,DWORD PTR SS:[ESP+0x3C] ; Case 9C of switch 0065E2DA 0065E2E3 . 83CA FF OR EDX,0xFFFFFFFF 0065E2E6 . 3B46 1C CMP EAX,DWORD PTR DS:[ESI+0x1C] ; ((byte6^byte0)^18)+3d)^a7 必须大于7 这个是用来判断版本的 0065E2E9 > 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14] 0065E2ED . C74424 34 FFF>MOV DWORD PTR SS:[ESP+0x34],-0x1 0065E2F5 . 76 1B JBE SHORT 010Edito.0065E312 0065E2F7 . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 0065E2FB . 75 0E JNZ SHORT 010Edito.0065E30B 0065E2FD . 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+0x14] 0065E301 . 50 PUSH EAX ; /block 0065E302 . FF15 98978B00 CALL DWORD PTR DS:[<&QtCore4.?qFree@@YAX>; \free 0065E308 . 83C4 04 ADD ESP,0x4 0065E30B > B8 4E000000 MOV EAX,0x4E 0065E310 . EB 72 JMP SHORT 010Edito.0065E384 0065E312 > F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 0065E316 . 75 0E JNZ SHORT 010Edito.0065E326 0065E318 . 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+0x14] 0065E31C . 50 PUSH EAX ; /block 0065E31D . FF15 98978B00 CALL DWORD PTR DS:[<&QtCore4.?qFree@@YAX>; \free 0065E323 . 83C4 04 ADD ESP,0x4 0065E326 > B8 2D000000 MOV EAX,0x2D 0065E32B . EB 57 JMP SHORT 010Edito.0065E384 0065E32D > 80F9 FC CMP CL,0xFC 0065E330 . 75 73 JNZ SHORT 010Edito.0065E3A5 0065E332 . 0FB64C24 1E MOVZX ECX,BYTE PTR SS:[ESP+0x1E] ; Case FC of switch 0065E2DA 0065E337 . 0FB65424 1D MOVZX EDX,BYTE PTR SS:[ESP+0x1D] 0065E33C . C1E1 08 SHL ECX,0x8 0065E33F . 50 PUSH EAX 0065E340 . 0FB64424 20 MOVZX EAX,BYTE PTR SS:[ESP+0x20] 0065E345 . 03CA ADD ECX,EDX 0065E347 . C1E1 08 SHL ECX,0x8 0065E34A . 03C8 ADD ECX,EAX 0065E34C . 51 PUSH ECX 0065E34D . E8 37B2DAFF CALL 010Edito.00409589 0065E352 . 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+0x1C] 0065E356 . 83C4 08 ADD ESP,0x8 0065E359 . 83CA FF OR EDX,0xFFFFFFFF 0065E35C . C74424 34 FFF>MOV DWORD PTR SS:[ESP+0x34],-0x1 0065E364 . 85C0 TEST EAX,EAX 0065E366 . 74 55 JE SHORT 010Edito.0065E3BD 0065E368 . 8946 18 MOV DWORD PTR DS:[ESI+0x18],EAX 0065E36B . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 0065E36F . 75 0E JNZ SHORT 010Edito.0065E37F 0065E371 . 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+0x14] 0065E375 . 50 PUSH EAX ; /block 0065E376 . FF15 98978B00 CALL DWORD PTR DS:[<&QtCore4.?qFree@@YAX>; \free 0065E37C . 83C4 04 ADD ESP,0x4 0065E37F > B8 93000000 MOV EAX,0x93 0065E384 > 8B4C24 2C MOV ECX,DWORD PTR SS:[ESP+0x2C] 0065E388 . 64:890D 00000>MOV DWORD PTR FS:[0],ECX 0065E38F . 59 POP ECX 0065E390 . 5F POP EDI 0065E391 . 5E POP ESI 0065E392 . 5D POP EBP 0065E393 . 5B POP EBX 0065E394 . 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14] 0065E398 . 33CC XOR ECX,ESP 0065E39A . E8 03330700 CALL 010Edito.006D16A2 0065E39F . 83C4 24 ADD ESP,0x24 0065E3A2 . C2 0800 RETN 0x8 0065E3A5 > 80F9 AC CMP CL,0xAC 0065E3A8 . 75 04 JNZ SHORT 010Edito.0065E3AE 0065E3AA . 85ED TEST EBP,EBP ; Case AC of switch 0065E2DA 0065E3AC . 75 2E JNZ SHORT 010Edito.0065E3DC 0065E3AE > 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14] ; Default case of switch 0065E2DA 0065E3B2 . C74424 34 FFF>MOV DWORD PTR SS:[ESP+0x34],-0x1 0065E3BA . 83CA FF OR EDX,0xFFFFFFFF 0065E3BD > F0:0FC111 LOCK XADD DWORD PTR DS:[ECX],EDX 0065E3C1 .^ 0F85 B9FEFFFF JNZ 010Edito.0065E280 0065E3C7 . 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+0x14] 0065E3CB . 50 PUSH EAX ; /block 0065E3CC . FF15 98978B00 CALL DWORD PTR DS:[<&QtCore4.?qFree@@YAX>; \free 0065E3D2 . 83C4 04 ADD ESP,0x4 0065E3D5 . B8 E7000000 MOV EAX,0xE7 0065E3DA .^ EB A8 JMP SHORT 010Edito.0065E384 0065E3DC > 83CA FF OR EDX,0xFFFFFFFF 0065E3DF . 396C24 40 CMP DWORD PTR SS:[ESP+0x40],EBP 0065E3E3 .^ E9 01FFFFFF JMP 010Edito.0065E2E9
这个就是算法，正确的流程大致是这样的：
1.首先检查用户名长度和注册码长度，等于0函数就退了。
2.转换注册码格式：从字符串转换成数值，貌似只能是0-9 a-f之间的字符。。。
注册码：“1234-5678-9abc-deff”
转换之后 12 34 56 78 9a bc de ff 00 00
程序中好像是一个10字节的数组来存放转换后的数值的。假设数组是
char szPass[10]={0x12,0x34,0x56,0x78,0x9a,0xbc,0xff,0,0}
3.接着先比较szPass[3] 是不是0x9c 不是就比较是否是FC和AC（后边两种情况略过。）
4.对注册码做运算得到两个值：
Num1=((szPass[6]^szPass[0])^0x18)+0x3d)^a7;
Num2=(((((szPass[7]^szPass[1])*100 +szPass[5]^szPass[2]) ^ 0x7892) + 0x4D30) ^ 0x3421)
Num2 %11==0 ? Num2=Num2/11 : Num2=0
接着就判断Num1是否为0 (正确流程不为0)
Num是否等于0 是否大于0x3E8 正确流程应该是在[1,1000）之间。
5.接着调用 sub_004028EC (jmp 0065C500)
该函数的作用是通过用户名计算出来一个值。
0065C500 > \8B4424 04 MOV EAX,DWORD PTR SS:[ESP+0x4] ; 参数1 用户名 0065C504 . 83EC 0C SUB ESP,0xC 0065C507 . 53 PUSH EBX 0065C508 . 55 PUSH EBP 0065C509 . 33DB XOR EBX,EBX 0065C50B . 33ED XOR EBP,EBP 0065C50D . 8D50 01 LEA EDX,DWORD PTR DS:[EAX+0x1] 0065C510 > 8A08 MOV CL,BYTE PTR DS:[EAX] 0065C512 . 40 INC EAX 0065C513 . 84C9 TEST CL,CL 0065C515 .^ 75 F9 JNZ SHORT 010Edito.0065C510 0065C517 . 2BC2 SUB EAX,EDX ; 求用户名长度 0065C519 . 3BC3 CMP EAX,EBX 0065C51B . 894424 10 MOV DWORD PTR SS:[ESP+0x10],EAX 0065C51F . 0F8E 09010000 JLE 010Edito.0065C62E 0065C525 . 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+0x24] ; 参数4 0065C529 . 56 PUSH ESI 0065C52A . 57 PUSH EDI 0065C52B . 8BF8 MOV EDI,EAX 0065C52D . C1E7 04 SHL EDI,0x4 0065C530 . 2BF8 SUB EDI,EAX ; edi=参数4<<4-参数4 0065C532 . 8B4424 28 MOV EAX,DWORD PTR SS:[ESP+0x28] ; 参数3 0065C536 . 8BF0 MOV ESI,EAX 0065C538 . C1E6 04 SHL ESI,0x4 0065C53B . 895C24 14 MOV DWORD PTR SS:[ESP+0x14],EBX 0065C53F . 895C24 10 MOV DWORD PTR SS:[ESP+0x10],EBX 0065C543 . 03F0 ADD ESI,EAX ; esi=参数3<<4 +参数3 0065C545 > 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+0x20] ; 参数1 字符串 0065C549 . 0FB60C03 MOVZX ECX,BYTE PTR DS:[EBX+EAX] ; ebx计数器 初值0 0065C54D . 51 PUSH ECX ; /c 0065C54E . FF15 60908B00 CALL DWORD PTR DS:[<&MSVCR90.toupper>>; \toupper 0065C554 . 83C4 04 ADD ESP,0x4 0065C557 . 837C24 24 00 CMP DWORD PTR SS:[ESP+0x24],0x0 ; 参数2 isNotFc 0065C55C . 74 5B JE SHORT 010Edito.0065C5B9 0065C55E . 8B0C85 F0B58A>MOV ECX,DWORD PTR DS:[EAX*4+0x8AB5F0] 0065C565 . 8D50 0D LEA EDX,DWORD PTR DS:[EAX+0xD] 0065C568 . 81E2 FF000000 AND EDX,0xFF 0065C56E . 03CD ADD ECX,EBP 0065C570 . 330C95 F0B58A>XOR ECX,DWORD PTR DS:[EDX*4+0x8AB5F0] 0065C577 . 83C0 2F ADD EAX,0x2F 0065C57A . 25 FF000000 AND EAX,0xFF 0065C57F . 0FAF0C85 F0B5>IMUL ECX,DWORD PTR DS:[EAX*4+0x8AB5F0> 0065C587 . 8BD6 MOV EDX,ESI 0065C589 . 81E2 FF000000 AND EDX,0xFF 0065C58F . 030C95 F0B58A>ADD ECX,DWORD PTR DS:[EDX*4+0x8AB5F0] 0065C596 . 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+0x10] 0065C59A . 8BC7 MOV EAX,EDI 0065C59C . 25 FF000000 AND EAX,0xFF 0065C5A1 . 030C85 F0B58A>ADD ECX,DWORD PTR DS:[EAX*4+0x8AB5F0] 0065C5A8 . 81E2 FF000000 AND EDX,0xFF 0065C5AE . 030C95 F0B58A>ADD ECX,DWORD PTR DS:[EDX*4+0x8AB5F0] 0065C5B5 . 8BE9 MOV EBP,ECX 0065C5B7 . EB 58 JMP SHORT 010Edito.0065C611 0065C5B9 > 8B1485 F0B58A>MOV EDX,DWORD PTR DS:[EAX*4+0x8AB5F0] 0065C5C0 . 8D48 3F LEA ECX,DWORD PTR DS:[EAX+0x3F] 0065C5C3 . 03D5 ADD EDX,EBP 0065C5C5 . 83C0 17 ADD EAX,0x17 0065C5C8 . 81E1 FF000000 AND ECX,0xFF 0065C5CE . 33148D F0B58A>XOR EDX,DWORD PTR DS:[ECX*4+0x8AB5F0] 0065C5D5 . 25 FF000000 AND EAX,0xFF 0065C5DA . 0FAF1485 F0B5>IMUL EDX,DWORD PTR DS:[EAX*4+0x8AB5F0> 0065C5E2 . 8BC6 MOV EAX,ESI 0065C5E4 . 25 FF000000 AND EAX,0xFF 0065C5E9 . 031485 F0B58A>ADD EDX,DWORD PTR DS:[EAX*4+0x8AB5F0] 0065C5F0 . 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+0x14] 0065C5F4 . 8BCF MOV ECX,EDI 0065C5F6 . 81E1 FF000000 AND ECX,0xFF 0065C5FC . 03148D F0B58A>ADD EDX,DWORD PTR DS:[ECX*4+0x8AB5F0] 0065C603 . 25 FF000000 AND EAX,0xFF 0065C608 . 031485 F0B58A>ADD EDX,DWORD PTR DS:[EAX*4+0x8AB5F0] 0065C60F . 8BEA MOV EBP,EDX 0065C611 > 834424 10 13 ADD DWORD PTR SS:[ESP+0x10],0x13 0065C616 . 834424 14 07 ADD DWORD PTR SS:[ESP+0x14],0x7 0065C61B . 43 INC EBX 0065C61C . 83C6 09 ADD ESI,0x9 0065C61F . 83C7 0D ADD EDI,0xD 0065C622 . 3B5C24 18 CMP EBX,DWORD PTR SS:[ESP+0x18] 0065C626 .^ 0F8C 19FFFFFF JL 010Edito.0065C545 0065C62C . 5F POP EDI 0065C62D . 5E POP ESI 0065C62E > 8BC5 MOV EAX,EBP 0065C630 . 5D POP EBP 0065C631 . 5B POP EBX 0065C632 . 83C4 0C ADD ESP,0xC 0065C635 . C3 RETN
该函数有四个参数：
参数1：【char* 类型】用户名字符串，不用多说
参数2：【int 类型】根据szPass[3]的值决定。如果szPass[3]=0xFC 这个值是0 否则1
参数3：【BYTE 类型】这个可能是软件版本号。根据Num1得来，程序中只要Num1>2 这个就是0，下边还有判断Num1的地方要求Num1必须大于7
1.——————————————————————————
0065E158 . 83F9 02 CMP ECX,0x2 ; ECX=((byte6^byte0)^18)+3d)^a7
0065E15B . 1BFF SBB EDI,EDI ; CF位 EDI只能是0或者-1
0065E15D . 23F9 AND EDI,ECX ; ecx>=2 edi=0 ecx<2 edi=ecx
2.——————————————————————————
0065E2E6 . 3B46 1C CMP EAX,DWORD PTR DS:[ESI+0x1C] ; ((byte6^byte0)^18)+3d)^a7 必须大于7 这个是用来判断版本的
参数4：【BYTE/WORD类型】类型有点不确定。这个值跟用户数量有关。
传入的就是Num2的值。
这个函数对用的C代码：
int sub_65C500(const char *pszName, int isNotFC, BYTE a3, BYTE a4)
{
unsigned int i; // ebx@1
int nRet; // ebp@1
BYTE v6; // di@2
BYTE v7; // si@2
int cNameByte; // eax@3
BYTE v10; // [sp+8h] [bp-Ch]@2
BYTE var_8; // [sp+Ch] [bp-8h]@2
unsigned int nNameLen; // [sp+10h] [bp-4h]@1
DWORD* pDwData=(DWORD*)data;
i = 0;
nRet = 0;
nNameLen = strlen(pszName);
if ( nNameLen > 0 )
{
v6 = 15 * a4;
var_8 = 0;
v10 = 0;
v7 = 17 * a3;
do
{
cNameByte = toupper(pszName[i]);
if ( isNotFC ) // 7 8位不是FC这里是1 是的话就是0
nRet = pDwData[v10]
+ pDwData[v6]
+ pDwData[v7]
+ pDwData[(cNameByte + 0x2F)] * (pDwData[(cNameByte + 0xD)] ^ (nRet + pDwData[cNameByte]));
else
nRet = pDwData[var_8]
+ pDwData[v6]
+ pDwData[v7]
+ pDwData[(cNameByte + 0x17)] * (pDwData[(cNameByte + 0x3F)] ^ (nRet + pDwData[cNameByte]));
v10 += 19;
var_8 += 7;
++i;
v7 += 9;
v6 += 13;
}
while ( i < nNameLen );
}
return nRet;
}Table在地址0x8AB5F0处大概也就1024字节这么大了。Table内容见附件内的全局数组。
这个函数返回一个int类型的值，从高到地假如是0xAABBCCDD
（注意这里的AA并不表示数值一定是11 22 33这样的）
接着就是比较AA是否等于szPass[7]
接着就是比较BB是否等于szPass[6]
接着就是比较CC是否等于szPass[5]
接着就是比较DD是否等于szPass[4]
正确流程要求上述四个值全部相等。
整个正确流程就是这样，正确的话最后返回0x2D。
流程分析完，就是注册机的事了，具体的内容看附件吧。
判断用户数量的在sub_00573090 处，有兴趣的可以跟下。
【后记】
只是对QT感兴趣，还请作者不要见怪！
简单注册机：
Editor.zip
