关于金山毒霸2001序列号机的一点补充 (8千字)
今天突然想起金山毒霸2001序列号机还没有完成，就对update.exe进行跟踪，终于找到如下：* Referenced by a CALL at Address:
|:00418ABF
|
:0040875E 83257C15430000 and dword ptr [0043157C], 00000000
:00408765 53 push ebx
:00408766 56 push esi
* Reference To: MSVCRT._strnicmp, Ord:0000h
|
:00408767 8B3530E64100 mov esi, dword ptr [0041E630]
:0040876D 57 push edi
:0040876E 8B7C2410 mov edi, dword ptr [esp+10]
:00408772 6A06 push 00000006
* Possible StringData Ref from Data Obj ->"KAV00-"<—就是这个啦！
:00408774 68F4F64200 push 0042F6F4
:00408779 57 push edi
:0040877A FFD6 call esi
:0040877C 83C40C add esp, 0000000C
:0040877F 85C0 test eax, eax
:00408781 7411 je 00408794
:00408783 6A06 push 00000006
* Possible StringData Ref from Data Obj ->"KAV02-"-"<—就是这个啦！
|
:00408785 68ECF64200 push 0042F6EC
:0040878A 57 push edi
:0040878B FFD6 call esi
:0040878D 83C40C add esp, 0000000C
:00408790 85C0 test eax, eax
:00408792 7511 jne 004087A5
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408781(C)
|
:00408794 C7057C15430001000000 mov dword ptr [0043157C], 00000001
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004087D4(U), :004087F0(U), :0040880C(U), :00408828(U), :0040886E(U)
|:00408886(U), :0040889E(U), :004088B2(U), :004088CA(U), :004088E9(C)
|
:0040879E 6A01 push 00000001
:004087A0 58 pop eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004088F1(U)
|
:004087A1 5F pop edi
:004087A2 5E pop esi
:004087A3 5B pop ebx
:004087A4 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408792(C)
|
:004087A5 6A06 push 00000006
* Possible StringData Ref from Data Obj ->"KAV01-"-"<—就是这个啦！
|
:004087A7 68E4F64200 push 0042F6E4
:004087AC 57 push edi
:004087AD FFD6 call esi
:004087AF 83C40C add esp, 0000000C
:004087B2 6A04 push 00000004
:004087B4 5B pop ebx
:004087B5 85C0 test eax, eax
:004087B7 0F8497000000 je 00408854
:004087BD 6A06 push 00000006
* Possible StringData Ref from Data Obj ->"KAVFF-"-"<—就是这个啦！
|
:004087BF 68DCF64200 push 0042F6DC
:004087C4 57 push edi
:004087C5 FFD6 call esi
:004087C7 83C40C add esp, 0000000C
:004087CA 85C0 test eax, eax
:004087CC 7508 jne 004087D6
:004087CE 891D7C154300 mov dword ptr [0043157C], ebx
:004087D4 EBC8 jmp 0040879E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004087CC(C)
|
:004087D6 53 push ebx
* Possible StringData Ref from Data Obj ->"1006"-"<—就是这个啦！
|
:004087D7 68D4F64200 push 0042F6D4
:004087DC 57 push edi
:004087DD FFD6 call esi
:004087DF 83C40C add esp, 0000000C
:004087E2 85C0 test eax, eax
:004087E4 750C jne 004087F2
:004087E6 C7057C15430008000000 mov dword ptr [0043157C], 00000008
:004087F0 EBAC jmp 0040879E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004087E4(C)
|
:004087F2 53 push ebx
* Possible StringData Ref from Data Obj ->"1007"-"<—就是这个啦！
|
:004087F3 68CCF64200 push 0042F6CC
:004087F8 57 push edi
:004087F9 FFD6 call esi
:004087FB 83C40C add esp, 0000000C
:004087FE 85C0 test eax, eax
:00408800 750C jne 0040880E
:00408802 C7057C15430000020000 mov dword ptr [0043157C], 00000200
:0040880C EB90 jmp 0040879E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408800(C)
|
:0040880E 53 push ebx
* Possible StringData Ref from Data Obj ->"1010"-"<—就是这个啦！
|
:0040880F 68C4F64200 push 0042F6C4
:00408814 57 push edi
:00408815 FFD6 call esi
:00408817 83C40C add esp, 0000000C
:0040881A 85C0 test eax, eax
:0040881C 750F jne 0040882D
:0040881E C7057C15430000010000 mov dword ptr [0043157C], 00000100
:00408828 E971FFFFFF jmp 0040879E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040881C(C)
|
:0040882D 53 push ebx
* Possible StringData Ref from Data Obj ->"1011"-"<—就是这个啦！
|
:0040882E 68BCF64200 push 0042F6BC
:00408833 57 push edi
:00408834 FFD6 call esi
:00408836 83C40C add esp, 0000000C
:00408839 85C0 test eax, eax
:0040883B 750A jne 00408847
:0040883D C7057C15430008000000 mov dword ptr [0043157C], 00000008
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040883B(C)
|
:00408847 833D7C15430002 cmp dword ptr [0043157C], 00000002
:0040884E 0F858E000000 jne 004088E2
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004087B7(C)
|
:00408854 83257C15430000 and dword ptr [0043157C], 00000000
:0040885B E802620000 call 0040EA62
:00408860 85C0 test eax, eax
:00408862 740F je 00408873
:00408864 C7057C15430002000000 mov dword ptr [0043157C], 00000002
:0040886E E92BFFFFFF jmp 0040879E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408862(C)
|
:00408873 E80F610000 call 0040E987
:00408878 85C0 test eax, eax
:0040887A 740F je 0040888B
:0040887C C7057C15430010000000 mov dword ptr [0043157C], 00000010
:00408886 E913FFFFFF jmp 0040879E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040887A(C)
|
:0040888B E889610000 call 0040EA19
:00408890 85C0 test eax, eax
:00408892 740F je 004088A3
:00408894 C7057C15430020000000 mov dword ptr [0043157C], 00000020
:0040889E E9FBFEFFFF jmp 0040879E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408892(C)
|
:004088A3 E828610000 call 0040E9D0
:004088A8 85C0 test eax, eax
:004088AA 740B je 004088B7
:004088AC 891D7C154300 mov dword ptr [0043157C], ebx
:004088B2 E9E7FEFFFF jmp 0040879E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004088AA(C)
|
:004088B7 E8EF610000 call 0040EAAB
:004088BC 85C0 test eax, eax
:004088BE 740F je 004088CF
:004088C0 C7057C15430040000000 mov dword ptr [0043157C], 00000040
:004088CA E9CFFEFFFF jmp 0040879E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004088BE(C)
|
:004088CF E820620000 call 0040EAF4
:004088D4 85C0 test eax, eax
:004088D6 740A je 004088E2
只要序列号前6或者4位和上面标出的相同就可以了，其他的可以随你填，但不包括后面12位，序列号器我就不编了。
详见：http://www.chat001.com/forum/crackforum/20274.html
