password2000 v2.7.0 (22千字)
http://newhua.ruyi.com/down/p2k270.exe这个软件其实算法并不难,翻来覆去的用同一个call,作者只是报定了一个宗旨：烦死你！
呵呵，有兴趣的人自己看吧 ... ...
===============================================================================================
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C446(C)
|
:0041C3BA 6A08 push 00000008
:0041C3BC 8D4C2420 lea ecx, dword ptr [esp+20]
:0041C3C0 55 push ebp
:0041C3C1 51 push ecx
:0041C3C2 8D4C2458 lea ecx, dword ptr [esp+58]
:0041C3C6 E82BCA0100 call 00438DF6<-----------------------------取用户名的前8位
:0041C3CB 50 push eax
:0041C3CC 8D4C2414 lea ecx, dword ptr [esp+14]
:0041C3D0 C644244005 mov [esp+40], 05
:0041C3D5 E8D6300200 call 0043F4B0
:0041C3DA 8D4C241C lea ecx, dword ptr [esp+1C]
:0041C3DE 885C243C mov byte ptr [esp+3C], bl
:0041C3E2 E8902F0200 call 0043F377
:0041C3E7 51 push ecx
:0041C3E8 8D542414 lea edx, dword ptr [esp+14]
:0041C3EC 8BCC mov ecx, esp
:0041C3EE 89642430 mov dword ptr [esp+30], esp
:0041C3F2 52 push edx
:0041C3F3 E8F42C0200 call 0043F0EC
:0041C3F8 51 push ecx
:0041C3F9 8D442450 lea eax, dword ptr [esp+50]
:0041C3FD 8BCC mov ecx, esp
:0041C3FF 89642438 mov dword ptr [esp+38], esp
:0041C403 50 push eax
:0041C404 C644244806 mov [esp+48], 06
:0041C409 E8DE2C0200 call 0043F0EC
:0041C40E 8D4C2428 lea ecx, dword ptr [esp+28]
:0041C412 885C2444 mov byte ptr [esp+44], bl
:0041C416 51 push ecx
:0041C417 8BCE mov ecx, esi
:0041C419 E862FBFFFF call 0041BF80<-------------(1)---------计算(由用户名前8位),算法详见下
:0041C41E 50 push eax<------------------------------call(1)的结果1943803359447161397
:0041C41F 8D4C2418 lea ecx, dword ptr [esp+18]
:0041C423 C644244007 mov [esp+40], 07
:0041C428 E862330200 call 0043F78F
:0041C42D 8D4C2420 lea ecx, dword ptr [esp+20]
:0041C431 885C243C mov byte ptr [esp+3C], bl
:0041C435 E83D2F0200 call 0043F377
:0041C43A 8B442418 mov eax, dword ptr [esp+18]
:0041C43E 83C508 add ebp, 00000008
:0041C441 48 dec eax
:0041C442 89442418 mov dword ptr [esp+18], eax
:0041C446 0F856EFFFFFF jne 0041C3BA
:0041C44C 8B6C2424 mov ebp, dword ptr [esp+24]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C3AE(C)
|
:0041C450 8D14FD00000000 lea edx, dword ptr [8*edi+00000000]
:0041C457 55 push ebp
:0041C458 8D442428 lea eax, dword ptr [esp+28]
:0041C45C 52 push edx
:0041C45D 50 push eax
:0041C45E 8D4C2458 lea ecx, dword ptr [esp+58]
:0041C462 E88FC90100 call 00438DF6<-----------------------------取用户名的后5位
:0041C467 50 push eax
:0041C468 8D4C2414 lea ecx, dword ptr [esp+14]
:0041C46C C644244008 mov [esp+40], 08
:0041C471 E83A300200 call 0043F4B0
:0041C476 8D4C2424 lea ecx, dword ptr [esp+24]
:0041C47A 885C243C mov byte ptr [esp+3C], bl
:0041C47E E8F42E0200 call 0043F377
:0041C483 51 push ecx
:0041C484 8D542414 lea edx, dword ptr [esp+14]
:0041C488 8BCC mov ecx, esp
:0041C48A 89642434 mov dword ptr [esp+34], esp
:0041C48E 52 push edx
:0041C48F E8582C0200 call 0043F0EC
:0041C494 51 push ecx
:0041C495 8D442450 lea eax, dword ptr [esp+50]
:0041C499 8BCC mov ecx, esp
:0041C49B 89642434 mov dword ptr [esp+34], esp
:0041C49F 50 push eax
:0041C4A0 C644244809 mov [esp+48], 09
:0041C4A5 E8422C0200 call 0043F0EC
:0041C4AA 8D4C242C lea ecx, dword ptr [esp+2C]
:0041C4AE 885C2444 mov byte ptr [esp+44], bl
:0041C4B2 51 push ecx
:0041C4B3 8BCE mov ecx, esi
:0041C4B5 E8C6FAFFFF call 0041BF80<-------------(2)---------计算(由用户名后5位),算法同call (1)
:0041C4BA 50 push eax<------------------------------call(2)的结果1056146343234067490
:0041C4BB 8D4C2418 lea ecx, dword ptr [esp+18]
:0041C4BF C64424400A mov [esp+40], 0A
:0041C4C4 E8C6320200 call 0043F78F<----------------------合并call(1)和call(2)的结果
:0041C4C9 8D4C2424 lea ecx, dword ptr [esp+24] 9438033594471613971056146343234067490
:0041C4CD 885C243C mov byte ptr [esp+3C], bl
:0041C4D1 E8A12E0200 call 0043F377
:0041C4D6 51 push ecx
:0041C4D7 8D542418 lea edx, dword ptr [esp+18]
:0041C4DB 8BCC mov ecx, esp
:0041C4DD 89642434 mov dword ptr [esp+34], esp
:0041C4E1 52 push edx
:0041C4E2 E8052C0200 call 0043F0EC
:0041C4E7 8B7C2448 mov edi, dword ptr [esp+48]
:0041C4EB 8BCE mov ecx, esi
:0041C4ED 57 push edi
:0041C4EE E85DFDFFFF call 0041C250<-------------(3)------根据合并后的数计算出最终注册码
:0041C4F3 BB01000000 mov ebx, 00000001
:0041C4F8 895C2428 mov dword ptr [esp+28], ebx
:0041C4FC 8D4C2414 lea ecx, dword ptr [esp+14]
:0041C500 C644243C03 mov [esp+3C], 03
:0041C505 E86D2E0200 call 0043F377
:0041C50A 8D4C2410 lea ecx, dword ptr [esp+10]
:0041C50E C644243C02 mov [esp+3C], 02
:0041C513 E85F2E0200 call 0043F377
:0041C518 8D4C2448 lea ecx, dword ptr [esp+48]
:0041C51C 885C243C mov byte ptr [esp+3C], bl
:0041C520 E8522E0200 call 0043F377
:0041C525 8D4C244C lea ecx, dword ptr [esp+4C]
:0041C529 C644243C00 mov [esp+3C], 00
:0041C52E E8442E0200 call 0043F377
:0041C533 8B4C2434 mov ecx, dword ptr [esp+34]
:0041C537 8BC7 mov eax, edi
:0041C539 5F pop edi
:0041C53A 5E pop esi
:0041C53B 5D pop ebp
:0041C53C 64890D00000000 mov dword ptr fs:[00000000], ecx
:0041C543 5B pop ebx
:0041C544 83C430 add esp, 00000030
:0041C547 C20C00 ret 000C<---------------------------返回
==============================================================================================
* Referenced by a CALL at Addresses:<------------------------------------call (1)(2)(3.1)
|:0041BE59 , :0041BEF5 , :0041C2D9 , :0041C419 , :0041C4B5
|:0041C83E
|
* Possible Reference to Dialog: DialogID_01BF, CONTROL_ID:00FF, ""
|
:0041BF80 6AFF push FFFFFFFF
:0041BF82 680FCE4500 push 0045CE0F
:0041BF87 64A100000000 mov eax, dword ptr fs:[00000000]
:0041BF8D 50 push eax
:0041BF8E 64892500000000 mov dword ptr fs:[00000000], esp
:0041BF95 83EC38 sub esp, 00000038
:0041BF98 55 push ebp
:0041BF99 56 push esi
:0041BF9A 57 push edi
:0041BF9B 8BE9 mov ebp, ecx
:0041BF9D C744242C00000000 mov [esp+2C], 00000000
:0041BFA5 8D442458 lea eax, dword ptr [esp+58]<-----8430110010883617(固定数字)
... ... 略 ... ...
:0041C188 E873F9FFFF call 0041BB00<---------------------(1.1)(2.1)(3.1.1),跟入
:0041C18D 57 push edi<--------------------------447161397
:0041C18E 8D442418 lea eax, dword ptr [esp+18]
:0041C192 56 push esi<--------------------------1943803359
:0041C193 50 push eax
:0041C194 E80D340200 call 0043F5A6<---------------------合并
:0041C199 8B742454 mov esi, dword ptr [esp+54]
:0041C19D 8D4C2414 lea ecx, dword ptr [esp+14]<-------合并后1943803359447161397
... ... 略 ... ...
:0041C247 C20C00 ret 000C
=================================================================================================
* Referenced by a CALL at Address:<---------------------------------call (1.1)(2.1)(3.1.1)
|:0041C188
|
* Possible Reference to Dialog: DialogID_01BF, CONTROL_ID:00FF, ""
|
:0041BB00 6AFF push FFFFFFFF
:0041BB02 68B0CC4500 push 0045CCB0
:0041BB07 64A100000000 mov eax, dword ptr fs:[00000000]
:0041BB0D 50 push eax
:0041BB0E 64892500000000 mov dword ptr fs:[00000000], esp
:0041BB15 83EC10 sub esp, 00000010
:0041BB18 53 push ebx
:0041BB19 55 push ebp
:0041BB1A 56 push esi
:0041BB1B 57 push edi
:0041BB1C 8BD9 mov ebx, ecx
:0041BB1E 51 push ecx
:0041BB1F 8D442434 lea eax, dword ptr [esp+34]<----------lanc
:0041BB23 8BCC mov ecx, esp
:0041BB25 89642420 mov dword ptr [esp+20], esp
:0041BB29 50 push eax
:0041BB2A C744243005000000 mov [esp+30], 00000005
:0041BB32 E8B5350200 call 0043F0EC
:0041BB37 8BCB mov ecx, ebx
:0041BB39 E852010000 call 0041BC90<-----(1.1.1)(2.1.1)(3.1.1.1)-----0x40f3abfb,算法见下
:0041BB3E 51 push ecx
:0041BB3F 8D542438 lea edx, dword ptr [esp+38]<----------elot
:0041BB43 8BCC mov ecx, esp
:0041BB45 89642420 mov dword ptr [esp+20], esp
:0041BB49 52 push edx
:0041BB4A 8BF0 mov esi, eax<-------------------------0x40f3abfb
:0041BB4C E89B350200 call 0043F0EC
:0041BB51 8BCB mov ecx, ebx
:0041BB53 E838010000 call 0041BC90<------(1.1.2)(2.1.2)(3.1.1.2)----0x8a83570c,算法见下
:0041BB58 8BF8 mov edi, eax<-------------------------0x8a83570c
:0041BB5A 8B442438 mov eax, dword ptr [esp+38]<----------8430
:0041BB5E 50 push eax
:0041BB5F E855D50000 call 004290B9<------------------------转换成16进制,8430==0x20ee
:0041BB64 8B4C2440 mov ecx, dword ptr [esp+40]<----------1100
:0041BB68 89442414 mov dword ptr [esp+14], eax
:0041BB6C 51 push ecx
:0041BB6D E847D50000 call 004290B9<------------------------转换成16进制,1100==0x44c
:0041BB72 8B542448 mov edx, dword ptr [esp+48]<----------1088
:0041BB76 8944241C mov dword ptr [esp+1C], eax
:0041BB7A 52 push edx
:0041BB7B E839D50000 call 004290B9<------------------------转换成16进制,1088==0x440
:0041BB80 89442424 mov dword ptr [esp+24], eax
:0041BB84 8B442450 mov eax, dword ptr [esp+50]<----------3617
:0041BB88 50 push eax
:0041BB89 E82BD50000 call 004290B9<------------------------转换成16进制,3617==0xe21
:0041BB8E 83C410 add esp, 00000010
:0041BB91 8944241C mov dword ptr [esp+1C], eax
:0041BB95 33C9 xor ecx, ecx
:0041BB97 BA20000000 mov edx, 00000020
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BBE1(C)
|
:0041BB9C 8B6C2410 mov ebp, dword ptr [esp+10]<----------0x20ee
:0041BBA0 8BC7 mov eax, edi<-------------------------0x8a83570c
:0041BBA2 C1E004 shl eax, 04<--------------------------0x8a83570c<<4==0xa83570c0
:0041BBA5 03C5 add eax, ebp<-------------------------0xa83570c0+0x20ee==0xa83591ae
:0041BBA7 8B6C2414 mov ebp, dword ptr [esp+14]<----------0x44c
:0041BBAB 03C6 add eax, esi<-------------------------0xa83591ae+0x44c==0xe9293da9
:0041BBAD 8BF7 mov esi, edi
:0041BBAF C1EE05 shr esi, 05<--------------------------0x8a83570c>>5==0x4541ab8
:0041BBB2 81E94786C861 sub ecx, 61C88647<--------------------0x9e3779b9
:0041BBB8 03F5 add esi, ebp<-------------------------0x4541ab8+0x44c==0x4541f04
:0041BBBA 8B6C2418 mov ebp, dword ptr [esp+18]<----------0x440
:0041BBBE 33C6 xor eax, esi<-------------------------0xe9293da9^0x440 ==0xed7d22ad
:0041BBC0 8D3439 lea esi, dword ptr [ecx+edi]<---------0x9e3779b9+0x8a83570c==0x28dab0c5
:0041BBC3 33F0 xor esi, eax<-------------------------0x28dab0c5^0xed7d22ad==0xc5c7f268
:0041BBC5 8BC6 mov eax, esi
:0041BBC7 C1E004 shl eax, 04<--------------------------0xc5c7f268<<4==0x5c7f2680
:0041BBCA 03C5 add eax, ebp<-------------------------0x5c7f2680+0x440==0x5c7f2ac0
:0041BBCC 8B6C241C mov ebp, dword ptr [esp+1C]<----------0xe21
:0041BBD0 03C7 add eax, edi<-------------------------0x5c7f2ac0+0x8a83570c==0xe70281cc
:0041BBD2 8BFE mov edi, esi
:0041BBD4 C1EF05 shr edi, 05<--------------------------0xc5c7f268>>5==0x62e3f93
:0041BBD7 03FD add edi, ebp<-------------------------0x62e3f93+0xe21==0x62e4db4
:0041BBD9 33C7 xor eax, edi<-------------------------0xe70281cc^0x62e4db4==0xe12ccc78
:0041BBDB 8D3C31 lea edi, dword ptr [ecx+esi]<---------0x9e3779b9+0xc5c7f268==0x63ff6c21
:0041BBDE 33F8 xor edi, eax<-------------------------0xe12ccc78^0x63ff6c21==0x82d3a059
:0041BBE0 4A dec edx<------------------------------0x20
:0041BBE1 75B9 jne 0041BB9C<-------------------------天啊,计算32次?!
:0041BBE3 8BC6 mov eax, esi
:0041BBE5 99 cdq
:0041BBE6 8BC8 mov ecx, eax<-------------------------0x73dc15df
:0041BBE8 8BC7 mov eax, edi<-------------------------0x1aa72435
:0041BBEA 33CA xor ecx, edx<-------------------------0x73dc15df^0==0x73dc15df
:0041BBEC 2BCA sub ecx, edx<-------------------------0x73dc15df-0==0x73dc15df
:0041BBEE 99 cdq
:0041BBEF 8BF0 mov esi, eax<-------------------------0x1aa72435
:0041BBF1 51 push ecx
:0041BBF2 8D4B04 lea ecx, dword ptr [ebx+04]
:0041BBF5 33F2 xor esi, edx
* Possible StringData Ref from Data Obj ->"%ld"
|
:0041BBF7 68F07B4700 push 00477BF0
:0041BBFC 51 push ecx
:0041BBFD 2BF2 sub esi, edx
:0041BBFF E824D70100 call 00439328<------------------------转换成10进制,0x73dc15df==1943803359
:0041BC04 83C40C add esp, 0000000C
:0041BC07 83C308 add ebx, 00000008
:0041BC0A 56 push esi
* Possible StringData Ref from Data Obj ->"%ld"
|
:0041BC0B 68F07B4700 push 00477BF0
:0041BC10 53 push ebx
:0041BC11 E812D70100 call 00439328<------------------------转换成10进制,0x1aa72435==447161397
... ... 略 ... ...
:0041BC82 C21800 ret 0018
========================================================
