Multi Clipboard Ver m9.34.01 (18千字)
http://newhua.ruyi.com/down/mcbsx.exe这个软件注册码的计算部分还挺复杂的,一下子还不能马上看明白,可惜最后采用明码比较,是一大败笔... ...
有兴趣的看一看就知道了
==========================================================================================
:004060B6 E8CC160200 call 00427787<-----------------读取用户名
:004060BB BF08914900 mov edi, 00499108
:004060C0 83C9FF or ecx, FFFFFFFF
:004060C3 33C0 xor eax, eax
:004060C5 F2 repnz
:004060C6 AE scasb
:004060C7 F7D1 not ecx
:004060C9 49 dec ecx
:004060CA 83F903 cmp ecx, 00000003<------------用户名要大于3位
:004060CD 7356 jnb 00406125
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004060CD(C)
|
:00406125 6A50 push 00000050
:00406127 6858914900 push 00499158
* Possible Reference to Dialog: DialogID_00CE, CONTROL_ID:0483, ""
|
:0040612C 6883040000 push 00000483
:00406131 B930014400 mov ecx, 00440130
:00406136 E84C160200 call 00427787<----------------读取 e-Mail
:0040613B 8B152CA34900 mov edx, dword ptr [0049A32C]
:00406141 BB01000000 mov ebx, 00000001
:00406146 53 push ebx
:00406147 6858914900 push 00499158
:0040614C 52 push edx
:0040614D E8DE5B0000 call 0040BD30
:00406152 83C40C add esp, 0000000C
:00406155 3BC3 cmp eax, ebx
:00406157 743E je 00406197
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406157(C)
|
:00406197 53 push ebx
:00406198 E8F3220000 call 00408490<----------------将用户名和 e-Mail 写入 .ini 文件
:0040619D 83C404 add esp, 00000004
:004061A0 B908000000 mov ecx, 00000008
:004061A5 33C0 xor eax, eax
:004061A7 BF348F4900 mov edi, 00498F34
:004061AC F3 repz
:004061AD AB stosd
:004061AE 6A20 push 00000020
:004061B0 68348F4900 push 00498F34
* Possible Reference to Dialog: DialogID_00CE, CONTROL_ID:0481, ""
|
:004061B5 6881040000 push 00000481
:004061BA B930014400 mov ecx, 00440130
:004061BF E8C3150200 call 00427787<---------------读取注册码
:004061C4 B940000000 mov ecx, 00000040
:004061C9 33C0 xor eax, eax
:004061CB BFFC014400 mov edi, 004401FC
:004061D0 68FC014400 push 004401FC
* Possible StringData Ref from Data Obj ->"Multi Clipboard"
|
:004061D5 6890B74300 push 0043B790
:004061DA 6808914900 push 00499108
:004061DF F3 repz
:004061E0 AB stosd
:004061E1 E83A1B0000 call 00407D20<----------(1)-----核心计算,跟入
:004061E6 68FC014400 push 004401FC
:004061EB E8B01A0000 call 00407CA0
:004061F0 68348F4900 push 00498F34
:004061F5 E8A61A0000 call 00407CA0
:004061FA BFFC014400 mov edi, 004401FC
:004061FF 83C9FF or ecx, FFFFFFFF
:00406202 33C0 xor eax, eax
:00406204 83C414 add esp, 00000014
:00406207 F2 repnz
:00406208 AE scasb
:00406209 F7D1 not ecx
:0040620B 49 dec ecx
:0040620C BFFC014400 mov edi, 004401FC<-----------30353b3b3437
:00406211 BE348F4900 mov esi, 00498F34<-----------输入的注册码
:00406216 33D2 xor edx, edx
:00406218 F3 repz
:00406219 A6 cmpsb<-----------------------比较,相同则注册成功
:0040621A 0F85B2000000 jne 004062D2
================================================================================================
* Referenced by a CALL at Addresses:-------------------------------计算(1)
|:00401E9B , :00405EFD , :004061E1 , :0040C698
|
:00407D20 51 push ecx
:00407D21 53 push ebx
:00407D22 8B54240C mov edx, dword ptr [esp+0C]
:00407D26 55 push ebp
:00407D27 56 push esi
:00407D28 57 push edi
:00407D29 B9000A0000 mov ecx, 00000A00
:00407D2E 33C0 xor eax, eax
:00407D30 BFFC044400 mov edi, 004404FC
:00407D35 33DB xor ebx, ebx
:00407D37 33F6 xor esi, esi
:00407D39 F3 repz
:00407D3A AB stosd
:00407D3B 89742410 mov dword ptr [esp+10], esi
:00407D3F BFFC044400 mov edi, 004404FC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407DDA(C)
|
:00407D44 8A0416 mov al, byte ptr [esi+edx]<----------取用户名的第1位'l'=0x6c
............. 略 ............... <----------去掉用户名中非字母或数字的其他字符
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407DCF(C)
|
:00407DE0 B914000000 mov ecx, 00000014
:00407DE5 33C0 xor eax, eax
:00407DE7 8BFA mov edi, edx
:00407DE9 68FC044400 push 004404FC
:00407DEE F3 repz
:00407DEF AB stosd
:00407DF0 BFFC044400 mov edi, 004404FC
:00407DF5 83C9FF or ecx, FFFFFFFF
:00407DF8 F2 repnz
:00407DF9 AE scasb
:00407DFA F7D1 not ecx<------------------------------用户名的长度0xc
:00407DFC 2BF9 sub edi, ecx
:00407DFE 8BC1 mov eax, ecx
:00407E00 8BF7 mov esi, edi
:00407E02 8BFA mov edi, edx
:00407E04 C1E902 shr ecx, 02
:00407E07 F3 repz
:00407E08 A5 movsd
:00407E09 8BC8 mov ecx, eax
:00407E0B 83E103 and ecx, 00000003
:00407E0E F3 repz
:00407E0F A4 movsb
:00407E10 E898D90000 call 004157AD<-------------------把用户名转换成小写
:00407E15 8D4C2414 lea ecx, dword ptr [esp+14]
:00407E19 8D54241C lea edx, dword ptr [esp+1C]
:00407E1D 51 push ecx
:00407E1E 52 push edx
:00407E1F 895C2424 mov dword ptr [esp+24], ebx
:00407E23 C744241C01000000 mov [esp+1C], 00000001
:00407E2B E8B0010000 call 00407FE0<--------------------(2)------计算，跟入
:00407E30 8B7C2428 mov edi, dword ptr [esp+28]<-----'Multi Clipboard'
:00407E34 83C9FF or ecx, FFFFFFFF
:00407E37 33C0 xor eax, eax
:00407E39 83C40C add esp, 0000000C
:00407E3C F2 repnz
:00407E3D AE scasb
:00407E3E F7D1 not ecx
:00407E40 2BF9 sub edi, ecx
:00407E42 8BF7 mov esi, edi
:00407E44 8BD1 mov edx, ecx
:00407E46 BFFC044400 mov edi, 004404FC<--------------用户名
:00407E4B 83C9FF or ecx, FFFFFFFF
:00407E4E F2 repnz
:00407E4F AE scasb
:00407E50 8BCA mov ecx, edx
:00407E52 4F dec edi
:00407E53 C1E902 shr ecx, 02
:00407E56 F3 repz
:00407E57 A5 movsd<----------------把'Multi Clipboard'接在小写的用户名后
:00407E58 8BCA mov ecx, edx
:00407E5A 8B542418 mov edx, dword ptr [esp+18]<---------0x9b((2)的计算结果)
:00407E5E 83E103 and ecx, 00000003
:00407E61 F3 repz
:00407E62 A4 movsb
:00407E63 8A0DFC044400 mov cl, byte ptr [004404FC]<---------连接后的第1位0x6c('l')
:00407E69 33F6 xor esi, esi
:00407E6B 3ACB cmp cl, bl
:00407E6D 89742410 mov dword ptr [esp+10], esi
:00407E71 7431 je 00407EA4
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E9A(C)
|
:00407E73 8BC1 mov eax, ecx
:00407E75 25FF000000 and eax, 000000FF
:00407E7A 8D3CC0 lea edi, dword ptr [eax+8*eax]<---------9*0x6c==0x3cc
:00407E7D 03C6 add eax, esi<---------------------------0x6c+0x0(序号)==0x6c
:00407E7F 8D0478 lea eax, dword ptr [eax+2*edi]<---------0x6c+2*0x3cc==0x804
:00407E82 03D0 add edx, eax<---------------------------0x9b+0x804==0x89f
:00407E84 80F960 cmp cl, 60<------------------------第1位为字母
:00407E87 7305 jnb 00407E8E
:00407E89 83C215 add edx, 00000015
:00407E8C EB03 jmp 00407E91
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E87(C)
|
:00407E8E 83EA15 sub edx, 00000015<-------------------0x89f-0x15==0x88a
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E8C(U)
|
:00407E91 8A8EFD044400 mov cl, byte ptr [esi+004404FD]<----------取第2位
:00407E97 46 inc esi
:00407E98 3ACB cmp cl, bl<-------------------------是否为0
:00407E9A 75D7 jne 00407E73<-----------------------不为0则继续循环
:00407E9C 89742410 mov dword ptr [esp+10], esi<--------0x384
:00407EA0 89542418 mov dword ptr [esp+18], edx<--------0xc28a<---最后结果
~~~~~~
******************************************************************
0xc28a==049802
049802 的ASCII值为 30 34 39 38 30 32
+0 +1 +2 +3 +4 +5
—————————
30 35 3B 3B 34 37 <------------注册码
******************************************************************
=========================================================================================
* Referenced by a CALL at Address:<----------------------------------计算(2)
|:00407E2B
|
:00407FE0 55 push ebp
:00407FE1 8BEC mov ebp, esp
:00407FE3 83EC08 sub esp, 00000008
:00407FE6 8B450C mov eax, dword ptr [ebp+0C]
:00407FE9 53 push ebx
:00407FEA 56 push esi
:00407FEB 57 push edi
:00407FEC 8B7D08 mov edi, dword ptr [ebp+08]
:00407FEF 668B08 mov cx, word ptr [eax]
:00407FF2 660FB605FD044400 movzx ax, byte ptr [004404FD]<-------用户名的第2位0x61('a')
:00407FFA 8B17 mov edx, dword ptr [edi]
:00407FFC 894DF8 mov dword ptr [ebp-08], ecx
:00407FFF 660FB60DFE044400 movzx cx, byte ptr [004404FE]<-------用户名的第3位0x6e('n')
:00408007 8955FC mov dword ptr [ebp-04], edx
:0040800A 03C8 add ecx, eax<------------------------0x6e+0x61==0xcf
:0040800C 660FB615FC044400 movzx dx, byte ptr [004404FC]<-------用户名的第1位0x6c('l')
:00408014 03CA add ecx, edx<------------------------0xcf+0x6c==0x13b
:00408016 B856555555 mov eax, 55555556
:0040801B 81E1FFFF0000 and ecx, 0000FFFF
:00408021 F7E9 imul ecx<-----------------------0x55555556*0x13b==0x69000000d2
:00408023 8BC2 mov eax, edx<------------------------0x69
:00408025 8BC8 mov ecx, eax
:00408027 C1E91F shr ecx, 1F<-------------------------0x69>>0x1f==0x0
:0040802A 03C1 add eax, ecx<------------------------0x69+0x0===0x69
:0040802C 3C30 cmp al, 30
:0040802E 7208 jb 00408038
:00408030 3C39 cmp al, 39
:00408032 7704 ja 00408038<--------------------------是否位数字
:00408034 2C30 sub al, 30<---------------------------是则减0x30
:00408036 EB1A jmp 00408052
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040802E(C), :00408032(C)
|
:00408038 3C61 cmp al, 61
:0040803A 7208 jb 00408044
:0040803C 3C7A cmp al, 7A
:0040803E 7704 ja 00408044<---------------------是否为字母
:00408040 2C61 sub al, 61<----------------------是则减0x61
:00408042 EB0E jmp 00408052 0x69-0x61==0x8
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408036(U), :00408042(U), :00408046(C), :0040804E(U)
|
:00408052 8AC8 mov cl, al<--------------------------0x8
:00408054 80F91A cmp cl, 1A
:00408057 884D0C mov byte ptr [ebp+0C], cl
:0040805A 761F jbe 0040807B
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040805A(C)
|
:0040807B 8B450C mov eax, dword ptr [ebp+0C]
:0040807E 8BC8 mov ecx, eax
:00408080 81E1FF000000 and ecx, 000000FF<------------------0x8
:00408086 49 dec ecx<----------------------------0x8-0x1==0x7
:00408087 83F918 cmp ecx, 00000018
:0040808A 0F87EA000000 ja 0040817A
:00408090 FF248DEC814000 jmp dword ptr [4*ecx+004081EC]<-----jmp [00408208]
=> jmp 0040815a
=======================================================================================
* Referenced by a CALL at Address:
|:0040815B
|
:00407780 8B4C2404 mov ecx, dword ptr [esp+04]<--------0x8
:00407784 8B15FC044400 mov edx, dword ptr [004404FC]<------0x63('l')
:0040778A 81E1FF000000 and ecx, 000000FF
:00407790 81E2FF000000 and edx, 000000FF
:00407796 0FAFD1 imul edx, ecx<----------------------0x63*0x8==0x360
:00407799 B8ABAAAAAA mov eax, AAAAAAAB
:0040779E 8D0C49 lea ecx, dword ptr [ecx+2*ecx]<-----0x3*0x8==0x18
:004077A1 F7E2 mul edx<----------------0xaaaaaaab*0x360==0x24000000120
:004077A3 8BC2 mov eax, edx<-------------------0x240
:004077A5 D1E8 shr eax, 1<---------------------0x240>>0x1==0x120
:004077A7 C1E903 shr ecx, 03<--------------------0x18>>0x3==0x3
:004077AA 0FAFC1 imul eax, ecx<------------------0x120*0x3==0x360
:004077AD 83C008 add eax, 00000008<--------------0x360+0x8==0x368
:004077B0 C3 ret<----------------------------回到:00408160
=======================================================
:0040815A 50 push eax
