加密精灵V2.2破解过程 (9千字)
加密精灵V2.2是一个文件加密工具，破解它可以用两种方法：爆破和注册算法。好，我们来看看怎样破它：1、爆破：
用W32DASM反汇编主程序，在串式参考中查找“这个软件注册给”，双击它，会找到下面的代码：
* Reference To: GDI32.GetObjectA, Ord:014Fh
|
:00418E90 FF1578804300 Call dword ptr [00438078]
:00418E96 A178F74300 mov eax, dword ptr [0043F778] <=====取回注册标志
:00418E9B 85C0 test eax, eax <=====是否是0
:00418E9D 7420 je 00418EBF <=====是则没有注册,跳到未注册的代码处
:00418E9F 682CF34300 push 0043F32C <=====注册成功
:00418EA4 8D542434 lea edx, dword ptr [esp+34]
* Possible StringData Ref from Data Obj ->"这个软件注册给: %s"
|
:00418EA8 68D0C84300 push 0043C8D0
:00418EAD 52 push edx
* Reference To: USER32.wsprintfA, Ord:02ACh
|
:00418EAE FF1520834300 Call dword ptr [00438320]
:00418EB4 83C40C add esp, 0000000C
:00418EB7 8D442430 lea eax, dword ptr [esp+30]
:00418EBB 33C9 xor ecx, ecx
:00418EBD EB0A jmp 00418EC9
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418E9D(C)
|
* Possible StringData Ref from Data Obj ->"您的注册是对我们最大的支持和鼓励"
|
:00418EBF B8ACC84300 mov eax, 0043C8AC
* Possible Reference to Dialog: DialogID_00A1, CONTROL_ID:00FF, ""
看到上面的代码了吗?所以我们必须把注册标志改为不为零的数字,通常是改为1,我的改法是:
:00418E96 A178F74300 mov eax, dword ptr [0043F778] <=====改为mov word ptr
:00418E9B 85C0 test eax, eax <=====[0043F778],1刚好九个字节
:00418E9D 7420 je 00418EBF
2、注册算法:
这个软件是根据注册名来算出注册码的,注册码一共有16位,程序会自动生成密码表,密码表的形式为:
ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz
然后通过注册名算出各个注册码在密码表中的位置.好,我们先下中断,BPX HMEMCPY，中断后用pmodule返回到主程序：
:0040151F 6A1E push 0000001E <=====返回到这里
:00401521 6864EA4300 push 0043EA64
:00401526 6815040000 push 00000415
:0040152B 53 push ebx
:0040152C FFD6 call esi
:0040152E 50 push eax
:0040152F FFD7 call edi
:00401531 6A02 push 00000002
:00401533 6A00 push 00000000
:00401535 E836780100 call 00418D70
:0040153A 6A00 push 00000000
:0040153C 6864EA4300 push 0043EA64 <=====这里是我们输入的注册名和注册码
:00401541 682CF34300 push 0043F32C <=====
:00401546 E895730200 call 004288E0 <=====计算和判断注册码的CALL,如果不正确则EAX=1,所以要F8进入
:0040154B 83C414 add esp, 00000014
:0040154E F7D8 neg eax
:00401550 1BC0 sbb eax, eax
:00401552 40 inc eax
:00401553 A378F74300 mov dword ptr [0043F778], eax
:00401558 0F849C000000 je 004015FA <====如果注册码不正确,则跳
:0040155E BF2CF34300 mov edi, 0043F32C
:00401563 83C9FF or ecx, FFFFFFFF
:00401566 33C0 xor eax, eax
:00401568 F2 repnz
:00401569 AE scasb
:0040156A F7D1 not ecx
:0040156C 51 push ecx
:0040156D 682CF34300 push 0043F32C
* Possible StringData Ref from Data Obj ->"UserName"
|
:00401572 68D0B04300 push 0043B0D0
* Possible StringData Ref from Data Obj ->"Setings"
|
:00401577 68C8B04300 push 0043B0C8
:0040157C E8BF030000 call 00401940
:00401581 8BC8 mov ecx, eax
:00401583 E8A8B10000 call 0040C730
:00401588 BF64EA4300 mov edi, 0043EA64
:0040158D 83C9FF or ecx, FFFFFFFF
:00401590 33C0 xor eax, eax
:00401592 F2 repnz
:00401593 AE scasb
:00401594 F7D1 not ecx
:00401596 51 push ecx
:00401597 6864EA4300 push 0043EA64
* Possible StringData Ref from Data Obj ->"RegisterNumber"
进入CALL后,一直按F10,来到下面的地方:
:004288FA E871000000 call 00428970 <====调用算法的CALL,F8进入
:004288FF 83C408 add esp, 00000008
:00428902 85C0 test eax, eax
:00428904 744D je 00428953
:00428906 53 push ebx
:00428907 56 push esi
:00428908 8D74240C lea esi, dword ptr [esp+0C]
:0042890C 8BC7 mov eax, edi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428930(C)
|
:0042890E 8A10 mov dl, byte ptr [eax] <====我们输入的假注册码
:00428910 8A1E mov bl, byte ptr [esi] <====真正的注册码,用D ESI就可以看到真正的注册码
:00428912 8ACA mov cl, dl
:00428914 3AD3 cmp dl, bl <====比较注册码
:00428916 751E jne 00428936
:00428918 84C9 test cl, cl
:0042891A 7416 je 00428932
:0042891C 8A5001 mov dl, byte ptr [eax+01]
:0042891F 8A5E01 mov bl, byte ptr [esi+01]
:00428922 8ACA mov cl, dl
:00428924 3AD3 cmp dl, bl
:00428926 750E jne 00428936
:00428928 83C002 add eax, 00000002
:0042892B 83C602 add esi, 00000002
:0042892E 84C9 test cl, cl
:00428930 75DC jne 0042890E
下面是注册算法:
:004289E1 8B442458 mov eax, dword ptr [esp+58] <===取注册名,ESI初始值=注册名长度
:004289E5 33D2 xor edx, edx
:004289E7 BF3E000000 mov edi, 0000003E
:004289EC 0FBE0C06 movsx ecx, byte ptr [esi+eax] <==取注册名+注册名字符位置
:004289F0 03CD add ecx, ebp <===ECX+B2770FBE
:004289F2 8BC1 mov eax, ecx <+==EAX=ECX EAX=商 EDX=余数
:004289F4 F7F7 div edi <==EAX/3E
:004289F6 83F93D cmp ecx, 0000003D <==；比较CL是否大于3D
:004289F9 8BFA mov edi, edx
:004289FB 7615 jbe 00428A12 不大于则跳
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A10(C)
|
:004289FD B885104208 mov eax, 08421085
:00428A02 F7E1 mul ecx
:00428A04 2BCA sub ecx, edx
:00428A06 D1E9 shr ecx, 1
:00428A08 03CA add ecx, edx
:00428A0A C1E905 shr ecx, 05
:00428A0D 83F93D cmp ecx, 0000003D
:00428A10 77EB ja 004289FD
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004289FB(C)
|
:00428A12 03CF add ecx, edi
:00428A14 83F93D cmp ecx, 0000003D
:00428A17 761F jbe 00428A38
:00428A19 8BC1 mov eax, ecx
:00428A1B 33D2 xor edx, edx
:00428A1D BF3E000000 mov edi, 0000003E
:00428A22 F7F7 div edi
:00428A24 B885104208 mov eax, 08421085
:00428A29 8BFA mov edi, edx
:00428A2B F7E1 mul ecx
:00428A2D 2BCA sub ecx, edx
:00428A2F D1E9 shr ecx, 1
:00428A31 03CA add ecx, edx
:00428A33 C1E905 shr ecx, 05
:00428A36 03CF add ecx, edi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A17(C)
|
:00428A38 8B54245C mov edx, dword ptr [esp+5C]
:00428A3C 8A4C0C14 mov cl, byte ptr [esp+ecx+14] <===从密码表中取位置为ECX的注册码
:00428A40 8B442410 mov eax, dword ptr [esp+10]
:00428A44 880C13 mov byte ptr [ebx+edx], cl <====保存注册码
:00428A47 43 inc ebx
:00428A48 46 inc esi
:00428A49 3BF0 cmp esi, eax
:00428A4B 7C02 jl 00428A4F
:00428A4D 33F6 xor esi, esi <=====清0
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A4B(C)
|
:00428A4F 45 inc ebp
:00428A50 83FB10 cmp ebx, 00000010 <====够16位了吗?
:00428A53 7C8C jl 004289E1 <====不够继续运算
:00428A55 8B44245C mov eax, dword ptr [esp+5C]
:00428A59 C70598FB430010000000 mov dword ptr [0043FB98], 00000010
:00428A63 5D pop ebp
:00428A64 C6040300 mov byte ptr [ebx+eax], 00
:00428A68 5B pop ebx
:00428A69 5F pop edi
:00428A6A B801000000 mov eax, 00000001
:00428A6F 5E pop esi
:00428A70 83C444 add esp, 00000044
:00428A73 C3 ret
写注册机不是小弟的长项,希望哪位朋友写一个注册机给大家用好了,呵呵
