加密金刚锁V3.00注册算法----(下集) (13千字)
第二个运算函数f2(Y):-------------------------------------------------
:0040B8F4 89442404 mov dword ptr [esp+04], eax
:0040B8F8 8A0424 mov al, byte ptr [esp] <===取参数
:0040B8FB C1E006 shl eax, 06 <====
:0040B8FE 33D2 xor edx, edx
:0040B900 8A1424 mov dl, byte ptr [esp] <===取参数
:0040B903 C1FA02 sar edx, 02 <====
:0040B906 0AC2 or al, dl <====整理出公式：R8=(Y shl 6) or (x sar 2)
:0040B908 880424 mov byte ptr [esp], al <====保存R8
:0040B90B 56 push esi
:0040B90C E827710800 call 00492A38
:0040B911 59 pop ecx
:0040B912 8BD8 mov ebx, eax
:0040B914 D1EB shr ebx, 1
:0040B916 8D041E lea eax, dword ptr [esi+ebx]
:0040B919 89442408 mov dword ptr [esp+08], eax
:0040B91D EB15 jmp 0040B934
-------------------------------------------------
下面是机器码后四位的运算:
:0040B91F 8BD3 mov edx, ebx <=====取LNX(x=4 to 7)
:0040B921 8B4C2408 mov ecx, dword ptr [esp+08]
:0040B925 0FAFD3 imul edx, ebx <=====LNX*LNX
:0040B928 8A01 mov al, byte ptr [ecx] <=====取N4--N7
:0040B92A 43 inc ebx
:0040B92B 02D0 add dl, al <=====Nx+LNX
:0040B92D 301424 xor byte ptr [esp], dl <=====循环xor ,结果为R9
:0040B930 FF442408 inc [esp+08]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B91D(U)
|
:0040B934 56 push esi
:0040B935 E8FE700800 call 00492A38
:0040B93A 59 pop ecx
:0040B93B 3BD8 cmp ebx, eax
:0040B93D 72E0 jb 0040B91F
:0040B93F 33C0 xor eax, eax
:0040B941 8A1424 mov dl, byte ptr [esp] <====取R9
:0040B944 8A0424 mov al, byte ptr [esp] <====取R9
:0040B947 C1E202 shl edx, 02 <====
:0040B94A C1F806 sar eax, 06 <====
:0040B94D 0AC2 or al, dl <====整理出公式:R10=(R9 shl 2) or (R9 sar 6)
:0040B94F 33DB xor ebx, ebx
:0040B951 880424 mov byte ptr [esp], al <====保存R10
:0040B954 8BC6 mov eax, esi
:0040B956 8944240C mov dword ptr [esp+0C], eax
:0040B95A EB12 jmp 0040B96E
-----------------------------------------------
下面是机器码前四位的运算:
:0040B95C 8BD3 mov edx, ebx <=====取LNX(x=0 to 3)
:0040B95E 8B4C240C mov ecx, dword ptr [esp+0C]
:0040B962 8A01 mov al, byte ptr [ecx] <=====取N0--N3
:0040B964 02D0 add dl, al <=====LNX+NX
:0040B966 301424 xor byte ptr [esp], dl <====循环xor ,结果为R11
:0040B969 43 inc ebx
:0040B96A FF44240C inc [esp+0C]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B95A(U)
|
:0040B96E 56 push esi
:0040B96F E8C4700800 call 00492A38
:0040B974 D1E8 shr eax, 1
:0040B976 59 pop ecx
:0040B977 3BD8 cmp ebx, eax
:0040B979 72E1 jb 0040B95C
:0040B97B 8BCF mov ecx, edi
:0040B97D 33D2 xor edx, edx
:0040B97F 0FAFCF imul ecx, edi
:0040B982 8A1424 mov dl, byte ptr [esp] <====取R11
:0040B985 8A0424 mov al, byte ptr [esp] <====取R11
:0040B988 C1FA02 sar edx, 02 <====
:0040B98B C1E006 shl eax, 06 <====
:0040B98E 0AC2 or al, dl <====整理出公式:R12=(R11 sar 2) or (R11 shl 6)
:0040B990 880424 mov byte ptr [esp], al <====保存R12
---------------------------------------------------
:0040B993 8A043E mov al, byte ptr [esi+edi] <====取N0
:0040B996 8A1424 mov dl, byte ptr [esp] <====取R12
:0040B999 02C8 add cl, al <====LN0+N0
:0040B99B 8BC5 mov eax, ebp
:0040B99D 32CA xor cl, dl <=====(LN0+N0) xor R12
:0040B99F 47 inc edi
:0040B9A0 F7ED imul ebp <====LN4*LN4
:0040B9A2 8A142E mov dl, byte ptr [esi+ebp] <====取N4
:0040B9A5 4D dec ebp
:0040B9A6 02C2 add al, dl <====N4+LN4*LN4
:0040B9A8 4D dec ebp
:0040B9A9 32C8 xor cl, al <====((LN0+N0) xor R12) xor (N4+LN4*LN4)
:0040B9AB 8B442404 mov eax, dword ptr [esp+04]
:0040B9AF F76C2404 imul [esp+04] <=====L*L
:0040B9B3 8B542404 mov edx, dword ptr [esp+04]
:0040B9B7 4D dec ebp
:0040B9B8 47 inc edi
:0040B9B9 8A1C16 mov bl, byte ptr [esi+edx]
:0040B9BC 02C3 add al, bl
:0040B9BE 32C8 xor cl, al <====(((LN0+N0) xor R12) xor (N4+LN4*LN4)) xor (L*L),结果为R13
:0040B9C0 880C24 mov byte ptr [esp], cl <====保存R13
----------------------------------------------------
:0040B9FF 8BD7 mov edx, edi <====LN3
:0040BA01 8A0C3E mov cl, byte ptr [esi+edi] <====取N3
:0040BA04 0FAFD7 imul edx, edi <====LN3*LN3
:0040BA07 02D1 add dl, cl <====N3+LN3*LN3
:0040BA09 8BCD mov ecx, ebp <====LN1
:0040BA0B 0FAFCD imul ecx, ebp <====LN1*LN1
:0040BA0E 8A0424 mov al, byte ptr [esp] <====取R13
:0040BA11 47 inc edi
:0040BA12 32D0 xor dl, al <====R13 xor (N3+LN3*LN3)
:0040BA14 8A042E mov al, byte ptr [esi+ebp] <====取N1
:0040BA17 02C8 add cl, al <====N1+LN1*LN1
:0040BA19 8B442404 mov eax, dword ptr [esp+04] <====取LN5
:0040BA1D 32D1 xor dl, cl <=====(R13 xor (N3+LN3*LN3)) xor (N1+LN1*LN1)
:0040BA1F 8B4C2404 mov ecx, dword ptr [esp+04]
:0040BA23 0FAF4C2404 imul ecx, dword ptr [esp+04] <====LN5*LN5
:0040BA28 8A1C06 mov bl, byte ptr [esi+eax] <====取N5
:0040BA2B 4D dec ebp
:0040BA2C 02CB add cl, bl <====N5+LN5*LN5
:0040BA2E 4D dec ebp
:0040BA2F 32D1 xor dl, cl <====[(R13 xor (N3+LN3*LN3)) xor (N1+LN1*LN1)] xor (N5+LN5*LN5)
:0040BA31 4D dec ebp
:0040BA32 881424 mov byte ptr [esp], dl <=====保存R14,同时这个数也做为函数的返回值
:0040BA35 47 inc edi
----------------------------------------------------
下面是函数返回后的代码:
:0040D7BB 8A55A0 mov dl, byte ptr [ebp-60] <====取循环变量J
:0040D7BE 0480 add al, 80 <====R14+80
:0040D7C0 2AC2 sub al, dl <====R14+80-J
:0040D7C2 8B55A0 mov edx, dword ptr [ebp-60] <====取循环变量J
:0040D7C5 0FAFD6 imul edx, esi <====J*LNX
:0040D7C8 8BCE mov ecx, esi
:0040D7CA 02CA add cl, dl <====J*LNX+LNX
:0040D7CC BA02000000 mov edx, 00000002
:0040D7D1 32C1 xor al, cl <====(R14+80-J) xor (J*LNX+LNX),结果作为下一个函数调用的参数
:0040D7D3 FF4DD4 dec [ebp-2C]
:0040D7D6 8BD8 mov ebx, eax
:0040D7D8 8D45EC lea eax, dword ptr [ebp-14]
:0040D7DB E8A0370900 call 004A0F80
:0040D7E0 66C745C83800 mov [ebp-38], 0038
:0040D7E6 33C0 xor eax, eax
:0040D7E8 8945E8 mov dword ptr [ebp-18], eax
:0040D7EB 8D55E8 lea edx, dword ptr [ebp-18]
:0040D7EE FF45D4 inc [ebp-2C]
:0040D7F1 8B45B4 mov eax, dword ptr [ebp-4C]
:0040D7F4 E8D7FBFFFF call 0040D3D0
:0040D7F9 8B4DE8 mov ecx, dword ptr [ebp-18]
:0040D7FC 85C9 test ecx, ecx
:0040D7FE 7405 je 0040D805
:0040D800 8B4DE8 mov ecx, dword ptr [ebp-18]
:0040D803 EB05 jmp 0040D80A
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D7FE(C)
|
:0040D805 B90C7F4B00 mov ecx, 004B7F0C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D803(U)
|
:0040D80A 8BD3 mov edx, ebx <====取参数
:0040D80C 8B45B4 mov eax, dword ptr [ebp-4C]
:0040D80F E86CDFFFFF call 0040B780 <====第二次调用函数f1(X)
:0040D814 8B55A0 mov edx, dword ptr [ebp-60] <====取循环次数J
:0040D817 8BCE mov ecx, esi
:0040D819 0FAF55A0 imul edx, dword ptr [ebp-60] <====J*J
:0040D81D 02C2 add al, dl <=============f1+J*J
:0040D81F 8BD6 mov edx, esi <=============LNX
:0040D821 2AC1 sub al, cl <=============(f1+J*J)-LNX
:0040D823 32C2 xor al, dl <=============((f1+J*J)-LNX) xor LNX,结果作为下一个函数的参数
:0040D825 BA02000000 mov edx, 00000002
:0040D82A FF4DD4 dec [ebp-2C]
:0040D82D 8BD8 mov ebx, eax
:0040D82F 8D45E8 lea eax, dword ptr [ebp-18]
:0040D832 E849370900 call 004A0F80
:0040D837 66C745C84400 mov [ebp-38], 0044
:0040D83D 33C0 xor eax, eax
:0040D83F 8945E4 mov dword ptr [ebp-1C], eax
:0040D842 8D55E4 lea edx, dword ptr [ebp-1C]
:0040D845 FF45D4 inc [ebp-2C]
:0040D848 8B45B4 mov eax, dword ptr [ebp-4C]
:0040D84B E880FBFFFF call 0040D3D0
:0040D850 8B4DE4 mov ecx, dword ptr [ebp-1C]
:0040D853 85C9 test ecx, ecx
:0040D855 7405 je 0040D85C
:0040D857 8B4DE4 mov ecx, dword ptr [ebp-1C]
:0040D85A EB05 jmp 0040D861
----------------------------------------------
:0040D861 8BD3 mov edx, ebx <====取参数
:0040D863 8B45B4 mov eax, dword ptr [ebp-4C]
:0040D866 E869E0FFFF call 0040B8D4 <====第二次调用函数f2(Y)
:0040D86B 8A55A0 mov dl, byte ptr [ebp-60] <====取循环次数J
:0040D86E 0480 add al, 80 <=====f2+80
:0040D870 2AC2 sub al, dl <=====f2+80-J
:0040D872 8BD6 mov edx, esi <=====LNX
:0040D874 0FAFD6 imul edx, esi <=====LNX*LNX
:0040D877 8A4DA0 mov cl, byte ptr [ebp-60] <=====取循环次数J
:0040D87A 02CA add cl, dl <=====J+LNX*LNX
:0040D87C BA02000000 mov edx, 00000002
:0040D881 32C1 xor al, cl <====(f2+80-J) xor (J+LNX*LNX),结果为最终的运算结果
:0040D883 FF4DD4 dec [ebp-2C]
:0040D886 8BD8 mov ebx, eax
:0040D888 8D45E4 lea eax, dword ptr [ebp-1C]
:0040D88B E8F0360900 call 004A0F80
:0040D890 33C0 xor eax, eax
:0040D892 8AC3 mov al, bl
:0040D894 50 push eax
:0040D895 E8AE9E0800 call 00497748 <=====判断运算结果是不是大写字母
:0040D89A 59 pop ecx
:0040D89B 85C0 test eax, eax
:0040D89D 7416 je 0040D8B5 <=====如果不是,则循环变量J=J+1,继续运算,直到结果为合法的注册码为止
:0040D89F 8BFB mov edi, ebx
:0040D8A1 81E7FF000000 and edi, 000000FF
:0040D8A7 57 push edi
:0040D8A8 E83BBC0800 call 004994E8
:0040D8AD 59 pop ecx
:0040D8AE 8B559C mov edx, dword ptr [ebp-64]
:0040D8B1 8802 mov byte ptr [edx], al
:0040D8B3 EB08 jmp 0040D8BD
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D89D(C)
|
:0040D8B5 FF45A0 inc [ebp-60]
:0040D8B8 E9B9FDFFFF jmp 0040D676
-----------------------------------------------
|
:0040D8CE 8B55A4 mov edx, dword ptr [ebp-5C]
:0040D8D1 3BC2 cmp eax, edx
:0040D8D3 7505 jne 0040D8DA
:0040D8D5 33C9 xor ecx, ecx
:0040D8D7 894DA4 mov dword ptr [ebp-5C], ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D8D3(C)
|
:0040D8DA FF4598 inc [ebp-68]
:0040D8DD 46 inc esi
:0040D8DE FF45A4 inc [ebp-5C]
:0040D8E1 83FE08 cmp esi, 00000008 <=====运算出所有的注册码了吗?
:0040D8E4 0F8C7FFDFFFF jl 0040D669 <=====如果没有,则继续运算
哗,好长啊,写得手都累了,呵呵,想不到一个小小的软件的注册算法有那么长啊.不过总的来说它的注册算法并不复杂,只是不断的调用函数来运算罢了.
