SuperCleaner 2.43 (9千字)
为了能看到精华5，我也凑数垃圾文献一篇软件叫SuperCleaner.exe
下载地址：http://www.southbaypc.com/
目的：自己弹出注册码
:00412615 8B8C2418010000 mov ecx, dword ptr [esp+00000118]输入的注册码 00012615 8B8424 18010000 MOV EAX,DWORD PTR SS:[ESP+118] /*因为比较以后会改变eax值
:0041261C 8D442410 lea eax, dword ptr [esp+10] 正确的注册码 0001261C 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 我就颠倒一下ecx,和eax*/
:00412620 50 push eax 00012620 50 PUSH EAX
:00412621 51 push ecx 00012621 51 PUSH ECX
:00412622 E869FFFFFF call 00412590 00012622 E8 69FFFFFF CALL 00012590
:00412627 83C410 add esp, 00000010 00012627 83C4 10 ADD ESP,10
:0041262A 85C0 test eax, eax 0001262A 85C0 TEST EAX,EAX
* Possible Reference to String Resource ID=00001: "Registered to: %s"
|
:0041262C B801000000 mov eax, 00000001
:00412631 7502 jne 00412635
:00412633 8BC6 mov eax, esi
00012078 6A 00 PUSH 0 00012078 6A 00 PUSH 0
0001207A 68 3C3D4200 PUSH 423D3C 0001207A 51 PUSH ECX /*颠倒后正确的注册码在ecx里面
0001207F 6A 0A PUSH 0A 0001207B 90 NOP
00012081 56 PUSH ESI 0001207C 90 NOP
00012082 E8 C980FFFF CALL 0000A150 弹出错误窗口 0001207D 90 NOP
00012087 83C4 10 ADD ESP,10 0001207E 90 NOP
0001208A 33C0 XOR EAX,EAX 0001207F 51 PUSH ECX 标题和内容都是注册码*/
00012080 90 NOP
00012081 56 PUSH ESI
付注册码算法
:004126EA 57 push edi------->注册名地址
* Reference To: KERNEL32.lstrlenA, Ord:03AEh-->的长度
|
:004126EB FF1538024200 Call dword ptr [00420238]
:004126F1 8BF0 mov esi, eax
:004126F3 33C9 xor ecx, ecx
:004126F5 33C0 xor eax, eax
:004126F7 85F6 test esi, esi
:004126F9 7E13 jle 0041270E
:004126FB 8B1530664200 mov edx, dword ptr [00426630]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041270C(C)
|
:00412701 0FBE1C38 movsx ebx, byte ptr [eax+edi]-->注册名地址
:00412705 03DA add ebx, edx
:00412707 03CB add ecx, ebx
:00412709 40 inc eax
:0041270A 3BC6 cmp eax, esi
:0041270C 7CF3 jl 00412701----->以上是把注册名都加上一个edx然后再累加起来
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004126F9(C)
|
:0041270E 8B9C2418010000 mov ebx, dword ptr [esp+00000118]
:00412715 51 push ecx
* Possible StringData Ref from Data Obj ->"%ld-"
|
:00412716 6844664200 push 00426644
:0041271B 53 push ebx
* Reference To: USER32.wsprintfA, Ord:02D6h
|
:0041271C FF151C034200 Call dword ptr [0042031C]-->用这个api变成xxxx-的格式..下面的算法大通小异
:00412722 83C40C add esp, 0000000C 没有难度，大家有兴趣就看
:00412725 33C9 xor ecx, ecx
:00412727 33C0 xor eax, eax
:00412729 85F6 test esi, esi
:0041272B 7E14 jle 00412741
:0041272D 8B1534664200 mov edx, dword ptr [00426634]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041273F(C)
|
:00412733 0FBE2C38 movsx ebp, byte ptr [eax+edi]
:00412737 0FAFEA imul ebp, edx
:0041273A 03CD add ecx, ebp
:0041273C 40 inc eax
:0041273D 3BC6 cmp eax, esi
:0041273F 7CF2 jl 00412733
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041272B(C)
|
:00412741 51 push ecx
:00412742 8D4C2414 lea ecx, dword ptr [esp+14]
* Possible StringData Ref from Data Obj ->"%ld-"
|
:00412746 6844664200 push 00426644
:0041274B 51 push ecx
* Reference To: USER32.wsprintfA, Ord:02D6h
|
:0041274C FF151C034200 Call dword ptr [0042031C]
:00412752 83C40C add esp, 0000000C
:00412755 8D542410 lea edx, dword ptr [esp+10]
:00412759 52 push edx
:0041275A 53 push ebx
* Reference To: KERNEL32.lstrcatA, Ord:039Fh
|
:0041275B FF1520024200 Call dword ptr [00420220]
:00412761 33C9 xor ecx, ecx
:00412763 33C0 xor eax, eax
:00412765 85F6 test esi, esi
:00412767 7E13 jle 0041277C
:00412769 8B1538664200 mov edx, dword ptr [00426638]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041277A(C)
|
:0041276F 0FBE2C38 movsx ebp, byte ptr [eax+edi]
:00412773 03EA add ebp, edx
:00412775 03CD add ecx, ebp
:00412777 40 inc eax
:00412778 3BC6 cmp eax, esi
:0041277A 7CF3 jl 0041276F
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412767(C)
|
:0041277C 51 push ecx
:0041277D 8D442414 lea eax, dword ptr [esp+14]
* Possible StringData Ref from Data Obj ->"%ld-"
|
:00412781 6844664200 push 00426644
:00412786 50 push eax
* Reference To: USER32.wsprintfA, Ord:02D6h
|
:00412787 FF151C034200 Call dword ptr [0042031C]
:0041278D 83C40C add esp, 0000000C
:00412790 8D4C2410 lea ecx, dword ptr [esp+10]
:00412794 51 push ecx
:00412795 53 push ebx
* Reference To: KERNEL32.lstrcatA, Ord:039Fh
|
:00412796 FF1520024200 Call dword ptr [00420220]
:0041279C 33C9 xor ecx, ecx
:0041279E 33C0 xor eax, eax
:004127A0 85F6 test esi, esi
:004127A2 7E14 jle 004127B8
:004127A4 8B153C664200 mov edx, dword ptr [0042663C]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004127B6(C)
|
:004127AA 0FBE2C38 movsx ebp, byte ptr [eax+edi]
:004127AE 0FAFEA imul ebp, edx
:004127B1 03CD add ecx, ebp
:004127B3 40 inc eax
:004127B4 3BC6 cmp eax, esi
:004127B6 7CF2 jl 004127AA
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004127A2(C)
|
:004127B8 51 push ecx
:004127B9 8D542414 lea edx, dword ptr [esp+14]
* Possible StringData Ref from Data Obj ->"%ld"
|
:004127BD 6840664200 push 00426640
:004127C2 52 push edx
* Reference To: USER32.wsprintfA, Ord:02D6h
|
:004127C3 FF151C034200 Call dword ptr [0042031C]
:004127C9 83C40C add esp, 0000000C
:004127CC 8D442410 lea eax, dword ptr [esp+10]
:004127D0 50 push eax
:004127D1 53 push ebx
* Reference To: KERNEL32.lstrcatA, Ord:039Fh
|
:004127D2 FF1520024200 Call dword ptr [00420220]
:004127D8 5F pop edi---连接出来的注册码在ebx里面
:004127D9 5E pop esi
:004127DA 5D pop ebp
:004127DB 5B pop ebx
:004127DC 81C400010000 add esp, 00000100
:004127E2 C3 ret
这个算法简单的不能再简单了，我想大家都应该能看懂吧，我连解释都懒得写
00012082 E8 C980FFFF CALL 0000A150
pll621
