BTW:这个软件在v2.3.? 的时候我就分析出了它的算法,不过,一直没有公开文章(只公开了它的keygen),但没想到过了那么久,它的算法依旧没有改变,所以,决定放出来和大家分享一下快乐!
【破文标题】 51汇编集成开发环境 2.4.2 - 算法分析
【破文作者】 KuNgBiM[DFCG]
【作者邮箱】 gb_1227@163.com【软件名称】 51汇编集成开发环境 2.4.2
【软件大小】 6127KB
【软件类别】 国产软件/编程工具
【运行环境】 Win9x/Me/NT/2000/XP
【加入时间】 2005-4-3 16:32:50
【下载地址】 下载页面
【软件介绍】
51
汇编集成开发环境是基于windows环境的51汇编软件开发平台,它集源程序的编辑、汇编、反汇编和全软件仿真调试于一体,功能齐全,使用方便,适用于与MCS51兼容的各类单片机。该软件还具有MCS48的汇编、反汇编和将MCS48源程序转换为MCS51源程序的移植功能。V2.3以上版本增加了MCS51的中文编程功能。MCS51源程序中的操作码、标号和特殊功能寄存器均可使用中文。新版本优化和修改了51反汇编程序,智能分段,可读性更好。【保护方式】 注册码+ 功能限制
【编译语言】 Microsoft Visual Basic 5.0 / 6.0
【调试环境】 Win2K、KDeAlls(Ollydbg个人修改版)、W32Dasm、PEiD、Visual Basic 6.0
【破解日期】 2005-04-07 12:46:33
【破解目的】 研究算法分析
【作者声明】 初学Crack,只是感兴趣,没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【破解内容】
用PEID查没有加壳,Microsoft Visual Basic 5.0 / 6.0编写的,启动软件后点击注册,填入用户名和注册码,点注册,注册窗关闭。
好,用KDeAlls载入,试着下断(VB程序的专用函数) bpx __vbaStrCmp,回车!F9运行4次,来到程序界面点击注册项,填入用户名KuNgBiM,注册码9876543210,点注册!
004C872F 8B45 A0
mov eax,
dword ptr ss:[
ebp-60] //
取机器码(这里为:1289249510)
004C8732 50
push eax
004C8733 68 28554100
push MCS51.00415528
004C8738 FF15 FC104000
call dword ptr ds:[<&MSVBVM60.__vbaStrCmp>]
; MSVBVM60.__vbaStrCmp //中断这里,继续F9!
004C873E 8BF8
mov edi,
eax
004C8740 8D4D A0
lea ecx,
dword ptr ss:[
ebp-60]
004C8743 F7DF
neg edi //
edi=1
004C8745 1BFF
sbb edi,
edi
004C8747 47
inc edi
004C8748 F7DF
neg edi //
edi=0
004C874A FF15 54124000
call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>
; MSVBVM60.__vbaFreeStr
004C8750 8D4D 9C
lea ecx,
dword ptr ss:[
ebp-64]
004C8753 FF15 58124000
call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>>
; MSVBVM60.__vbaFreeObj
004C8759 66:3BFB
cmp di,
bx
004C875C 0F84 B9000000
je MCS51.004C881B
....................
004C8856 8B4D A0
mov ecx,
dword ptr ss:[
ebp-60] //
取用户名(这里为:KuNgBiM)
004C8859 51
push ecx
004C885A 68 28554100
push MCS51.00415528
004C885F FF15 FC104000
call dword ptr ds:[<&MSVBVM60.__vbaStrCmp>]
; MSVBVM60.__vbaStrCmp //中断这里,继续F9!
004C8865 8BF8
mov edi,
eax
004C8867 8D4D A0
lea ecx,
dword ptr ss:[
ebp-60]
004C886A F7DF
neg edi //
edi=1
004C886C 1BFF
sbb edi,
edi
004C886E 47
inc edi
004C886F F7DF
neg edi //
edi=1
004C8871 FF15 54124000
call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>
; MSVBVM60.__vbaFreeStr
004C8877 8D4D 9C
lea ecx,
dword ptr ss:[
ebp-64]
004C887A FF15 58124000
call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>>
; MSVBVM60.__vbaFreeObj
004C8880 66:3BFB
cmp di,
bx
004C8883 0F84 B9000000
je MCS51.004C8942
....................
004C897D 8B55 A0
mov edx,
dword ptr ss:[
ebp-60] //
取用户输入假码(这里为:9876543210)
004C8980 52
push edx
004C8981 68 28554100
push MCS51.00415528
004C8986 FF15 FC104000
call dword ptr ds:[<&MSVBVM60.__vbaStrCmp>]
; MSVBVM60.__vbaStrCmp //中断这里,继续F9!
004C898C 8BF8
mov edi,
eax
004C898E 8D4D A0
lea ecx,
dword ptr ss:[
ebp-60]
004C8991 F7DF
neg edi //
edi=1
004C8993 1BFF
sbb edi,
edi
004C8995 47
inc edi
004C8996 F7DF
neg edi //
edi=1
004C8998 FF15 54124000
call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>
; MSVBVM60.__vbaFreeStr
004C899E 8D4D 9C
lea ecx,
dword ptr ss:[
ebp-64]
004C89A1 FF15 58124000
call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>>
; MSVBVM60.__vbaFreeObj
004C89A7 66:3BFB
cmp di,
bx
004C89AA 0F84 B9000000
je MCS51.004C8A69
...................
004C8E82 8B1D 6C104000
mov ebx,
dword ptr ds:[<&MSVBVM60.__vbaHresu>
; MSVBVM60.__vbaHresultCheckObj
004C8E88 8B55 B4
mov edx,
dword ptr ss:[
ebp-4C] //
机器计算出的真码, UNICODE "GYAOAEFGQMTO"
004C8E8B 8B45 A0
mov eax,
dword ptr ss:[
ebp-60] //
用户输入假码,UNICODE "9876543210"
004C8E8E 52
push edx
004C8E8F 50
push eax
004C8E90 FF15 FC104000
call dword ptr ds:[<&MSVBVM60.__vbaStrCmp>]
; MSVBVM60.__vbaStrCmp //中断这里,真假码经典比较!
004C8E96 8BF8
mov edi,
eax
004C8E98 8D4D A0
lea ecx,
dword ptr ss:[
ebp-60]
004C8E9B F7DF
neg edi //
edi=1
004C8E9D 1BFF
sbb edi,
edi
004C8E9F 47
inc edi
004C8EA0 F7DF
neg edi //
edi=0
004C8EA2 FF15 54124000
call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>
; MSVBVM60.__vbaFreeStr
004C8EA8 8D4D 9C
lea ecx,
dword ptr ss:[
ebp-64]
004C8EAB FF15 58124000
call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>>
; MSVBVM60.__vbaFreeObj
004C8EB1 66:85FF
test di,
di
004C8EB4 0F84 1C0A0000
je MCS51.004C98D6
=====================================================
小节:在004C8E90处可以制作内存注册机(代码设置如下)
////////////////////////////
中断地址:004C8E90
中断次数:1
第一字节:FF
指令长度:6
内存方式--->EDX--->宽字符串
////////////////////////////
=====================================================
BTW
:本文的目的是研究算法,所以下面我们来研究它的算法:004C8B2C 8B55 A0
mov edx,
dword ptr ss:[
ebp-60] //
依次类推,寻找mov eax,dword ptr ss:[ebp-60] 我们可以来到这里
004C8B2F 52
push edx
004C8B30 FF15 5C124000
call dword ptr ds:[<&MSVBVM60.#581>]
; MSVBVM60.rtcR8ValFromBstr //取机器码
004C8B36 DC05 98144000
fadd qword ptr ds:[401498] //
转为浮点加法运算
--------------------------------------------------------------------------------------------------------------
st=1289249510.0000000000 //
机器码变换为浮点运算:1289249510
ds:[00401498]=340202550625.0000 // ???
大胆猜想为某一个固定值:340202550625
//
机器码(1289249510)+常量(340202550625)=特征码(341491800135)
--------------------------------------------------------------------------------------------------------------
004C8B3C 8D8D 6CFFFFFF
lea ecx,
dword ptr ss:[
ebp-94]
004C8B42 C785 7CFFFFFF 0>
mov dword ptr ss:[
ebp-84],5
004C8B4C DD5D 84
fstp qword ptr ss:[
ebp-7C]
-------------------------------------------------------------------------------------------
st=3.4149180013500001280e+11 //
把运算结果" 341491800135"存到变量[ebp-7C]中
堆栈 ss:[0012F53C]=4.031853397209806e-313
-------------------------------------------------------------------------------------------
004C8B4F DFE0
fstsw ax //
ax=20
004C8B51 A8 0D
test al,0D
004C8B53 0F85 AB0E0000
jnz MCS51.004C9A04
004C8B59 8D85 7CFFFFFF
lea eax,
dword ptr ss:[
ebp-84]
004C8B5F 50
push eax
004C8B60 51
push ecx
004C8B61 FF15 FC114000
call dword ptr ds:[<&MSVBVM60.#613>]
; MSVBVM60.rtcVarStrFromVar
004C8B67 8D95 6CFFFFFF
lea edx,
dword ptr ss:[
ebp-94]
004C8B6D 8D4D DC
lea ecx,
dword ptr ss:[
ebp-24]
004C8B70 FFD7
call edi
004C8B72 8D4D A0
lea ecx,
dword ptr ss:[
ebp-60]
004C8B75 FF15 54124000
call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>
; MSVBVM60.__vbaFreeStr
004C8B7B 8D4D 9C
lea ecx,
dword ptr ss:[
ebp-64]
004C8B7E FF15 58124000
call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>>
; MSVBVM60.__vbaFreeObj
004C8B84 8D8D 7CFFFFFF
lea ecx,
dword ptr ss:[
ebp-84]
004C8B8A FF15 24104000
call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>>
; MSVBVM60.__vbaFreeVar
004C8B90 8D55 DC
lea edx,
dword ptr ss:[
ebp-24]
004C8B93 8D85 7CFFFFFF
lea eax,
dword ptr ss:[
ebp-84]
004C8B99 52
push edx
004C8B9A 50
push eax
004C8B9B FF15 70104000
call dword ptr ds:[<&MSVBVM60.__vbaLenVar>]
; MSVBVM60.__vbaLenVar
004C8BA1 50
push eax
004C8BA2 FF15 E4114000
call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]
; MSVBVM60.__vbaI4Var
004C8BA8 8BF0
mov esi,
eax //
获得特征码" 341491800135"长度
004C8BAA 83FE 0C
cmp esi,0C //
比较特征码" 341491800135"长度=D
004C8BAD 0F8D C5000000
jge MCS51.004C8C78 //
大于C就跳走
........................
004C8C78 8B1D F0114000
mov ebx,
dword ptr ds:[<&MSVBVM60.__vbaVarAd>
; MSVBVM60.__vbaVarAdd
004C8C7E BA 28554100
mov edx,MCS51.00415528
004C8C83 8D4D B4
lea ecx,
dword ptr ss:[
ebp-4C]
004C8C86 FF15 B8114000
call dword ptr ds:[<&MSVBVM60.__vbaStrCopy>>
; MSVBVM60.__vbaStrCopy
004C8C8C B8 02000000
mov eax,2 //
特征码转换为字符串" 341491800135"
004C8C91 B9 01000000
mov ecx,1
004C8C96 8985 3CFFFFFF
mov dword ptr ss:[
ebp-C4],
eax
004C8C9C 8985 2CFFFFFF
mov dword ptr ss:[
ebp-D4],
eax
004C8CA2 8985 1CFFFFFF
mov dword ptr ss:[
ebp-E4],
eax
004C8CA8 8D95 3CFFFFFF
lea edx,
dword ptr ss:[
ebp-C4]
004C8CAE 898D 44FFFFFF
mov dword ptr ss:[
ebp-BC],
ecx
004C8CB4 898D 24FFFFFF
mov dword ptr ss:[
ebp-DC],
ecx
004C8CBA 8D85 2CFFFFFF
lea eax,
dword ptr ss:[
ebp-D4]
004C8CC0 52
push edx
004C8CC1 8D8D 1CFFFFFF
lea ecx,
dword ptr ss:[
ebp-E4]
004C8CC7 50
push eax
004C8CC8 8D95 9CFEFFFF
lea edx,
dword ptr ss:[
ebp-164]
004C8CCE 51
push ecx
004C8CCF 8D85 ACFEFFFF
lea eax,
dword ptr ss:[
ebp-154]
004C8CD5 52
push edx
004C8CD6 8D4D CC
lea ecx,
dword ptr ss:[
ebp-34]
004C8CD9 50
push eax
004C8CDA 51
push ecx
004C8CDB C785 34FFFFFF 0>
mov dword ptr ss:[
ebp-CC],0C
004C8CE5 FF15 80104000
call dword ptr ds:[<&MSVBVM60.__vbaVarForIn>
; MSVBVM60.__vbaVarForInit //变量初始化,循环开始了
004C8CEB 85C0
test eax,
eax
004C8CED 0F84 4D010000
je MCS51.004C8E40
004C8CF3 8D55 DC
lea edx,
dword ptr ss:[
ebp-24] //
取特征码" 341491800135"
004C8CF6 8D45 A0
lea eax,
dword ptr ss:[
ebp-60] //
取特征码第一位
004C8CF9 52
push edx
004C8CFA 50
push eax
004C8CFB FF15 80114000
call dword ptr ds:[<&MSVBVM60.__vbaStrVarVa>
; MSVBVM60.__vbaStrVarVal
004C8D01 50
push eax //
特征码压栈
004C8D02 FF15 54104000
call dword ptr ds:[<&MSVBVM60.#516>]
; MSVBVM60.rtcAnsiValueBstr
004C8D08 66:8985 44FFFFF>
mov word ptr ss:[
ebp-BC],
ax //
特征码初始值为空 ax=20
004C8D0F B8 02000000
mov eax,2
004C8D14 8D8D 3CFFFFFF
lea ecx,
dword ptr ss:[
ebp-C4]
004C8D1A 8985 3CFFFFFF
mov dword ptr ss:[
ebp-C4],
eax
004C8D20 8985 2CFFFFFF
mov dword ptr ss:[
ebp-D4],
eax
004C8D26 8985 1CFFFFFF
mov dword ptr ss:[
ebp-E4],
eax
004C8D2C 8D55 CC
lea edx,
dword ptr ss:[
ebp-34]
004C8D2F 51
push ecx
004C8D30 8D85 7CFFFFFF
lea eax,
dword ptr ss:[
ebp-84]
004C8D36 52
push edx
004C8D37 50
push eax
004C8D38 C785 34FFFFFF 1>
mov dword ptr ss:[
ebp-CC],1A //
常量26
004C8D42 C785 24FFFFFF 4>
mov dword ptr ss:[
ebp-DC],41 //
常量65
004C8D4C FF15 54114000
call dword ptr ds:[<&MSVBVM60.__vbaVarMul>]
; MSVBVM60.__vbaVarMul //循环次数与首位字ASC相乘
004C8D52 8D8D 2CFFFFFF
lea ecx,
dword ptr ss:[
ebp-D4]
004C8D58 50
push eax
004C8D59 8D95 6CFFFFFF
lea edx,
dword ptr ss:[
ebp-94]
004C8D5F 51
push ecx
004C8D60 52
push edx
004C8D61 FF15 04124000
call dword ptr ds:[<&MSVBVM60.__vbaVarMod>]
; MSVBVM60.__vbaVarMod //乘法结果 与 常量26 求余
004C8D67 50
push eax
004C8D68 8D85 1CFFFFFF
lea eax,
dword ptr ss:[
ebp-E4]
004C8D6E 8D8D 5CFFFFFF
lea ecx,
dword ptr ss:[
ebp-A4]
004C8D74 50
push eax
004C8D75 51
push ecx
004C8D76 FFD3
call ebx //
余数+常量65,即 6+65=71
004C8D78 50
push eax
004C8D79 FF15 E4114000
call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]
; MSVBVM60.__vbaI4Var //把ASC(71)转换为字符串"G" //第首位注册码字符
004C8D7F 8D95 4CFFFFFF
lea edx,
dword ptr ss:[
ebp-B4]
004C8D85 50
push eax
004C8D86 52
push edx
004C8D87 FF15 78114000
call dword ptr ds:[<&MSVBVM60.#608>]
; MSVBVM60.rtcVarBstrFromAnsi
004C8D8D 8D95 4CFFFFFF
lea edx,
dword ptr ss:[
ebp-B4]
004C8D93 8D4D A4
lea ecx,
dword ptr ss:[
ebp-5C]
004C8D96 FFD7
call edi
004C8D98 8D4D A0
lea ecx,
dword ptr ss:[
ebp-60]
004C8D9B FF15 54124000
call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>
; MSVBVM60.__vbaFreeStr
004C8DA1 8D8D 5CFFFFFF
lea ecx,
dword ptr ss:[
ebp-A4]
004C8DA7 FF15 24104000
call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>>
; MSVBVM60.__vbaFreeVar
004C8DAD 8BC6
mov eax,
esi
004C8DAF 8D4D DC
lea ecx,
dword ptr ss:[
ebp-24]
004C8DB2 83E8 01
sub eax,1 //
计数器减1
004C8DB5 8D95 7CFFFFFF
lea edx,
dword ptr ss:[
ebp-84]
004C8DBB 0F80 480C0000
jo MCS51.004C9A09
004C8DC1 50
push eax
004C8DC2 51
push ecx
004C8DC3 52
push edx
004C8DC4 FF15 30124000
call dword ptr ds:[<&MSVBVM60.#619>]
; MSVBVM60.rtcRightCharVar //逐次取特征码单个字符
004C8DCA 8D95 7CFFFFFF
lea edx,
dword ptr ss:[
ebp-84]
004C8DD0 8D4D DC
lea ecx,
dword ptr ss:[
ebp-24]
004C8DD3 FFD7
call edi
004C8DD5 8B45 B4
mov eax,
dword ptr ss:[
ebp-4C]
004C8DD8 8D8D 3CFFFFFF
lea ecx,
dword ptr ss:[
ebp-C4]
004C8DDE 8985 44FFFFFF
mov dword ptr ss:[
ebp-BC],
eax
004C8DE4 8D55 A4
lea edx,
dword ptr ss:[
ebp-5C]
004C8DE7 51
push ecx
004C8DE8 8D85 7CFFFFFF
lea eax,
dword ptr ss:[
ebp-84]
004C8DEE 83EE 01
sub esi,1 //
计数器自减1
004C8DF1 52
push edx
004C8DF2 50
push eax
004C8DF3 C785 3CFFFFFF 0>
mov dword ptr ss:[
ebp-C4],8
004C8DFD 0F80 060C0000
jo MCS51.004C9A09
004C8E03 FFD3
call ebx //
注册码=第首位注册码字符"G"+注册码
004C8E05 50
push eax
004C8E06 FF15 2C104000
call dword ptr ds:[<&MSVBVM60.__vbaStrVarMo>
; MSVBVM60.__vbaStrVarMove
004C8E0C 8BD0
mov edx,
eax
004C8E0E 8D4D B4
lea ecx,
dword ptr ss:[
ebp-4C]
004C8E11 FF15 28124000
call dword ptr ds:[<&MSVBVM60.__vbaStrMove>>
; MSVBVM60.__vbaStrMove
004C8E17 8D8D 7CFFFFFF
lea ecx,
dword ptr ss:[
ebp-84]
004C8E1D FF15 24104000
call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>>
; MSVBVM60.__vbaFreeVar
004C8E23 8D8D 9CFEFFFF
lea ecx,
dword ptr ss:[
ebp-164]
004C8E29 8D95 ACFEFFFF
lea edx,
dword ptr ss:[
ebp-154]
004C8E2F 51
push ecx
004C8E30 52
push edx
004C8E31 8D45 CC
lea eax,
dword ptr ss:[
ebp-34]
004C8E34 50
push eax
004C8E35 FF15 4C124000
call dword ptr ds:[<&MSVBVM60.__vbaVarForNe>
; MSVBVM60.__vbaVarForNext
004C8E3B ^ E9 ABFEFFFF
jmp MCS51.004C8CEB //
逐次取特征码变换,由此向上做循环运算反复循环了N次,就得到了真注册码“GYAOAEFGQMTO”
由此也可以分析出注册码计算过程了!!
=========================================
总结:
(注册码与用户名无关!)
第一步:机器码 + 常量 = 特征码
第二步:运算码 = 特征码转换为字符串后,前加上一个空格
第三步:运算码循环运算12次,得到12位的注册码
=========================================
VB算法注册机原代码:
============= WindowsXP sp1+VB6.0下编译通过 ================
Private Sub Text1_Change()
Dim tzm As String
Dim zcm As String
Dim i As Integer
tzm = " " & Val(Text1.Text) + 340202550625#
For i = 1 To 12
zcm = zcm & Chr((Asc(Mid(tzm, i, 1)) * i Mod 26) + 65)
Next
Text2.Text = zcm
End Sub
======== 收工,吃饭咯~ =========
Cracked By KuNgBiM[DFCG]
2005-04-07 12:46:33
学校运动会
[课程]FART 脱壳王!加量不加价!FART作者讲授!