|
|
|---|---|
|
|
晕，我没动用任何工具，打开程序随便输信息，第一次就注册成功了，用时1秒钟！
 注册成功条件： name是至少3位字母，code前三位要和用户名相同。 
|
|
|
最初由 HillCat 发布 
|
|
|
再仔细看了一下：
MessageBoxW 或者 GetWindowTextW： ====================================== 00401314 |. 6A 64 push 64 ; /Count = 64 (100.) 00401316 |. 8D8D 68FEFFFF lea ecx,dword ptr ss:[ebp-198] ; | 0040131C |. 51 push ecx ; |Buffer 0040131D |. 8B15 80304000 mov edx,dword ptr ds:[403080] ; | 00401323 |. 52 push edx ; |hWnd => 002B0370 (class='Edit',parent=003403A8) 00401324 |. FF15 0C204000 call dword ptr ds:[<&USER32.GetWindowTextW>] ; \GetWindowTextW 0040132A |. 6A 64 push 64 ; /Count = 64 (100.) 0040132C |. 8D85 30FFFFFF lea eax,dword ptr ss:[ebp-D0] ; | 00401332 |. 50 push eax ; |Buffer 00401333 |. 8B0D 7C304000 mov ecx,dword ptr ds:[40307C] ; | 00401339 |. 51 push ecx ; |hWnd => 001F0366 (class='Edit',parent=003403A8) 0040133A |. FF15 0C204000 call dword ptr ds:[<&USER32.GetWindowTextW>] ; \GetWindowTextW 00401340 |. E8 21010000 call my.00401466 00401345 |. 99 cdq 00401346 |. B9 20030000 mov ecx,320 0040134B |. F7F9 idiv ecx 0040134D |. 52 push edx 0040134E |. E8 13010000 call my.00401466 00401353 |. 99 cdq ; | 00401354 |. B9 BC020000 mov ecx,2BC ; | 00401359 |. F7F9 idiv ecx ; | 0040135B |. 52 push edx ; |Arg6 0040135C |. 68 28304000 push my.00403028 ; |Arg5 = 00403028 ASCII "jcduvwxyz" 00401361 |. 68 14304000 push my.00403014 ; |Arg4 = 00403014 ASCII "FGHIJCDUVWXYZSTefghijcduvwxyz" 00401366 |. 68 00304000 push my.00403000 ; |Arg3 = 00403000 0040136B |. 8D95 30FFFFFF lea edx,dword ptr ss:[ebp-D0] ; |//输入的code 00401371 |. 52 push edx ; |Arg2 00401372 |. 8D85 68FEFFFF lea eax,dword ptr ss:[ebp-198] ; |//输入的name 00401378 |. 50 push eax ; |Arg1 00401379 |. E8 12FDFFFF call my.00401090 ; \//关键CALL, F7跟入，到Lable1!! 0040137E |. 85C0 test eax,eax ; //标志位判断 00401380 |. 74 0C je short my.0040138E ; //为零就失败 00401382 |. C785 60FEFFFF 58304000 mov dword ptr ss:[ebp-1A0],my.00403058 0040138C |. EB 0A jmp short my.00401398 0040138E |> C785 60FEFFFF 64304000 mov dword ptr ss:[ebp-1A0],my.00403064 00401398 |> 6A 40 push 40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL 0040139A |. 68 70304000 push my.00403070 ; |Title = "提示" 0040139F |. 8B8D 60FEFFFF mov ecx,dword ptr ss:[ebp-1A0] ; | 004013A5 |. 51 push ecx ; |Text 004013A6 |. 8B55 08 mov edx,dword ptr ss:[ebp+8] ; | 004013A9 |. 52 push edx ; |hOwner 004013AA |. FF15 08204000 call dword ptr ds:[<&USER32.MessageBoxW>] ; \MessageBoxW Lable1： ========================================= 00401090 /$ 55 push ebp 00401091 |. 8BEC mov ebp,esp 00401093 |. 83EC 0C sub esp,0C 00401096 |. 56 push esi 00401097 |. C745 F4 FFFFFFFF mov dword ptr ss:[ebp-C],-1 0040109E |. 817D 1C BC020000 cmp dword ptr ss:[ebp+1C],2BC 004010A5 |. 7F 09 jg short my.004010B0 004010A7 |. 817D 20 20030000 cmp dword ptr ss:[ebp+20],320 004010AE |. 7E 07 jle short my.004010B7 004010B0 |> 33C0 xor eax,eax 004010B2 |. E9 73010000 jmp my.0040122A 004010B7 |> 8B45 10 mov eax,dword ptr ss:[ebp+10] 004010BA |. 8945 FC mov dword ptr ss:[ebp-4],eax 004010BD |. C745 F8 00000000 mov dword ptr ss:[ebp-8],0 004010C4 |. EB 09 jmp short my.004010CF 004010C6 |> 8B4D F8 /mov ecx,dword ptr ss:[ebp-8] 004010C9 |. 83C1 01 |add ecx,1 004010CC |. 894D F8 |mov dword ptr ss:[ebp-8],ecx 004010CF |> 837D F8 2F cmp dword ptr ss:[ebp-8],2F 004010D3 |. 7D 1C |jge short my.004010F1 004010D5 |. 33D2 |xor edx,edx 004010D7 |. 85D2 |test edx,edx 004010D9 |. 74 02 |je short my.004010DD 004010DB |. EB 14 |jmp short my.004010F1 004010DD |> 8B45 FC |mov eax,dword ptr ss:[ebp-4] 004010E0 |. 0345 F8 |add eax,dword ptr ss:[ebp-8] 004010E3 |. 33C9 |xor ecx,ecx 004010E5 |. 8A08 |mov cl,byte ptr ds:[eax] 004010E7 |. 8B55 F4 |mov edx,dword ptr ss:[ebp-C] 004010EA |. 03D1 |add edx,ecx 004010EC |. 8955 F4 |mov dword ptr ss:[ebp-C],edx 004010EF |.^ EB D5 \jmp short my.004010C6 004010F1 |> 837D F8 2F cmp dword ptr ss:[ebp-8],2F 004010F5 |. 7D 07 jge short my.004010FE 004010F7 |. 33C0 xor eax,eax 004010F9 |. E9 2C010000 jmp my.0040122A 004010FE |> 8B45 14 mov eax,dword ptr ss:[ebp+14] 00401101 |. 8945 FC mov dword ptr ss:[ebp-4],eax 00401104 |. C745 F8 00000000 mov dword ptr ss:[ebp-8],0 0040110B |. EB 09 jmp short my.00401116 0040110D |> 8B4D F8 /mov ecx,dword ptr ss:[ebp-8] 00401110 |. 83C1 01 |add ecx,1 00401113 |. 894D F8 |mov dword ptr ss:[ebp-8],ecx 00401116 |> 837D F8 14 cmp dword ptr ss:[ebp-8],14 0040111A |. 7D 1C |jge short my.00401138 0040111C |. 33D2 |xor edx,edx 0040111E |. 85D2 |test edx,edx 00401120 |. 74 02 |je short my.00401124 00401122 |. EB 14 |jmp short my.00401138 00401124 |> 8B45 FC |mov eax,dword ptr ss:[ebp-4] 00401127 |. 0345 F8 |add eax,dword ptr ss:[ebp-8] 0040112A |. 33C9 |xor ecx,ecx 0040112C |. 8A08 |mov cl,byte ptr ds:[eax] 0040112E |. 8B55 F4 |mov edx,dword ptr ss:[ebp-C] 00401131 |. 2BD1 |sub edx,ecx 00401133 |. 8955 F4 |mov dword ptr ss:[ebp-C],edx 00401136 |.^ EB D5 \jmp short my.0040110D 00401138 |> 837D F8 14 cmp dword ptr ss:[ebp-8],14 0040113C |. 7D 07 jge short my.00401145 0040113E |. 33C0 xor eax,eax 00401140 |. E9 E5000000 jmp my.0040122A 00401145 |> 8B45 18 mov eax,dword ptr ss:[ebp+18] 00401148 |. 8945 FC mov dword ptr ss:[ebp-4],eax 0040114B |. C745 F8 00000000 mov dword ptr ss:[ebp-8],0 00401152 |. EB 09 jmp short my.0040115D 00401154 |> 8B4D F8 /mov ecx,dword ptr ss:[ebp-8] 00401157 |. 83C1 01 |add ecx,1 0040115A |. 894D F8 |mov dword ptr ss:[ebp-8],ecx 0040115D |> 837D F8 14 cmp dword ptr ss:[ebp-8],14 00401161 |. 7D 1C |jge short my.0040117F 00401163 |. 33D2 |xor edx,edx 00401165 |. 85D2 |test edx,edx 00401167 |. 74 02 |je short my.0040116B 00401169 |. EB 14 |jmp short my.0040117F 0040116B |> 8B45 FC |mov eax,dword ptr ss:[ebp-4] 0040116E |. 0345 F8 |add eax,dword ptr ss:[ebp-8] 00401171 |. 33C9 |xor ecx,ecx 00401173 |. 8A08 |mov cl,byte ptr ds:[eax] 00401175 |. 8B55 F4 |mov edx,dword ptr ss:[ebp-C] 00401178 |. 23D1 |and edx,ecx 0040117A |. 8955 F4 |mov dword ptr ss:[ebp-C],edx 0040117D |.^ EB D5 \jmp short my.00401154 0040117F |> 837D F8 14 cmp dword ptr ss:[ebp-8],14 00401183 |. 7D 07 jge short my.0040118C 00401185 |. 33C0 xor eax,eax 00401187 |. E9 9E000000 jmp my.0040122A 0040118C |> 8B45 08 mov eax,dword ptr ss:[ebp+8] ; //name 0040118F |. 50 push eax 00401190 |. E8 B4020000 call my.00401449 00401195 |. 83C4 04 add esp,4 00401198 |. 8945 1C mov dword ptr ss:[ebp+1C],eax ; //name位数 0040119B |. 8B4D 0C mov ecx,dword ptr ss:[ebp+C] ; //code 0040119E |. 51 push ecx 0040119F |. E8 A5020000 call my.00401449 004011A4 |. 83C4 04 add esp,4 004011A7 |. 8945 20 mov dword ptr ss:[ebp+20],eax ; //code的位数 004011AA |. 8B55 1C mov edx,dword ptr ss:[ebp+1C] 004011AD |. 3B55 20 cmp edx,dword ptr ss:[ebp+20] ; //比较name和code的位数 004011B0 |. 7E 04 jle short my.004011B6 ; //name位数不能大于code位数 004011B2 |. 33C0 xor eax,eax 004011B4 |. EB 74 jmp short my.0040122A 004011B6 |> 8B45 1C mov eax,dword ptr ss:[ebp+1C] 004011B9 |. 3B45 20 cmp eax,dword ptr ss:[ebp+20] 004011BC |. 75 0A jnz short my.004011C8 004011BE |. 837D 1C 00 cmp dword ptr ss:[ebp+1C],0 ; //位数是否为零 004011C2 |. 75 04 jnz short my.004011C8 004011C4 |. 33C0 xor eax,eax 004011C6 |. EB 62 jmp short my.0040122A 004011C8 |> C745 20 00000000 mov dword ptr ss:[ebp+20],0 004011CF |> 8B4D 1C /mov ecx,dword ptr ss:[ebp+1C] 004011D2 |. 8B55 1C |mov edx,dword ptr ss:[ebp+1C] 004011D5 |. 83EA 01 |sub edx,1 004011D8 |. 8955 1C |mov dword ptr ss:[ebp+1C],edx 004011DB |. 85C9 |test ecx,ecx 004011DD |. 74 42 |je short my.00401221 004011DF |. 8B45 1C |mov eax,dword ptr ss:[ebp+1C] 004011E2 |. 8B4D 0C |mov ecx,dword ptr ss:[ebp+C] ; //code 004011E5 |. 33D2 |xor edx,edx 004011E7 |. 66:8B1441 |mov dx,word ptr ds:[ecx+eax*2] ; //code最后一位开始取 004011EB |. 8B45 1C |mov eax,dword ptr ss:[ebp+1C] 004011EE |. 8B4D 08 |mov ecx,dword ptr ss:[ebp+8] ; //name 004011F1 |. 33F6 |xor esi,esi 004011F3 |. 66:8B3441 |mov si,word ptr ds:[ecx+eax*2] ; //name最后一位开始取 004011F7 |. 33D6 |xor edx,esi ; //code取位 xor name取位 004011F9 |. 8B45 1C |mov eax,dword ptr ss:[ebp+1C] 004011FC |. 8B4D 0C |mov ecx,dword ptr ss:[ebp+C] 004011FF |. 33F6 |xor esi,esi 00401201 |. 66:8B3441 |mov si,word ptr ds:[ecx+eax*2] 00401205 |. 83F6 30 |xor esi,30 ; //name取位 xor 30 00401208 |. 33C0 |xor eax,eax 0040120A |. 66:8B0475 34304000 |mov ax,word ptr ds:[esi*2+403034] ; //403034保存的是作者E-mail地址，呵呵 00401212 |. 3BD0 |cmp edx,eax ; //经过上面的运算，这里进行关键比较 00401214 |. 75 09 |jnz short my.0040121F ; //不等就跳过 00401216 |. 8B4D 20 |mov ecx,dword ptr ss:[ebp+20] 00401219 |. 83C1 01 |add ecx,1 ; //如果上面比较结果相等，到这里，ecx加1 0040121C |. 894D 20 |mov dword ptr ss:[ebp+20],ecx ; //ecx值入[ebp+20] 0040121F |>^ EB AE \jmp short my.004011CF 00401221 |> 33C0 xor eax,eax 00401223 |. 837D 20 03 cmp dword ptr ss:[ebp+20],3 ; //比较[ebp+20]和3， 00401227 |. 0F9DC0 setge al ; //，设置标志位，至少三位相等 0040122A |> 5E pop esi 0040122B |. 8BE5 mov esp,ebp 0040122D |. 5D pop ebp 0040122E \. C2 1C00 retn 1C ; //返回到40137E 总结： ============================================== 我没有仔细去推敲具体算法计算，但我发现作者使用算法后 CMP F(name),G(code) 与 name和code对应位直接比较的效果完全一样（限于字母）。 作者的精心设计,让我这样投机取巧了~
|
|
|
呵呵
|
|
|
多谢山猫！
|
|
|
最初由 HillCat 发布 这个........ |
