用PEID查哦。。显示Nothing found *这些字样。在想肯定加有壳不管那么多了OD载入
004B4F2E > 9C PUSHFD ; 壳的入口
004B4F2F 60 PUSHAD
004B4F30 E8 00000000 CALL UcopyKin.004B4F35 ; 用ESP定律吧!
看ESP值为0012FFA0,在命令窗口下hr 0012FFA0 F9运行，
004B519D C2 0C00 RETN 0C
004B51A0 61 POPAD
004B51A1 9D POPFD ; 断在这里
004B51A2 - E9 1508FDFF JMP UcopyKin.004859BC ; 这就是奔向小康了，这段跨越好大哦!
===================================================================================
脱完壳再查一下Borland Delphi 6.0 - 7.0语言写的，再查一下算法是MD5的晕哦!!!(不懂MD5算法)接下来就是找算法了!!
00481514 55 PUSH EBP ; 下断F12
00481515 8BEC MOV EBP,ESP
00481517 6A 00 PUSH 0
00481519 6A 00 PUSH 0
0048151B 6A 00 PUSH 0
0048151D 53 PUSH EBX
0048151E 56 PUSH ESI
0048151F 8BD8 MOV EBX,EAX
00481521 33C0 XOR EAX,EAX
00481523 55 PUSH EBP
00481524 68 59164800 PUSH UcopyKin.00481659
00481529 64:FF30 PUSH DWORD PTR FS:[EAX]
0048152C 64:8920 MOV DWORD PTR FS:[EAX],ESP
0048152F 8BC3 MOV EAX,EBX
00481531 E8 5AFBFFFF CALL UcopyKin.00481090 ; ★★★关键CALL跟进!!★★★
00481536 84C0 TEST AL,AL
00481538 0F84 DF000000 JE UcopyKin.0048161D ; 关键跳转!爆破处。。
0048153E 6A 40 PUSH 40
00481540 68 68164800 PUSH UcopyKin.00481668 ; 注册成功!
00481545 68 74164800 PUSH UcopyKin.00481674 ; 谢谢你的注册!
======================================================================
跟进00481090
00481090 55 PUSH EBP
00481091 8BEC MOV EBP,ESP
00481093 B9 06000000 MOV ECX,6
00481098 6A 00 PUSH 0
0048109A 6A 00 PUSH 0
0048109C 49 DEC ECX
0048109D ^ 75 F9 JNZ SHORT UcopyKin.00481098
0048109F 53 PUSH EBX
004810A0 8BD8 MOV EBX,EAX
004810A2 33C0 XOR EAX,EAX
004810A4 55 PUSH EBP
004810A5 68 94114800 PUSH UcopyKin.00481194
004810AA 64:FF30 PUSH DWORD PTR FS:[EAX]
004810AD 64:8920 MOV DWORD PTR FS:[EAX],ESP
004810B0 8D55 F0 LEA EDX,DWORD PTR SS:[EBP-10]
004810B3 8B83 40030000 MOV EAX,DWORD PTR DS:[EBX+340]
004810B9 E8 5AA3FBFF CALL UcopyKin.0043B418 ; 获取用户名，长度送入EAX
004810BE 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10] ; EDX=用户名，fcrjzmd
004810C1 8D4D F4 LEA ECX,DWORD PTR SS:[EBP-C]
004810C4 8BC3 MOV EAX,EBX
004810C6 E8 F5020000 CALL UcopyKin.004813C0 ; ★用户名运算(计算用户名得到值139266)
004810CB 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] ; EAX=139266
004810CE 50 PUSH EAX ; 压入139266
004810CF 8D55 E4 LEA EDX,DWORD PTR SS:[EBP-1C]
004810D2 8B83 30030000 MOV EAX,DWORD PTR DS:[EBX+330]
004810D8 E8 3BA3FBFF CALL UcopyKin.0043B418 ; 获取用机器码,长度送入EAX
004810DD 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C] ; EDX=587-207-186
004810E0 8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18]
004810E3 8BC3 MOV EAX,EBX
004810E5 E8 76030000 CALL UcopyKin.00481460 ; 将机器码合并587207186
004810EA 8B55 E8 MOV EDX,DWORD PTR SS:[EBP-18] ; EDX=587207186
004810ED 8D4D EC LEA ECX,DWORD PTR SS:[EBP-14]
004810F0 8BC3 MOV EAX,EBX
004810F2 E8 C9020000 CALL UcopyKin.004813C0 ; ★机器码运算(得出1152625)
004810F7 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14] ; EDX=1152625
004810FA 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
004810FD 59 POP ECX ; 弹出用户名运算得出139266
004810FE E8 4D34F8FF CALL UcopyKin.00404550 ; 将机器码运算的值(1152625)和用户名运算的值(139266)合并
00481103 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00481106 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; EAX=1152625139266(机器码和用户值的合并)
00481109 E8 82FBFFFF CALL UcopyKin.00480C90 ; ★★★MD5算法CALL
0048110E 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C]
00481111 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
00481114 E8 EBFBFFFF CALL UcopyKin.00480D04 ; ★★★核心算法!
00481119 8D4D FC LEA ECX,DWORD PTR SS:[EBP-4]
0048111C 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; EDX=80776f60d672ba41acb6188034e680ac
0048111F 8BC3 MOV EAX,EBX
00481121 E8 7E000000 CALL UcopyKin.004811A4
00481126 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00481129 8B83 44030000 MOV EAX,DWORD PTR DS:[EBX+344]
0048112F E8 E4A2FBFF CALL UcopyKin.0043B418 ; 获取假码，长度送入EAX
00481134 8B55 D0 MOV EDX,DWORD PTR SS:[EBP-30] ; EDX=假码
00481137 8D4D F8 LEA ECX,DWORD PTR SS:[EBP-8]
0048113A 8BC3 MOV EAX,EBX
0048113C E8 1F030000 CALL UcopyKin.00481460 ; ★★★核心算法!真码出现!!
00481141 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; EAX=8Y776P6YN672LK41KML6188Y34H68YKM
00481144 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
00481147 E8 0435F8FF CALL UcopyKin.00404650 ; 真假码对比CALL
0048114C 75 04 JNZ SHORT UcopyKin.00481152 ; 不相等则失败，反之相等则成功!!※爆破最佳位置NOP
0048114E B3 01 MOV BL,1 ; 将1送入BL是注册码检证成功标志!!
00481150 EB 02 JMP SHORT UcopyKin.00481154
00481152 33DB XOR EBX,EBX
00481154 33C0 XOR EAX,EAX
00481156 5A POP EDX
00481157 59 POP ECX
00481158 59 POP ECX
00481159 64:8910 MOV DWORD PTR FS:[EAX],EDX
0048115C 68 9B114800 PUSH UcopyKin.0048119B
00481161 8D45 D0 LEA EAX,DWORD PTR SS:[EBP-30]
00481164 E8 DB30F8FF CALL UcopyKin.00404244
00481169 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C]
0048116C E8 D330F8FF CALL UcopyKin.00404244
00481171 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
00481174 BA 02000000 MOV EDX,2
00481179 E8 EA30F8FF CALL UcopyKin.00404268
0048117E 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
00481181 E8 BE30F8FF CALL UcopyKin.00404244
00481186 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
00481189 BA 03000000 MOV EDX,3
0048118E E8 D530F8FF CALL UcopyKin.00404268
00481193 C3 RETN
00481194 ^ E9 132AF8FF JMP UcopyKin.00403BAC
00481199 ^ EB C6 JMP SHORT UcopyKin.00481161
0048119B 8BC3 MOV EAX,EBX
0048119D 5B POP EBX
0048119E 8BE5 MOV ESP,EBP
004811A0 5D POP EBP
004811A1 C3 RETN
用户名的算法和机器码算法都一样的逐个取出ASCII码，乘4再和下ASCII码累加，累加的值再乘4，一直循环计算直至到取完，
取完得出的值除以A，余数和30相加，一直循环计算直至到取完，用户名和机器分计算得出的值合并(我得出值1152625139266)
接下来就是MD5算法了，这个MD5我是不懂看了对于我这个菜鸟难度太高了。这个是我初步分析的手稿以后搞懂MD5再分析吧。(N年吧)
再看一下注册表信息吧，注册成功后的注册表如下：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SetUCK]
"UsrName"="fcrjzmd"
"Passwd"="8Y776P6YN672LK41KML6188Y34H68YKM"
删掉就变成10天试用版了!
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
