mov     ecx, ds:var_time
UnPackEr:0040308D                 mov     eax, ds:check_time
UnPackEr:00403092                 cmp     ecx, eax
UnPackEr:00403094                 jz      short loc_4030AF
UnPackEr:00403096                 mov     edx, ds:TApplication
UnPackEr:0040309C                 mov     eax, [edx]      ; DWORD
UnPackEr:0040309E                 mov     ecx, ds:frmStartup ; DWORD 未注册显示的窗口
UnPackEr:004030A4                 mov     edx, ds:off_702798 ; DWORD
UnPackEr:004030AA                 call    TApplication_CreateForm

UnPackEr:004018F4                 push    ebp             ; UfrmMain.sub_004018F4
UnPackEr:004018F5                 mov     ebp, esp
UnPackEr:004018F7                 add     esp, 0FFFFFB38h
UnPackEr:004018FD                 xor     eax, eax
UnPackEr:004018FF                 mov     [ebp+a2], eax
UnPackEr:00401902                 xor     edx, edx
UnPackEr:00401904                 mov     [ebp+var_8], edx
UnPackEr:00401907                 xor     ecx, ecx
UnPackEr:00401909                 mov     [ebp+a1], ecx
UnPackEr:0040190C                 xor     eax, eax
UnPackEr:0040190E                 mov     [ebp+var_10], eax
UnPackEr:00401911                 xor     edx, edx
UnPackEr:00401913                 mov     [ebp+a4], edx

static char modulus_n[] = "A70F8F62AA6E97D1";
static char op_str5[] = "10001";
static char check_str6[] = "55776B";
long* a = nullptr;
    long* b = nullptr;
    long* c = nullptr;
    long* d = nullptr;
    int flag = 0;
    std::string operated_regcode;
    operated_regcode.resize(56);
    int seat_num = 0;
    int seat_c = 0;

    std::string regcode;
    std::string name;
    name.resize(32);
    std::cout << "Registration Name: " << std::endl;
    std::cin.getline(const_cast<char *>(name.c_str()),name.size());
    name.resize(strlen(name.c_str()));
    std::cout << "Registration Code: " << std::endl;
    std::cin >> regcode;
    size_t pos;
    while ( pos = regcode.find("-"), pos!= std::string::npos)
    {
        regcode.replace(pos,1,"");
    }

    HASH hasher;

    zhsread(const_cast<char*>(regcode.c_str()), &a);
    zhsread(modulus_n, &c);
    zhsread(op_str5, &b);
    zexpmod(a, b, c, &d);//d=(a^b)%c  //对注册码进行RSA加密后放到d
    zhswrite(const_cast<char*>(operated_regcode.c_str()), d);
    std::cout << "RSA-64 encrypted registration code: " << operated_regcode << std::endl;
    hasher.lowerStr(const_cast<char*>(operated_regcode.c_str()));

    //一下是对RSA加密后的注册码进行各种检测看是否符合规则.
    if (operated_regcode[0] != check_str6[0] &&
        operated_regcode[0] != '4')
    {
        if (operated_regcode[0] != check_str6[2] &&
            operated_regcode[1] != check_str6[3])
        {
            if (operated_regcode[0] == check_str6[4] ||
                operated_regcode[1] == check_str6[5])
            {
                flag += 4;
                if (operated_regcode[14] < 'a')
                    seat_c = operated_regcode[14] - '0';
                else
                    seat_c = operated_regcode[14] - 'W';
                seat_c *= 16;
                if (operated_regcode[15] < 'a')
                    seat_c += operated_regcode[15] - '0';
                else
                    seat_c += operated_regcode[15] - 'W';
                seat_c -= 32;
                if (operated_regcode[8] < 'a')
                    seat_num = operated_regcode[8] - '0';
                else
                    seat_num = operated_regcode[8] - 'W';
                seat_num *= 16;
                if (operated_regcode[9] < 'a')
                    seat_num += operated_regcode[9] - '0';
                else
                    seat_num += operated_regcode[9] - 'W';
                seat_num -= 32;
                seat_num += seat_c << 6;
            }
        }
        else
        {
            flag += 4;
            if (operated_regcode[8] < 97)
                seat_num = operated_regcode[8] - '0';
            else
                seat_num = operated_regcode[8] - 'W';
            seat_num *= 16;
            if (operated_regcode[9] < 97)
                seat_num += operated_regcode[9] - '0';
            else
                seat_num += operated_regcode[9] - 'W';
            seat_num -= 32;
        }
    }
    else
    {

        ++flag;
        if (operated_regcode[1] == check_str6[1] || operated_regcode[1] == '6')
            ++flag;
        if (operated_regcode[8] == '5')
            ++flag;
        if (operated_regcode[9] == '3')
            ++flag;
    }

    std::string composite_str = "UTRISO" + name + regcode;

    std::string composite_md5 = hasher(composite_str.c_str(), "MD5");
    hasher.upperStr(const_cast<char*>(composite_md5.c_str()));
    std::cout << "composite UTRISO,name,regcode md5: " << composite_md5 << std::endl;

    unsigned int comp_md5_len;
    const unsigned char* hex_composite_md5 = hasher.hash(composite_str.c_str(), "MD5", comp_md5_len);
    if ((operated_regcode[6] < '2' || operated_regcode[6] > '2') && (operated_regcode[6] < 'd' || operated_regcode[6] > 'd'))
        --flag;
    if (operated_regcode[7] != 'a' && operated_regcode[7] != 'c' && operated_regcode[7] != 'b')
        --flag;
    flag -= 2;

    //一下是对"UTRISO" + name + regcode计算出来的MD5前为位进行搜索,看是否存在
    //于数据库中...这一项最难满足了
    int len_data = 52413;
    int i = 0;
    int index = 0;
    do
    {

        index = (len_data + i) / 2;
        int result = memcmp(&data[6 * index], hex_composite_md5, 6);
        if (result <= 0)
        {
            if (result >= 0)
            {
                flag -= 2;
                if (flag == 0)
                {
                    //success
                    std::cout << "matched key check data at offset " << 6 * index << std::endl;
                }
                break;
            }
            i = index + 1;
        }
        else
        {
            len_data = index - 1;
        }
    } while (i <= len_data);
    std::cout << "last compared data: ";
    for (int i = 0; i < 6; i++)
    {
        printf("%02X", data[6 * index + i]);
    }
    std::cout << std::endl;

    std::string check_data_md5 = hasher(reinterpret_cast<const char*>(data), "MD5", 314484);
    hasher.upperStr(const_cast<char*>(check_data_md5.c_str()));
    std::cout << "key check data md5: " << check_data_md5 << std::endl;

    if (flag == 0)
    {
        std::cout << "correct registration!" << std::endl;
    }
    else
    {
        std::cout << "wrong registration!" << std::endl;
    }
    FREESPACE(a);
    FREESPACE(b);
    FREESPACE(c);
    FREESPACE(d);

#define shift(x, n) (((x) << (n)) | ((x) >> (32-(n))))
#define F(x, y, z) (((x) & (y)) | ((~x) & (z)))
#define G(x, y, z) (((x) & (z)) | ((y) & (~z)))
#define H(x, y, z) ((x) ^ (y) ^ (z))
#define I(x, y, z) ((y) ^ ((x) | (~z)))

#define FF(a ,b ,c ,d ,Mj ,s ,ti)  a = b + (shift((a + F(b, c, d) + Mj + ti) , s))
#define GG(a, b, c, d, Mj, s, ti)  a = b + (shift((a + G(b, c, d) + Mj + ti) , s))
#define HH(a, b, c, d, Mj, s, ti)  a = b + (shift((a + H(b, c, d) + Mj + ti) , s))
#define II(a, b, c, d, Mj, s, ti)  a = b + (shift((a + I(b, c, d) + Mj + ti) , s))

#define A 0x67452301
#define B 0xefcdab89
#define C 0x98badcfe
#define D 0x10325476

typedef unsigned long long ull;
typedef unsigned int uint;
typedef unsigned char uchar;

//msg must be padded 512 bit.
extern inline ull md5_512(uint* msg)
{
    uint a = A, b = B, c = C, d = D;

    FF(a, b, c, d, msg[0], 7, 0xd76aa478);
    FF(d, a, b, c, msg[1], 12, 0xe8c7b756);
    FF(c, d, a, b, msg[2], 17, 0x242070db);
    FF(b, c, d, a, msg[3], 22, 0xc1bdceee);
    FF(a, b, c, d, msg[4], 7, 0xf57c0faf);
    FF(d, a, b, c, msg[5], 12, 0x4787c62a);
    FF(c, d, a, b, msg[6], 17, 0xa8304613);
    FF(b, c, d, a, msg[7], 22, 0xfd469501);
    FF(a, b, c, d, msg[8], 7, 0x698098d8);
    FF(d, a, b, c, msg[9], 12, 0x8b44f7af);
    FF(c, d, a, b, msg[10], 17, 0xffff5bb1);
    FF(b, c, d, a, msg[11], 22, 0x895cd7be);
    FF(a, b, c, d, msg[12], 7, 0x6b901122);
    FF(d, a, b, c, msg[13], 12, 0xfd987193);
    FF(c, d, a, b, msg[14], 17, 0xa679438e);
    FF(b, c, d, a, msg[15], 22, 0x49b40821);

    GG(a, b, c, d, msg[1], 5, 0xf61e2562);
    GG(d, a, b, c, msg[6], 9, 0xc040b340);
    GG(c, d, a, b, msg[11], 14, 0x265e5a51);
    GG(b, c, d, a, msg[0], 20, 0xe9b6c7aa);
    GG(a, b, c, d, msg[5], 5, 0xd62f105d);
    GG(d, a, b, c, msg[10], 9, 0x02441453);
    GG(c, d, a, b, msg[15], 14, 0xd8a1e681);
    GG(b, c, d, a, msg[4], 20, 0xe7d3fbc8);
    GG(a, b, c, d, msg[9], 5, 0x21e1cde6);
    GG(d, a, b, c, msg[14], 9, 0xc33707d6);
    GG(c, d, a, b, msg[3], 14, 0xf4d50d87);
    GG(b, c, d, a, msg[8], 20, 0x455a14ed);
    GG(a, b, c, d, msg[13], 5, 0xa9e3e905);
    GG(d, a, b, c, msg[2], 9, 0xfcefa3f8);
    GG(c, d, a, b, msg[7], 14, 0x676f02d9);
    GG(b, c, d, a, msg[12], 20, 0x8d2a4c8a);

    HH(a, b, c, d, msg[5], 4, 0xfffa3942);
    HH(d, a, b, c, msg[8], 11, 0x8771f681);
    HH(c, d, a, b, msg[11], 16, 0x6d9d6122);
    HH(b, c, d, a, msg[14], 23, 0xfde5380c);
    HH(a, b, c, d, msg[1], 4, 0xa4beea44);
    HH(d, a, b, c, msg[4], 11, 0x4bdecfa9);
    HH(c, d, a, b, msg[7], 16, 0xf6bb4b60);
    HH(b, c, d, a, msg[10], 23, 0xbebfbc70);
    HH(a, b, c, d, msg[13], 4, 0x289b7ec6);
    HH(d, a, b, c, msg[0], 11, 0xeaa127fa);
    HH(c, d, a, b, msg[3], 16, 0xd4ef3085);
    HH(b, c, d, a, msg[6], 23, 0x04881d05);
    HH(a, b, c, d, msg[9], 4, 0xd9d4d039);
    HH(d, a, b, c, msg[12], 11, 0xe6db99e5);
    HH(c, d, a, b, msg[15], 16, 0x1fa27cf8);
    HH(b, c, d, a, msg[2], 23, 0xc4ac5665);

    II(a, b, c, d, msg[0], 6, 0xf4292244);
    II(d, a, b, c, msg[7], 10, 0x432aff97);
    II(c, d, a, b, msg[14], 15, 0xab9423a7);
    II(b, c, d, a, msg[5], 21, 0xfc93a039);
    II(a, b, c, d, msg[12], 6, 0x655b59c3);
    II(d, a, b, c, msg[3], 10, 0x8f0ccc92);
    II(c, d, a, b, msg[10], 15, 0xffeff47d);
    II(b, c, d, a, msg[1], 21, 0x85845dd1);
    II(a, b, c, d, msg[8], 6, 0x6fa87e4f);
    II(d, a, b, c, msg[15], 10, 0xfe2ce6e0);
    II(c, d, a, b, msg[6], 15, 0xa3014314);
    II(b, c, d, a, msg[13], 21, 0x4e0811a1);
    II(a, b, c, d, msg[4], 6, 0xf7537e82);
    II(d, a, b, c, msg[11], 10, 0xbd3af235);
    II(c, d, a, b, msg[2], 15, 0x2ad7d2bb);
    II(b, c, d, a, msg[9], 21, 0xeb86d391);

    a = a + A;
    b = b + B;
    c = c + C;
    d = d + D;
    return (ull(b) << 32) | a;
}

#define m_res  0x58F0709D5591682F
typedef unsigned long long ull;

__device__ __inline__ void add_mod(ull &a, ull b, ull m)
{
    b = a + b;
    if (b < a)
    {
        a = (b%m + m_res) % m;
    }
    else
    {
        a = b%m;
    }
}

__device__ __inline__ void  mul_mod(ull &a, ull b, ull m)
{
    ull tmp = a%m;
    a = 0;
    while (b)
    {
        if (b & 1)
            add_mod(a, tmp, m);

        add_mod(tmp, tmp, m);
        b >>= 1;
    }
}

__device__ __inline__ ull exp_mod(ull c, ull e, ull n)
{
    c %= n;
    ull result = 1;
    while (e > 0)
    {
        if (e & 1)
        {
            mul_mod(result, c, n);//result = (result*c) % n;
        }
        e >>= 1;
        mul_mod(c, c, n);//c = (c*c) % n;
    }

    return result;
}

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法