软件：驱动精灵2.02
简介：驱动精灵是一个非常实用的驱动程序备份工具，经常重装电脑的人一定有找驱动程序的经验，要不就原版驱动程序已经不见了，就是事先没有备份起来，找起来相当费时；现在你只要利用驱动精灵的驱动程序备份功能，在电脑重装前，将你目前电脑中的最新版本驱动程序通通备份下载，待重装完成时，再试用它的驱动程序还原功能安装，这样，便可以节省掉许多许动程序安装的时间，并且在也不怕找不到驱动程序了。
平台：
操作系统: Microsoft Windows XP
系统补丁: Service Pack 2
工具：OD1.10，peid，lordpe，importREC
软件出来很早了，注册算法又简单，估计注册机已经满天飞了。忙于工作，拿来练练手，热热身。
开工：
1、 准备工作：安装完毕后，运行，出现注册对话框，随便输入点什么，注册，有注册错误提示。
2、 查壳，UPX，脱之。
3、 载入脱壳后程序，搜索Messagebox,下断。
断在这里：
0049D5AD 33D2 XOR EDX,EDX
0049D5AF E8 2063FAFF CALL dumped_.004438D4
0049D5B4 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
0049D5B7 BA 03000000 MOV EDX,3
0049D5BC E8 677BF6FF CALL dumped_.00405128
0049D5C1 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
0049D5C4 BA 64D84900 MOV EDX,dumped_.0049D864 ; ASCII "$%^"
0049D5C9 E8 B675F6FF CALL dumped_.00404B84
0049D5CE 6A 00 PUSH 0
0049D5D0 68 68D84900 PUSH dumped_.0049D868 ; ASCII "Invalid Registration Code"
0049D5D5 68 84D84900 PUSH dumped_.0049D884 ; ASCII "Please make sure the registration
code and the registration name are
correct."
0049D5DA 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D5DD E8 66CAFAFF CALL dumped_.0044A048
0049D5E2 50 PUSH EAX
0049D5E3 E8 3CA6F6FF CALL <JMP.&user32.MessageBoxA>――――这里
向上看：
0049D3F2 85C0 TEST EAX,EAX
0049D3F4 0F84 9A010000 JE dumped_.0049D594
0049D3FA 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D3FD 8B80 04030000 MOV EAX,DWORD PTR DS:[EAX+304]
0049D403 33D2 XOR EDX,EDX
0049D405 E8 CA64FAFF CALL dumped_.004438D4
0049D40A 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
0049D40D E8 DA76F6FF CALL dumped_.00404AEC
0049D412 6A 00 PUSH 0
0049D414 68 8CD74900 PUSH dumped_.0049D78C ; ASCII "Registration Success!"――――好消息
0049D419 68 A4D74900 PUSH dumped_.0049D7A4 ; ASCII " Thank you for your support.
We will work even harder and
notify you future releases."
0049D41E 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D421 E8 22CCFAFF CALL dumped_.0044A048
0049D426 50 PUSH EAX
0049D427 E8 F8A7F6FF CALL <JMP.&user32.MessageBoxA>
在向上，找到注册函数开头：
0049D1F4 55 PUSH EBP――――这里是开头，下断，F9运行后，注册，断在这里，F8向下跟
0049D1F5 8BEC MOV EBP,ESP
0049D1F7 B9 0B000000 MOV ECX,0B
0049D1FC 6A 00 PUSH 0
0049D1FE 6A 00 PUSH 0
0049D200 49 DEC ECX
0049D201 ^75 F9 JNZ SHORT dumped_.0049D1FC
0049D203 51 PUSH ECX
0049D204 53 PUSH EBX
0049D205 56 PUSH ESI
0049D206 57 PUSH EDI
0049D207 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
0049D20A 33C0 XOR EAX,EAX
0049D20C 55 PUSH EBP
0049D20D 68 45D64900 PUSH dumped_.0049D645
0049D212 64:FF30 PUSH DWORD PTR FS:[EAX]
0049D215 64:8920 MOV DWORD PTR FS:[EAX],ESP
0049D218 8D55 E4 LEA EDX,DWORD PTR SS:[EBP-1C]
0049D21B 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D21E 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
0049D224 E8 7B66FAFF CALL dumped_.004438A4 ;取用户名
0049D229 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
0049D22C E8 737BF6FF CALL dumped_.00404DA4
0049D231 05 57040000 ADD EAX,457
0049D236 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
0049D239 E8 72C2F6FF CALL dumped_.004094B0 ; 用不同的用户名会发现这里生成一个数字：（用户名位数+1111）10进制
0049D23E 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
0049D241 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D244 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
0049D24A E8 5566FAFF CALL dumped_.004438A4
0049D24F 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
0049D252 BA 5CD64900 MOV EDX,dumped_.0049D65C ; ASCII "DiSTiNCT"
0049D257 E8 8C7CF6FF CALL dumped_.00404EE8
0049D25C 0F84 32030000 JE dumped_.0049D594
0049D262 8D55 DC LEA EDX,DWORD PTR SS:[EBP-24]
0049D265 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D268 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
0049D26E E8 3166FAFF CALL dumped_.004438A4
0049D273 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24]
0049D276 BA 70D64900 MOV EDX,dumped_.0049D670 ; ASCII "Team iNSaNE"
0049D27B E8 687CF6FF CALL dumped_.00404EE8
0049D280 0F84 0E030000 JE dumped_.0049D594
0049D286 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28]
0049D289 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D28C 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
0049D292 E8 0D66FAFF CALL dumped_.004438A4
0049D297 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28]
0049D29A BA 84D64900 MOV EDX,dumped_.0049D684 ; ASCII "TNT!2000"
0049D29F E8 447CF6FF CALL dumped_.00404EE8
0049D2A4 0F84 EA020000 JE dumped_.0049D594
0049D2AA 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
0049D2AD 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D2B0 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
0049D2B6 E8 E965FAFF CALL dumped_.004438A4
0049D2BB 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C]
0049D2BE BA 98D64900 MOV EDX,dumped_.0049D698 ; ASCII "-=Demian/TNT!=-"
0049D2C3 E8 207CF6FF CALL dumped_.00404EE8
0049D2C8 0F84 C6020000 JE dumped_.0049D594
0049D2CE 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
0049D2D1 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D2D4 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
0049D2DA E8 C565FAFF CALL dumped_.004438A4
0049D2DF 8B45 D0 MOV EAX,DWORD PTR SS:[EBP-30]
0049D2E2 BA B0D64900 MOV EDX,dumped_.0049D6B0 ; ASCII "-=Demian/TNT!=- "
0049D2E7 E8 FC7BF6FF CALL dumped_.00404EE8
0049D2EC 0F84 A2020000 JE dumped_.0049D594
0049D2F2 8D55 CC LEA EDX,DWORD PTR SS:[EBP-34]
0049D2F5 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D2F8 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
0049D2FE E8 A165FAFF CALL dumped_.004438A4
0049D303 8B45 CC MOV EAX,DWORD PTR SS:[EBP-34]
0049D306 BA CCD64900 MOV EDX,dumped_.0049D6CC ; ASCII "DiSTiNCT "
0049D30B E8 D87BF6FF CALL dumped_.00404EE8
0049D310 0F84 7E020000 JE dumped_.0049D594
0049D316 8D55 C8 LEA EDX,DWORD PTR SS:[EBP-38]
0049D319 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D31C 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
0049D322 E8 7D65FAFF CALL dumped_.004438A4
0049D327 8B45 C8 MOV EAX,DWORD PTR SS:[EBP-38]
0049D32A BA E0D64900 MOV EDX,dumped_.0049D6E0 ; ASCII "TMG"
0049D32F E8 B47BF6FF CALL dumped_.00404EE8
0049D334 0F84 5A020000 JE dumped_.0049D594
0049D33A 8D55 C4 LEA EDX,DWORD PTR SS:[EBP-3C]
0049D33D 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D340 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
0049D346 E8 5965FAFF CALL dumped_.004438A4
0049D34B 8B45 C4 MOV EAX,DWORD PTR SS:[EBP-3C]
0049D34E BA ECD64900 MOV EDX,dumped_.0049D6EC ; ASCII "Sponge Uk"
0049D353 E8 907BF6FF CALL dumped_.00404EE8
0049D358 0F84 36020000 JE dumped_.0049D594
0049D35E 8D55 C0 LEA EDX,DWORD PTR SS:[EBP-40]
0049D361 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D364 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
0049D36A E8 3565FAFF CALL dumped_.004438A4
0049D36F 8B45 C0 MOV EAX,DWORD PTR SS:[EBP-40]
0049D372 BA 00D74900 MOV EDX,dumped_.0049D700 ; ASCII "Sponge Uk "
0049D377 E8 6C7BF6FF CALL dumped_.00404EE8 ; 以上黑名单，这几位可能是传说中的牛人。
0049D37C 0F84 12020000 JE dumped_.0049D594
0049D382 68 14D74900 PUSH dumped_.0049D714
0049D387 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D38A FFB0 2C030000 PUSH DWORD PTR DS:[EAX+32C]
0049D390 68 20D74900 PUSH dumped_.0049D720 ; ASCII "20"――――从这里开始生成注册码，前几位是MTW20，然后与前面生成的数字连接
0049D395 FF75 E8 PUSH DWORD PTR SS:[EBP-18]
0049D398 68 2CD74900 PUSH dumped_.0049D72C
0049D39D 8D55 B8 LEA EDX,DWORD PTR SS:[EBP-48]
0049D3A0 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D3A3 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300]
0049D3A9 E8 F664FAFF CALL dumped_.004438A4
0049D3AE 8B45 B8 MOV EAX,DWORD PTR SS:[EBP-48]
0049D3B1 8D55 BC LEA EDX,DWORD PTR SS:[EBP-44]
0049D3B4 E8 9BFDFFFF CALL dumped_.0049D154 ; 用户名转换ASCII码
0049D3B9 FF75 BC PUSH DWORD PTR SS:[EBP-44]
0049D3BC 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
0049D3BF BA 06000000 MOV EDX,6
0049D3C4 E8 9B7AF6FF CALL dumped_.00404E64――――将前面生成的注册码前半部分与用户名的ASCII码连接即为注册码
0049D3C9 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
0049D3CC BA 38D74900 MOV EDX,dumped_.0049D738 ; ASCII "\System32\spool\drivers\w32x86\2\riched20.dll SetActiveEditControlFont, Arial, 30"
0049D3D1 E8 AE77F6FF CALL dumped_.00404B84
0049D3D6 8D55 B4 LEA EDX,DWORD PTR SS:[EBP-4C]
0049D3D9 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D3DC 8B80 04030000 MOV EAX,DWORD PTR DS:[EAX+304]
0049D3E2 E8 BD64FAFF CALL dumped_.004438A4 ; 取假码
0049D3E7 8B55 B4 MOV EDX,DWORD PTR SS:[EBP-4C]
0049D3EA 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
0049D3ED E8 EE7CF6FF CALL dumped_.004050E0――――注册码与假码比较
0049D3F2 85C0 TEST EAX,EAX
0049D3F4 0F84 9A010000 JE dumped_.0049D594
0049D3FA 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0049D3FD 8B80 04030000 MOV EAX,DWORD PTR DS:[EAX+304]
0049D403 33D2 XOR EDX,EDX
0049D405 E8 CA64FAFF CALL dumped_.004438D4
0049D40A 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
0049D40D E8 DA76F6FF CALL dumped_.00404AEC
0049D412 6A 00 PUSH 0
0049D414 68 8CD74900 PUSH dumped_.0049D78C ; ASCII "Registration Success!"
0049D419 68 A4D74900 PUSH dumped_.0049D7A4 ; ASCII " Thank you for your support.
We will work even harder and
notify you future releases."
0049D41E 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
*******************************************************************************
基本上齐活了。
注册码=MTW20&(1111+用户名位数)&-&(用户名ASCII码)
*******************************************************************************
转载请注明出处和作者，并保持文章的完整性。
*******************************************************************************
与本站相识是在图书馆的一本黑客防线上的密界寻踪。刚来时看了一篇《贪吃豆豆龙》的破文，其间与一位名为菜鸟的网友共同学习。越来越入迷，虽然功底浅，但乐在其中。难一点的搞不了，只能搞一搞明码和爆破。大学毕业以来，偶尔来看看文章，但由于工作忙，没时间深入学习。偶有心得，拿出来与大家分享，惭愧……阿弥陀佛，善哉！善哉！
桃花坞里桃花庵……
[课程]Linux pwn 探索篇！
