原文出处：http://bbs.pediy.com/showthread.php?s=&threadid=25100
关键地方
0040156A |. 68 FF000000 push 0FF ; /Count = FF (255.)
0040156F |. 68 A0374000 push 004037A0 ; |Buffer = CrackMe_.004037A0
00401574 |. 68 EC030000 push 3EC ; |ControlID = 3EC (1004.)
00401579 |. FF75 08 push dword ptr [ebp+8] ; |hWnd
0040157C |. E8 19020000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA
00401581 |. 83F8 04 cmp eax, 4 //name要超过4个字符
00401584 |. 73 05 jnb short 0040158B
00401586 |. E9 BD010000 jmp 00401748
0040158B |> 68 00010000 push 100 ; /Count = 100 (256.)
00401590 |. 68 AB384000 push 004038AB ; |Buffer = CrackMe_.004038AB
00401595 |. 68 ED030000 push 3ED ; |ControlID = 3ED (1005.)
0040159A |. FF75 08 push dword ptr [ebp+8] ; |hWnd
0040159D |. E8 F8010000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA
004015A2 |. 83F8 20 cmp eax, 20 //serail是32个字符，可以看成4个DWORD 每两个字符组成一个BYTE，从左到右 我这里就用a,b,c,d来代替了
004015A5 |. 74 05 je short 004015AC
004015A7 |. E9 9C010000 jmp 00401748
004015AC |> 33C9 xor ecx, ecx
004015AE |. 8D05 AB384000 lea eax, [4038AB]
004015B4 |> 8A1401 /mov dl, [ecx+eax]
004015B7 |. 80FA 39 |cmp dl, 39
004015BA |. 76 05 |jbe short 004015C1
004015BC |. 80FA 41 |cmp dl, 41
004015BF |. 72 0A |jb short 004015CB
004015C1 |> 80FA 30 |cmp dl, 30
004015C4 |. 72 05 |jb short 004015CB
004015C6 |. 80FA 46 |cmp dl, 46
004015C9 |. 76 05 |jbe short 004015D0
004015CB |> E9 78010000 |jmp 00401748
004015D0 |> 41 |inc ecx
004015D1 |. 83F9 20 |cmp ecx, 20
004015D4 |.^ 75 DE \jnz short 004015B4
004015D6 |. 33C9 xor ecx, ecx
004015D8 |. 33DB xor ebx, ebx
004015DA |> C1E3 04 /shl ebx, 4
004015DD |. 8A1401 |mov dl, [ecx+eax]
004015E0 |. 80FA 41 |cmp dl, 41
004015E3 |. 72 0A |jb short 004015EF
004015E5 |. 80FA 46 |cmp dl, 46
004015E8 |. 77 05 |ja short 004015EF
004015EA |. 80EA 37 |sub dl, 37
004015ED |. EB 03 |jmp short 004015F2
004015EF |> 80EA 30 |sub dl, 30
004015F2 |> 80E2 0F |and dl, 0F
004015F5 |. 0ADA |or bl, dl
004015F7 |. 41 |inc ecx
004015F8 |. 83F9 09 |cmp ecx, 9
004015FB |. 73 05 |jnb short 00401602
004015FD |. 895D FC |mov [ebp-4], ebx //头8个字符转成DWORD=>a
00401600 |.^ EB D8 |jmp short 004015DA
00401602 |> 895D F8 |mov [ebp-8], ebx //9-16字符转成DWORD=>b
00401605 |. 83F9 10 |cmp ecx, 10
00401608 |.^ 75 D0 \jnz short 004015DA
0040160A |. B8 E6212845 mov eax, 452821E6
0040160F |. 3145 FC xor [ebp-4], eax //a异或0x452821E6
00401612 |. B8 7713D038 mov eax, 38D01377
00401617 |. 3145 F8 xor [ebp-8], eax //b异或0x38D01377
0040161A |. 8B45 FC mov eax, [ebp-4]
0040161D |. C1C0 10 rol eax, 10
00401620 |. C0C0 04 rol al, 4
00401623 |. C0C4 04 rol ah, 4
00401626 |. 66:C1C0 08 rol ax, 8
0040162A |. C1C0 10 rol eax, 10
0040162D |. 8945 FC mov [ebp-4], eax //a轮换自己的高16位
00401630 |. 8B5D F8 mov ebx, [ebp-8]
00401633 |. C0C3 04 rol bl, 4
00401636 |. C0C7 04 rol bh, 4
00401639 |. 66:C1C3 08 rol bx, 8
0040163D |. 895D F8 mov [ebp-8], ebx //b轮换自己的低16位
00401640 |. 33D2 xor edx, edx
00401642 |. C16D FC 08 shr dword ptr [ebp-4], 8 //a>>8
00401646 |. 8AD3 mov dl, bl
00401648 |. C1CA 08 ror edx, 8
0040164B |. 0955 FC or [ebp-4], edx //把b的高八位补上
0040164E |. 33D2 xor edx, edx
00401650 |. C16D F8 08 shr dword ptr [ebp-8], 8 //b>>8
00401654 |. 8AD0 mov dl, al
00401656 |. C1CA 08 ror edx, 8
00401659 |. 0955 F8 or [ebp-8], edx //补上a的高八位
0040165C |. 33DB xor ebx, ebx
0040165E |. 33C9 xor ecx, ecx
00401660 |. 33D2 xor edx, edx
00401662 |. 8D05 A0374000 lea eax, [4037A0]
00401668 |> 8A1401 /mov dl, [ecx+eax]
0040166B |. 84D2 |test dl, dl
0040166D |. 74 05 |je short 00401674
0040166F |. 41 |inc ecx
00401670 |. 03DA |add ebx, edx
00401672 |.^ EB F4 \jmp short 00401668
00401674 |> E8 94FDFFFF call 0040140D //初始化Table，具体算法见注册机
00401679 |. 8D1D A0374000 lea ebx, [4037A0]
0040167F |. E8 B1FDFFFF call 00401435 //计算name产生的KeyNumber，具体见注册机
00401684 |. 3145 FC xor [ebp-4], eax
00401687 |. B9 10000000 mov ecx, 10
0040168C |. 33DB xor ebx, ebx
0040168E |. 8D05 AB384000 lea eax, [4038AB]
00401694 |> C1E3 04 /shl ebx, 4
00401697 |. 8A1401 |mov dl, [ecx+eax]
0040169A |. 80FA 41 |cmp dl, 41
0040169D |. 72 0A |jb short 004016A9
0040169F |. 80FA 46 |cmp dl, 46
004016A2 |. 77 05 |ja short 004016A9
004016A4 |. 80EA 37 |sub dl, 37
004016A7 |. EB 03 |jmp short 004016AC
004016A9 |> 80EA 30 |sub dl, 30
004016AC |> 80E2 0F |and dl, 0F
004016AF |. 0ADA |or bl, dl
004016B1 |. 41 |inc ecx
004016B2 |. 83F9 19 |cmp ecx, 19
004016B5 |. 73 05 |jnb short 004016BC
004016B7 |. 895D F4 |mov [ebp-C], ebx //serial 17-24位送到DWORD c
004016BA |.^ EB D8 |jmp short 00401694
004016BC |> 895D F0 |mov [ebp-10], ebx //serial 25-32送到DWORD d
004016BF |. 83F9 20 |cmp ecx, 20
004016C2 |.^ 75 D0 \jnz short 00401694
004016C4 |. B8 24D7D037 mov eax, 37D0D724
004016C9 |. 3145 F4 xor [ebp-C], eax //c异或0x37D0D724
004016CC |. 8B45 F4 mov eax, [ebp-C]
004016CF |. 66:C1C0 04 rol ax, 4 //低16位右移4
004016D3 |. 8945 F4 mov [ebp-C], eax
004016D6 |. B8 6C0CE934 mov eax, 34E90C6C
004016DB |. 3145 F0 xor [ebp-10], eax //d异或0x34E90C6C
004016DE |. E8 2AFDFFFF call 0040140D //初始化Table，具体算法见注册机
004016E3 |. 8D1D A0374000 lea ebx, [4037A0]
004016E9 |. E8 47FDFFFF call 00401435 //计算name产生的KeyNumber，具体见注册机
004016EE |. 50 push eax ; /<%08X>
004016EF |. 68 2C304000 push 0040302C ; |Format = "%08X"
004016F4 |. 68 30354000 push 00403530 ; |s = CrackMe_.00403530
004016F9 |. E8 8A000000 call <jmp.&user32.wsprintfA> ; \wsprintfA
004016FE |. 83C4 0C add esp, 0C //得到KeyNumber转成的字符串
00401701 |. 6A 08 push 8 ; /Arg2 = 00000008
00401703 |. 68 30354000 push 00403530 ; |Arg1 = 00403530
00401708 |. E8 07FAFFFF call 00401114 ; \CrackMe_.00401114 //MD5变换
0040170D |. A1 B3394000 mov eax, [4039B3]
00401712 |. 3145 FC xor [ebp-4], eax //a与MD5结果比较
00401715 |. 75 31 jnz short 00401748
00401717 |. A1 B7394000 mov eax, [4039B7]
0040171C |. 3145 F8 xor [ebp-8], eax
0040171F |. 837D F8 FF cmp dword ptr [ebp-8], -1 //b的比较
00401723 |. 74 02 je short 00401727
00401725 |. EB 21 jmp short 00401748
00401727 |> A1 BB394000 mov eax, [4039BB]
0040172C |. 3145 F4 xor [ebp-C], eax
0040172F |. 75 17 jnz short 00401748 //c比较
00401731 |. A1 BF394000 mov eax, [4039BF]
00401736 |. 3145 F0 xor [ebp-10], eax
00401739 |. 75 0D jnz short 00401748 //d比较 都相等转下面
0040173B |. 68 D2204000 push 004020D2 ; /Text = "GOOD JOB, MAN!"
00401740 |. FF75 08 push dword ptr [ebp+8] ; |hWnd
00401743 |. E8 76000000 call <jmp.&user32.SetWindowTextA> ; \SetWindowTextA
00401748 |> 33C0 xor eax, eax
0040174A |. EB 1A jmp short 00401766
0040174C |> 83F8 10 cmp eax, 10
0040174F |. 75 0C jnz short 0040175D
00401751 |. 6A 00 push 0 ; /Result = 0; Case 10 (WM_CLOSE) of switch 00401490
00401753 |. FF75 08 push dword ptr [ebp+8] ; |hWnd
00401756 |. E8 39000000 call <jmp.&user32.EndDialog> ; \EndDialog
0040175B |. EB 09 jmp short 00401766
0040175D |> B8 00000000 mov eax, 0 ; Default case of switch 00401490
00401762 |. C9 leave
00401763 |. C2 1000 retn 10
00401766 |> B8 01000000 mov eax, 1
0040176B |. C9 leave
0040176C \. C2 1000 retn 10
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
