【破解软件】**公交查询软件工具
【下载地址】国产软件不提供下载地址
【保护方式】ASPack 2.12 + 注册码
【作者声明】初学Crack,只是感兴趣,消遣业余时间,错误之处敬请诸位前辈不吝赐教。
【调试环境】Winxp、OllyDBD、PEiD
【软件信息】**公交查询工具,公交直达查询并有换乘查询,是一款绿色软件。 一、追码
ASPack壳,脱壳略过。
OD 载入程序查找字串参考,找到:“注册成功”,向上在004D1498处下断。
注册框显示机器码:94473715811 填入注册码:12345678
004D1498 /. 55 PUSH EBP
004D1499 |. 8BEC MOV EBP,ESP
004D149B |. 33C9 XOR ECX,ECX
004D149D |. 51 PUSH ECX
004D149E |. 51 PUSH ECX
004D149F |. 51 PUSH ECX
004D14A0 |. 51 PUSH ECX
004D14A1 |. 51 PUSH ECX
004D14A2 |. 51 PUSH ECX
004D14A3 |. 53 PUSH EBX
004D14A4 |. 56 PUSH ESI
004D14A5 |. 8BD8 MOV EBX,EAX
004D14A7 |. 33C0 XOR EAX,EAX
004D14A9 |. 55 PUSH EBP
004D14AA |. 68 A2154D00 PUSH tk.004D15A2
004D14AF |. 64:FF30 PUSH DWORD PTR FS:[EAX]
004D14B2 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
004D14B5 |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
004D14B8 |. E8 A7F7FFFF CALL tk.004D0C64
004D14BD |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; [EBP-8]=94473715811(机器码)
004D14C0 |. 8D4D FC LEA ECX,DWORD PTR SS:[EBP-4]
004D14C3 |. B8 B8154D00 MOV EAX,tk.004D15B8 ; 固定字符串:dflk56321
004D14C8 |. E8 13FBFFFF CALL tk.004D0FE0 ; 算法Call
004D14CD |. 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
004D14D0 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; [EBP-4]=O17mt1774m(真码)
004D14D3 |. E8 4C75F3FF CALL tk.00408A24
004D14D8 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
004D14DB |. 50 PUSH EAX
004D14DC |. 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
004D14DF |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
004D14E5 |. E8 E2ABF7FF CALL tk.0044C0CC
004D14EA |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
004D14ED |. 8D55 F0 LEA EDX,DWORD PTR SS:[EBP-10]
004D14F0 |. E8 2F75F3FF CALL tk.00408A24
004D14F5 |. 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10] ; [EBP-10]=假码
004D14F8 |. 58 POP EAX
004D14F9 |. E8 9A31F3FF CALL tk.00404698 ; 比较真假码
004D14FE |. 75 54 JNZ SHORT tk.004D1554 ; 跳注册失败
004D1500 |. A1 605E4D00 MOV EAX,DWORD PTR DS:[4D5E60]
004D1505 |. C600 01 MOV BYTE PTR DS:[EAX],1
004D1508 |. 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
004D150B |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
004D1511 |. E8 B6ABF7FF CALL tk.0044C0CC
004D1516 |. 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18]
004D1519 |. 50 PUSH EAX
004D151A |. A1 28604D00 MOV EAX,DWORD PTR DS:[4D6028]
004D151F |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D1521 |. B9 CC154D00 MOV ECX,tk.004D15CC ; ASCII "sn"
004D1526 |. BA D8154D00 MOV EDX,tk.004D15D8 ; ASCII "config"
004D152B |. 8B30 MOV ESI,DWORD PTR DS:[EAX]
004D152D |. FF56 04 CALL NEAR DWORD PTR DS:[ESI+4] ; 写注册信息
004D1530 |. B8 E8154D00 MOV EAX,tk.004D15E8 ; 注册成功
004D1535 |. E8 062DF6FF CALL tk.00434240
004D153A |. A1 9C5E4D00 MOV EAX,DWORD PTR DS:[4D5E9C]
004D153F |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D1541 |. BA FC154D00 MOV EDX,tk.004D15FC
004D14C8 处F7进入算法Call
004D0FE0 /$ 55 PUSH EBP
004D0FE1 |. 8BEC MOV EBP,ESP
004D0FE3 |. 51 PUSH ECX
004D0FE4 |. B9 04000000 MOV ECX,4
004D0FE9 |> 6A 00 /PUSH 0
004D0FEB |. 6A 00 |PUSH 0
004D0FED |. 49 |DEC ECX
004D0FEE |.^ 75 F9 \JNZ SHORT tk.004D0FE9
004D0FF0 |. 51 PUSH ECX
004D0FF1 |. 874D FC XCHG DWORD PTR SS:[EBP-4],ECX
004D0FF4 |. 53 PUSH EBX
004D0FF5 |. 56 PUSH ESI
004D0FF6 |. 57 PUSH EDI
004D0FF7 |. 8BF9 MOV EDI,ECX
004D0FF9 |. 8955 F8 MOV DWORD PTR SS:[EBP-8],EDX
004D0FFC |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
004D0FFF |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004D1002 |. E8 3537F3FF CALL tk.0040473C
004D1007 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
004D100A |. E8 2D37F3FF CALL tk.0040473C
004D100F |. 33C0 XOR EAX,EAX
004D1011 |. 55 PUSH EBP
004D1012 |. 68 54114D00 PUSH tk.004D1154
004D1017 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
004D101A |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
004D101D |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
004D1020 |. E8 6732F3FF CALL tk.0040428C
004D1025 |. 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
004D1028 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; [EBP-8]=机器码
004D102B |. E8 F479F3FF CALL tk.00408A24
004D1030 |. FF75 E8 PUSH DWORD PTR SS:[EBP-18]
004D1033 |. 8D55 E4 LEA EDX,DWORD PTR SS:[EBP-1C]
004D1036 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004D1039 |. E8 E679F3FF CALL tk.00408A24
004D103E |. FF75 E4 PUSH DWORD PTR SS:[EBP-1C]
004D1041 |. 68 6C114D00 PUSH tk.004D116C ; 固定字符串:29T.cOm
004D1046 |. 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
004D1049 |. BA 03000000 MOV EDX,3
004D104E |. E8 B935F3FF CALL tk.0040460C ; 连接机器码与固定字符串
004D1053 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
//[EBP-14]=94473715811dflk5632129T.cOm
004D1056 |. 8D4D F4 LEA ECX,DWORD PTR SS:[EBP-C]
004D1059 |. BA 7C114D00 MOV EDX,tk.004D117C
004D105E |. E8 F9FDFFFF CALL tk.004D0E5C ; 运算符串F7进入
004D1063 |. 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
004D1066 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] ; [EBP-C]=n
004D1069 |. E8 2AFAFFFF CALL tk.004D0A98 ; 查表踢除非表内字符
004D106E |. 8B55 E0 MOV EDX,DWORD PTR SS:[EBP-20]
004D1071 |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
004D1074 |. E8 AB32F3FF CALL tk.00404324
004D1079 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
004D107C |. E8 CB34F3FF CALL tk.0040454C
004D1081 |. 83F8 0A CMP EAX,0A
004D1084 |. 7D 0B JGE SHORT tk.004D1091
004D1086 |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
004D1089 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
004D108C |. E8 C334F3FF CALL tk.00404554
004D1091 |> 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
004D1094 |. E8 B334F3FF CALL tk.0040454C
004D1099 |. 83F8 0A CMP EAX,0A
004D109C |. 7E 16 JLE SHORT tk.004D10B4
004D109E |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
004D10A1 |. 50 PUSH EAX
004D10A2 |. B9 0A000000 MOV ECX,0A
004D10A7 |. BA 01000000 MOV EDX,1
004D10AC |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
004D10AF |. E8 F836F3FF CALL tk.004047AC ; 取计算结果前10位
004D10B4 |> 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] ; [EBP-C]=O17mt1774m
004D10B7 |. E8 9034F3FF CALL tk.0040454C
004D10BC |. 8BD8 MOV EBX,EAX
004D10BE |. 85DB TEST EBX,EBX
----------------------中间省略-------------------------------
004D115C . 5E POP ESI
004D115D . 5B POP EBX
004D115E . 8BE5 MOV ESP,EBP
004D1160 . 5D POP EBP
004D1161 . C3 RETN ; 返回到 004D14CD 004D105E处F7进入运算字符串 004D0E5C /$ 55 PUSH EBP
004D0E5D |. 8BEC MOV EBP,ESP
004D0E5F |. 6A 00 PUSH 0
004D0E61 |. 6A 00 PUSH 0
004D0E63 |. 6A 00 PUSH 0
004D0E65 |. 6A 00 PUSH 0
004D0E67 |. 6A 00 PUSH 0
004D0E69 |. 6A 00 PUSH 0
004D0E6B |. 6A 00 PUSH 0
004D0E6D |. 6A 00 PUSH 0
004D0E6F |. 53 PUSH EBX
004D0E70 |. 56 PUSH ESI
004D0E71 |. 57 PUSH EDI
004D0E72 |. 894D F4 MOV DWORD PTR SS:[EBP-C],ECX
004D0E75 |. 8955 F8 MOV DWORD PTR SS:[EBP-8],EDX
004D0E78 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
004D0E7B |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004D0E7E |. E8 B938F3FF CALL tk.0040473C
004D0E83 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
004D0E86 |. E8 B138F3FF CALL tk.0040473C
004D0E8B |. 33C0 XOR EAX,EAX
004D0E8D |. 55 PUSH EBP
004D0E8E |. 68 D20F4D00 PUSH tk.004D0FD2
004D0E93 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
004D0E96 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
004D0E99 |. BE 01000000 MOV ESI,1
004D0E9E |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
004D0EA1 |. E8 E633F3FF CALL tk.0040428C
004D0EA6 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004D0EA9 |. E8 9E36F3FF CALL tk.0040454C
004D0EAE |. 8BD8 MOV EBX,EAX
004D0EB0 |. 85DB TEST EBX,EBX
004D0EB2 |. 7E 29 JLE SHORT tk.004D0EDD
004D0EB4 |. BF 01000000 MOV EDI,1
004D0EB9 |> 8D45 EC /LEA EAX,DWORD PTR SS:[EBP-14] ; 循环取出连接字符串偶数位
004D0EBC |. 50 |PUSH EAX
004D0EBD |. 8BD7 |MOV EDX,EDI
004D0EBF |. 03D2 |ADD EDX,EDX
004D0EC1 |. B9 01000000 |MOV ECX,1
004D0EC6 |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
004D0EC9 |. E8 DE38F3FF |CALL tk.004047AC
004D0ECE |. 8B55 EC |MOV EDX,DWORD PTR SS:[EBP-14]
004D0ED1 |. 8D45 F0 |LEA EAX,DWORD PTR SS:[EBP-10]
004D0ED4 |. E8 7B36F3FF |CALL tk.00404554
004D0ED9 |. 47 |INC EDI
004D0EDA |. 4B |DEC EBX
004D0EDB |.^ 75 DC \JNZ SHORT tk.004D0EB9 ; 得到:47751dl5319.O
004D0EDD |> 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
004D0EE0 |. 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10]
004D0EE3 |. E8 6C36F3FF CALL tk.00404554 ; 再次连接
004D0EE8 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
; [EBP-4]=94473715811dflk5632129T.cOm47751dl5319.O
004D0EEB |. E8 5C36F3FF CALL tk.0040454C ; EAX=28
004D0EF0 |. 8BD8 MOV EBX,EAX
004D0EF2 |. 85DB TEST EBX,EBX
004D0EF4 |. 7E 46 JLE SHORT tk.004D0F3C
004D0EF6 |. BF 01000000 MOV EDI,1
004D0EFB |> 8D45 E8 /LEA EAX,DWORD PTR SS:[EBP-18]
004D0EFE |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4] ; 连接后字符串入EDX
004D0F01 |. 8A543A FF |MOV DL,BYTE PTR DS:[EDX+EDI-1] ; 顺取连接后的字符串
004D0F05 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; [EBP-8]=0D 01 14 05 02
004D0F08 |. 8A4C31 FF |MOV CL,BYTE PTR DS:[ECX+ESI-1]
004D0F0C |. 32D1 |XOR DL,CL ; DL=39 xor D=34
004D0F0E |. E8 6135F3FF |CALL tk.00404474 ; 保存计算结果
004D0F13 |. 8B55 E8 |MOV EDX,DWORD PTR SS:[EBP-18]
004D0F16 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
004D0F19 |. E8 3636F3FF |CALL tk.00404554 ; 保存计算结果
004D0F1E |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
004D0F21 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
004D0F24 |. E8 2336F3FF |CALL tk.0040454C ; 取出(0D 01 14 05 02)
004D0F29 |. 8D56 01 |LEA EDX,DWORD PTR DS:[ESI+1]
004D0F2C |. 3BC2 |CMP EAX,EDX ; 取到第几位?
004D0F2E |. 7C 03 |JL SHORT tk.004D0F33 ; 取完5个跳
004D0F30 |. 46 |INC ESI
004D0F31 |. EB 05 |JMP SHORT tk.004D0F38
004D0F33 |> BE 01000000 |MOV ESI,1 ; 再从第1位开始
004D0F38 |> 47 |INC EDI ; 取到第几位字符串
004D0F39 |. 4B |DEC EBX ; EBX=连接字符串位数
004D0F3A |.^ 75 BF \JNZ SHORT tk.004D0EFB
//计算出s1=45 21:0!=3<erii87'73?8@+aBl 2580pi7>0-+M
004D0F3C |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004D0F3F |. E8 0836F3FF CALL tk.0040454C ; 计算结果长度
004D0F44 |. 8BD8 MOV EBX,EAX
004D0F46 |. 85DB TEST EBX,EBX
004D0F48 |. 7E 48 JLE SHORT tk.004D0F92
004D0F4A |. BF 01000000 MOV EDI,1
004D0F4F |> 8D45 E4 /LEA EAX,DWORD PTR SS:[EBP-1C]
004D0F52 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4] ; 连接后字符串
004D0F55 |. 8A543A FF |MOV DL,BYTE PTR DS:[EDX+EDI-1] ; 顺取连接后的字符串
004D0F59 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; [EBP-8]=0D 01 14 05 02
004D0F5C |. 8A4C31 FF |MOV CL,BYTE PTR DS:[ECX+ESI-1]
004D0F60 |. 0AD1 |OR DL,CL ; DL=39 or D =3D
004D0F62 |. E8 0D35F3FF |CALL tk.00404474
004D0F67 |. 8B55 E4 |MOV EDX,DWORD PTR SS:[EBP-1C]
004D0F6A |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004D0F6D |. 8B09 |MOV ECX,DWORD PTR DS:[ECX]
004D0F6F |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
004D0F72 |. E8 2136F3FF |CALL tk.00404598 ; 计算结果连在s1首部
004D0F77 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
004D0F7A |. E8 CD35F3FF |CALL tk.0040454C ; 取出(0D 01 14 05 02)
004D0F7F |. 8D56 01 |LEA EDX,DWORD PTR DS:[ESI+1]
004D0F82 |. 3BC2 |CMP EAX,EDX ; 取到第几位?
004D0F84 |. 7C 03 |JL SHORT tk.004D0F89 ; 取完5个跳
004D0F86 |. 46 |INC ESI ; 计数器
004D0F87 |. EB 05 |JMP SHORT tk.004D0F8E
004D0F89 |> BE 01000000 |MOV ESI,1 ; 再从第1位开始
004D0F8E |> 47 |INC EDI ; 取到第几位字符串
004D0F8F |. 4B |DEC EBX ; EBX=连接字符串位数
004D0F90 |.^ 75 BD \JNZ SHORT tk.004D0F4F
004D0F92 |> 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
----------------------中间省略-------------------------------
004D0FC4 |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
004D0FC7 |. BA 02000000 MOV EDX,2
004D0FCC |. E8 DF32F3FF CALL tk.004042B0
004D0FD1 \. C3 RETN
004D0FD2 .^ E9 D92BF3FF JMP tk.00403BB0
004D0FD7 .^ EB DE JMP SHORT tk.004D0FB7
004D0FD9 . 5F POP EDI
004D0FDA . 5E POP ESI
004D0FDB . 5B POP EBX
004D0FDC . 8BE5 MOV ESP,EBP
004D0FDE . 5D POP EBP
004D0FDF . C3 RETN ; 返回到 004D1063 二、算法小结
1.字符串连结
94473715811(机器码)+dflk56321+29T.cOm(后二组是固定字符)
得到:94473715811dflk5632129T.cOm
取出连接后的偶数位:47751dl5319.O
再连接:94473715811dflk5632129T.cOm47751dl5319.O
2.连结字符串与固定数值(0D 01 14 05 02)逐位异或运算
得到:45 21:0!=3<erii87'73?8@+aBl 2580pi7>0-+M (有不可显字符)
3.连结字符串与固定数值(0D 01 14 05 02)逐位或运算
逆序得到:O/=1?7mt1=774mOc/T9?3777=kmve=3=51?3745=
4.连接二组计算结果
得到:O/=1?7mt1=774mOc/T9?3777=kmve=3=51?3745=45 21:0!=3<erii87'73?8@+aBl 2580pi7>0-+M
5.查表剔除非表内字符
表:(ASCII "0123456789abcdefghijklmnopqrstuvwxyz~!@#$%^&*()[]{}-+")
得到:O17mt1774mOcT93777kmve351374545210!3erii87738@+aBl2580pi70-+M
6.取出前10位是注册码
注册码:O17mt1774m
7.注册信息保存在config.ini文件
三、注册机原码
在Delphi7 + WindowsXP SP2下编译运行通过
const
OperateAryLen = 5;
const
OperateAry : array[1..OperateAryLen] of Integer =($0D, $01, $14, $05,$02);
function DoubleStr(Str: string): string; //取字符串偶位数字符
var
i: Integer;
begin
Result := '';
for i := 2 to Length(Str) do
if i mod 2 = 0 then
Result := Result + Str[i];
end;
function OperateStr(const aStr: string): string; //xor运算
var
i,n: Integer;
begin
SetLength(Result, Length(aStr));
for i := 1 to Length(aStr) do begin
n := i mod OperateAryLen;
if n = 0 then
n := 5;
Result[i] := Char(Ord(astr[i]) xor OperateAry[n]);
end;
end;
function OpeateStr(const aStr: string): string; //or运算
var
i,n: Integer;
begin
SetLength(Result, Length(aStr));
for i := 1 to Length(aStr) do begin
n := i mod OperateAryLen;
if n = 0 then
n := 5;
Result[i] := Char(Ord(aStr[i]) or OperateAry[n]);
end;
end;
function StrToBack(bStr: string): string; //将字符串倒转过来
var i:integer;
begin
for i:=1 to length(bStr) do
begin
Result :=bStr[i]+Result;
end;
end;
function SiftStr(cStr: string): string; //过滤字符串
var i,j:integer;
begin
Result:='';
j:=Length(cStr);
for i:=0 to j do
begin
if cStr[i] in ['0'..'9','a'..'z','A'..'Z','~','!',
'@','#','$','%','^','&','*','(',')','[',']','{','}','-','+'] then
Result:=Result+cStr[i];
end;
end;
procedure TForm1.Button1Click(Sender: TObject);
var s,s1,s2,s3,s4:string;
begin
If Length(edit1.text) =0 Then exit
else
s:=edit1.text+'dflk5632129T.cOm'+DoubleStr(edit1.Text+'dflk5632129T.cOm');
s1:= OperateStr(s);
s2:= StrToBack(OpeateStr(s));
s3:= concat(s2,s1);
s4:= SiftStr(s3);
edit2.text:=copy(s4,1,10);
end;
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!