【破文标题】wavsplitter算法分析
【破文作者】学习破解
【作者邮箱】wxh9833@163.com
【作者主页】学习破解
【破解工具】PEiD,,OD
【破解平台】Windows 2K&XP
【软件名称】WAV Splitter V1.0.0459
【软件大小】428 KB
【原版下载】http://www.skycn.com/soft/26000.html
【保护方式】注册码
【软件简介】软件语言： 英文
软件类别： 国外软件 / 共享版 / 文件分割
应用平台： Win9x/NT/2000/XP/2003
界面预览： 无
更新时间： 2006-07-25 09:58:40
【破解声明】呵呵,用于交流.请各位指教!!!:)
------------------------------------------------------------------------
1、Peid查壳。无壳Microsoft Visual C++ 7.0写的，呵呵。
2、先运行一下软件，看一看有没有提示。呵呵。果真有啊“registration failed!”
3、就从这里下手吧。OD载入。呵呵。看一下吧。
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
004016F3 . 55 push ebp
004016F4 . 56 push esi
004016F5 . 57 push edi
004016F6 . BF 0100000>mov edi, 1
004016FB . 57 push edi
004016FC . 8BF1 mov esi, ecx
004016FE . E8 CCE9010>call 004200CF
00401703 . 8B46 70 mov eax, [esi+70] ; 堆栈 ds:[0012F4B8]=00D654C0, (ASCII "123")
00401706 . 8B68 F4 mov ebp, [eax-C]
00401709 . 83FD 02 cmp ebp, 2
0040170C . 7D 15 jge short 00401723
0040170E . 6A 00 push 0
00401710 . 6A 00 push 0
00401712 . 68 1CE8420>push 0042E81C ; ASCII "Please input correct User Name!"
00401717 . E8 D15D020>call 004274ED
0040171C . 5F pop edi
0040171D . 5E pop esi
0040171E . 5D pop ebp
0040171F . 83C4 0C add esp, 0C
00401722 . C3 retn
00401723 > 8B4E 74 mov ecx, [esi+74] ; 堆栈 ds:[0012F4BC]=00D654E0, (ASCII "78787878")
00401726 . 8379 F4 08 cmp dword ptr [ecx-C], 8
0040172A . 7D 15 jge short 00401741
0040172C . 6A 00 push 0
0040172E . 6A 00 push 0
00401730 . 68 F4E7420>push 0042E7F4 ; ASCII "Please input correct Registration Code!"
00401735 . E8 B35D020>call 004274ED
0040173A . 5F pop edi
0040173B . 5E pop esi
0040173C . 5D pop ebp
0040173D . 83C4 0C add esp, 0C
00401740 . C3 retn
00401741 > 8B46 70 mov eax, [esi+70] ; 堆栈 ds:[0012F4B8]=00D654C0, (ASCII "123")
00401744 . 8B48 F4 mov ecx, [eax-C] ; ds:[00D654B4]=00000003
00401747 . 85C9 test ecx, ecx
00401749 . 7D 0A jge short 00401755
0040174B . 68 5700078>push 80070057
00401750 . E8 1BFAFFF>call 00401170
00401755 > 8A10 mov dl, [eax]
00401757 . 8B46 70 mov eax, [esi+70]
0040175A . 3978 F4 cmp [eax-C], edi
0040175D . 7D 0A jge short 00401769
0040175F . 68 5700078>push 80070057
00401764 . E8 07FAFFF>call 00401170
00401769 > 8A40 01 mov al, [eax+1] ; ds:[00D654C1]=32 ('2')
0040176C . 884424 0E mov [esp+E], al
00401770 . 8B46 70 mov eax, [esi+70] ; 堆栈 ds:[0012F4B8]=00D654C0, (ASCII "123")
00401773 . 8B48 F4 mov ecx, [eax-C]
00401776 . 85C9 test ecx, ecx
00401778 . 7D 0A jge short 00401784
0040177A . 68 5700078>push 80070057
0040177F . E8 ECF9FFF>call 00401170
00401784 > 8B4E 70 mov ecx, [esi+70] ; 堆栈 ds:[0012F4B8]=00D654C0, (ASCII "123")
00401787 . 53 push ebx
00401788 . 8A18 mov bl, [eax] ; ds:[00D654C0]=31 ('1')
0040178A . 3979 F4 cmp [ecx-C], edi
0040178D . 7D 0A jge short 00401799
0040178F . 68 5700078>push 80070057
00401794 . E8 D7F9FFF>call 00401170
00401799 > 0FB6C2 movzx eax, dl ; dl=31 ('1')
0040179C . 83C8 57 or eax, 57
0040179F . 99 cdq
004017A0 . BF 0A00000>mov edi, 0A
004017A5 . F7FF idiv edi
004017A7 . 0FB64424 1>movzx eax, byte ptr [esp+12] ; 堆栈 ss:[0012EDC6]=32 ('2')
004017AC . 83C8 41 or eax, 41
004017AF . 885424 16 mov [esp+16], dl ; dl=09
004017B3 . 99 cdq
004017B4 . F7FF idiv edi
004017B6 . 0FB6C3 movzx eax, bl ; bl=31 ('1')
004017B9 . 83C8 56 or eax, 56
004017BC . 885424 12 mov [esp+12], dl ; dl=05
004017C0 . 99 cdq
004017C1 . F7FF idiv edi
004017C3 . 0FB641 01 movzx eax, byte ptr [ecx+1] ; ds:[00D654C1]=32 ('2')
004017C7 . 83C8 53 or eax, 53
004017CA . 8BCF mov ecx, edi ; edi=0000000A
004017CC . 885424 17 mov [esp+17], dl ; dl=09
004017D0 . 99 cdq
004017D1 . F7F9 idiv ecx
004017D3 . 33C0 xor eax, eax
004017D5 . 33C9 xor ecx, ecx
004017D7 . 85ED test ebp, ebp
004017D9 . 885424 18 mov [esp+18], dl ; dl=05
004017DD . 7E 20 jle short 004017FF
004017DF . 90 nop
004017E0 > 85C9 test ecx, ecx
004017E2 . 0F8C D2000>jl 004018BA
004017E8 . 8B7E 70 mov edi, [esi+70] ; 堆栈 ds:[0012F4B8]=00D654C0, (ASCII "123")
004017EB . 3B4F F4 cmp ecx, [edi-C] ; ds:[00D654B4]=00000003
004017EE . 0F8F C6000>jg 004018BA
004017F4 . 0FB6140F movzx edx, byte ptr [edi+ecx] ; ds:[00D654C0]=31 ('1')
004017F8 . 03C2 add eax, edx ; 累加
004017FA . 41 inc ecx
004017FB . 3BCD cmp ecx, ebp
004017FD .^ 7C E1 jl short 004017E0
004017FF > 8B4E 74 mov ecx, [esi+74] ; 堆栈 ds:[0012F4BC]=00D654E0, (ASCII "78787878")
00401802 . 8B51 F4 mov edx, [ecx-C] ; ds:[00D654D4]=00000008
00401805 . 85D2 test edx, edx
00401807 . 7D 0A jge short 00401813
00401809 . 68 5700078>push 80070057
0040180E . E8 5DF9FFF>call 00401170
00401813 > 8A11 mov dl, [ecx] ; ds:[00D654E0]=37 ('7') 1
00401815 . 8B4E 74 mov ecx, [esi+74] ; 堆栈 ds:[0012F4BC]=00D654E0, (ASCII "78787878")
00401818 . 8379 F4 01 cmp dword ptr [ecx-C], 1
0040181C . 885424 19 mov [esp+19], dl ; dl=37 ('7')
00401820 . 7D 0A jge short 0040182C
00401822 . 68 5700078>push 80070057
00401827 . E8 44F9FFF>call 00401170
0040182C > 8A49 01 mov cl, [ecx+1] ; ds:[00D654E1]=38 ('8') 2
0040182F . 8B7E 74 mov edi, [esi+74] ; 堆栈 ds:[0012F4BC]=00D654E0, (ASCII "78787878")
00401832 . 884C24 13 mov [esp+13], cl ; cl=38 ('8')
00401836 . 837F F4 02 cmp dword ptr [edi-C], 2
0040183A . 7D 0A jge short 00401846
0040183C . 68 5700078>push 80070057
00401841 . E8 2AF9FFF>call 00401170
00401846 > 8A4F 02 mov cl, [edi+2] ; ds:[00D654E2]=37 ('7') 3
00401849 . 8B7E 74 mov edi, [esi+74]
0040184C . 884C24 14 mov [esp+14], cl
00401850 . 837F F4 03 cmp dword ptr [edi-C], 3
00401854 . 7D 0A jge short 00401860
00401856 . 68 5700078>push 80070057
0040185B . E8 10F9FFF>call 00401170
00401860 > 8A4F 03 mov cl, [edi+3] ; ds:[00D654E3]=38 ('8') 4
00401863 . 8B7E 74 mov edi, [esi+74]
00401866 . 884C24 15 mov [esp+15], cl
0040186A . 837F F4 04 cmp dword ptr [edi-C], 4
0040186E . 7D 0A jge short 0040187A
00401870 . 68 5700078>push 80070057
00401875 . E8 F6F8FFF>call 00401170
0040187A > 8A5F 04 mov bl, [edi+4] ; ds:[00D654E4]=37 ('7') 5
0040187D . 8B7E 74 mov edi, [esi+74]
00401880 . 837F F4 05 cmp dword ptr [edi-C], 5
00401884 . 7D 0A jge short 00401890
00401886 . 68 5700078>push 80070057
0040188B . E8 E0F8FFF>call 00401170
00401890 > 8A4F 05 mov cl, [edi+5] ; ds:[00D654E5]=38 ('8') 6
00401893 . 8B7E 74 mov edi, [esi+74]
00401896 . 884C24 1A mov [esp+1A], cl
0040189A . 837F F4 06 cmp dword ptr [edi-C], 6
0040189E . 7D 0A jge short 004018AA
004018A0 . 68 5700078>push 80070057
004018A5 . E8 C6F8FFF>call 00401170
004018AA > 8A4F 06 mov cl, [edi+6] ; ds:[00D654E6]=37 ('7') 7
004018AD . 8B7E 74 mov edi, [esi+74]
004018B0 . 884C24 1B mov [esp+1B], cl
004018B4 . 837F F4 07 cmp dword ptr [edi-C], 7
004018B8 . 7D 0A jge short 004018C4
004018BA > 68 5700078>push 80070057
004018BF . E8 ACF8FFF>call 00401170
004018C4 > 8A4F 07 mov cl, [edi+7] ; ds:[00D654E7]=38 ('8') 8
004018C7 . 0FB67C24 1>movzx edi, byte ptr [esp+16] ; 堆栈 ss:[0012EDCA]=09
004018CC . 0FB6D2 movzx edx, dl
004018CF . 83EA 30 sub edx, 30
004018D2 . 3BFA cmp edi, edx ; 比较第1位
004018D4 . 75 48 jnz short 0040191E
004018D6 . 0FB65424 1>movzx edx, byte ptr [esp+13]
004018DB . 0FB67C24 1>movzx edi, byte ptr [esp+12]
004018E0 . 83EA 30 sub edx, 30
004018E3 . 3BFA cmp edi, edx ; 比较第2位
004018E5 . 75 37 jnz short 0040191E
004018E7 . 0FB65424 1>movzx edx, byte ptr [esp+14]
004018EC . 0FB67C24 1>movzx edi, byte ptr [esp+17]
004018F1 . 83EA 30 sub edx, 30
004018F4 . 3BFA cmp edi, edx ; 比较第3位
004018F6 . 75 26 jnz short 0040191E
004018F8 . 0FB65424 1>movzx edx, byte ptr [esp+15]
004018FD . 0FB67C24 1>movzx edi, byte ptr [esp+18]
00401902 . 83EA 30 sub edx, 30
00401905 . 3BFA cmp edi, edx ; 比较第4位
00401907 . 75 15 jnz short 0040191E
00401909 . 99 cdq
0040190A . BF 0A00000>mov edi, 0A
0040190F . F7FF idiv edi ; 96 idiv a--〉edx=0
00401911 . 0FB6C2 movzx eax, dl ; dl=00
00401914 . 0FB6D3 movzx edx, bl
00401917 . 83EA 30 sub edx, 30
0040191A . 3BC2 cmp eax, edx ; 比较第5位
0040191C . 74 3A je short 00401958 ; 跳转则成功
0040191E > 8A5424 19 mov dl, [esp+19]
00401922 . B0 31 mov al, 31
00401924 . 3AD0 cmp dl, al ; 或者第1位必须为1
00401926 . 0F85 82000>jnz 004019AE
0040192C . 384424 13 cmp [esp+13], al ; 或者第2位必须为1
00401930 . 75 7C jnz short 004019AE
00401932 . 807C24 14 >cmp byte ptr [esp+14], 39 ; 或者第3位必须为9
00401937 . 75 75 jnz short 004019AE
00401939 . 384424 15 cmp [esp+15], al ; 或者第4位必须为1
0040193D . 75 6F jnz short 004019AE
0040193F . 80FB 33 cmp bl, 33 ; 或者第5位必须为3
00401942 . 75 6A jnz short 004019AE
00401944 . 8A5424 1A mov dl, [esp+1A] ; 或者第6位必须为6
00401948 . B0 36 mov al, 36
0040194A . 3AD0 cmp dl, al
0040194C . 75 60 jnz short 004019AE
0040194E . 384424 1B cmp [esp+1B], al ; 或者第7位必须为6
00401952 . 75 5A jnz short 004019AE
00401954 . 3AC8 cmp cl, al ; 或者第8位必须为1
00401956 . 75 56 jnz short 004019AE
00401958 > 6A 00 push 0
0040195A . 6A 00 push 0
0040195C . 68 D8E7420>push 0042E7D8 ; ASCII "Registration has succeeded!"
00401961 . E8 875B020>call 004274ED
00401966 . 8B7E 70 mov edi, [esi+70]
00401969 . E8 2473020>call 00428C92
0040196E . 8B40 04 mov eax, [eax+4]
00401971 . 57 push edi ; /Arg3
00401972 . 68 CCE7420>push 0042E7CC ; |Arg2 = 0042E7CC ASCII "username"
00401977 . 68 C4E7420>push 0042E7C4 ; |Arg1 = 0042E7C4 ASCII "Option"
0040197C . 8BC8 mov ecx, eax ; |
0040197E . E8 CA58020>call 0042724D ; \WAVSplit.0042724D
00401983 . 8B7E 74 mov edi, [esi+74]
00401986 . E8 0773020>call 00428C92
0040198B . 8B40 04 mov eax, [eax+4]
0040198E . 57 push edi ; /Arg3
0040198F . 68 B0E7420>push 0042E7B0 ; |Arg2 = 0042E7B0 ASCII "registration_code"
00401994 . 68 C4E7420>push 0042E7C4 ; |Arg1 = 0042E7C4 ASCII "Option"
00401999 . 8BC8 mov ecx, eax ; |
0040199B . E8 AD58020>call 0042724D ; \WAVSplit.0042724D
004019A0 . 5B pop ebx
004019A1 . 5F pop edi
004019A2 . 8BCE mov ecx, esi
004019A4 . 5E pop esi
004019A5 . 5D pop ebp
004019A6 . 83C4 0C add esp, 0C
004019A9 . E9 371C020>jmp 004235E5
004019AE > 6A 00 push 0
004019B0 . 6A 00 push 0
004019B2 . 68 98E7420>push 0042E798 ; ASCII "Registration failed!"
004019B7 . E8 315B020>call 004274ED
004019BC . 5B pop ebx
004019BD . 5F pop edi
004019BE . 5E pop esi
004019BF . 5D pop ebp
004019C0 . 83C4 0C add esp, 0C
004019C3 . C3 retn
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
------------------------------------------------------------------------
小结：
有些朋友会迷糊，呵呵看一看吧，怎么算得呢，呵呵总结一下。
（1）注册码第1位=((用户名第1位 OR 57) MOD A)
（2）注册码第2位=((用户名第2位 OR 41) MOD A)
（3）注册码第3位=((用户名第1位 OR 56) MOD A)
（4）注册码第4位=((用户名第2位 OR 53) MOD A)
（5）注册码第5位=((用户名字符累加和) MOD A)
至于其他位的值可以任意填写。
------------------------------------------------------------------------
【版权声明】本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
