-
-
[原创]*** WordV3.9算法分析
-
发表于: 2006-12-8 12:52 5733
-
【文章标题】: *** WordV3.9算法分析
【文章作者】: yzs&yzslly
【软件名称】: BatchDoc for WordV3.9
【下载地址】: 自己搜索下载
【保护方式】: 注册码
【编写语言】: vb
【使用工具】: OD
【作者声明】: 只是感兴趣,没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
输入试炼码:123-456,点注册中断在
0043CA80 > \55 push ebp
0043CA81 . 8BEC mov ebp,esp
0043CA83 . 83EC 0C sub esp,0C
0043CA86 . 68 061E4000 push ; SE 句柄安装
。。。省略往下
0043CB38 . 52 push edx ; 压入注册码
0043CB39 . 68 60114100 push BatchDoc.00411160 ; -
0043CB3E . 53 push ebx
0043CB3F . FF15 7811400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaInStr
0043CB45 . 8BC8 mov ecx,eax
0043CB47 . FF15 D010400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaI2I4
0043CB4D . 8D4D DC lea ecx,dword ptr ss:[ebp-24]
0043CB50 . 8945 E8 mov dword ptr ss:[ebp-18],eax
0043CB53 . FF15 FC11400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaFreeStr
0043CB59 . 8D4D D4 lea ecx,dword ptr ss:[ebp-2C]
0043CB5C . FF15 F811400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaFreeObj
0043CB62 . 8B06 mov eax,dword ptr ds:[esi]
0043CB64 . 56 push esi
0043CB65 . FF90 0803000>call dword ptr ds:[eax+308]
0043CB6B . 8D4D D4 lea ecx,dword ptr ss:[ebp-2C]
0043CB6E . 50 push eax
0043CB6F . 51 push ecx
0043CB70 . FFD7 call edi
0043CB72 . 8BD8 mov ebx,eax
0043CB74 . 8D45 DC lea eax,dword ptr ss:[ebp-24]
0043CB77 . 50 push eax
0043CB78 . 53 push ebx
0043CB79 . 8B13 mov edx,dword ptr ds:[ebx]
0043CB7B . FF92 A000000>call dword ptr ds:[edx+A0]
0043CB81 . 85C0 test eax,eax
0043CB83 . DBE2 fclex
0043CB85 . 7D 12 jge short BatchDoc.0043CB99
0043CB87 . 68 A0000000 push 0A0
0043CB8C . 68 58064100 push BatchDoc.00410658
0043CB91 . 53 push ebx
0043CB92 . 50 push eax
0043CB93 . FF15 5C10400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaHresultCheckObj
0043CB99 > 8B4D DC mov ecx,dword ptr ss:[ebp-24]
0043CB9C . 51 push ecx
0043CB9D . FF15 2810400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaLenBstr
0043CBA3 . 33DB xor ebx,ebx
0043CBA5 . 83F8 03 cmp eax,3 ; 注册码长度大于3
0043CBA8 . 0F9FC3 setg bl
0043CBAB . F7DB neg ebx
0043CBAD . 33D2 xor edx,edx
0043CBAF . 66:837D E8 0>cmp word ptr ss:[ebp-18],1
0043CBB4 . 8D4D DC lea ecx,dword ptr ss:[ebp-24]
0043CBB7 . 0F9FC2 setg dl
0043CBBA . F7DA neg edx
0043CBBC . 23DA and ebx,edx
0043CBBE . FF15 FC11400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaFreeStr
0043CBC4 . 8D4D D4 lea ecx,dword ptr ss:[ebp-2C]
0043CBC7 . FF15 F811400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaFreeObj
0043CBCD . 66:85DB test bx,bx
0043CBD0 . 0F84 0104000>je BatchDoc.0043CFD7 ; 判断注册码是否有“-”号,长度大于3
///////////////////////////////////////////////////////////////////////////////////////////////////
0043CBD6 . 8B06 mov eax,dword ptr ds:[esi]
0043CBD8 . 56 push esi
0043CBD9 . FF90 0803000>call dword ptr ds:[eax+308]
0043CBDF . 8D4D D4 lea ecx,dword ptr ss:[ebp-2C]
0043CBE2 . 50 push eax
0043CBE3 . 51 push ecx
0043CBE4 . FFD7 call edi
0043CBE6 . 8BD8 mov ebx,eax
0043CBE8 . 8D45 DC lea eax,dword ptr ss:[ebp-24]
0043CBEB . 50 push eax
0043CBEC . 53 push ebx
0043CBED . 8B13 mov edx,dword ptr ds:[ebx]
0043CBEF . FF92 A000000>call dword ptr ds:[edx+A0]
0043CBF5 . 85C0 test eax,eax
0043CBF7 . DBE2 fclex
0043CBF9 . 7D 12 jge short BatchDoc.0043CC0D
0043CBFB . 68 A0000000 push 0A0
0043CC00 . 68 58064100 push BatchDoc.00410658
0043CC05 . 53 push ebx
0043CC06 . 50 push eax
0043CC07 . FF15 5C10400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaHresultCheckObj
0043CC0D > 66:8B4D E8 mov cx,word ptr ss:[ebp-18]
0043CC11 . 8B45 DC mov eax,dword ptr ss:[ebp-24]
0043CC14 . 66:83E9 01 sub cx,1
0043CC18 . 8945 C4 mov dword ptr ss:[ebp-3C],eax
0043CC1B . 0F80 0606000>jo BatchDoc.0043D227
0043CC21 . 0FBFD1 movsx edx,cx
0043CC24 . 8D45 BC lea eax,dword ptr ss:[ebp-44]
0043CC27 . 52 push edx ; /Arg3
0043CC28 . 8D4D AC lea ecx,dword ptr ss:[ebp-54] ; |
0043CC2B . 50 push eax ; |Arg2
0043CC2C . 51 push ecx ; |Arg1
0043CC2D . C745 DC 0000>mov dword ptr ss:[ebp-24],0 ; |
0043CC34 . C745 BC 0800>mov dword ptr ss:[ebp-44],8 ; |
0043CC3B . FF15 CC11400>call dword ptr ds:[<&MSVBVM60.#61>; \rtcLeftCharVar
0043CC41 . 8D55 AC lea edx,dword ptr ss:[ebp-54]
0043CC44 . 52 push edx
0043CC45 . FF15 2410400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaStrVarMove
0043CC4B . 8B1D D411400>mov ebx,dword ptr ds:[<&MSVBVM60.>; MSVBVM60.__vbaStrMove
0043CC51 . 8BD0 mov edx,eax
0043CC53 . 8D4D E4 lea ecx,dword ptr ss:[ebp-1C]
0043CC56 . FFD3 call ebx ; <&MSVBVM60.__vbaStrMove>
0043CC58 . 8D4D D4 lea ecx,dword ptr ss:[ebp-2C]
0043CC5B . FF15 F811400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaFreeObj
0043CC61 . 8D45 AC lea eax,dword ptr ss:[ebp-54]
0043CC64 . 8D4D BC lea ecx,dword ptr ss:[ebp-44]
0043CC67 . 50 push eax
0043CC68 . 51 push ecx
0043CC69 . 6A 02 push 2
0043CC6B . FF15 2C10400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaFreeVarList
0043CC71 . 8B16 mov edx,dword ptr ds:[esi]
0043CC73 . 83C4 0C add esp,0C
0043CC76 . 56 push esi
0043CC77 . FF92 0803000>call dword ptr ds:[edx+308]
0043CC7D . 50 push eax
0043CC7E . 8D45 D4 lea eax,dword ptr ss:[ebp-2C]
0043CC81 . 50 push eax
0043CC82 . FFD7 call edi
0043CC84 . 8B08 mov ecx,dword ptr ds:[eax]
0043CC86 . 8D55 DC lea edx,dword ptr ss:[ebp-24]
0043CC89 . 52 push edx
0043CC8A . 50 push eax
0043CC8B . 8985 58FFFFF>mov dword ptr ss:[ebp-A8],eax
0043CC91 . FF91 A000000>call dword ptr ds:[ecx+A0]
0043CC97 . 85C0 test eax,eax
0043CC99 . DBE2 fclex
0043CC9B . 7D 18 jge short BatchDoc.0043CCB5
0043CC9D . 8B8D 58FFFFF>mov ecx,dword ptr ss:[ebp-A8]
0043CCA3 . 68 A0000000 push 0A0
0043CCA8 . 68 58064100 push BatchDoc.00410658
0043CCAD . 51 push ecx
0043CCAE . 50 push eax
0043CCAF . FF15 5C10400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaHresultCheckObj
0043CCB5 > 8B16 mov edx,dword ptr ds:[esi]
0043CCB7 . 56 push esi
0043CCB8 . FF92 0803000>call dword ptr ds:[edx+308]
0043CCBE . 50 push eax
0043CCBF . 8D45 D0 lea eax,dword ptr ss:[ebp-30]
0043CCC2 . 50 push eax
0043CCC3 . FFD7 call edi
0043CCC5 . 8BF8 mov edi,eax
0043CCC7 . 8D55 D8 lea edx,dword ptr ss:[ebp-28]
0043CCCA . 52 push edx
0043CCCB . 57 push edi
0043CCCC . 8B0F mov ecx,dword ptr ds:[edi]
0043CCCE . FF91 A000000>call dword ptr ds:[ecx+A0]
0043CCD4 . 85C0 test eax,eax
0043CCD6 . DBE2 fclex
0043CCD8 . 7D 12 jge short BatchDoc.0043CCEC
0043CCDA . 68 A0000000 push 0A0
0043CCDF . 68 58064100 push BatchDoc.00410658
0043CCE4 . 57 push edi
0043CCE5 . 50 push eax
0043CCE6 . FF15 5C10400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaHresultCheckObj
0043CCEC > 8B45 DC mov eax,dword ptr ss:[ebp-24]
0043CCEF . C745 DC 0000>mov dword ptr ss:[ebp-24],0
0043CCF6 . 8945 C4 mov dword ptr ss:[ebp-3C],eax
0043CCF9 . 8B45 D8 mov eax,dword ptr ss:[ebp-28]
0043CCFC . 50 push eax
0043CCFD . C745 BC 0800>mov dword ptr ss:[ebp-44],8
0043CD04 . FF15 2810400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaLenBstr
0043CD0A . 0FBF4D E8 movsx ecx,word ptr ss:[ebp-18]
0043CD0E . 2BC1 sub eax,ecx
0043CD10 . 8D55 BC lea edx,dword ptr ss:[ebp-44]
0043CD13 . 0F80 0E05000>jo BatchDoc.0043D227
0043CD19 . 50 push eax ; /Arg3
0043CD1A . 8D45 AC lea eax,dword ptr ss:[ebp-54] ; |
0043CD1D . 52 push edx ; |Arg2
0043CD1E . 50 push eax ; |Arg1
0043CD1F . FF15 E011400>call dword ptr ds:[<&MSVBVM60.#61>; \rtcRightCharVar
0043CD25 . 8D4D AC lea ecx,dword ptr ss:[ebp-54]
0043CD28 . 51 push ecx
0043CD29 . FF15 2410400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaStrVarMove
//////////////////////////////////////////////////////////////////////////////////////////////
上面这段代码是对输入的注册码按“-”进行分离
/////////////////////////////////////////////////////////////////////////////////////////////
0043CD2F . 8BD0 mov edx,eax
0043CD31 . 8D4D E0 lea ecx,dword ptr ss:[ebp-20]
0043CD34 . FFD3 call ebx
0043CD36 . 8D4D D8 lea ecx,dword ptr ss:[ebp-28]
0043CD39 . FF15 FC11400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaFreeStr
0043CD3F . 8D55 D0 lea edx,dword ptr ss:[ebp-30]
0043CD42 . 8D45 D4 lea eax,dword ptr ss:[ebp-2C]
0043CD45 . 52 push edx
0043CD46 . 50 push eax
0043CD47 . 6A 02 push 2
0043CD49 . FF15 3810400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaFreeObjList
0043CD4F . 8D4D AC lea ecx,dword ptr ss:[ebp-54]
0043CD52 . 8D55 BC lea edx,dword ptr ss:[ebp-44]
0043CD55 . 51 push ecx
0043CD56 . 52 push edx
0043CD57 . 6A 02 push 2
0043CD59 . FF15 2C10400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaFreeVarList
0043CD5F . 8B45 E0 mov eax,dword ptr ss:[ebp-20]
0043CD62 . 83C4 18 add esp,18
0043CD65 . 8D4D E4 lea ecx,dword ptr ss:[ebp-1C]
0043CD68 . 50 push eax
0043CD69 . 51 push ecx
0043CD6A . E8 31F9FFFF call BatchDoc.0043C6A0 ; 关键算法
0043CD6F . 8BD0 mov edx,eax
0043CD71 . 8D4D DC lea ecx,dword ptr ss:[ebp-24]
0043CD74 . FFD3 call ebx
0043CD76 . 50 push eax
0043CD77 . FF15 C410400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaStrCmp
0043CD7D . 8BF8 mov edi,eax
0043CD7F . 8D4D DC lea ecx,dword ptr ss:[ebp-24]
0043CD82 . F7DF neg edi
0043CD84 . 1BFF sbb edi,edi
0043CD86 . 47 inc edi
0043CD87 . F7DF neg edi
0043CD89 . FF15 FC11400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaFreeStr
0043CD8F . 66:85FF test di,di
0043CD92 . 0F84 4702000>je BatchDoc.0043CFDF ; 跳OVER
跟进上面的关键算法来到
0043C6A0 $ 55 push ebp
0043C6A1 . 8BEC mov ebp,esp
0043C6A3 . 83EC 0C sub esp,0C
0043C6A6 . 68 061E4000 push ; SE 句柄安装
0043C6AB . 64:A1 000000>mov eax,dword ptr fs:[0]
。。。省略往下
0043C6EF . 85C0 test eax,eax ; 左边字符长度,后面循环用
0043C6F1 . 0F84 2003000>je BatchDoc.0043CA17
。。。省略往下
0043C85F > \8B51 0C mov edx,dword ptr ds:[ecx+C]
0043C862 . 8BC3 mov eax,ebx
0043C864 . 33DB xor ebx,ebx
0043C866 . 8A1C02 mov bl,byte ptr ds:[edx+eax] ; 把倒数第二位的ASC码送入bl
0043C869 . 8BF3 mov esi,ebx ; 把bl的值送至esi,记为c
。。。省略往下
0043C8B0 . 8A1C02 mov bl,byte ptr ds:[edx+eax] ; 左边每个字符的ASC
0043C8B3 . 8B55 D0 mov edx,dword ptr ss:[ebp-30] ; 第一次为最后一位的ASC码,后为b值
0043C8B6 . 23DA and ebx,edx ; 和最后一位ASC码或b值做and运算,记为a
0043C8B8 . 85C9 test ecx,ecx
0043C8BA . 74 22 je short BatchDoc.0043C8DE
0043C8BC . 66:8339 01 cmp word ptr ds:[ecx],1
0043C8C0 . 75 1C jnz short BatchDoc.0043C8DE
0043C8C2 . 8B7D 84 mov edi,dword ptr ss:[ebp-7C]
0043C8C5 . 8B51 14 mov edx,dword ptr ds:[ecx+14]
0043C8C8 . 8B41 10 mov eax,dword ptr ds:[ecx+10]
0043C8CB . 2BFA sub edi,edx
0043C8CD . 3BF8 cmp edi,eax
0043C8CF . 72 09 jb short BatchDoc.0043C8DA
0043C8D1 . FF15 C010400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaGenerateBoundsError
0043C8D7 . 8B4D D8 mov ecx,dword ptr ss:[ebp-28]
0043C8DA > 8BC7 mov eax,edi
0043C8DC . EB 05 jmp short BatchDoc.0043C8E3
0043C8DE > FFD7 call edi
0043C8E0 . 8B4D D8 mov ecx,dword ptr ss:[ebp-28]
0043C8E3 > 8B49 0C mov ecx,dword ptr ds:[ecx+C]
0043C8E6 . 33D2 xor edx,edx
0043C8E8 . 8A1401 mov dl,byte ptr ds:[ecx+eax] ; 每个字符的ASC码
0043C8EB . 8BFA mov edi,edx
0043C8ED . 0BFE or edi,esi ; 与c做OR运算,记作b
0043C8EF . 81FB 8000000>cmp ebx,80
0043C8F5 . 7E 0F jle short BatchDoc.0043C906
0043C8F7 . B8 00010000 mov eax,100
0043C8FC . 2BC3 sub eax,ebx
0043C8FE . 0F80 7501000>jo BatchDoc.0043CA79
0043C904 . 8BD8 mov ebx,eax
0043C906 > 81FF 8000000>cmp edi,80 ; b>80
0043C90C . 7E 0F jle short BatchDoc.0043C91D
0043C90E . B9 00010000 mov ecx,100
0043C913 . 2BCF sub ecx,edi ; 100-b
0043C915 . 0F80 5E01000>jo BatchDoc.0043CA79
0043C91B . 8BF9 mov edi,ecx ; b=100-b
0043C91D > 8B45 C4 mov eax,dword ptr ss:[ebp-3C]
0043C920 . 85C0 test eax,eax
0043C922 . 74 22 je short BatchDoc.0043C946
0043C924 . 66:8338 01 cmp word ptr ds:[eax],1
0043C928 . 75 1C jnz short BatchDoc.0043C946
0043C92A . 8B4D 84 mov ecx,dword ptr ss:[ebp-7C]
0043C92D . 8B50 14 mov edx,dword ptr ds:[eax+14]
0043C930 . 2BCA sub ecx,edx
0043C932 . 8BF1 mov esi,ecx
0043C934 . 8B48 10 mov ecx,dword ptr ds:[eax+10]
0043C937 . 3BF1 cmp esi,ecx
0043C939 . 72 06 jb short BatchDoc.0043C941
0043C93B . FF15 C010400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaGenerateBoundsError
0043C941 > 8975 80 mov dword ptr ss:[ebp-80],esi
0043C944 . EB 09 jmp short BatchDoc.0043C94F
0043C946 > FF15 C010400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaGenerateBoundsError
0043C94C . 8945 80 mov dword ptr ss:[ebp-80],eax
0043C94F > 68 981D4100 push BatchDoc.00411D98 ; /a
0043C954 . FF15 3C10400>call dword ptr ds:[<&MSVBVM60.#51>; \rtcAnsiValueBstr
0043C95A . 0FBFC8 movsx ecx,ax ; 这里得到字符“A”的asc值41
0043C95D . 8BC7 mov eax,edi
0043C95F . BE 34000000 mov esi,34
0043C964 . 0FAFC3 imul eax,ebx ; a*b
0043C967 . 0F80 0C01000>jo BatchDoc.0043CA79
0043C96D . 99 cdq
0043C96E . F7FE idiv esi ; a*b/34,余值入edx
0043C970 . 03CA add ecx,edx ; edx+41,也就是余值加上41,记S
0043C972 . 0F80 0101000>jo BatchDoc.0043CA79
0043C978 . FF15 1411400>call dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaUI1I4
0043C97E . 8B55 C4 mov edx,dword ptr ss:[ebp-3C]
0043C981 . 8BF7 mov esi,edi ; 将b值移送esi
0043C983 . 03F3 add esi,ebx ; b=a+b
0043C985 . 8B5D C8 mov ebx,dword ptr ss:[ebp-38]
0043C988 . 8B4A 0C mov ecx,dword ptr ds:[edx+C]
0043C98B . 8B55 80 mov edx,dword ptr ss:[ebp-80]
0043C98E . 0F80 E500000>jo BatchDoc.0043CA79
0043C994 . 880411 mov byte ptr ds:[ecx+edx],al ; 将S转换成字符就是注册码
0043C997 . B8 01000000 mov eax,1
0043C99C . 81E6 FF00000>and esi,0FF
0043C9A2 . 66:0345 E8 add ax,word ptr ss:[ebp-18] ; a=b(b为没加a前的值)
0043C9A6 . 897D D0 mov dword ptr ss:[ebp-30],edi
0043C9A9 . 8B7D DC mov edi,dword ptr ss:[ebp-24]
0043C9AC . 0F80 C700000>jo BatchDoc.0043CA79
0043C9B2 . 8945 E8 mov dword ptr ss:[ebp-18],eax
0043C9B5 .^ E9 EFFDFFFF jmp BatchDoc.0043C7A9 ; 下个循环
--------------------------------------------------------------------------------
【经验总结】
1、注册码必须有“-”号,长度大于3
2、这给个源码,不然说还真不好写
l=左边注册码的长度
a = Asc(Mid(Text1.Text, l, 1))
b = Asc(Mid(Text1.Text, l - 1, 1))
zc = ""
For i = 1 To l
s = Mid(Text1.Text, i, 1)
a = a And Asc(s)
b = b Or Asc(s)
If b > 128 Then
b = 256 - b
End If
k = ((a * b) Mod 52) + 65
zc = zc + Chr(k)
c = b
b = a + b
a = c
Next
这样就可算出注册码的右边
3、如果注册码的右边字符=计算所得的字符,注册成功
4、可以有N组注册码,呵呵
--------------------------------------------------------------------------------
【版权声明】: 转载请注明作者并保持文章的完整, 谢谢!
2006年12月08日 下午 12:50:05
赞赏
- [求助]electron加密方式 6160
- C# hook connect 老是返回-1(已解决) 4695
- [求助]RSA 5558
- [求助]向其他程序中的listview写入数据 5858
- [求助][求助]C++ 6511