【文章标题】: 数独伙伴的简单分析
【文章作者】: talaqi
【软件名称】: 数独伙伴V1.0
【软件大小】: 284K
【下载地址】: 天空下载
【加壳方式】: 无壳
【保护方式】: 注册码（明码）
【编写语言】: C++
【使用工具】: OD
【操作平台】: XP
【软件介绍】: 趣味游戏！
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
00440F3D . 50 push eax ; 此处下断，F8
00440F3E . 8BF9 mov edi,ecx
00440F40 . 68 45040000 push 445
00440F45 . E8 DC030000 call <jmp.&MFC42.#3098> ; 取注册码长度
00440F4A . 68 80404400 push whnbeyon.00444080 ; /mode = "w"
00440F4F . 68 98404400 push whnbeyon.00444098 ; |path =
"c:WINDOWSsysm.svx"
00440F54 . FF15 D4214400 call dword ptr ds:[<&MSVCRT.fopen>] ; \fopen
00440F5A . 8BE8 mov ebp,eax
00440F5C . 83C4 08 add esp,8
00440F5F . 85ED test ebp,ebp
00440F61 . 75 12 jnz short whnbeyon.00440F75
00440F63 . 50 push eax
00440F64 . 68 B44B4400 push whnbeyon.00444BB4 ; ASCII "ERROR"
00440F69 . 68 AC4B4400 push whnbeyon.00444BAC ; ASCII "FILE"
00440F6E . 8BCF mov ecx,edi
00440F70 . E8 87030000 call <jmp.&MFC42.#4224>
00440F75 > BE 944B4400 mov esi,whnbeyon.00444B94 ; ASCII
"WXDCE-73-94BF-07-JM3"(试炼码)
00440F7A . 8D4424 10 lea eax,dword ptr ss:[esp+10] ; 取出假注册码
00440F7E > 8A10 mov dl,byte ptr ds:[eax]
00440F80 . 8A1E mov bl,byte ptr ds:[esi]
00440F82 . 8ACA mov cl,dl
00440F84 . 3AD3 cmp dl,bl ;假码与试炼码依次比较
00440F86 . 75 1E jnz short whnbeyon.00440FA6 ;不相等则跳走。以下同理
00440F88 . 84C9 test cl,cl
00440F8A . 74 16 je short whnbeyon.00440FA2
00440F8C . 8A50 01 mov dl,byte ptr ds:[eax+1]
00440F8F . 8A5E 01 mov bl,byte ptr ds:[esi+1]
00440F92 . 8ACA mov cl,dl
00440F94 . 3AD3 cmp dl,bl
00440F96 . 75 0E jnz short whnbeyon.00440FA6
00440F98 . 83C0 02 add eax,2
00440F9B . 83C6 02 add esi,2
00440F9E . 84C9 test cl,cl
00440FA0 .^ 75 DC jnz short whnbeyon.00440F7E
00440FA2 > 33C0 xor eax,eax
00440FA4 . EB 05 jmp short whnbeyon.00440FAB
00440FA6 > 1BC0 sbb eax,eax
00440FA8 . 83D8 FF sbb eax,-1
00440FAB > 85C0 test eax,eax
00440FAD . 0F84 0B010000 je whnbeyon.004410BE
00440FB3 . BE 7C4B4400 mov esi,whnbeyon.00444B7C ; ASCII
"MOL-LY94-3SOL-IEV-OLI-J"(试炼码)
00440FB8 . 8D4424 10 lea eax,dword ptr ss:[esp+10]
00440FBC > 8A10 mov dl,byte ptr ds:[eax]
00440FBE . 8A1E mov bl,byte ptr ds:[esi]
00440FC0 . 8ACA mov cl,dl
00440FC2 . 3AD3 cmp dl,bl
00440FC4 . 75 1E jnz short whnbeyon.00440FE4
00440FC6 . 84C9 test cl,cl
00440FC8 . 74 16 je short whnbeyon.00440FE0
00440FCA . 8A50 01 mov dl,byte ptr ds:[eax+1]
00440FCD . 8A5E 01 mov bl,byte ptr ds:[esi+1]
00440FD0 . 8ACA mov cl,dl
00440FD2 . 3AD3 cmp dl,bl
00440FD4 . 75 0E jnz short whnbeyon.00440FE4
00440FD6 . 83C0 02 add eax,2
00440FD9 . 83C6 02 add esi,2
00440FDC . 84C9 test cl,cl
00440FDE .^ 75 DC jnz short whnbeyon.00440FBC
00440FE0 > 33C0 xor eax,eax
00440FE2 . EB 05 jmp short whnbeyon.00440FE9
00440FE4 > 1BC0 sbb eax,eax
00440FE6 . 83D8 FF sbb eax,-1
00440FE9 > 85C0 test eax,eax
00440FEB . 0F84 CD000000 je whnbeyon.004410BE
00440FF1 . BE 5C4B4400 mov esi,whnbeyon.00444B5C ; ASCII
"SW0-662882-710109-1112-2512-2X"(试炼码)
00440FF6 . 8D4424 10 lea eax,dword ptr ss:[esp+10]
00440FFA > 8A10 mov dl,byte ptr ds:[eax]
00440FFC . 8A1E mov bl,byte ptr ds:[esi]
00440FFE . 8ACA mov cl,dl
00441000 . 3AD3 cmp dl,bl
00441002 . 75 1E jnz short whnbeyon.00441022
00441004 . 84C9 test cl,cl
00441006 . 74 16 je short whnbeyon.0044101E
00441008 . 8A50 01 mov dl,byte ptr ds:[eax+1]
0044100B . 8A5E 01 mov bl,byte ptr ds:[esi+1]
0044100E . 8ACA mov cl,dl
00441010 . 3AD3 cmp dl,bl
00441012 . 75 0E jnz short whnbeyon.00441022
00441014 . 83C0 02 add eax,2
00441017 . 83C6 02 add esi,2
0044101A . 84C9 test cl,cl
0044101C .^ 75 DC jnz short whnbeyon.00440FFA
0044101E > 33C0 xor eax,eax
00441020 . EB 05 jmp short whnbeyon.00441027
00441022 > 1BC0 sbb eax,eax
00441024 . 83D8 FF sbb eax,-1
00441027 > 85C0 test eax,eax
00441029 . 0F84 8F000000 je whnbeyon.004410BE
0044102F . BE 404B4400 mov esi,whnbeyon.00444B40 ; ASCII
"BEC-A13-IIW-MXZ-CDE-801-1BT"(试炼码)
00441034 . 8D4424 10 lea eax,dword ptr ss:[esp+10]
00441038 > 8A10 mov dl,byte ptr ds:[eax]
0044103A . 8A1E mov bl,byte ptr ds:[esi]
0044103C . 8ACA mov cl,dl
0044103E . 3AD3 cmp dl,bl
00441040 . 75 1E jnz short whnbeyon.00441060
00441042 . 84C9 test cl,cl
00441044 . 74 16 je short whnbeyon.0044105C
00441046 . 8A50 01 mov dl,byte ptr ds:[eax+1]
00441049 . 8A5E 01 mov bl,byte ptr ds:[esi+1]
0044104C . 8ACA mov cl,dl
0044104E . 3AD3 cmp dl,bl
00441050 . 75 0E jnz short whnbeyon.00441060
00441052 . 83C0 02 add eax,2
00441055 . 83C6 02 add esi,2
00441058 . 84C9 test cl,cl
0044105A .^ 75 DC jnz short whnbeyon.00441038
0044105C > 33C0 xor eax,eax
0044105E . EB 05 jmp short whnbeyon.00441065
00441060 > 1BC0 sbb eax,eax
00441062 . 83D8 FF sbb eax,-1
00441065 > 85C0 test eax,eax
00441067 . 74 55 je short whnbeyon.004410BE
00441069 . BE 284B4400 mov esi,whnbeyon.00444B28 ; ASCII
"SOP-HIAWSXS-WINJTY-6674"(试炼码)
0044106E . 8D4424 10 lea eax,dword ptr ss:[esp+10]
00441072 > 8A10 mov dl,byte ptr ds:[eax]
00441074 . 8A1E mov bl,byte ptr ds:[esi]
00441076 . 8ACA mov cl,dl
00441078 . 3AD3 cmp dl,bl
0044107A . 75 1E jnz short whnbeyon.0044109A
0044107C . 84C9 test cl,cl
0044107E . 74 16 je short whnbeyon.00441096
00441080 . 8A50 01 mov dl,byte ptr ds:[eax+1]
00441083 . 8A5E 01 mov bl,byte ptr ds:[esi+1]
00441086 . 8ACA mov cl,dl
00441088 . 3AD3 cmp dl,bl
0044108A . 75 0E jnz short whnbeyon.0044109A
0044108C . 83C0 02 add eax,2
0044108F . 83C6 02 add esi,2
00441092 . 84C9 test cl,cl
00441094 .^ 75 DC jnz short whnbeyon.00441072
00441096 > 33C0 xor eax,eax
00441098 . EB 05 jmp short whnbeyon.0044109F
0044109A > 1BC0 sbb eax,eax
0044109C . 83D8 FF sbb eax,-1
0044109F > 85C0 test eax,eax
004410A1 . 74 1B je short whnbeyon.004410BE
004410A3 . 6A 00 push 0
004410A5 . 68 84404400 push whnbeyon.00444084
004410AA . 68 D44A4400 push whnbeyon.00444AD4 ;请输入正确的注册码
004410AF . 8BCF mov ecx,edi
004410B1 . E8 46020000 call <jmp.&MFC42.#4224>
004410B6 . 5F pop edi
004410B7 . 5E pop esi
004410B8 . 5D pop ebp
004410B9 . 5B pop ebx
004410BA . 83C4 64 add esp,64
004410BD . C3 retn
004410BE > 68 48484400 push whnbeyon.00444848 ; /format =
004410C3 . 55 push ebp ; |stream
004410C4 . FF15 90214400 call dword ptr ds:[<&MSVCRT.fprintf>] ; \fprintf
004410CA . 55 push ebp ; /stream
004410CB . FF15 8C214400 call dword ptr ds:[<&MSVCRT.fclose>] ; \fclose
004410D1 . 83C4 0C add esp,0C
004410D4 . 8BCF mov ecx,edi
004410D6 . 6A 00 push 0
004410D8 . 68 40484400 push whnbeyon.00444840
004410DD . 68 2C484400 push whnbeyon.0044482C ; 注册成功
004410E2 . E8 15020000 call <jmp.&MFC42.#4224>
004410E7 . 8BCF mov ecx,edi
004410E9 . E8 2C020000 call <jmp.&MFC42.#4376>
004410EE . 5F pop edi
004410EF . 5E pop esi
004410F0 . 5D pop ebp
004410F1 . 5B pop ebx
004410F2 . 83C4 64 add esp,64
004410F5 . C3 retn
--------------------------------------------------------------------------------
【经验总结】
此例为明码比较，假码与真码依次比较，相等就注册成功。VEAR EASY！
非常适合初学者练习。
本人是个菜鸟。有不妥之处还望指正，为谢！
--------------------------------------------------------------------------------
【版权声明】: 本文原创于看雪技术论坛, 转载请注明作者并保持文章的完整, 谢谢!
2007年02月24日 12:34:14
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
