下载地址:http://www.skycn.com/soft/17202.html
随便输入注册码,跳出“注册码错误”。
dasm载入,查找文本串参考“注册码错误”和“注册成功”,得到地址分别是004B5915,004B59CA,我们分析注册算法
OD载入,来到上面这个地址,我们往前看看,在哪里jump的呢。但是在004B58FA下断后,程序出现异常。我们继续往前看,发现004B58DD这里
也有判断的地方,我们重新下断运行。结果发现正确的注册码。这个例子很简单,我们总结一下,在判断注册码之前一般程序会先mov eax,错
误的注册码,mov ebx,正确的注册码,然后cmp eax,ebx或者call 某地址的分支程序来做判断。然后用jz或者jnz,je之类的来跳转,抓住关
键字我们就可以节省时间来找到注册码。我是菜鸟,还不会写注册机,至于他是怎么计算注册码的,在这个程序段的004B588B处开始就是计算
了。有兴趣的朋友可以分析一下,有什么不对的望大家批评指正,一起进步。
004B5808 /. 55 push ebp
004B5809 |. 8BEC mov ebp, esp
004B580B |. B9 07000000 mov ecx, 7
004B5810 |> 6A 00 /push 0
004B5812 |. 6A 00 |push 0
004B5814 |. 49 |dec ecx
004B5815 |.^ 75 F9 \jnz short 004B5810
004B5817 |. 51 push ecx
004B5818 |. 53 push ebx
004B5819 |. 56 push esi
004B581A |. 57 push edi
004B581B |. 8BD8 mov ebx, eax
004B581D |. 33C0 xor eax, eax
004B581F |. 55 push ebp
004B5820 |. 68 845A4B00 push 004B5A84
004B5825 |. 64:FF30 push dword ptr fs:[eax]
004B5828 |. 64:8920 mov fs:[eax], esp
004B582B |. 8D55 F0 lea edx, [ebp-10]
004B582E |. 8B83 4C030000 mov eax, [ebx+34C]
004B5834 |. E8 3704FAFF call 00455C70
004B5839 |. 8B45 F0 mov eax, [ebp-10]
004B583C |. 8D55 F4 lea edx, [ebp-C]
004B583F |. E8 F02FF5FF call 00408834
004B5844 |. 8D55 EC lea edx, [ebp-14]
004B5847 |. 8B83 4C030000 mov eax, [ebx+34C]
004B584D |. E8 1E04FAFF call 00455C70
004B5852 |. 8B45 EC mov eax, [ebp-14]
004B5855 |. BA 9C5A4B00 mov edx, 004B5A9C
004B585A |. E8 6DEEF4FF call 004046CC
004B585F |. 0F84 BD010000 je 004B5A22
004B5865 |. 8D55 E8 lea edx, [ebp-18]
004B5868 |. 8B83 4C030000 mov eax, [ebx+34C]
004B586E |. E8 FD03FAFF call 00455C70
004B5873 |. 837D E8 00 cmp dword ptr [ebp-18], 0
004B5877 |. 0F84 A5010000 je 004B5A22
004B587D |. 8D55 E0 lea edx, [ebp-20]
004B5880 |. 8B83 48030000 mov eax, [ebx+348]
004B5886 |. E8 E503FAFF call 00455C70
004B588B |. 8B45 E0 mov eax, [ebp-20]
004B588E |. 8D4D E4 lea ecx, [ebp-1C]
004B5891 |. BA B05A4B00 mov edx, 004B5AB0 ; ASCII "DS$%^TG"
004B5896 |. E8 51CA0200 call 004E22EC
004B589B |. 8B45 E4 mov eax, [ebp-1C]
004B589E |. 50 push eax
004B589F |. 8D55 D8 lea edx, [ebp-28]
004B58A2 |. 8B83 48030000 mov eax, [ebx+348]
004B58A8 |. E8 C303FAFF call 00455C70
004B58AD |. 8B45 D8 mov eax, [ebp-28]
004B58B0 |. 8D55 DC lea edx, [ebp-24]
004B58B3 |. E8 1CCB0200 call 004E23D4
004B58B8 |. 8B55 DC mov edx, [ebp-24]
004B58BB |. 8D45 F8 lea eax, [ebp-8]
004B58BE |. 59 pop ecx
004B58BF |. E8 08EDF4FF call 004045CC
004B58C4 |. 8D55 D4 lea edx, [ebp-2C]
004B58C7 |. 8B83 4C030000 mov eax, [ebx+34C]
004B58CD |. E8 9E03FAFF call 00455C70
004B58D2 |. 8B45 D4 mov eax, [ebp-2C] ;在这里下断运行,发现这里放的是自己输入的数据
;堆栈 ss:[0013F9F8]=00FB7FF4, (ASCII "54321")eax=00000005
004B58D5 |. 8B55 F8 mov edx, [ebp-8] ;这里存放的是注册码的数据
;堆栈 ss:[0013FA1C]=00FE2EE4, (ASCII "?I4H3E5AG2B3I?E6@@")
edx=00150608
004B58D8 |. E8 EFEDF4FF call 004046CC
004B58DD |. 74 57 je short 004B5936 ;这里也像是判断注册码的
004B58DF |. 8D55 D0 lea edx, [ebp-30]
004B58E2 |. 8B83 4C030000 mov eax, [ebx+34C]
004B58E8 |. E8 8303FAFF call 00455C70
004B58ED |. 8B45 D0 mov eax, [ebp-30] ;在这下断运行,看是不是能发现注册码
004B58F0 |. BA C05A4B00 mov edx, 004B5AC0
004B58F5 |. E8 D2EDF4FF call 004046CC
004B58FA |. 74 3A je short 004B5936 ;像是在这里判断的
004B58FC |. A1 A07B4E00 mov eax, [4E7BA0]
004B5901 |. 8B00 mov eax, [eax]
004B5903 |. 8B98 E4030000 mov ebx, [eax+3E4]
004B5909 |. C643 48 01 mov byte ptr [ebx+48], 1
004B590D |. A1 A07B4E00 mov eax, [4E7BA0]
004B5912 |. 8D43 68 lea eax, [ebx+68]
004B5915 |. BA E05A4B00 mov edx, 004B5AE0 ;来到这,这里是注册错误分支
004B591A |. E8 F5E9F4FF call 00404314
004B591F |. A1 A07B4E00 mov eax, [4E7BA0]
004B5924 |. 8B00 mov eax, [eax]
004B5926 |. 8B80 E4030000 mov eax, [eax+3E4]
004B592C |. 8B10 mov edx, [eax]
004B592E |. FF52 30 call [edx+30]
004B5931 |. E9 EC000000 jmp 004B5A22
004B5936 |> 8D55 C8 lea edx, [ebp-38]
004B5939 |. A1 0C7C4E00 mov eax, [4E7C0C]
004B593E |. 8B00 mov eax, [eax]
004B5940 |. E8 EB14FCFF call 00476E30
004B5945 |. 8B45 C8 mov eax, [ebp-38]
004B5948 |. 8D55 CC lea edx, [ebp-34]
004B594B |. E8 A437F5FF call 004090F4
004B5950 |. 8B55 CC mov edx, [ebp-34]
004B5953 |. 8D45 FC lea eax, [ebp-4]
004B5956 |. B9 F85A4B00 mov ecx, 004B5AF8 ; ASCII "\wake.ini"
004B595B |. E8 6CECF4FF call 004045CC
004B5960 |. 8B4D FC mov ecx, [ebp-4]
004B5963 |. B2 01 mov dl, 1
004B5965 |. A1 4C834300 mov eax, [43834C]
004B596A |. E8 8D2AF8FF call 004383FC
004B596F |. 8BF0 mov esi, eax
004B5971 |. 8D55 C4 lea edx, [ebp-3C]
004B5974 |. 8B83 4C030000 mov eax, [ebx+34C]
004B597A |. E8 F102FAFF call 00455C70
004B597F |. 8B45 C4 mov eax, [ebp-3C]
004B5982 |. 50 push eax
004B5983 |. B9 0C5B4B00 mov ecx, 004B5B0C ; ASCII "code"
004B5988 |. BA 1C5B4B00 mov edx, 004B5B1C ; ASCII "reg"
004B598D |. 8BC6 mov eax, esi
004B598F |. 8B38 mov edi, [eax]
004B5991 |. FF57 04 call [edi+4]
004B5994 |. 68 285B4B00 push 004B5B28
004B5999 |. B9 345B4B00 mov ecx, 004B5B34 ; ASCII "dd"
004B599E |. BA 405B4B00 mov edx, 004B5B40 ; ASCII "date"
004B59A3 |. 8BC6 mov eax, esi
004B59A5 |. 8B38 mov edi, [eax]
004B59A7 |. FF57 04 call [edi+4]
004B59AA |. 8BC6 mov eax, esi
004B59AC |. E8 1BDBF4FF call 004034CC
004B59B1 |. A1 A07B4E00 mov eax, [4E7BA0]
004B59B6 |. 8B00 mov eax, [eax]
004B59B8 |. 8BB0 E4030000 mov esi, [eax+3E4]
004B59BE |. C646 48 01 mov byte ptr [esi+48], 1
004B59C2 |. A1 A07B4E00 mov eax, [4E7BA0]
004B59C7 |. 8D46 68 lea eax, [esi+68]
004B59CA |. BA 505B4B00 mov edx, 004B5B50 ;这里是注册成功分支
004B59CF |. E8 40E9F4FF call 00404314
004B59D4 |. A1 A07B4E00 mov eax, [4E7BA0]
004B59D9 |. 8B00 mov eax, [eax]
004B59DB |. 8B80 E4030000 mov eax, [eax+3E4]
004B59E1 |. 8B10 mov edx, [eax]
004B59E3 |. FF52 30 call [edx+30]
004B59E6 |. A1 A07B4E00 mov eax, [4E7BA0]
004B59EB |. 8B00 mov eax, [eax]
004B59ED |. 8B80 08030000 mov eax, [eax+308]
004B59F3 |. C640 30 01 mov byte ptr [eax+30], 1
004B59F7 |. A1 A07B4E00 mov eax, [4E7BA0]
004B59FC |. 8B00 mov eax, [eax]
004B59FE |. E8 E1D7FBFF call 004731E4
004B5A03 |. BA 645B4B00 mov edx, 004B5B64 ; ASCII "Registered!"
004B5A08 |. 8B83 4C030000 mov eax, [ebx+34C]
004B5A0E |. E8 8D02FAFF call 00455CA0
004B5A13 |. A1 3C784E00 mov eax, [4E783C]
004B5A18 |. C600 01 mov byte ptr [eax], 1
004B5A1B |. 8BC3 mov eax, ebx
004B5A1D |. E8 1AD6FBFF call 0047303C
004B5A22 |> 33C0 xor eax, eax
004B5A24 |. 5A pop edx
004B5A25 |. 59 pop ecx
004B5A26 |. 59 pop ecx
004B5A27 |. 64:8910 mov fs:[eax], edx
004B5A2A |. 68 8B5A4B00 push 004B5A8B
004B5A2F |> 8D45 C4 lea eax, [ebp-3C]
004B5A32 |. E8 89E8F4FF call 004042C0
004B5A37 |. 8D45 C8 lea eax, [ebp-38]
004B5A3A |. BA 02000000 mov edx, 2
004B5A3F |. E8 A0E8F4FF call 004042E4
004B5A44 |. 8D45 D0 lea eax, [ebp-30]
004B5A47 |. BA 03000000 mov edx, 3
004B5A4C |. E8 93E8F4FF call 004042E4
004B5A51 |. 8D45 DC lea eax, [ebp-24]
004B5A54 |. E8 67E8F4FF call 004042C0
004B5A59 |. 8D45 E0 lea eax, [ebp-20]
004B5A5C |. E8 5FE8F4FF call 004042C0
004B5A61 |. 8D45 E4 lea eax, [ebp-1C]
004B5A64 |. E8 57E8F4FF call 004042C0
004B5A69 |. 8D45 E8 lea eax, [ebp-18]
004B5A6C |. BA 03000000 mov edx, 3
004B5A71 |. E8 6EE8F4FF call 004042E4
004B5A76 |. 8D45 F4 lea eax, [ebp-C]
004B5A79 |. BA 03000000 mov edx, 3
004B5A7E |. E8 61E8F4FF call 004042E4
004B5A83 \. C3 retn
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课