能力值：
( LV2，RANK：10 )
|
-
-
2 楼
感兴趣的继续,
以下的关键,已经可以暴掉了.
00401640 . 83EC 3C sub esp, 3C
00401643 . 53 push ebx
00401644 . 56 push esi
00401645 . 57 push edi
00401646 . 8BD9 mov ebx, ecx
00401648 . 6A 01 push 1
0040164A . E8 65030000 call <jmp.&MFC42.#6334_CWnd::UpdateData>
0040164F . 8B7B 64 mov edi, dword ptr [ebx+64]
00401652 . 8B47 F8 mov eax, dword ptr [edi-8]
00401655 . 83F8 10 cmp eax, 10
00401658 0F85 12010000 jnz 00401770 //nop掉
0040165E . 83C9 FF or ecx, FFFFFFFF
00401661 . 33C0 xor eax, eax
00401663 . F2:AE repne scas byte ptr es:[edi]
00401665 . F7D1 not ecx
00401667 . 2BF9 sub edi, ecx
00401669 . 8D5424 20 lea edx, dword ptr [esp+20]
0040166D . 8BC1 mov eax, ecx
0040166F . 8BF7 mov esi, edi
00401671 . 8BFA mov edi, edx
00401673 . 6A 10 push 10
00401675 . C1E9 02 shr ecx, 2
00401678 . F3:A5 rep movs dword ptr es:[edi], dword ptr [esi]
0040167A . 8BC8 mov ecx, eax
0040167C . 83E1 03 and ecx, 3
0040167F . F3:A4 rep movs byte ptr es:[edi], byte ptr [esi]
00401681 . 8D4C24 24 lea ecx, dword ptr [esp+24]
00401685 . 51 push ecx
00401686 . E8 45FFFFFF call 004015D0
0040168B . 83C4 08 add esp, 8
0040168E . 85C0 test eax, eax
00401690 0F84 DA000000 je 00401770 //nop掉
00401696 . 8B7B 60 mov edi, dword ptr [ebx+60]
00401699 . 83C9 FF or ecx, FFFFFFFF
0040169C . 33C0 xor eax, eax
0040169E . 8D5424 0C lea edx, dword ptr [esp+C]
004016A2 . F2:AE repne scas byte ptr es:[edi]
004016A4 . F7D1 not ecx
004016A6 . 2BF9 sub edi, ecx
004016A8 . 68 83FC0000 push 0FC83
004016AD . 8BC1 mov eax, ecx
004016AF . 8BF7 mov esi, edi
004016B1 . 8BFA mov edi, edx
004016B3 . 6A 0B push 0B
004016B5 . C1E9 02 shr ecx, 2
004016B8 . F3:A5 rep movs dword ptr es:[edi], dword ptr [esi]
004016BA . 8BC8 mov ecx, eax
004016BC . 83E1 03 and ecx, 3
004016BF . F3:A4 rep movs byte ptr es:[edi], byte ptr [esi]
004016C1 . 8D4C24 28 lea ecx, dword ptr [esp+28]
004016C5 . 51 push ecx
004016C6 . E8 45FFFFFF call 00401610
004016CB . 83C4 04 add esp, 4
004016CE . 50 push eax
004016CF . E8 ACFEFFFF call 00401580
004016D4 . 0FBE5424 18 movsx edx, byte ptr [esp+18]
004016D9 . 83C4 0C add esp, 0C
004016DC . 3BC2 cmp eax, edx
004016DE 0F85 8C000000 jnz 00401770 //nop掉
004016E4 . 68 83FC0000 push 0FC83
004016E9 . 8D4424 28 lea eax, dword ptr [esp+28]
004016ED . 6A 0B push 0B
004016EF . 50 push eax
004016F0 . E8 1BFFFFFF call 00401610
004016F5 . 83C4 04 add esp, 4
004016F8 . 50 push eax
004016F9 . E8 82FEFFFF call 00401580
004016FE . 0FBE4C24 19 movsx ecx, byte ptr [esp+19]
00401703 . 83C4 0C add esp, 0C
00401706 . 3BC1 cmp eax, ecx
00401708 75 66 jnz short 00401770 //nop掉
0040170A . 68 83FC0000 push 0FC83
0040170F . 8D5424 2C lea edx, dword ptr [esp+2C]
00401713 . 6A 0B push 0B
00401715 . 52 push edx
00401716 . E8 F5FEFFFF call 00401610
0040171B . 83C4 04 add esp, 4
0040171E . 50 push eax
0040171F . E8 5CFEFFFF call 00401580
00401724 . 0FBE4C24 1A movsx ecx, byte ptr [esp+1A]
00401729 . 83C4 0C add esp, 0C
0040172C . 3BC1 cmp eax, ecx
0040172E 75 40 jnz short 00401770 //nop掉
00401730 . 68 83FC0000 push 0FC83
00401735 . 8D5424 30 lea edx, dword ptr [esp+30]
00401739 . 6A 0B push 0B
0040173B . 52 push edx
0040173C . E8 CFFEFFFF call 00401610
00401741 . 83C4 04 add esp, 4
00401744 . 50 push eax
00401745 . E8 36FEFFFF call 00401580
0040174A . 0FBE4C24 1B movsx ecx, byte ptr [esp+1B]
0040174F . 83C4 0C add esp, 0C
00401752 . 3BC1 cmp eax, ecx
00401754 75 1A jnz short 00401770 //nop掉
00401756 . 6A 00 push 0
00401758 . 68 38304000 push 00403038
0040175D . 68 2C304000 push 0040302C
00401762 . 8BCB mov ecx, ebx
00401764 . E8 45020000 call <jmp.&MFC42.#4224_CWnd::MessageBoxA> ;正确
00401769 . 5F pop edi
0040176A . 5E pop esi
0040176B . 5B pop ebx
0040176C . 83C4 3C add esp, 3C
0040176F . C3 retn
00401770 > 6A 00 push 0
00401772 . 6A 00 push 0
00401774 . 68 20304000 push 00403020
00401779 . 8BCB mov ecx, ebx
0040177B . E8 2E020000 call <jmp.&MFC42.#4224_CWnd::MessageBoxA> ;出错的提示
00401780 . 5F pop edi
00401781 . 5E pop esi
00401782 . 5B pop ebx
00401783 . 83C4 3C add esp, 3C
00401786 . C3 retn
|
能力值：
( LV8，RANK：130 )
|
-
-
4 楼
注册码前四位算法:
设注册码前4位为X,X送Esi,edi初始为1
1、(EDI*ESI)/FC83=0..............X 送EDI
2、 X*X/FC83=Y...................X1送ESI
3、(X*X1)/FC83=Y2................X2送EDI
4、(X1*X1)/FC83=Y3...............X3送ESI
5、(X3*X3)/FC83=Y4...............X4送ESI
6、(X2*X4)/FC83=Y5..............X5送EDI
最后,用X5和注册名第一位的ascii码比较,不等就跳
|
能力值：
( LV8，RANK：130 )
|
-
-
6 楼
a-->5502
c-->EE45
d-->6D82
e-->87DD
f-->867B
g-->C190
h-->60CF
i-->4A07
j-->5018
k-->5DD6
l-->E34A
m-->4479
n-->4AAB
o-->EF1C
p-->7343
q-->DC6D
r-->A117
s-->5912
t-->FC0B
u-->1C2C
v-->4555
w-->2AE9
x-->76BB
y-->822B
z-->E1D2
====================================================================================
上面一组数字,左边为注册名前四位的字符,右边为各字符所对应的注册码,
比如,你的注册名是aaaa,则注册码为5502550255025502
注册名只有前四位有效,前四位按上表所示选出后,后面的自己想怎么写怎么写长度限定为19位,
注册名:qianyicy
注册码:DC6D4A0755024AAB
|
能力值：
( LV8，RANK：130 )
|
-
-
8 楼
....犯了一个小错误,自己潜意识里认为注册码第一位不能为0
补上b对应的注册码
b-->03C0
|
