-
-
[旧帖] [分享]Open Video Converter 3.0.3算法分析--菜菜鸟进，其他人飘 0.00雪花
-
发表于: 2007-9-4 17:12
-
菜鸟学破文的笔记，有错误处请指正
【破文标题】Open Video Converter 3.0.3算法分析
【破文作者】ZHOU2X,lvcaolhx
【作者邮箱】hafiwu@sohu.com
【作者主页】
【破解工具】OD
【破解平台】XPSP2
【软件名称】Open Video Converter 3.0.3
【软件大小】546kb
【原版下载】http://hn.onlinedown.net/soft/27574.htm
【保护方式】注册码
【软件简介】根据ZHOU2X的破文写的详细学习笔记
【破解声明】学习他人的破文，积累经验
------------------------------------------------------------------------
【破解过程】下断点，找字串
00417233 . 55 push ebp
00417234 . 56 push esi
00417235 . 57 push edi
00417236 . BF 01000000 mov edi, 1
0041723B . 57 push edi
0041723C . 8BF1 mov esi, ecx
0041723E . E8 8BC30100 call 004335CE
00417243 . 8B46 70 mov eax, dword ptr [esi+70]//注册名
00417246 . 8B68 F4 mov ebp, dword ptr [eax-C]//注册名长度
00417249 . 83FD 02 cmp ebp, 2//比较注册名长度是否大于2
0041724C . 7D 15 jge short 00417263//大于等于就跳
0041724E . 6A 00 push 0
00417250 . 6A 00 push 0
00417252 . 68 0CAB4400 push 0044AB0C ; please input correct user name!
00417257 . E8 0B620200 call 0043D467
0041725C . 5F pop edi
0041725D . 5E pop esi
0041725E . 5D pop ebp
0041725F . 83C4 0C add esp, 0C
00417262 . C3 retn
00417263 > 8B4E 74 mov ecx, dword ptr [esi+74]//输入的注册码
00417266 . 8379 F4 08 cmp dword ptr [ecx-C], 8//比较注册码是否大于8
0041726A . 7D 15 jge short 00417281
0041726C . 6A 00 push 0
0041726E . 6A 00 push 0
00417270 . 68 E4AA4400 push 0044AAE4 ; please input correct registration code!
00417275 . E8 ED610200 call 0043D467
0041727A . 5F pop edi
0041727B . 5E pop esi
0041727C . 5D pop ebp
0041727D . 83C4 0C add esp, 0C
00417280 . C3 retn
00417281 > 8B46 70 mov eax, dword ptr [esi+70]
00417284 . 8B48 F4 mov ecx, dword ptr [eax-C]
00417287 . 85C9 test ecx, ecx
00417289 . 7D 0A jge short 00417295
0041728B . 68 57000780 push 80070057
00417290 . E8 5BA0FEFF call 004012F0
00417295 > 8A10 mov dl, byte ptr [eax]
00417297 . 8B46 70 mov eax, dword ptr [esi+70]
0041729A . 3978 F4 cmp dword ptr [eax-C], edi
0041729D . 7D 0A jge short 004172A9
0041729F . 68 57000780 push 80070057
004172A4 . E8 47A0FEFF call 004012F0
004172A9 > 8A40 01 mov al, byte ptr [eax+1]
004172AC . 884424 0E mov byte ptr [esp+E], al
004172B0 . 8B46 70 mov eax, dword ptr [esi+70]
004172B3 . 8B48 F4 mov ecx, dword ptr [eax-C]
004172B6 . 85C9 test ecx, ecx
004172B8 . 7D 0A jge short 004172C4
004172BA . 68 57000780 push 80070057
004172BF . E8 2CA0FEFF call 004012F0
004172C4 > 8B4E 70 mov ecx, dword ptr [esi+70]
004172C7 . 53 push ebx
004172C8 . 8A18 mov bl, byte ptr [eax]
004172CA . 3979 F4 cmp dword ptr [ecx-C], edi
004172CD . 7D 0A jge short 004172D9
004172CF . 68 57000780 push 80070057
004172D4 . E8 17A0FEFF call 004012F0
004172D9 > 0FB6C2 movzx eax, dl//取注册名第一位，dl=4B('K')
004172DC . 83C8 41 or eax, 41//注册名第一位字符ASCII码值和16进制数41或运算(4B or 41=4B),运算结果可在下一行代码的FPU窗口中的EAX值中看到(须在调试过程中)
004172DF . 99 cdq//字符扩展，作用是EDX=0可在下一行代码的FPU窗口中的EDX值中看到
004172E0 . BF 0A000000 mov edi, 0A//edi=0A,10进制为10
004172E5 . F7FF idiv edi//注册名第一位字符第一次或运算结果除以10，商为7，余数为5
则EAX=7，EDX=5在下一行代码的FPU窗口中查看EAX，EDX值可看到
004172E7 . 0FB64424 12 movzx eax, byte ptr [esp+12]//取注册名第2位<76('v')>
004172EC . 83C8 56 or eax, 56//注册名第2位字符ASCII码值和16进制数56或运算
结果为16进制数76
004172EF . 885424 16 mov byte ptr [esp+16], dl//保存注册名第一位字符第一次或运算结果除以10的余数，记为余数1，[esp+16]=5,后面要用到[esp+16]
004172F3 . 99 cdq//字符扩展
004172F4 . F7FF idiv edi//注册名第2位字符第一次或运算结果除以10,商为11，余数为8
则EAX=B(11的16进制)，EDX=8
004172F6 . 0FB6C3 movzx eax, bl//取注册名第一位，进行第2次运算
004172F9 . 83C8 49 or eax, 49//注册名第一位字符第2次或运算
结果为16进制数4B
004172FC . 885424 12 mov byte ptr [esp+12], dl//保存注册名第2位字符第1次或运算结果除以10的余数，记为余数2,[esp+12]=8,后面要用到[esp+12]
00417300 . 99 cdq////字符扩展
00417301 . F7FF idiv edi//注册名第一位字符第2次或运算结果除以10，商为7，余数为5
则EAX=7，EDX=5
00417303 . 0FB641 01 movzx eax, byte ptr [ecx+1]//取注册名第二位字符76('v')
00417307 . 83C8 43 or eax, 43//注册名第2位字符ASCII码值和16进制数43或运算
0041730A . 8BCF mov ecx, edi
0041730C . 885424 17 mov byte ptr [esp+17], dl//保存注册名第一位字符第2次或运算结果除以10的余数，记为余数3，[esp+17]=5,后面要用到[esp+17]
00417310 . 99 cdq
00417311 . F7F9 idiv ecx//注册名第2位字符第2次或运算结果除以10,商为11，余数为9
则EAX=B(11的16进制)，EDX=9
00417313 . 33C0 xor eax, eax//清零
00417315 . 33C9 xor ecx, ecx//清零
00417317 . 85ED test ebp, ebp//ebp是否为0
00417319 . 885424 18 mov byte ptr [esp+18], dl//保存注册名第2位字符第2次或运算结果除以10的余数，记为余数4，[esp+18]=9,后面要用到[esp+18]
0041731D . 7E 20 jle short 0041733F
0041731F . 90 nop
00417320 > 85C9 test ecx, ecx
00417322 . 0F8C D2000000 jl 004173FA
00417328 . 8B7E 70 mov edi, dword ptr [esi+70]
0041732B . 3B4F F4 cmp ecx, dword ptr [edi-C]
0041732E . 0F8F C6000000 jg 004173FA
00417334 . 0FB6140F movzx edx, byte ptr [edi+ecx]
00417338 . 03C2 add eax, edx
0041733A . 41 inc ecx
0041733B . 3BCD cmp ecx, ebp
0041733D .^ 7C E1 jl short 00417320
0041733F > 8B4E 74 mov ecx, dword ptr [esi+74]
00417342 . 8B51 F4 mov edx, dword ptr [ecx-C]
00417345 . 85D2 test edx, edx
00417347 . 7D 0A jge short 00417353
00417349 . 68 57000780 push 80070057
0041734E . E8 9D9FFEFF call 004012F0
00417353 > 8A11 mov dl, byte ptr [ecx]
00417355 . 8B4E 74 mov ecx, dword ptr [esi+74]
00417358 . 8379 F4 01 cmp dword ptr [ecx-C], 1
0041735C . 885424 19 mov byte ptr [esp+19], dl
00417360 . 7D 0A jge short 0041736C
00417362 . 68 57000780 push 80070057
00417367 . E8 849FFEFF call 004012F0
0041736C > 8A49 01 mov cl, byte ptr [ecx+1]
0041736F . 8B7E 74 mov edi, dword ptr [esi+74]
00417372 . 884C24 13 mov byte ptr [esp+13], cl
00417376 . 837F F4 02 cmp dword ptr [edi-C], 2
0041737A . 7D 0A jge short 00417386
0041737C . 68 57000780 push 80070057
00417381 . E8 6A9FFEFF call 004012F0
00417386 > 8A4F 02 mov cl, byte ptr [edi+2]
00417389 . 8B7E 74 mov edi, dword ptr [esi+74]
0041738C . 884C24 14 mov byte ptr [esp+14], cl
00417390 . 837F F4 03 cmp dword ptr [edi-C], 3
00417394 . 7D 0A jge short 004173A0
00417396 . 68 57000780 push 80070057
0041739B . E8 509FFEFF call 004012F0
004173A0 > 8A4F 03 mov cl, byte ptr [edi+3]
004173A3 . 8B7E 74 mov edi, dword ptr [esi+74]
004173A6 . 884C24 15 mov byte ptr [esp+15], cl
004173AA . 837F F4 04 cmp dword ptr [edi-C], 4
004173AE . 7D 0A jge short 004173BA
004173B0 . 68 57000780 push 80070057
004173B5 . E8 369FFEFF call 004012F0
004173BA > 8A5F 04 mov bl, byte ptr [edi+4]
004173BD . 8B7E 74 mov edi, dword ptr [esi+74]
004173C0 . 837F F4 05 cmp dword ptr [edi-C], 5
004173C4 . 7D 0A jge short 004173D0
004173C6 . 68 57000780 push 80070057
004173CB . E8 209FFEFF call 004012F0
004173D0 > 8A4F 05 mov cl, byte ptr [edi+5]
004173D3 . 8B7E 74 mov edi, dword ptr [esi+74]
004173D6 . 884C24 1A mov byte ptr [esp+1A], cl
004173DA . 837F F4 06 cmp dword ptr [edi-C], 6
004173DE . 7D 0A jge short 004173EA
004173E0 . 68 57000780 push 80070057
004173E5 . E8 069FFEFF call 004012F0
004173EA > 8A4F 06 mov cl, byte ptr [edi+6]
004173ED . 8B7E 74 mov edi, dword ptr [esi+74]
004173F0 . 884C24 1B mov byte ptr [esp+1B], cl
004173F4 . 837F F4 07 cmp dword ptr [edi-C], 7
004173F8 . 7D 0A jge short 00417404
004173FA > 68 57000780 push 80070057
004173FF . E8 EC9EFEFF call 004012F0
00417404 > 8A4F 07 mov cl, byte ptr [edi+7]
00417407 . 0FB67C24 16 movzx edi, byte ptr [esp+16]//余数1
0041740C . 0FB6D2 movzx edx, dl
0041740F . 83EA 30 sub edx, 30//注册码第1位ASCII码值减16进制数30
00417412 . 3BFA cmp edi, edx//注册码第1位ASCII码值减16进制数30的结果与余数1的值比较
00417414 . 75 48 jnz short 0041745E//不等就跳
00417416 . 0FB65424 13 movzx edx, byte ptr [esp+13]
0041741B . 0FB67C24 12 movzx edi, byte ptr [esp+12]//余数2
00417420 . 83EA 30 sub edx, 30
00417423 . 3BFA cmp edi, edx
00417425 . 75 37 jnz short 0041745E
00417427 . 0FB65424 14 movzx edx, byte ptr [esp+14]
0041742C . 0FB67C24 17 movzx edi, byte ptr [esp+17]//余数3
00417431 . 83EA 30 sub edx, 30
00417434 . 3BFA cmp edi, edx
00417436 . 75 26 jnz short 0041745E
00417438 . 0FB65424 15 movzx edx, byte ptr [esp+15]
0041743D . 0FB67C24 18 movzx edi, byte ptr [esp+18]//余数4
00417442 . 83EA 30 sub edx, 30
00417445 . 3BFA cmp edi, edx
00417447 . 75 15 jnz short 0041745E
00417449 . 99 cdq
0041744A . BF 0A000000 mov edi, 0A
0041744F . F7FF idiv edi
00417451 . 0FB6C2 movzx eax, dl
00417454 . 0FB6D3 movzx edx, bl
00417457 . 83EA 30 sub edx, 30
0041745A . 3BC2 cmp eax, edx
0041745C . 74 38 je short 00417496
0041745E > 807C24 19 35 cmp byte ptr [esp+19], 35//通用注册码518962
00417463 . 0F85 83000000 jnz 004174EC
00417469 . 807C24 13 31 cmp byte ptr [esp+13], 31
0041746E . 75 7C jnz short 004174EC
00417470 . 807C24 14 38 cmp byte ptr [esp+14], 38
00417475 . 75 75 jnz short 004174EC
00417477 . 807C24 15 39 cmp byte ptr [esp+15], 39
0041747C . 75 6E jnz short 004174EC
0041747E . 80FB 37 cmp bl, 37
00417481 . 75 69 jnz short 004174EC
00417483 . 807C24 1A 36 cmp byte ptr [esp+1A], 36
00417488 . 75 62 jnz short 004174EC
0041748A . 807C24 1B 32 cmp byte ptr [esp+1B], 32
0041748F . 75 5B jnz short 004174EC
00417491 . 80F9 39 cmp cl, 39
00417494 . 75 56 jnz short 004174EC
00417496 > 6A 00 push 0
00417498 . 6A 00 push 0
0041749A . 68 C8AA4400 push 0044AAC8 ; registration has succeeded!
0041749F . E8 C35F0200 call 0043D467
------------------------------------------------------------------------
【破解总结】一句话：学得苦，写得更苦!!!!!!!
------------------------------------------------------------------------
【版权声明】本文由ZHOU2X原创，本人添加的详细解释，转载请注明作者并保持完整，Thank You!
【破文标题】Open Video Converter 3.0.3算法分析
【破文作者】ZHOU2X,lvcaolhx
【作者邮箱】hafiwu@sohu.com
【作者主页】
【破解工具】OD
【破解平台】XPSP2
【软件名称】Open Video Converter 3.0.3
【软件大小】546kb
【原版下载】http://hn.onlinedown.net/soft/27574.htm
【保护方式】注册码
【软件简介】根据ZHOU2X的破文写的详细学习笔记
【破解声明】学习他人的破文，积累经验
------------------------------------------------------------------------
【破解过程】下断点，找字串
00417233 . 55 push ebp
00417234 . 56 push esi
00417235 . 57 push edi
00417236 . BF 01000000 mov edi, 1
0041723B . 57 push edi
0041723C . 8BF1 mov esi, ecx
0041723E . E8 8BC30100 call 004335CE
00417243 . 8B46 70 mov eax, dword ptr [esi+70]//注册名
00417246 . 8B68 F4 mov ebp, dword ptr [eax-C]//注册名长度
00417249 . 83FD 02 cmp ebp, 2//比较注册名长度是否大于2
0041724C . 7D 15 jge short 00417263//大于等于就跳
0041724E . 6A 00 push 0
00417250 . 6A 00 push 0
00417252 . 68 0CAB4400 push 0044AB0C ; please input correct user name!
00417257 . E8 0B620200 call 0043D467
0041725C . 5F pop edi
0041725D . 5E pop esi
0041725E . 5D pop ebp
0041725F . 83C4 0C add esp, 0C
00417262 . C3 retn
00417263 > 8B4E 74 mov ecx, dword ptr [esi+74]//输入的注册码
00417266 . 8379 F4 08 cmp dword ptr [ecx-C], 8//比较注册码是否大于8
0041726A . 7D 15 jge short 00417281
0041726C . 6A 00 push 0
0041726E . 6A 00 push 0
00417270 . 68 E4AA4400 push 0044AAE4 ; please input correct registration code!
00417275 . E8 ED610200 call 0043D467
0041727A . 5F pop edi
0041727B . 5E pop esi
0041727C . 5D pop ebp
0041727D . 83C4 0C add esp, 0C
00417280 . C3 retn
00417281 > 8B46 70 mov eax, dword ptr [esi+70]
00417284 . 8B48 F4 mov ecx, dword ptr [eax-C]
00417287 . 85C9 test ecx, ecx
00417289 . 7D 0A jge short 00417295
0041728B . 68 57000780 push 80070057
00417290 . E8 5BA0FEFF call 004012F0
00417295 > 8A10 mov dl, byte ptr [eax]
00417297 . 8B46 70 mov eax, dword ptr [esi+70]
0041729A . 3978 F4 cmp dword ptr [eax-C], edi
0041729D . 7D 0A jge short 004172A9
0041729F . 68 57000780 push 80070057
004172A4 . E8 47A0FEFF call 004012F0
004172A9 > 8A40 01 mov al, byte ptr [eax+1]
004172AC . 884424 0E mov byte ptr [esp+E], al
004172B0 . 8B46 70 mov eax, dword ptr [esi+70]
004172B3 . 8B48 F4 mov ecx, dword ptr [eax-C]
004172B6 . 85C9 test ecx, ecx
004172B8 . 7D 0A jge short 004172C4
004172BA . 68 57000780 push 80070057
004172BF . E8 2CA0FEFF call 004012F0
004172C4 > 8B4E 70 mov ecx, dword ptr [esi+70]
004172C7 . 53 push ebx
004172C8 . 8A18 mov bl, byte ptr [eax]
004172CA . 3979 F4 cmp dword ptr [ecx-C], edi
004172CD . 7D 0A jge short 004172D9
004172CF . 68 57000780 push 80070057
004172D4 . E8 17A0FEFF call 004012F0
004172D9 > 0FB6C2 movzx eax, dl//取注册名第一位，dl=4B('K')
004172DC . 83C8 41 or eax, 41//注册名第一位字符ASCII码值和16进制数41或运算(4B or 41=4B),运算结果可在下一行代码的FPU窗口中的EAX值中看到(须在调试过程中)
004172DF . 99 cdq//字符扩展，作用是EDX=0可在下一行代码的FPU窗口中的EDX值中看到
004172E0 . BF 0A000000 mov edi, 0A//edi=0A,10进制为10
004172E5 . F7FF idiv edi//注册名第一位字符第一次或运算结果除以10，商为7，余数为5
则EAX=7，EDX=5在下一行代码的FPU窗口中查看EAX，EDX值可看到
004172E7 . 0FB64424 12 movzx eax, byte ptr [esp+12]//取注册名第2位<76('v')>
004172EC . 83C8 56 or eax, 56//注册名第2位字符ASCII码值和16进制数56或运算
结果为16进制数76
004172EF . 885424 16 mov byte ptr [esp+16], dl//保存注册名第一位字符第一次或运算结果除以10的余数，记为余数1，[esp+16]=5,后面要用到[esp+16]
004172F3 . 99 cdq//字符扩展
004172F4 . F7FF idiv edi//注册名第2位字符第一次或运算结果除以10,商为11，余数为8
则EAX=B(11的16进制)，EDX=8
004172F6 . 0FB6C3 movzx eax, bl//取注册名第一位，进行第2次运算
004172F9 . 83C8 49 or eax, 49//注册名第一位字符第2次或运算
结果为16进制数4B
004172FC . 885424 12 mov byte ptr [esp+12], dl//保存注册名第2位字符第1次或运算结果除以10的余数，记为余数2,[esp+12]=8,后面要用到[esp+12]
00417300 . 99 cdq////字符扩展
00417301 . F7FF idiv edi//注册名第一位字符第2次或运算结果除以10，商为7，余数为5
则EAX=7，EDX=5
00417303 . 0FB641 01 movzx eax, byte ptr [ecx+1]//取注册名第二位字符76('v')
00417307 . 83C8 43 or eax, 43//注册名第2位字符ASCII码值和16进制数43或运算
0041730A . 8BCF mov ecx, edi
0041730C . 885424 17 mov byte ptr [esp+17], dl//保存注册名第一位字符第2次或运算结果除以10的余数，记为余数3，[esp+17]=5,后面要用到[esp+17]
00417310 . 99 cdq
00417311 . F7F9 idiv ecx//注册名第2位字符第2次或运算结果除以10,商为11，余数为9
则EAX=B(11的16进制)，EDX=9
00417313 . 33C0 xor eax, eax//清零
00417315 . 33C9 xor ecx, ecx//清零
00417317 . 85ED test ebp, ebp//ebp是否为0
00417319 . 885424 18 mov byte ptr [esp+18], dl//保存注册名第2位字符第2次或运算结果除以10的余数，记为余数4，[esp+18]=9,后面要用到[esp+18]
0041731D . 7E 20 jle short 0041733F
0041731F . 90 nop
00417320 > 85C9 test ecx, ecx
00417322 . 0F8C D2000000 jl 004173FA
00417328 . 8B7E 70 mov edi, dword ptr [esi+70]
0041732B . 3B4F F4 cmp ecx, dword ptr [edi-C]
0041732E . 0F8F C6000000 jg 004173FA
00417334 . 0FB6140F movzx edx, byte ptr [edi+ecx]
00417338 . 03C2 add eax, edx
0041733A . 41 inc ecx
0041733B . 3BCD cmp ecx, ebp
0041733D .^ 7C E1 jl short 00417320
0041733F > 8B4E 74 mov ecx, dword ptr [esi+74]
00417342 . 8B51 F4 mov edx, dword ptr [ecx-C]
00417345 . 85D2 test edx, edx
00417347 . 7D 0A jge short 00417353
00417349 . 68 57000780 push 80070057
0041734E . E8 9D9FFEFF call 004012F0
00417353 > 8A11 mov dl, byte ptr [ecx]
00417355 . 8B4E 74 mov ecx, dword ptr [esi+74]
00417358 . 8379 F4 01 cmp dword ptr [ecx-C], 1
0041735C . 885424 19 mov byte ptr [esp+19], dl
00417360 . 7D 0A jge short 0041736C
00417362 . 68 57000780 push 80070057
00417367 . E8 849FFEFF call 004012F0
0041736C > 8A49 01 mov cl, byte ptr [ecx+1]
0041736F . 8B7E 74 mov edi, dword ptr [esi+74]
00417372 . 884C24 13 mov byte ptr [esp+13], cl
00417376 . 837F F4 02 cmp dword ptr [edi-C], 2
0041737A . 7D 0A jge short 00417386
0041737C . 68 57000780 push 80070057
00417381 . E8 6A9FFEFF call 004012F0
00417386 > 8A4F 02 mov cl, byte ptr [edi+2]
00417389 . 8B7E 74 mov edi, dword ptr [esi+74]
0041738C . 884C24 14 mov byte ptr [esp+14], cl
00417390 . 837F F4 03 cmp dword ptr [edi-C], 3
00417394 . 7D 0A jge short 004173A0
00417396 . 68 57000780 push 80070057
0041739B . E8 509FFEFF call 004012F0
004173A0 > 8A4F 03 mov cl, byte ptr [edi+3]
004173A3 . 8B7E 74 mov edi, dword ptr [esi+74]
004173A6 . 884C24 15 mov byte ptr [esp+15], cl
004173AA . 837F F4 04 cmp dword ptr [edi-C], 4
004173AE . 7D 0A jge short 004173BA
004173B0 . 68 57000780 push 80070057
004173B5 . E8 369FFEFF call 004012F0
004173BA > 8A5F 04 mov bl, byte ptr [edi+4]
004173BD . 8B7E 74 mov edi, dword ptr [esi+74]
004173C0 . 837F F4 05 cmp dword ptr [edi-C], 5
004173C4 . 7D 0A jge short 004173D0
004173C6 . 68 57000780 push 80070057
004173CB . E8 209FFEFF call 004012F0
004173D0 > 8A4F 05 mov cl, byte ptr [edi+5]
004173D3 . 8B7E 74 mov edi, dword ptr [esi+74]
004173D6 . 884C24 1A mov byte ptr [esp+1A], cl
004173DA . 837F F4 06 cmp dword ptr [edi-C], 6
004173DE . 7D 0A jge short 004173EA
004173E0 . 68 57000780 push 80070057
004173E5 . E8 069FFEFF call 004012F0
004173EA > 8A4F 06 mov cl, byte ptr [edi+6]
004173ED . 8B7E 74 mov edi, dword ptr [esi+74]
004173F0 . 884C24 1B mov byte ptr [esp+1B], cl
004173F4 . 837F F4 07 cmp dword ptr [edi-C], 7
004173F8 . 7D 0A jge short 00417404
004173FA > 68 57000780 push 80070057
004173FF . E8 EC9EFEFF call 004012F0
00417404 > 8A4F 07 mov cl, byte ptr [edi+7]
00417407 . 0FB67C24 16 movzx edi, byte ptr [esp+16]//余数1
0041740C . 0FB6D2 movzx edx, dl
0041740F . 83EA 30 sub edx, 30//注册码第1位ASCII码值减16进制数30
00417412 . 3BFA cmp edi, edx//注册码第1位ASCII码值减16进制数30的结果与余数1的值比较
00417414 . 75 48 jnz short 0041745E//不等就跳
00417416 . 0FB65424 13 movzx edx, byte ptr [esp+13]
0041741B . 0FB67C24 12 movzx edi, byte ptr [esp+12]//余数2
00417420 . 83EA 30 sub edx, 30
00417423 . 3BFA cmp edi, edx
00417425 . 75 37 jnz short 0041745E
00417427 . 0FB65424 14 movzx edx, byte ptr [esp+14]
0041742C . 0FB67C24 17 movzx edi, byte ptr [esp+17]//余数3
00417431 . 83EA 30 sub edx, 30
00417434 . 3BFA cmp edi, edx
00417436 . 75 26 jnz short 0041745E
00417438 . 0FB65424 15 movzx edx, byte ptr [esp+15]
0041743D . 0FB67C24 18 movzx edi, byte ptr [esp+18]//余数4
00417442 . 83EA 30 sub edx, 30
00417445 . 3BFA cmp edi, edx
00417447 . 75 15 jnz short 0041745E
00417449 . 99 cdq
0041744A . BF 0A000000 mov edi, 0A
0041744F . F7FF idiv edi
00417451 . 0FB6C2 movzx eax, dl
00417454 . 0FB6D3 movzx edx, bl
00417457 . 83EA 30 sub edx, 30
0041745A . 3BC2 cmp eax, edx
0041745C . 74 38 je short 00417496
0041745E > 807C24 19 35 cmp byte ptr [esp+19], 35//通用注册码518962
00417463 . 0F85 83000000 jnz 004174EC
00417469 . 807C24 13 31 cmp byte ptr [esp+13], 31
0041746E . 75 7C jnz short 004174EC
00417470 . 807C24 14 38 cmp byte ptr [esp+14], 38
00417475 . 75 75 jnz short 004174EC
00417477 . 807C24 15 39 cmp byte ptr [esp+15], 39
0041747C . 75 6E jnz short 004174EC
0041747E . 80FB 37 cmp bl, 37
00417481 . 75 69 jnz short 004174EC
00417483 . 807C24 1A 36 cmp byte ptr [esp+1A], 36
00417488 . 75 62 jnz short 004174EC
0041748A . 807C24 1B 32 cmp byte ptr [esp+1B], 32
0041748F . 75 5B jnz short 004174EC
00417491 . 80F9 39 cmp cl, 39
00417494 . 75 56 jnz short 004174EC
00417496 > 6A 00 push 0
00417498 . 6A 00 push 0
0041749A . 68 C8AA4400 push 0044AAC8 ; registration has succeeded!
0041749F . E8 C35F0200 call 0043D467
------------------------------------------------------------------------
【破解总结】一句话：学得苦，写得更苦!!!!!!!
------------------------------------------------------------------------
【版权声明】本文由ZHOU2X原创，本人添加的详细解释，转载请注明作者并保持完整，Thank You!
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
