注册部分
00401930 55 PUSH EBP
00401931 8BEC MOV EBP, ESP
00401933 81EC A4010000 SUB ESP, 1A4
00401939 53 PUSH EBX
0040193A 56 PUSH ESI
0040193B 8BD9 MOV EBX, ECX
0040193D 57 PUSH EDI
0040193E B9 31000000 MOV ECX, 31
00401943 33C0 XOR EAX, EAX
00401945 8DBD 25FFFFFF LEA EDI, DWORD PTR SS:[EBP-DB]
0040194B C685 24FFFFFF 0>MOV BYTE PTR SS:[EBP-DC], 0
00401952 F3:AB REP STOS DWORD PTR ES:[EDI]
00401954 66:AB STOS WORD PTR ES:[EDI]
00401956 AA STOS BYTE PTR ES:[EDI]
00401957 B9 31000000 MOV ECX, 31
0040195C 33C0 XOR EAX, EAX
0040195E 8DBD 5DFEFFFF LEA EDI, DWORD PTR SS:[EBP-1A3]
00401964 C685 5CFEFFFF 0>MOV BYTE PTR SS:[EBP-1A4], 0
0040196B F3:AB REP STOS DWORD PTR ES:[EDI]
0040196D 66:AB STOS WORD PTR ES:[EDI]
0040196F AA STOS BYTE PTR ES:[EDI]
00401970 8D85 24FFFFFF LEA EAX, DWORD PTR SS:[EBP-DC]
00401976 68 C8000000 PUSH 0C8
0040197B 33F6 XOR ESI, ESI
0040197D 50 PUSH EAX
0040197E 68 EA030000 PUSH 3EA
00401983 8BCB MOV ECX, EBX
00401985 895D EC MOV DWORD PTR SS:[EBP-14], EBX
00401988 8975 FC MOV DWORD PTR SS:[EBP-4], ESI
0040198B E8 C6030000 CALL <JMP.&MFC42.#3098> ; 取注册名
00401990 8D8D 5CFEFFFF LEA ECX, DWORD PTR SS:[EBP-1A4]
00401996 68 C8000000 PUSH 0C8
0040199B 51 PUSH ECX
0040199C 68 EB030000 PUSH 3EB
004019A1 8BCB MOV ECX, EBX
004019A3 E8 AE030000 CALL <JMP.&MFC42.#3098>
004019A8 8DBD 24FFFFFF LEA EDI, DWORD PTR SS:[EBP-DC]
004019AE 83C9 FF OR ECX, FFFFFFFF
004019B1 33C0 XOR EAX, EAX
004019B3 F2:AE REPNE SCAS BYTE PTR ES:[EDI]
004019B5 F7D1 NOT ECX
004019B7 49 DEC ECX
004019B8 8DBD 5CFEFFFF LEA EDI, DWORD PTR SS:[EBP-1A4] ; 取假注册码
004019BE 8BD1 MOV EDX, ECX
004019C0 83C9 FF OR ECX, FFFFFFFF
004019C3 F2:AE REPNE SCAS BYTE PTR ES:[EDI]
004019C5 8A85 24FFFFFF MOV AL, BYTE PTR SS:[EBP-DC]
004019CB 8955 F0 MOV DWORD PTR SS:[EBP-10], EDX
004019CE F7D1 NOT ECX
004019D0 49 DEC ECX ;
004019D1 8B7D FC MOV EDI, DWORD PTR SS:[EBP-4]
004019D4 0FBEC0 MOVSX EAX, AL
004019D7 03F8 ADD EDI, EAX
004019D9 8A8435 25FFFFFF MOV AL, BYTE PTR SS:[EBP+ESI-DB]
004019E0 46 INC ESI
004019E1 897D FC MOV DWORD PTR SS:[EBP-4], EDI
004019E4 84C0 TEST AL, AL
004019E6 ^ 75 E9 JNZ SHORT 004019D1
004019E8 74 03 JE SHORT 004019ED
004019EA 75 01 JNZ SHORT 004019ED
004019EC E8 DB E8
004019ED > 90 NOP
004019EE . 83FE 04 CMP ESI, 4 ; 注册名不能小于4位
004019EC E8 9083FE04 CALL 053E9D81
004019F1 0F8C FD000000 JL 00401AF4
004019F7 83FA 03 CMP EDX, 3
004019FA 7E 76 JLE SHORT 00401A72
004019FC 83F9 08 CMP ECX, 8 ; 注册码位数是否为8位
004019FF 75 71 JNZ SHORT 00401A72
00401A01 74 03 JE SHORT 00401A06
00401A03 75 01 JNZ SHORT 00401A06
00401A05 E8 908B4DF0 CALL F08DA59A
00401A0A 33F6 XOR ESI, ESI
00401A0C 85C9 TEST ECX, ECX
00401A0E BA DECACD5B MOV EDX, 5BCDCADE
00401A13 BB 40310152 MOV EBX, 52013140
00401A18 B8 25100820 MOV EAX, 20081025
00401A1D 7E 50 JLE SHORT 00401A6F
00401A1F EB 09 JMP SHORT 00401A2A
00401A21 8B55 FC MOV EDX, DWORD PTR SS:[EBP-4]
00401A24 8B5D F8 MOV EBX, DWORD PTR SS:[EBP-8]
00401A27 8B45 F4 MOV EAX, DWORD PTR SS:[EBP-C]
00401A2A 0FBE8C35 24FFFF>MOVSX ECX, BYTE PTR SS:[EBP+ESI-DC] ;取用户名第一个字符
00401A32 2BC1 SUB EAX, ECX ;EAX=20081025-68=20080FBD
00401A34 33D9 XOR EBX, ECX ;EBX=52013140^68=52013128
00401A36 8945 F4 MOV DWORD PTR SS:[EBP-C], EAX ;[EBP-C]=20080FBD
00401A39 03D1 ADD EDX, ECX ;EDX=5BCDCADE+68=5BCDCB46
00401A3B 2AC3 SUB AL, BL ;AL=BD-28=95
00401A3D 8955 FC MOV DWORD PTR SS:[EBP-4], EDX ;
00401A40 32C2 XOR AL, DL ;AL=95^46=D3
00401A42 895D F8 MOV DWORD PTR SS:[EBP-8], EBX ;EBX=52013128
00401A45 888435 24FFFFFF MOV BYTE PTR SS:[EBP+ESI-DC], AL ;AL=D3
00401A4C 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4] ;EAX=5BCDCB46
00401A4F C1C8 05 ROR EAX, 5 ;EAX=5BCDCB46 ROR 5=32DE6E5A
00401A52 8945 FC MOV DWORD PTR SS:[EBP-4], EAX
00401A55 8B45 F8 MOV EAX, DWORD PTR SS:[EBP-8] ;EAX=52013128
00401A58 C1C8 0B ROR EAX, 0B ;EAX=52013128 ROR B=250A4026
00401A5B 8945 F8 MOV DWORD PTR SS:[EBP-8], EAX ;
00401A5E 8B45 F4 MOV EAX, DWORD PTR SS:[EBP-C] ;EAX=20080FBD
00401A61 C1C8 0D ROR EAX, 0D ;EAX=20080FBD ROR D=7DE90040
00401A64 8945 F4 MOV DWORD PTR SS:[EBP-C], EAX
00401A67 8B45 F0 MOV EAX, DWORD PTR SS:[EBP-10] ;EAX=5
00401A6A 46 INC ESI ;ESI=1
00401A6B 3BF0 CMP ESI, EAX ;EAX=5,ESI=1
00401A6D ^ 7C B2 JL SHORT 00401A21 ;当ESI=5时循环终止
00401A6F 8B5D EC MOV EBX, DWORD PTR SS:[EBP-14]
00401A72 E8 89FEFFFF CALL 00401900
CALL进入
00401900 /$ 56 PUSH ESI
00401901 |. 33D2 XOR EDX, EDX
00401903 |. B9 34B84800 MOV ECX, 0048B834
00401908 |> 8BC2 /MOV EAX, EDX
0040190A |. BE 08000000 |MOV ESI, 8
0040190F |> A8 01 |/TEST AL, 1
00401911 |. 74 05 ||JE SHORT 00401918
00401913 |. 35 E11F51BA ||XOR EAX, BA511FE1
00401918 |> D1E8 ||SHR EAX, 1
0040191A |. 4E ||DEC ESI
0040191B |.^ 75 F2 |\JNZ SHORT 0040190F ;ESI=8,当ESI=0时循环终止
0040191D |. 8901 |MOV DWORD PTR DS:[ECX], EAX
0040191F |. 83C1 04 |ADD ECX, 4
00401922 |. 42 |INC EDX
00401923 |. 81F9 34BC4800 |CMP ECX, 0048BC34
00401929 |.^ 7C DD \JL SHORT 00401908
0040192B |. 5E POP ESI
0040192C \. C3 RETN
00401A77 8DBD 24FFFFFF LEA EDI, DWORD PTR SS:[EBP-DC]
00401A7D 83C9 FF OR ECX, FFFFFFFF ;ECX=FFFFFFFF
00401A80 33C0 XOR EAX, EAX
00401A82 83CE FF OR ESI, FFFFFFFF ;ESI=FFFFFFFF
00401A85 F2:AE REPNE SCAS BYTE PTR ES:[EDI]
00401A87 F7D1 NOT ECX ;ECX=6
00401A89 49 DEC ECX ;ECX=5,就是用户名位数
00401A8A 8BF9 MOV EDI, ECX
00401A8C 85FF TEST EDI, EDI
00401A8E 7E 2A JLE SHORT 00401ABA
00401A90 74 03 JE SHORT 00401A95
00401A92 75 01 JNZ SHORT 00401A95
00401A96 . 33C9 XOR ECX, ECX
00401A98 . 8BD6 MOV EDX, ESI ;EDX=FFFFFFFF
00401A9A 8A8C05 24FFFFFF MOV CL, BYTE PTR SS:[EBP+EAX-DC] ;CL=D3
00401AA1 81E2 FF000000 AND EDX, 0FF ;EDX=FFFFFFFF AND 0FF=FF
00401AA7 33CA XOR ECX, EDX ;ECX=D3 XOR FF=2C
00401AA9 C1EE 08 SHR ESI, 8 ;ESI逻辑右移8位=00FFFFFF
00401AAC 8B0C8D 34B84800 MOV ECX, DWORD PTR DS:[ECX*4+48B834] ;ECX=4D59608C
00401AB3 33F1 XOR ESI, ECX ;ESI=00FFFFFF XOR 4D59608C=4DA69F73
00401AB5 40 INC EAX ;EAX=1
00401AB6 3BC7 CMP EAX, EDI
00401AB8 ^ 7C D6 JL SHORT 00401A90 ;当EAX=5时循环终止
00401ABA 6A 10 PUSH 10
00401ABC 8D95 5CFEFFFF LEA EDX, DWORD PTR SS:[EBP-1A4] ;假注册码
00401AC2 6A 00 PUSH 0
00401AC4 52 PUSH EDX
00401AC5 FF15 04324000 CALL NEAR DWORD PTR DS:[<&MSVCRT.strtoul>; msvcrt.strtoul
00401ACB 83C4 0C ADD ESP, 0C
00401ACE 74 03 JE SHORT 00401AD3
00401AD0 75 01 JNZ SHORT 00401AD3
00401AD3 > 90 NOP
00401AD4 . F7D6 NOT ESI ;ESI=NOT(248267FB)=DB7D9804
00401AD6 . 3BC6 CMP EAX, ESI ;此时的NOT后的ESI的值EAX比较
实际上EAX的值就是填入的假码
00401AD8 75 1A JNZ SHORT 00401AF4 不跳则注册成功!
00401ADA 6A 00 PUSH 0
DB7D9804
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课