acafeel的CrackMe算法详细分析-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

acafeel的CrackMe算法详细分析

2004-12-27 16:48 8359

acafeel的CrackMe算法详细分析

小虾

2004-12-27 16:48

8359

废话我就不多说了，我就直奔主题吧。

呵呵，首先，因为这个CrackMe加了壳，所以我们先将他的壳去掉。
//外壳入口，第一层外壳，往下拉动滚动条，找到RETN子程序返回语句。

004B5000 >  9C              PUSHFD
004B5001    60              PUSHAD
004B5002    8B4424 24       MOV EAX,DWORD PTR SS:[ESP+24]
004B5006    E8 00000000     CALL CRACKME1.004B500B
004B500B    5D              POP EBP
004B500C    81ED 351C4000   SUB EBP,CRACKME1.00401C35
004B5012    50              PUSH EAX
004B5013    E8 ED020000     CALL CRACKME1.004B5305
004B5018    85C0            TEST EAX,EAX
004B501A    0F84 B3000000   JE CRACKME1.004B50D3
004B5020    8985 9C224000   MOV DWORD PTR SS:[EBP+40229C],EAX
004B5026    E8 95030000     CALL CRACKME1.004B53C0
004B502B    85C0            TEST EAX,EAX
004B502D    0F84 87000000   JE CRACKME1.004B50BA
004B5033    6A 00           PUSH 0
004B5035    FF95 D7214000   CALL DWORD PTR SS:[EBP+4021D7]
004B503B    8985 AC224000   MOV DWORD PTR SS:[EBP+4022AC],EAX
004B5041    80BD B0224000 0>CMP BYTE PTR SS:[EBP+4022B0],1
004B5048    0F85 86000000   JNZ CRACKME1.004B50D4
004B504E    E8 9E010000     CALL CRACKME1.004B51F1
004B5053    85C0            TEST EAX,EAX
004B5055    74 63           JE SHORT CRACKME1.004B50BA
004B5057    E8 C4010000     CALL CRACKME1.004B5220
004B505C    E8 DE030000     CALL CRACKME1.004B543F
004B5061    85C0            TEST EAX,EAX
004B5063    74 3D           JE SHORT CRACKME1.004B50A2
004B5065    FFB5 A4224000   PUSH DWORD PTR SS:[EBP+4022A4]
004B506B    6A 00           PUSH 0
004B506D    68 72010000     PUSH 172
004B5072    FFB5 A0224000   PUSH DWORD PTR SS:[EBP+4022A0]
004B5078    FF95 66224000   CALL DWORD PTR SS:[EBP+402266]
004B507E    FFB5 A0224000   PUSH DWORD PTR SS:[EBP+4022A0]
004B5084    FF95 77224000   CALL DWORD PTR SS:[EBP+402277]
004B508A    FFB5 A8224000   PUSH DWORD PTR SS:[EBP+4022A8]
004B5090    FF95 C2214000   CALL DWORD PTR SS:[EBP+4021C2]
004B5096    FFB5 A0224000   PUSH DWORD PTR SS:[EBP+4022A0]
004B509C    FF95 28224000   CALL DWORD PTR SS:[EBP+402228]
004B50A2    FFB5 A4224000   PUSH DWORD PTR SS:[EBP+4022A4]
004B50A8    FF95 AA214000   CALL DWORD PTR SS:[EBP+4021AA]
004B50AE    FFB5 98224000   PUSH DWORD PTR SS:[EBP+402298]
004B50B4    FF95 F6214000   CALL DWORD PTR SS:[EBP+4021F6]
004B50BA    8B85 AC224000   MOV EAX,DWORD PTR SS:[EBP+4022AC]
004B50C0    0385 94224000   ADD EAX,DWORD PTR SS:[EBP+402294]
004B50C6    8985 F91C4000   MOV DWORD PTR SS:[EBP+401CF9],EAX
004B50CC    61              POPAD
004B50CD    9D              POPFD
004B50CE    68 00000000     PUSH 0
004B50D3    C3              RETN      //在这里下一个断点，F9运行程序将中断在这里

//返回到这里，和上面一样，往下拉到滚动条，找到第一个JMP语句就行。

004B4000    90              NOP
004B4001    90              NOP
004B4002    90              NOP
004B4003    90              NOP
............................... //省略一大段NOP语句，
...............................
004B41A6    90              NOP
004B41A7    90              NOP
004B41A8    90              NOP
004B41A9  - E9 32D1FFFF     JMP CRACKME1.004B12E0  //到这里，在这里下一个断点，F9运行程序将中断在这里。

//接着到这里，这是UPX的外壳，也是最后一层壳，UPX也很好脱，还是和前面一样，往下拉动滚动条到下面，找到POPAD语句就是跳向程序入口的OEP处。

004B12E0    60              PUSHAD
004B12E1    BE 00104700     MOV ESI,CRACKME1.00471000
004B12E6    8DBE 0000F9FF   LEA EDI,DWORD PTR DS:[ESI+FFF90000]
004B12EC    C787 D0240900 7>MOV DWORD PTR DS:[EDI+924D0],484B2170
004B12F6    57              PUSH EDI
004B12F7    83CD FF         OR EBP,FFFFFFFF
004B12FA    EB 0E           JMP SHORT CRACKME1.004B130A
004B12FC    90              NOP
004B12FD    90              NOP
004B12FE    90              NOP
004B12FF    90              NOP
004B1300    8A06            MOV AL,BYTE PTR DS:[ESI]
004B1302    46              INC ESI
004B1303    8807            MOV BYTE PTR DS:[EDI],AL
004B1305    47              INC EDI
004B1306    01DB            ADD EBX,EBX
004B1308    75 07           JNZ SHORT CRACKME1.004B1311
004B130A    8B1E            MOV EBX,DWORD PTR DS:[ESI]
004B130C    83EE FC         SUB ESI,-4
004B130F    11DB            ADC EBX,EBX
004B1311  ^ 72 ED           JB SHORT CRACKME1.004B1300
004B1313    B8 01000000     MOV EAX,1
004B1318    01DB            ADD EBX,EBX
004B131A    75 07           JNZ SHORT CRACKME1.004B1323
004B131C    8B1E            MOV EBX,DWORD PTR DS:[ESI]
004B131E    83EE FC         SUB ESI,-4
004B1321    11DB            ADC EBX,EBX
004B1323    11C0            ADC EAX,EAX
004B1325    01DB            ADD EBX,EBX
004B1327    73 0B           JNB SHORT CRACKME1.004B1334
004B1329    75 19           JNZ SHORT CRACKME1.004B1344
004B132B    8B1E            MOV EBX,DWORD PTR DS:[ESI]
004B132D    83EE FC         SUB ESI,-4
004B1330    11DB            ADC EBX,EBX
004B1332    72 10           JB SHORT CRACKME1.004B1344
004B1334    48              DEC EAX
004B1335    01DB            ADD EBX,EBX
004B1337    75 07           JNZ SHORT CRACKME1.004B1340
004B1339    8B1E            MOV EBX,DWORD PTR DS:[ESI]
004B133B    83EE FC         SUB ESI,-4
004B133E    11DB            ADC EBX,EBX
004B1340    11C0            ADC EAX,EAX
004B1342  ^ EB D4           JMP SHORT CRACKME1.004B1318
004B1344    31C9            XOR ECX,ECX
004B1346    83E8 03         SUB EAX,3
004B1349    72 11           JB SHORT CRACKME1.004B135C
004B134B    C1E0 08         SHL EAX,8
004B134E    8A06            MOV AL,BYTE PTR DS:[ESI]
004B1350    46              INC ESI
004B1351    83F0 FF         XOR EAX,FFFFFFFF
004B1354    74 78           JE SHORT CRACKME1.004B13CE
004B1356    D1F8            SAR EAX,1
004B1358    89C5            MOV EBP,EAX
004B135A    EB 0B           JMP SHORT CRACKME1.004B1367
004B135C    01DB            ADD EBX,EBX
004B135E    75 07           JNZ SHORT CRACKME1.004B1367
004B1360    8B1E            MOV EBX,DWORD PTR DS:[ESI]
004B1362    83EE FC         SUB ESI,-4
004B1365    11DB            ADC EBX,EBX
004B1367    11C9            ADC ECX,ECX
004B1369    01DB            ADD EBX,EBX
004B136B    75 07           JNZ SHORT CRACKME1.004B1374
004B136D    8B1E            MOV EBX,DWORD PTR DS:[ESI]
004B136F    83EE FC         SUB ESI,-4
004B1372    11DB            ADC EBX,EBX
004B1374    11C9            ADC ECX,ECX
004B1376    75 20           JNZ SHORT CRACKME1.004B1398
004B1378    41              INC ECX
004B1379    01DB            ADD EBX,EBX
004B137B    75 07           JNZ SHORT CRACKME1.004B1384
004B137D    8B1E            MOV EBX,DWORD PTR DS:[ESI]
004B137F    83EE FC         SUB ESI,-4
004B1382    11DB            ADC EBX,EBX
004B1384    11C9            ADC ECX,ECX
004B1386    01DB            ADD EBX,EBX
004B1388  ^ 73 EF           JNB SHORT CRACKME1.004B1379
004B138A    75 09           JNZ SHORT CRACKME1.004B1395
004B138C    8B1E            MOV EBX,DWORD PTR DS:[ESI]
004B138E    83EE FC         SUB ESI,-4
004B1391    11DB            ADC EBX,EBX
004B1393  ^ 73 E4           JNB SHORT CRACKME1.004B1379
004B1395    83C1 02         ADD ECX,2
004B1398    81FD 00FBFFFF   CMP EBP,-500
004B139E    83D1 01         ADC ECX,1
004B13A1    8D142F          LEA EDX,DWORD PTR DS:[EDI+EBP]
004B13A4    83FD FC         CMP EBP,-4
004B13A7    76 0F           JBE SHORT CRACKME1.004B13B8
004B13A9    8A02            MOV AL,BYTE PTR DS:[EDX]
004B13AB    42              INC EDX
004B13AC    8807            MOV BYTE PTR DS:[EDI],AL
004B13AE    47              INC EDI
004B13AF    49              DEC ECX
004B13B0  ^ 75 F7           JNZ SHORT CRACKME1.004B13A9
004B13B2  ^ E9 4FFFFFFF     JMP CRACKME1.004B1306
004B13B7    90              NOP
004B13B8    8B02            MOV EAX,DWORD PTR DS:[EDX]
004B13BA    83C2 04         ADD EDX,4
004B13BD    8907            MOV DWORD PTR DS:[EDI],EAX
004B13BF    83C7 04         ADD EDI,4
004B13C2    83E9 04         SUB ECX,4
004B13C5  ^ 77 F1           JA SHORT CRACKME1.004B13B8
004B13C7    01CF            ADD EDI,ECX
004B13C9  ^ E9 38FFFFFF     JMP CRACKME1.004B1306
004B13CE    5E              POP ESI
004B13CF    89F7            MOV EDI,ESI
004B13D1    B9 A6470000     MOV ECX,47A6
004B13D6    8A07            MOV AL,BYTE PTR DS:[EDI]
004B13D8    47              INC EDI
004B13D9    2C E8           SUB AL,0E8
004B13DB    3C 01           CMP AL,1
004B13DD  ^ 77 F7           JA SHORT CRACKME1.004B13D6
004B13DF    803F 19         CMP BYTE PTR DS:[EDI],19
004B13E2  ^ 75 F2           JNZ SHORT CRACKME1.004B13D6
004B13E4    8B07            MOV EAX,DWORD PTR DS:[EDI]
004B13E6    8A5F 04         MOV BL,BYTE PTR DS:[EDI+4]
004B13E9    66:C1E8 08      SHR AX,8
004B13ED    C1C0 10         ROL EAX,10
004B13F0    86C4            XCHG AH,AL
004B13F2    29F8            SUB EAX,EDI
004B13F4    80EB E8         SUB BL,0E8
004B13F7    01F0            ADD EAX,ESI
004B13F9    8907            MOV DWORD PTR DS:[EDI],EAX
004B13FB    83C7 05         ADD EDI,5
004B13FE    89D8            MOV EAX,EBX
004B1400  ^ E2 D9           LOOPD SHORT CRACKME1.004B13DB
004B1402    8DBE 00E00A00   LEA EDI,DWORD PTR DS:[ESI+AE000]
004B1408    8B07            MOV EAX,DWORD PTR DS:[EDI]
004B140A    09C0            OR EAX,EAX
004B140C    74 3C           JE SHORT CRACKME1.004B144A
004B140E    8B5F 04         MOV EBX,DWORD PTR DS:[EDI+4]
004B1411    8D8430 30200B00 LEA EAX,DWORD PTR DS:[EAX+ESI+B2030]
004B1418    01F3            ADD EBX,ESI
004B141A    50              PUSH EAX
004B141B    83C7 08         ADD EDI,8
004B141E    FF96 F8200B00   CALL DWORD PTR DS:[ESI+B20F8]
004B1424    95              XCHG EAX,EBP
004B1425    8A07            MOV AL,BYTE PTR DS:[EDI]
004B1427    47              INC EDI
004B1428    08C0            OR AL,AL
004B142A  ^ 74 DC           JE SHORT CRACKME1.004B1408
004B142C    89F9            MOV ECX,EDI
004B142E    57              PUSH EDI
004B142F    48              DEC EAX
004B1430    F2:AE           REPNE SCAS BYTE PTR ES:[EDI]
004B1432    55              PUSH EBP
004B1433    FF96 FC200B00   CALL DWORD PTR DS:[ESI+B20FC]
004B1439    09C0            OR EAX,EAX
004B143B    74 07           JE SHORT CRACKME1.004B1444
004B143D    8903            MOV DWORD PTR DS:[EBX],EAX
004B143F    83C3 04         ADD EBX,4
004B1442  ^ EB E1           JMP SHORT CRACKME1.004B1425
004B1444    FF96 00210B00   CALL DWORD PTR DS:[ESI+B2100]
004B144A    61              POPAD    //到这里，下一个断点，F9运行程序将中断在这里。
004B144B  ^ E9 A8EBFDFF     JMP CRACKME1.0048FFF8  //跨段跳，跳到程序入口。

//程序入口点，在这里用OD插件Dump下来，再用ImpERC软件修复一下就行。本来我脱这个壳的目的是为了方便OD跟踪的，但一听说楼主有自验效，偶就不敢用他来调试了，嘿嘿!不过，偶还是有办法，偶就不脱他的壳直接带壳调试了（估计楼主加壳就是为了自验效:D）。脱壳后的文件我可以用来使用DeDe反汇编以方便动态跟踪。^Q^

0048FFF8    55              PUSH EBP
0048FFF9    8BEC            MOV EBP,ESP
0048FFFB    83C4 F4         ADD ESP,-0C
0048FFFE    B8 18FE4800     MOV EAX,CRACKME1.0048FE18
00490003    E8 6C65F7FF     CALL CRACKME1.00406574
00490008    A1 6C234900     MOV EAX,DWORD PTR DS:[49236C]
0049000D    8B00            MOV EAX,DWORD PTR DS:[EAX]
0049000F    E8 D890FAFF     CALL CRACKME1.004390EC
00490014    E8 FFFCFFFF     CALL CRACKME1.0048FD18
00490019    84C0            TEST AL,AL
0049001B    74 0E           JE SHORT CRACKME1.0049002B
0049001D    A1 6C234900     MOV EAX,DWORD PTR DS:[49236C]
00490022    8B00            MOV EAX,DWORD PTR DS:[EAX]
00490024    E8 0F92FAFF     CALL CRACKME1.00439238
00490029    EB 24           JMP SHORT CRACKME1.0049004F
0049002B    8B0D 6C244900   MOV ECX,DWORD PTR DS:[49246C]            ; CRACKME1.0049393C
00490031    A1 6C234900     MOV EAX,DWORD PTR DS:[49236C]
00490036    8B00            MOV EAX,DWORD PTR DS:[EAX]
00490038    8B15 68F24800   MOV EDX,DWORD PTR DS:[48F268]            ; CRACKME1.0048F2B4
0049003E    E8 C190FAFF     CALL CRACKME1.00439104
00490043    A1 6C234900     MOV EAX,DWORD PTR DS:[49236C]
00490048    8B00            MOV EAX,DWORD PTR DS:[EAX]
0049004A    E8 3591FAFF     CALL CRACKME1.00439184
0049004F    E8 5839F7FF     CALL CRACKME1.004039AC
00490054    0000            ADD BYTE PTR DS:[EAX],AL
00490056    0000            ADD BYTE PTR DS:[EAX],AL
00490058    0000            ADD BYTE PTR DS:[EAX],AL
0049005A    0000            ADD BYTE PTR DS:[EAX],AL

//现在我们用DeDe反汇编脱壳后的文件，看看有什么蛛丝马迹(注意，我使用的是小黑的修改版DeDe，原版无法反汇编加过壳的程序，小黑修改版DeDe你们可以去零度地带主页上下载。)，我在DeDe里看到了三个“比较”有用的过程。^_^
//第一个过程：BUTTON1过程。不过看了一下，发现这个过程跟本没有对我们的注册码和用户名进行过运算，只是将我们的用户名和注册码写入注册表而已，OK，我们不用去管这个过程了。

0048FB2C   55                     push    ebp
0048FB2D   8BEC                   mov     ebp, esp
0048FB2F   6A00                   push    $00
0048FB31   6A00                   push    $00
0048FB33   6A00                   push    $00
0048FB35   33C0                   xor     eax, eax
0048FB37   55                     push    ebp
0048FB38   68E5FB4800             push    $0048FBE5

***** TRY
|
0048FB3D   64FF30                 push    dword ptr fs:[eax]
0048FB40   648920                 mov     fs:[eax], esp
0048FB43   8D55FC                 lea     edx, [ebp-$04]
0048FB46   A13C394900             mov     eax, dword ptr [$0049393C]

* Reference to control Edit1 : TEdit
|
0048FB4B   8B80D8020000           mov     eax, [eax+$02D8]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
0048FB51   E89670FBFF             call    00446BEC
0048FB56   8B45FC                 mov     eax, [ebp-$04]
0048FB59   50                     push    eax

* Possible String Reference to: 'name'
|
0048FB5A   B9F8FB4800             mov     ecx, $0048FBF8

* Possible String Reference to: 'Reg'
|
0048FB5F   BA08FC4800             mov     edx, $0048FC08
0048FB64   A144394900             mov     eax, dword ptr [$00493944]

* Reference to: registry.TRegIniFile.WriteString(TRegIniFile;AnsiString;AnsiString;AnsiString);
|
0048FB69   E8E2F5FFFF             call    0048F150
0048FB6E   8D55F8                 lea     edx, [ebp-$08]
0048FB71   A13C394900             mov     eax, dword ptr [$0049393C]

* Reference to control Edit2 : TEdit
|
0048FB76   8B80E0020000           mov     eax, [eax+$02E0]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
0048FB7C   E86B70FBFF             call    00446BEC
0048FB81   8B45F8                 mov     eax, [ebp-$08]
0048FB84   50                     push    eax

* Possible String Reference to: 'code'
|
0048FB85   B914FC4800             mov     ecx, $0048FC14

* Possible String Reference to: 'Reg'
|
0048FB8A   BA08FC4800             mov     edx, $0048FC08
0048FB8F   A144394900             mov     eax, dword ptr [$00493944]

* Reference to: registry.TRegIniFile.WriteString(TRegIniFile;AnsiString;AnsiString;AnsiString);
|
0048FB94   E8B7F5FFFF             call    0048F150
0048FB99   6A01                   push    $01
0048FB9B   8D55F4                 lea     edx, [ebp-$0C]
0048FB9E   A16C234900             mov     eax, dword ptr [$0049236C]
0048FBA3   8B00                   mov     eax, [eax]

* Reference to: ddeman.TDdeMgr.GetExeName(TDdeMgr):AnsiString;
|           or: forms.TApplication.GetExeName(TApplication):AnsiString;
|
0048FBA5   E8A29AFAFF             call    0043964C
0048FBAA   8B45F4                 mov     eax, [ebp-$0C]

* Reference to: system.@LStrToPChar;
|
0048FBAD   E87643F7FF             call    00403F28
0048FBB2   50                     push    eax

* Reference to: Y.WinExec()
|
0048FBB3   E8386CF7FF             call    004067F0
0048FBB8   A13C394900             mov     eax, dword ptr [$0049393C]

* Reference to: forms.TCustomForm.Close(TCustomForm);
|
0048FBBD   E8D663FAFF             call    00435F98
0048FBC2   33C0                   xor     eax, eax
0048FBC4   5A                     pop     edx
0048FBC5   59                     pop     ecx
0048FBC6   59                     pop     ecx
0048FBC7   648910                 mov     fs:[eax], edx

****** FINALLY
|
0048FBCA   68ECFB4800             push    $0048FBEC
0048FBCF   8D45F4                 lea     eax, [ebp-$0C]

* Reference to: system.@LStrClr(String;String);
|
0048FBD2   E80D3FF7FF             call    00403AE4
0048FBD7   8D45F8                 lea     eax, [ebp-$08]
0048FBDA   BA02000000             mov     edx, $00000002

* Reference to: system.@LStrArrayClr;
|
0048FBDF   E8243FF7FF             call    00403B08
0048FBE4   C3                     ret


* Reference to: system.@HandleFinally;
|
0048FBE5   E99239F7FF             jmp     0040357C
0048FBEA   EBE3                   jmp     0048FBCF

****** END
|
0048FBEC   8BE5                   mov     esp, ebp
0048FBEE   5D                     pop     ebp
0048FBEF   C3                     ret

//呵呵~~！我们来看看第二个过程（注意：这个过程是启动时运行的），不过我发现这个过程也没有什么用，只是将我们的用户名和注册码取出来而已，OK，这个过程我们也不用管了。了。

0048F574   55                     push    ebp
0048F575   8BEC                   mov     ebp, esp
0048F577   6A00                   push    $00
0048F579   6A00                   push    $00
0048F57B   33C0                   xor     eax, eax
0048F57D   55                     push    ebp

* Possible String Reference to: '轱??腚YY]?
|
0048F57E   6808F64800             push    $0048F608

***** TRY
|
0048F583   64FF30                 push    dword ptr fs:[eax]
0048F586   648920                 mov     fs:[eax], esp

* Possible String Reference to: 'Software\aCaFeeL\CrackMe'
|
0048F589   B91CF64800             mov     ecx, $0048F61C
0048F58E   B201                   mov     dl, $01
0048F590   A108E94800             mov     eax, dword ptr [$0048E908]

* Reference to: registry.TRegIniFile.Create(TRegIniFile;boolean;AnsiString);overload;
|           or: registry.TRegistryIniFile.Create(TRegistryIniFile;boolean;AnsiString);overload;
|
0048F595   E856FAFFFF             call    0048EFF0
0048F59A   A344394900             mov     dword ptr [$00493944], eax
0048F59F   6A00                   push    $00
0048F5A1   8D45FC                 lea     eax, [ebp-$04]
0048F5A4   50                     push    eax

* Possible String Reference to: 'name'
|
0048F5A5   B940F64800             mov     ecx, $0048F640

* Possible String Reference to: 'Reg'
|
0048F5AA   BA50F64800             mov     edx, $0048F650
0048F5AF   A144394900             mov     eax, dword ptr [$00493944]

* Reference to: registry.TRegIniFile.ReadString(TRegIniFile;AnsiString;AnsiString;AnsiString):AnsiString;
|
0048F5B4   E8CBFAFFFF             call    0048F084
0048F5B9   8B55FC                 mov     edx, [ebp-$04]
0048F5BC   B848394900             mov     eax, $00493948

* Reference to: system.@LStrAsg;
|
0048F5C1   E87245F7FF             call    00403B38
0048F5C6   6A00                   push    $00
0048F5C8   8D45F8                 lea     eax, [ebp-$08]
0048F5CB   50                     push    eax

* Possible String Reference to: 'code'
|
0048F5CC   B95CF64800             mov     ecx, $0048F65C

* Possible String Reference to: 'Reg'
|
0048F5D1   BA50F64800             mov     edx, $0048F650
0048F5D6   A144394900             mov     eax, dword ptr [$00493944]

* Reference to: registry.TRegIniFile.ReadString(TRegIniFile;AnsiString;AnsiString;AnsiString):AnsiString;
|
0048F5DB   E8A4FAFFFF             call    0048F084
0048F5E0   8B55F8                 mov     edx, [ebp-$08]
0048F5E3   B84C394900             mov     eax, $0049394C

* Reference to: system.@LStrAsg;
|
0048F5E8   E84B45F7FF             call    00403B38
0048F5ED   33C0                   xor     eax, eax
0048F5EF   5A                     pop     edx
0048F5F0   59                     pop     ecx
0048F5F1   59                     pop     ecx
0048F5F2   648910                 mov     fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: 'YY]?
|
0048F5F5   680FF64800             push    $0048F60F
0048F5FA   8D45F8                 lea     eax, [ebp-$08]
0048F5FD   BA02000000             mov     edx, $00000002

* Reference to: system.@LStrArrayClr;
|
0048F602   E80145F7FF             call    00403B08
0048F607   C3                     ret


* Reference to: system.@HandleFinally;
|
0048F608   E96F3FF7FF             jmp     0040357C
0048F60D   EBEB                   jmp     0048F5FA

****** END
|
0048F60F   59                     pop     ecx
0048F610   59                     pop     ecx
0048F611   5D                     pop     ebp
0048F612   C3                     ret

//最后，我们来到最后一个过程，这个过程是关键过程（注意：这个过程也是程序启动时运行的），现在我们来看看他进行什么操作^Q^。

0048F848   55                     push    ebp
0048F849   8BEC                   mov     ebp, esp
0048F84B   33C9                   xor     ecx, ecx
0048F84D   51                     push    ecx
0048F84E   51                     push    ecx
0048F84F   51                     push    ecx
0048F850   51                     push    ecx
0048F851   51                     push    ecx
0048F852   51                     push    ecx
0048F853   51                     push    ecx
0048F854   51                     push    ecx
0048F855   53                     push    ebx
0048F856   56                     push    esi
0048F857   57                     push    edi
0048F858   8945FC                 mov     [ebp-$04], eax
0048F85B   33C0                   xor     eax, eax
0048F85D   55                     push    ebp
0048F85E   686EFA4800             push    $0048FA6E

//注册SEH异常，我们不管他
***** TRY
|
0048F863   64FF30                 push    dword ptr fs:[eax]
0048F866   648920                 mov     fs:[eax], esp
0048F869   BFF7000000             mov     edi, $000000F7
0048F86E   8D45F8                 lea     eax, [ebp-$08]

//下面是解密“?┴?1”字符，。。。。。。忘了是解密什么了，不过也不是很重要的。^_^
* Possible String Reference to: '?┴?1'
|
0048F871   BA84FA4800             mov     edx, $0048FA84

* Reference to: system.@LStrLAsg;
|
0048F876   E80143F7FF             call    00403B7C
0048F87B   8B45F8                 mov     eax, [ebp-$08]

* Reference to: system.@LStrLen:Integer;
|           or: system.@DynArrayLength;
|           or: system.DynArraySize(Pointer):Integer;
|
0048F87E   E8E144F7FF             call    00403D64
0048F883   8BF0                   mov     esi, eax
0048F885   85F6                   test    esi, esi
0048F887   7E1F                   jle     0048F8A8
0048F889   BB01000000             mov     ebx, $00000001
0048F88E   8D45F8                 lea     eax, [ebp-$08]

* Reference to: system.UniqueString(String;String);
|
0048F891   E89E46F7FF             call    00403F34
0048F896   8B55F8                 mov     edx, [ebp-$08]
0048F899   0FB6541AFF             movzx   edx, byte ptr [edx+ebx-$01] //开始解密字符。
0048F89E   2BD7                   sub     edx, edi
0048F8A0   885418FF               mov     [eax+ebx-$01], dl
0048F8A4   43                     inc     ebx
0048F8A5   4E                     dec     esi
0048F8A6   75E6                   jnz     0048F88E
0048F8A8   8D45F8                 lea     eax, [ebp-$08]
0048F8AB   8B55F8                 mov     edx, [ebp-$08]


* Reference to: system.@LStrLAsg;
|
0048F8AE   E8C942F7FF             call    00403B7C
0048F8B3   8D45F4                 lea     eax, [ebp-$0C]
0048F8B6   BA94FA4800             mov     edx, $0048FA94

* Reference to: system.@LStrLAsg;
|
0048F8BB   E8BC42F7FF             call    00403B7C
0048F8C0   8B45F4                 mov     eax, [ebp-$0C]

* Reference to: system.@LStrLen:Integer;
|           or: system.@DynArrayLength;
|           or: system.DynArraySize(Pointer):Integer;
|
0048F8C3   E89C44F7FF             call    00403D64
0048F8C8   8BF0                   mov     esi, eax
0048F8CA   85F6                   test    esi, esi
0048F8CC   7E1F                   jle     0048F8ED
0048F8CE   BB01000000             mov     ebx, $00000001
0048F8D3   8D45F4                 lea     eax, [ebp-$0C]

* Reference to: system.UniqueString(String;String);
|
0048F8D6   E85946F7FF             call    00403F34
0048F8DB   8B55F4                 mov     edx, [ebp-$0C]
0048F8DE   0FB6541AFF             movzx   edx, byte ptr [edx+ebx-$01]
0048F8E3   2BD7                   sub     edx, edi
0048F8E5   885418FF               mov     [eax+ebx-$01], dl
0048F8E9   43                     inc     ebx
0048F8EA   4E                     dec     esi
0048F8EB   75E6                   jnz     0048F8D3
0048F8ED   8D45F4                 lea     eax, [ebp-$0C]
0048F8F0   8B55F4                 mov     edx, [ebp-$0C]

* Reference to: system.@LStrLAsg;
|
0048F8F3   E88442F7FF             call    00403B7C
0048F8F8   8B45FC                 mov     eax, [ebp-$04]

* Reference to control FLabel1 : TFLabel
|
0048F8FB   8B9804030000           mov     ebx, [eax+$0304]
0048F901   80BB3801000001         cmp     byte ptr [ebx+$0138], $01
0048F908   7519                   jnz     0048F923   //这个跳转不用去管他。
0048F90A   8D55F0                 lea     edx, [ebp-$10]
0048F90D   8BC3                   mov     eax, ebx

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
0048F90F   E8D872FBFF             call    00446BEC
0048F914   8B45F0                 mov     eax, [ebp-$10]

* Possible String Reference to: '尚未注册的版本！'
|
0048F917   BAACFA4800             mov     edx, $0048FAAC

* Reference to: system.@LStrCmp;
|
0048F91C   E85345F7FF             call    00403E74
0048F921   7411                   jz      0048F934  //这个跳转也不用去管他
0048F923   A16C234900             mov     eax, dword ptr [$0049236C]
0048F928   8B00                   mov     eax, [eax]

* Reference to: forms.TApplication.Terminate(TApplication);
|
0048F92A   E80999FAFF             call    00439238
0048F92F   E98C000000             jmp     0048F9C0
0048F934   8D55EC                 lea     edx, [ebp-$14]
0048F937   A148394900             mov     eax, dword ptr [$00493948]

//嘿嘿关键的地方终于到了。:D
|
0048F93C   E823FDFFFF             call    0048F664  //关键Call，运算注册码子程序。F7进。
0048F941   8B45EC                 mov     eax, [ebp-$14]
0048F944   8B154C394900           mov     edx, [$0049394C]

//真假注册码比较Call子程序
* Reference to: sysutils.AnsiCompareStr(AnsiString;AnsiString):Integer;
|           or: sysutils.AnsiSameStr(AnsiString;AnsiString):Boolean;
|
0048F94A   E8B989F7FF             call    00408308 //真假注册码比较，明码比较，追到这里可以看到真假注册码。
0048F94F   84C0                   test    al, al //测试Al值。
0048F951   746D                   jz      0048F9C0 //不跳就注册成功，下面的不管他。
0048F953   8B45FC                 mov     eax, [ebp-$04]

* Reference to control FLabel1 : TFLabel
|
0048F956   8B8004030000           mov     eax, [eax+$0304]
0048F95C   33D2                   xor     edx, edx

* Reference to : TFLabel._PROC_0048E79C()
|
0048F95E   E839EEFFFF             call    0048E79C
0048F963   8B45FC                 mov     eax, [ebp-$04]

* Reference to control FLabel1 : TFLabel
|
0048F966   8B8004030000           mov     eax, [eax+$0304]
0048F96C   8B4058                 mov     eax, [eax+$58]
0048F96F   33D2                   xor     edx, edx

* Reference to: graphics.TFont.SetColor(TFont;TColor);
|
0048F971   E8B6A9F8FF             call    0041A32C
0048F976   8D45E8                 lea     eax, [ebp-$18]
0048F979   8B0D48394900           mov     ecx, [$00493948]
0048F97F   8B55F8                 mov     edx, [ebp-$08]

* Reference to: system.@LStrCat3;
|
0048F982   E82944F7FF             call    00403DB0
0048F987   8B55E8                 mov     edx, [ebp-$18]
0048F98A   8B45FC                 mov     eax, [ebp-$04]

* Reference to control FLabel1 : TFLabel
|
0048F98D   8B8004030000           mov     eax, [eax+$0304]

* Reference to: controls.TControl.SetText(TControl;TCaption);
|
0048F993   E88472FBFF             call    00446C1C
0048F998   8B45FC                 mov     eax, [ebp-$04]

* Reference to control Edit1 : TEdit
|
0048F99B   8B80D8020000           mov     eax, [eax+$02D8]
0048F9A1   8B1548394900           mov     edx, [$00493948]

* Reference to: controls.TControl.SetText(TControl;TCaption);
|
0048F9A7   E87072FBFF             call    00446C1C
0048F9AC   8B45FC                 mov     eax, [ebp-$04]

* Reference to control Edit2 : TEdit
|
0048F9AF   8B80E0020000           mov     eax, [eax+$02E0]
0048F9B5   8B154C394900           mov     edx, [$0049394C]

* Reference to: controls.TControl.SetText(TControl;TCaption);
|
0048F9BB   E85C72FBFF             call    00446C1C
0048F9C0   8D55E4                 lea     edx, [ebp-$1C]
0048F9C3   A148394900             mov     eax, dword ptr [$00493948]

|
0048F9C8   E897FCFFFF             call    0048F664
0048F9CD   8B45E4                 mov     eax, [ebp-$1C]
0048F9D0   8B154C394900           mov     edx, [$0049394C]

* Reference to: sysutils.AnsiCompareStr(AnsiString;AnsiString):Integer;
|           or: sysutils.AnsiSameStr(AnsiString;AnsiString):Boolean;
|
0048F9D6   E82D89F7FF             call    00408308
0048F9DB   84C0                   test    al, al
0048F9DD   7557                   jnz     0048FA36
0048F9DF   8D55E0                 lea     edx, [ebp-$20]
0048F9E2   8B45FC                 mov     eax, [ebp-$04]

* Reference to control FLabel1 : TFLabel
|
0048F9E5   8B8004030000           mov     eax, [eax+$0304]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
0048F9EB   E8FC71FBFF             call    00446BEC
0048F9F0   8B55E0                 mov     edx, [ebp-$20]
0048F9F3   8B45F8                 mov     eax, [ebp-$08]

* Reference to: system.@LStrPos;
|
0048F9F6   E85546F7FF             call    00404050
0048F9FB   85C0                   test    eax, eax
0048F9FD   7E37                   jle     0048FA36
0048F9FF   8B45FC                 mov     eax, [ebp-$04]

* Reference to control FLabel1 : TFLabel
|
0048FA02   8B8004030000           mov     eax, [eax+$0304]
0048FA08   B201                   mov     dl, $01

* Reference to : TFLabel._PROC_0048E79C()
|
0048FA0A   E88DEDFFFF             call    0048E79C
0048FA0F   8B45FC                 mov     eax, [ebp-$04]

* Reference to control FLabel1 : TFLabel
|
0048FA12   8B8004030000           mov     eax, [eax+$0304]
0048FA18   8B4058                 mov     eax, [eax+$58]
0048FA1B   BAFF000000             mov     edx, $000000FF

* Reference to: graphics.TFont.SetColor(TFont;TColor);
|
0048FA20   E807A9F8FF             call    0041A32C
0048FA25   8B45FC                 mov     eax, [ebp-$04]

* Reference to control FLabel1 : TFLabel
|
0048FA28   8B8004030000           mov     eax, [eax+$0304]
0048FA2E   8B55F4                 mov     edx, [ebp-$0C]

* Reference to: controls.TControl.SetText(TControl;TCaption);
|
0048FA31   E8E671FBFF             call    00446C1C
0048FA36   33C0                   xor     eax, eax
0048FA38   5A                     pop     edx
0048FA39   59                     pop     ecx
0048FA3A   59                     pop     ecx
0048FA3B   648910                 mov     fs:[eax], edx

****** FINALLY
|
0048FA3E   6875FA4800             push    $0048FA75
0048FA43   8D45E0                 lea     eax, [ebp-$20]

* Reference to: system.@LStrClr(String;String);
|
0048FA46   E89940F7FF             call    00403AE4
0048FA4B   8D45E4                 lea     eax, [ebp-$1C]
0048FA4E   BA03000000             mov     edx, $00000003

* Reference to: system.@LStrArrayClr;
|
0048FA53   E8B040F7FF             call    00403B08
0048FA58   8D45F0                 lea     eax, [ebp-$10]

* Reference to: system.@LStrClr(String;String);
|
0048FA5B   E88440F7FF             call    00403AE4
0048FA60   8D45F4                 lea     eax, [ebp-$0C]
0048FA63   BA02000000             mov     edx, $00000002

* Reference to: system.@LStrArrayClr;
|
0048FA68   E89B40F7FF             call    00403B08
0048FA6D   C3                     ret


* Reference to: system.@HandleFinally;
|
0048FA6E   E9093BF7FF             jmp     0040357C
0048FA73   EBCE                   jmp     0048FA43

****** END
|
0048FA75   5F                     pop     edi
0048FA76   5E                     pop     esi
0048FA77   5B                     pop     ebx
0048FA78   8BE5                   mov     esp, ebp
0048FA7A   5D                     pop     ebp
0048FA7B   C3                     ret

//这里是运算注册码的关键Call部分。

0048F664   55                     push    ebp
0048F665   8BEC                   mov     ebp, esp
0048F667   33C9                   xor     ecx, ecx
0048F669   51                     push    ecx
0048F66A   51                     push    ecx
0048F66B   51                     push    ecx
0048F66C   51                     push    ecx
0048F66D   51                     push    ecx
0048F66E   51                     push    ecx
0048F66F   51                     push    ecx
0048F670   51                     push    ecx
0048F671   53                     push    ebx
0048F672   56                     push    esi
0048F673   57                     push    edi
0048F674   8955F8                 mov     [ebp-$08], edx
0048F677   8945FC                 mov     [ebp-$04], eax
0048F67A   8B45FC                 mov     eax, [ebp-$04]

* Reference to: system.@LStrAddRef;
|
0048F67D   E89648F7FF             call    00403F18
0048F682   33C0                   xor     eax, eax
0048F684   55                     push    ebp

//解密字符，不重要，不管他。
* Possible String Reference to: '楱=?脬_^[?]?
|
0048F685   68CFF74800             push    $0048F7CF

***** TRY
|
0048F68A   64FF30                 push    dword ptr fs:[eax]
0048F68D   648920                 mov     fs:[eax], esp
0048F690   BF1B000000             mov     edi, $0000001B
0048F695   8D45E4                 lea     eax, [ebp-$1C]

//解密字符，不重要，不管他。
* Possible String Reference to: '屋疖'
|
0048F698   BAE8F74800             mov     edx, $0048F7E8

* Reference to: system.@LStrLAsg;
|
0048F69D   E8DA44F7FF             call    00403B7C
0048F6A2   8B45E4                 mov     eax, [ebp-$1C]

* Reference to: system.@LStrLen:Integer;
|           or: system.@DynArrayLength;
|           or: system.DynArraySize(Pointer):Integer;
|
0048F6A5   E8BA46F7FF             call    00403D64
0048F6AA   8BD8                   mov     ebx, eax
0048F6AC   85DB                   test    ebx, ebx
0048F6AE   7E1F                   jle     0048F6CF
0048F6B0   BE01000000             mov     esi, $00000001
0048F6B5   8D45E4                 lea     eax, [ebp-$1C]

* Reference to: system.UniqueString(String;String);
|
0048F6B8   E87748F7FF             call    00403F34
0048F6BD   8B55E4                 mov     edx, [ebp-$1C]
0048F6C0   0FB65432FF             movzx   edx, byte ptr [edx+esi-$01]
0048F6C5   2BD7                   sub     edx, edi
0048F6C7   885430FF               mov     [eax+esi-$01], dl
0048F6CB   46                     inc     esi
0048F6CC   4B                     dec     ebx
0048F6CD   75E6                   jnz     0048F6B5
0048F6CF   8D45E4                 lea     eax, [ebp-$1C]
0048F6D2   8B55E4                 mov     edx, [ebp-$1C]

* Reference to: system.@LStrLAsg;
|
0048F6D5   E8A244F7FF             call    00403B7C
0048F6DA   8D45E8                 lea     eax, [ebp-$18]

//解密字符，重要，这里是解密注册码的Key，当解密成功后的Key形式是：“AaBbC0cDdEe1FfGgH2hIiJj3KkLMm4NnOoP5pQqRr6SsTtU7uVvWw8XxYyZ9”
，保存下来，这个做注册机时有用。：
* Possible String Reference to: '\|]}^K~_`?a??M???f?h?i??
|                                P???n??R???s??T'
|
0048F6DD   BAF8F74800             mov     edx, $0048F7F8

* Reference to: system.@LStrLAsg;
|
0048F6E2   E89544F7FF             call    00403B7C
0048F6E7   8B45E8                 mov     eax, [ebp-$18]

* Reference to: system.@LStrLen:Integer;
|           or: system.@DynArrayLength;
|           or: system.DynArraySize(Pointer):Integer;
|
0048F6EA   E87546F7FF             call    00403D64
0048F6EF   8BD8                   mov     ebx, eax
0048F6F1   85DB                   test    ebx, ebx
0048F6F3   7E1F                   jle     0048F714
0048F6F5   BE01000000             mov     esi, $00000001
0048F6FA   8D45E8                 lea     eax, [ebp-$18]

//开始解密Key。
* Reference to: system.UniqueString(String;String);
|
0048F6FD   E83248F7FF             call    00403F34
0048F702   8B55E8                 mov     edx, [ebp-$18]
0048F705   0FB65432FF             movzx   edx, byte ptr [edx+esi-$01]
0048F70A   2BD7                   sub     edx, edi
0048F70C   885430FF               mov     [eax+esi-$01], dl
0048F710   46                     inc     esi
0048F711   4B                     dec     ebx
0048F712   75E6                   jnz     0048F6FA
0048F714   8D45E8                 lea     eax, [ebp-$18]
0048F717   8B55E8                 mov     edx, [ebp-$18]

* Reference to: system.@LStrLAsg;
|
0048F71A   E85D44F7FF             call    00403B7C
0048F71F   8D45F0                 lea     eax, [ebp-$10]
0048F722   8B55E8                 mov     edx, [ebp-$18]

* Reference to: system.@LStrLAsg;
|
0048F725   E85244F7FF             call    00403B7C
0048F72A   8B45FC                 mov     eax, [ebp-$04]
0048F72D   8B154C394900           mov     edx, [$0049394C]

//比较用户名和注册码是否相同，不用管他。
* Reference to: system.@LStrCmp;
|
0048F733   E83C47F7FF             call    00403E74
0048F738   750F                   jnz     0048F749
0048F73A   8B45F8                 mov     eax, [ebp-$08]

* Possible String Reference to: '陈樟'
|
0048F73D   BA40F84800             mov     edx, $0048F840

* Reference to: system.@LStrAsg;
|
0048F742   E8F143F7FF             call    00403B38
0048F747   EB63                   jmp     0048F7AC
0048F749   8D45F4                 lea     eax, [ebp-$0C]
0048F74C   8B55FC                 mov     edx, [ebp-$04]

* Reference to: system.@LStrLAsg;
|
0048F74F   E82844F7FF             call    00403B7C
0048F754   8B45FC                 mov     eax, [ebp-$04]

//取得用户名的长度，程序开始运算注册码，我们要开始注意以下语句，做注册码时有用。
* Reference to: system.@LStrLen:Integer;
|           or: system.@DynArrayLength;
|           or: system.DynArraySize(Pointer):Integer;
|
0048F757   E80846F7FF             call    00403D64 //取得用户名长度
0048F75C   8BD8                   mov     ebx, eax
0048F75E   85DB                   test    ebx, ebx
0048F760   7E3F                   jle     0048F7A1
0048F762   BF01000000             mov     edi, $00000001
0048F767   8B45F4                 mov     eax, [ebp-$0C]
0048F76A   33C9                   xor     ecx, ecx //ECX清0
0048F76C   8A4C38FF               mov     cl, byte ptr [eax+edi-$01] //依次循环取出用户名。
0048F770   81C1E01E0000           add     ecx, $00001EE0 //用户名的ASCII码和0x1EE0相加，
0048F776   8BC1                   mov     eax, ecx //保存到EAX作下一次运算
0048F778   B91B000000             mov     ecx, $0000001B  //ECX等于0x1B
0048F77D   99                     cdq  //寄存器符号扩展
0048F77E   F7F9                   idiv    ecx  //EAX和ECX相除，结果到EAX，余数到EDX(我们要得到的是余数)
0048F780   8BF2                   mov     esi, edx //相除的余数送给ESI
0048F782   46                     inc     esi //ESI加1
0048F783   8D45E0                 lea     eax, [ebp-$20] 
0048F786   8B55F0                 mov     edx, [ebp-$10] //取得解密后的Key
0048F789   8A5432FF               mov     dl, byte ptr [edx+esi-$01] //以余数作为指针取得Key中的任意一个值作为注册码。

* Reference to: system.@LStrFromChar(String;String;Char);
|           or: system.@LStrFromWChar(String;String;WideChar);
|           or: system.@WStrFromChar(WideString;WideString;Char);
|           or: system.@WStrFromWChar(WideString;WideString;WideChar);
|
0048F78D   E8FA44F7FF             call    00403C8C  //将取出的取转成Char字符。
0048F792   8B55E0                 mov     edx, [ebp-$20]
0048F795   8D45EC                 lea     eax, [ebp-$14]

* Reference to: system.@LStrCat;
|
0048F798   E8CF45F7FF             call    00403D6C //保存
0048F79D   47                     inc     edi 指针加1
0048F79E   4B                     dec     ebx 计数减1
0048F79F   75C6                   jnz     0048F767 //用户名未运算完毕跳回去继续，完毕之后退出循环。
0048F7A1   8B45F8                 mov     eax, [ebp-$08] //到这里注册码的已经运算完毕，以下的我们就不用管他了。
0048F7A4   8B55EC                 mov     edx, [ebp-$14]

* Reference to: system.@LStrAsg;
|
0048F7A7   E88C43F7FF             call    00403B38
0048F7AC   33C0                   xor     eax, eax
0048F7AE   5A                     pop     edx
0048F7AF   59                     pop     ecx
0048F7B0   59                     pop     ecx
0048F7B1   648910                 mov     fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: '_^[?]?
|
0048F7B4   68D6F74800             push    $0048F7D6
0048F7B9   8D45E0                 lea     eax, [ebp-$20]
0048F7BC   BA06000000             mov     edx, $00000006

* Reference to: system.@LStrArrayClr;
|
0048F7C1   E84243F7FF             call    00403B08
0048F7C6   8D45FC                 lea     eax, [ebp-$04]

* Reference to: system.@LStrClr(String;String);
|
0048F7C9   E81643F7FF             call    00403AE4
0048F7CE   C3                     ret


* Reference to: system.@HandleFinally;
|
0048F7CF   E9A83DF7FF             jmp     0040357C
0048F7D4   EBE3                   jmp     0048F7B9

****** END
|
0048F7D6   5F                     pop     edi
0048F7D7   5E                     pop     esi
0048F7D8   5B                     pop     ebx
0048F7D9   8BE5                   mov     esp, ebp
0048F7DB   5D                     pop     ebp
0048F7DC   C3                     ret

至此，注册码算法分析完毕，因为我是带壳调试，所以没有遇到自验效，没去看他的自验效在哪里，你们有兴趣的可以去找找。
这注册码算法用Delphi来表达则是：

Key := 'AaBbC0cDdEe1FfGgH2hIiJj3KkLMm4NnOoP5pQqRr6SsTtU7uVvWw8XxYyZ9';
Name := 用户名;

Function KeyGen(Name,Key:String):String;
var i,j:Integer;
    k:String;
begin
    for i := 1 to length(Name) do
    begin
        j := ((byte(ord(Name[i])) + $1EE0) mod $1B) + 1;
        k := k + chr(byte(ord(Key[j])));
    end; 
    Result := k   
end;

最后附上Delphi的注册机源码和注册机编写器的源码。
Delphi源码：

Function KeyGen(Name,Key:String):String;
var i,j:Integer;
    k:String;
begin
    for i := 1 to length(Name) do
    begin
        j := ((byte(ord(Name[i])) + $1EE0) mod $1B) + 1;
        k := k + chr(byte(ord(Key[j])));
    end; 
    Result := k   
end;

procedure TForm1.Button1Click(Sender: TObject);
var Name,Key:String;
begin
    if Edit1.Text <> '' then
    begin
         Key := 'AaBbC0cDdEe1FfGgH2hIiJj3KkLMm4NnOoP5pQqRr6SsTtU7uVvWw8XxYyZ9';
         Name := Edit1.Text;
         Edit2.Text := KeyGen(Name,Key);
    end;
end;

注册机编写器源码：

		.const

		.data
	szHomePage db "http://www.chinadfcg.com",0
	szEmail    db "mailto:ljyljx@163.com",0
	szErrMess  db "输入的序列号不正确！",0
	Key db "AaBbC0cDdEe1FfGgH2hIiJj3KkLMm4NnOoP5pQqRr6SsTtU7uVvWw8XxYyZ9",0
	SN db 50 dup(0)

		.code
	mov esi,1
loc_01:
	lea eax,hInput1
	mov al,byte ptr [eax+esi-1]
	test al,al
	jz loc_02
	and eax,0ffh
	add eax,1EE0h
	mov ecx,1Bh
	cdq
	idiv ecx
	and edx,0ffh
	inc dl
	lea ebx,Key
	lea ecx,SN
	mov al,byte ptr [ebx+edx]
	mov [ecx+esi-1],al
	inc esi
	jmp loc_01
loc_02:
	lea eax,SN

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

收藏・1

点赞・7

打赏

最新回复 (10)
qwgboy2000 雪币： 230 活跃值： (11) 能力值： ( LV8，RANK：130 ) 在线值：发帖 10 回帖 51 粉丝 0 关注私信	qwgboy2000 3 2004-12-27 17:11 2 楼 0 顶 ~~~~~~~~~~~ BS 看帖不顶的
Guaf 雪币： 201 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 27 粉丝 1 关注私信	Guaf 2004-12-27 19:02 3 楼 0 不错，学习……
linhanshi 雪币： 85452 活跃值： (198780) 能力值： (RANK：10 ) 在线值：发帖 9004 回帖 25618 粉丝 425 关注私信	linhanshi 2004-12-27 19:06 4 楼 0 支持!!!
注定我不平凡雪币： 209 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 94 粉丝 0 关注私信	注定我不平凡 2004-12-27 21:17 5 楼 0 学习了，楼主谢了
mhsong 雪币： 205 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 143 粉丝 1 关注私信	mhsong 2004-12-27 22:34 6 楼 0 先顶再看~~
烈火劲风雪币： 207 活跃值： (11) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 39 粉丝 0 关注私信	烈火劲风 2004-12-27 23:39 7 楼 0 可惜DELPHI源程序看不懂
acafeel 雪币： 333 活跃值： (116) 能力值： ( LV9，RANK：570 ) 在线值：发帖 31 回帖 219 粉丝 1 关注私信	acafeel 14 2004-12-29 09:31 8 楼 0 顶，对楼主表示敬佩:D
水煮小醉鱼雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 5 粉丝 0 关注私信	水煮小醉鱼 2004-12-29 13:36 9 楼 0 经典~学习了！谢谢，楼主辛苦~
pendan2001 雪币： 61 活跃值： (160) 能力值： ( LV9，RANK：170 ) 在线值：发帖 25 回帖 1180 粉丝 0 关注私信	pendan2001 4 2004-12-29 22:09 10 楼 0 支持!!!
bjjgq 雪币： 231 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 64 粉丝 0 关注私信	bjjgq 2010-10-19 12:08 11 楼 0 学习啦呀！！！
	游客登录 \| 注册方可回帖　回帖　表情雪币赚取及消费高级回复

小虾

发帖

2235

回帖

410

RANK

关注

私信

他的文章

[原创]Exe程序尾部附加数据添加程序(含源码)

关于我们

联系我们

企业服务

看雪公众号