注册
登录
| 关键词： nbsp dword eax ptr mov ebp unpacked edx 005457 005456 |
【破文标题】新华词典V2008 build 11.20算法分析【破文作者】canyun【作者邮箱】[email protected]【破解工具】OD，Peid，DEDE【破解平台】WinXP【软件名称】新华字典词典V2008 build 11.20【软件大小】10.4M【原版下载】http://www.duote.com/soft/2382.html【保护方式】注册码【软件简介】〖新华字典词典〗软件是一个精巧、全面、新颖的桌面资料工具。软件收集了中国所有的国标汉字，所有的规范成语，全面收集，权威、科学。是一个优秀的学习工具助手。新华字典包括汉字拼音、笔划、部首、检字法、五笔编码，字源、组词、举例、意思等等。详尽、齐全、细致、深入。成语词典包括拼音、出处、举例等等。歇后语典包括前部分及后部分。新华字典、成语词典、歇后语典都包括模糊检索功能。方便、快捷、高效。软件同时集成了众多的资料，包括名人名言、对联、名句欣赏、魔鬼词典、绕口令、千字文、三字经、百家姓、昔时贤文、俗语、谚语等等。是一款不可多得的优秀工具软件。【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）------------------------------------------------------------------------【破解过程】1. 查壳脱壳ASPack 2.12 -> Alexey Solodovnikov，简单脱之，发现是Borland Delphi 6.0 - 7.02. 定位注册事件 用DEDE查找按钮事件地址005457D03.算法分析005457D0 55 push ebp005457D1 8BEC mov ebp,esp005457D3 81C4 98FEFFFF add esp,-168005457D9 33C9 xor ecx,ecx005457DB 898D 9CFEFFFF mov dword ptr ss:[ebp-164],ecx005457E1 898D 98FEFFFF mov dword ptr ss:[ebp-168],ecx005457E7 898D A8FEFFFF mov dword ptr ss:[ebp-158],ecx005457ED 898D A4FEFFFF mov dword ptr ss:[ebp-15C],ecx005457F3 898D A0FEFFFF mov dword ptr ss:[ebp-160],ecx005457F9 8945 FC mov dword ptr ss:[ebp-4],eax005457FC 33C0 xor eax,eax005457FE 55 push ebp005457FF 68 F7595400 push unpacked.005459F700545804 64:FF30 push dword ptr fs:[eax]00545807 64:8920 mov dword ptr fs:[eax],esp0054580A 8D95 A8FEFFFF lea edx,dword ptr ss:[ebp-158]00545810 8B45 FC mov eax,dword ptr ss:[ebp-4]00545813 8B80 80050000 mov eax,dword ptr ds:[eax+580]00545819 E8 FE1DF0FF call unpacked.0044761C ; 取假注册码0054581E 8B85 A8FEFFFF mov eax,dword ptr ss:[ebp-158]00545824 50 push eax00545825 8D95 A0FEFFFF lea edx,dword ptr ss:[ebp-160]0054582B 8B45 FC mov eax,dword ptr ss:[ebp-4]0054582E 8B80 78050000 mov eax,dword ptr ds:[eax+578]00545834 E8 E31DF0FF call unpacked.0044761C ; 取验证码00545839 8B85 A0FEFFFF mov eax,dword ptr ss:[ebp-160]0054583F E8 783FECFF call unpacked.004097BC ; 将验证码转化为16进制=A00545844 03C0 add eax,eax ; A*2=B00545846 8D04C0 lea eax,dword ptr ds:[eax+eax*8] ; B+B*8=C00545849 8D95 A4FEFFFF lea edx,dword ptr ss:[ebp-15C]0054584F E8 9CFEFFFF call unpacked.005456F0 ; 算法关键00545854 8B95 A4FEFFFF mov edx,dword ptr ss:[ebp-15C]0054585A 58 pop eax0054585B E8 94F7EBFF call unpacked.00404FF4 ;内存注册机地址00545860 0F85 48010000 jnz unpacked.005459AE ;关键跳**********************************进入关键call unpacked.005456F0***************************005456F0 55 push ebp005456F1 8BEC mov ebp,esp005456F3 33C9 xor ecx,ecx005456F5 51 push ecx005456F6 51 push ecx005456F7 51 push ecx005456F8 51 push ecx005456F9 53 push ebx005456FA 56 push esi005456FB 8BF2 mov esi,edx005456FD 8BD8 mov ebx,eax005456FF 33C0 xor eax,eax00545701 55 push ebp00545702 68 C0575400 push unpacked.005457C000545707 64:FF30 push dword ptr fs:[eax]0054570A 64:8920 mov dword ptr fs:[eax],esp0054570D 81F3 F1250B00 xor ebx,0B25F1 ; C XOR 0B25F1=D00545713 8BC3 mov eax,ebx ; EAX=D00545715 33D2 xor edx,edx00545717 52 push edx00545718 50 push eax00545719 8D45 FC lea eax,dword ptr ss:[ebp-4]0054571C E8 6740ECFF call unpacked.00409788 ; 算法一 将D转换为十进制E00545721 8B45 FC mov eax,dword ptr ss:[ebp-4]00545724 0FB600 movzx eax,byte ptr ds:[eax] ; 取出E的第一位ASCII00545727 8B55 FC mov edx,dword ptr ss:[ebp-4]0054572A 0FB652 01 movzx edx,byte ptr ds:[edx+1] ; 取出E的第二位ASCII0054572E 03C2 add eax,edx ; 两位相加=F00545730 B9 05000000 mov ecx,500545735 99 cdq00545736 F7F9 idiv ecx ; F\5 商存在EAX,余数存在EDX00545738 80C2 34 add dl,34 ; 余数+34=G0054573B 8855 F8 mov byte ptr ss:[ebp-8],dl0054573E 8B45 FC mov eax,dword ptr ss:[ebp-4]00545741 0FB640 02 movzx eax,byte ptr ds:[eax+2] ; 取出E的第三位ASCII00545745 8B55 FC mov edx,dword ptr ss:[ebp-4]00545748 0FB652 03 movzx edx,byte ptr ds:[edx+3] ; 取出E的第四位ASCII0054574C 03C2 add eax,edx ; 两位相加=H0054574E B9 05000000 mov ecx,500545753 99 cdq00545754 F7F9 idiv ecx ; H\5 商存在EAX,余数存在EDX00545756 8BDA mov ebx,edx00545758 80C3 33 add bl,33 ; 余数+33=I0054575B 885D F9 mov byte ptr ss:[ebp-7],bl0054575E 8D45 F4 lea eax,dword ptr ss:[ebp-C]00545761 8A55 F8 mov dl,byte ptr ss:[ebp-8]00545764 E8 6FF6EBFF call unpacked.00404DD800545769 8B45 F4 mov eax,dword ptr ss:[ebp-C]0054576C 8D55 FC lea edx,dword ptr ss:[ebp-4]0054576F B9 1B000000 mov ecx,1B00545774 E8 17FAEBFF call unpacked.0040519000545779 8D45 F0 lea eax,dword ptr ss:[ebp-10]0054577C 8BD3 mov edx,ebx0054577E E8 55F6EBFF call unpacked.00404DD800545783 8B45 F0 mov eax,dword ptr ss:[ebp-10]00545786 8D55 FC lea edx,dword ptr ss:[ebp-4]00545789 B9 19000000 mov ecx,190054578E E8 FDF9EBFF call unpacked.00405190 ; 注册码=E&G&I ;三个数连接************************VB算法源码*********************************Private Sub Text1_Change()Dim A, E, G, H, SN As StringDim x, y, B, C, D As LongA = Val(Text1.Text)B = A * 2C = B + B * 8D = C Xor 730609E = Trim(Str(D))x = Asc(Mid(E, 1, 1)) + Asc(Mid(E, 2, 1))G = x Mod 5 + 4y = Asc(Mid(E, 3, 1)) + Asc(Mid(E, 4, 1))H = y Mod 5 + 3SN = E & G & HText2.Text = SNEnd Sub*********************内存注册机*********************************中断地址：0054585B中断次数：1第一字节：E8指令长度：5注册码保存在：EDX------------------------------------------------------------------------【版权声明】本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢! |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
