//连续求5个累加和10
SN:=''//0x32位长的序列号
//22P2ffmyM1zMecefbzyMrq4bzGbcrPbZ4MZQmqyv64FwX4kFVQ
buf[i]:=//5个累加和
for index:=1 to 5 do
begin
buf[i]:=0;
for j:=1 to 10 do
begin
buf[i]:=buf[i]+ord(SN[i+5*(j-1)]);
end;
end;
//[eax-00000014] - 0000034e N...=846
//[eax-00000010] - 00000387 ....=903
//[eax-0000000C] - 00000370 p...=880
//[eax-00000008] - 000003c2 ....=962
//[eax-00000004] - 0000038c ....=908
==========================================================
:004C5890 8D55D8 lea edx, dword ptr [ebp-28]
:004C5893 8B45DC mov eax, dword ptr [ebp-24]
:004C5896 E8E128F4FF call 0040817C
:004C589B FF75D8 push [ebp-28]
:004C589E 8D55D4 lea edx, dword ptr [ebp-2C]
:004C58A1 8B45E0 mov eax, dword ptr [ebp-20]
:004C58A4 E8D328F4FF call 0040817C
:004C58A9 FF75D4 push [ebp-2C]
:004C58AC 8D55D0 lea edx, dword ptr [ebp-30]
:004C58AF 8B45E4 mov eax, dword ptr [ebp-1C]
:004C58B2 E8C528F4FF call 0040817C
:004C58B7 FF75D0 push [ebp-30]
:004C58BA 8D55CC lea edx, dword ptr [ebp-34]
:004C58BD 8B45E8 mov eax, dword ptr [ebp-18]
:004C58C0 E8B728F4FF call 0040817C
:004C58C5 FF75CC push [ebp-34]
:004C58C8 8D55C8 lea edx, dword ptr [ebp-38]
:004C58CB 8B45EC mov eax, dword ptr [ebp-14]
:004C58CE E8A928F4FF call 0040817C====>buf转为字符串
:004C58D3 FF75C8 push [ebp-38]
:004C58D6 8D45F4 lea eax, dword ptr [ebp-0C]
:004C58D9 BA05000000 mov edx, 00000005
:004C58DE E8BDE5F3FF call 00403EA0====>5个字符串连接，用于和后面的结果比较
// 相等则正确
:004C58E3 8D4DF0 lea ecx, dword ptr [ebp-10]
//===========================================================
//846903880962908
//===========================================================
* Possible StringData Ref from Code Obj ->"JDqpBkLvn8Cm0HYIr1KQMSagURlieFAEb3jd7N4zwZoOGy"
->"xu6T2fstchVP9X5WwNC3OHDlm1efyqzcbM4GrZjP9TQ7gk"
->"2ov8F0IitXSJaAEBYxKunVL5Uhs6pRWd"
|
:004C58E6 8B1584174D00 mov edx, dword ptr [004D1784]===>Magicstr
:004C58EC 8B45F8 mov eax, dword ptr [ebp-08]=====>输入注册码
:004C58EF E8747BF8FF call 0044D468===>把输入注册码加密
//===========================================================
MagicStr:='JDqpBkLvn8Cm0HYIr1KQMSagURlieFAEb3jd7N4zwZoOGyxu
6T2fstchVP9X5WwNC3OHDlm1efyqzcbM4GrZjP9TQ7gk2ov8F0IitXSJaAEBYxKunVL5Uhs6pRWd'
具体又是累加
由12字符计算长度
由后面的字符计算后面的注册码
只要这个过程可以逆过来，那么这个keygen就可以做出；我们的先把这个算法搞明白
//==========================================================
:0044D4B0 BF33000000 mov edi, 00000033
:0044D4B5 8B45FC mov eax, dword ptr [ebp-04]
:0044D4B8 8A10 mov dl, byte ptr [eax]
:0044D4BA B933000000 mov ecx, 00000033
:0044D4BF 8B45F8 mov eax, dword ptr [ebp-08]
:0044D4C2 E825FAFFFF call 0044CEEC========>
===========================================================
sub_0044CEEC(arg1,arg2,arg3)//返回arg3在arg1中的位置，从arg2开始查找
//当arg2>length(arg1)时；返回-1；否则返回索引或者length(arg1);
//==============================================
:0044CEEC 55 push ebp
:0044CEED 8BEC mov ebp, esp
:0044CEEF 51 push ecx
:0044CEF0 53 push ebx
:0044CEF1 56 push esi
:0044CEF2 57 push edi
:0044CEF3 8BF9 mov edi, ecx===>startIndex
:0044CEF5 8BDA mov ebx, edx===>arg3
:0044CEF7 8945FC mov dword ptr [ebp-04], eax
:0044CEFA 8B45FC mov eax, dword ptr [ebp-04]
:0044CEFD E89270FBFF call 00403F94
:0044CF02 33C0 xor eax, eax
:0044CF04 55 push ebp
:0044CF05 684BCF4400 push 0044CF4B
:0044CF0A 64FF30 push dword ptr fs:[eax]
:0044CF0D 648920 mov dword ptr fs:[eax], esp
:0044CF10 83CEFF or esi, FFFFFFFF===>初始付值-1
:0044CF13 8B45FC mov eax, dword ptr [ebp-04]
:0044CF16 E8C56EFBFF call 00403DE0===>取输入字符串的长度
:0044CF1B 8BD0 mov edx, eax
:0044CF1D 2BD7 sub edx, edi
:0044CF1F 7C14 jl 0044CF35
:0044CF21 42 inc edx
:0044CF22 89F8 mov eax, edi===>startIndex
//==========================================================