＝
＝
＝Registry Crawler 4.0注册码算法分析
＝
＝
＝ CrAcKeD BY alphakk/OCG
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
＝软件简介: ＝
＝ Registry Crawler 是强大的用户和开发者快速定位并配置注册表的工具软 ＝
＝件。一个强大的搜索引擎允许你基于搜索标准查找注册信息。允许你单击超链 ＝
＝接显示条目。支持书签功能，可在注册表中的任何键中添加书签并直接从系统 ＝
＝托盘读取。此特征允许你访问你经常存取的注册键而无需手工打开 REGEDIT。 ＝
＝每天需要操作注册表的用户会发现 Registry Crawler 是一个节约时间的工具。＝
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
破解工具：SOFTICE，W32DASM
分析：
本软件采用用户名，注册码的验证方式，不注册的话会有30天的试用期，过期会提示用户注册，还未注册的话，将不能继续使用。
此软件无功能限制。
在注册窗口中输入以下信息：
用户名：alphakk/OCG
注册码：98765432
用GETWINDOWTEXT作断点，点击“解锁”，被SOFTICE中断，接着按F11跳出GETWINDOWTEXT函数，来到：
* Reference To: USER32.GetWindowTextA, Ord:015Eh
|
:0042DA07 FF1550844400 Call dword ptr [00448450]
:0042DA0D EB12 jmp 0042DA21 <<-------按F11后来到的地方
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D9FA(C)
|
:0042DA0F FF742408 push [esp+08]
:0042DA13 8B10 mov edx, dword ptr [eax]
:0042DA15 8BC8 mov ecx, eax
:0042DA17 FF742408 push [esp+08]
:0042DA1B FF9284000000 call dword ptr [edx+00000084]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DA0D(U)
|
:0042DA21 C20800 ret 0008
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝F10单步跟踪过上面后，来到：
* Possible Reference to Dialog:
|
:0040AFDC 6810E54500 push 0045E510
:0040AFE1 8D8EBC030000 lea ecx, dword ptr [esi+000003BC]
:0040AFE7 E8092A0200 call 0042D9F5
:0040AFEC 68FF000000 push 000000FF
* Possible Reference to Dialog:
|
:0040AFF1 6810E64500 push 0045E610 <<-----输入的注册码入栈
:0040AFF6 8D8E80030000 lea ecx, dword ptr [esi+00000380]
:0040AFFC E8F4290200 call 0042D9F5
* Possible Reference to Dialog:
|
:0040B001 6810E54500 push 0045E510 <<------用户名入栈
:0040B006 8D4C240C lea ecx, dword ptr [esp+0C]
:0040B00A E8F6330200 call 0042E405
:0040B00F 8B00 mov eax, dword ptr [eax] <<------用户名首地址－＞EAX
* Possible Reference to Dialog:
|
:0040B011 68848C4500 push 00458C84 <<------“TRIAL USER”入栈
:0040B016 50 push eax <<------用户名入栈
:0040B017 E8BFE60000 call 004196DB <<------比较函数，不同则EAX＝1
:0040B01C 83C408 add esp, 00000008
:0040B01F 8D4C2408 lea ecx, dword ptr [esp+08]
:0040B023 85C0 test eax, eax
:0040B025 0F94C3 sete bl <<------BL置0
:0040B028 E86A330200 call 0042E397
:0040B02D 84DB test bl, bl
:0040B02F 740F je 0040B040 <<------跳
:0040B031 6A01 push 00000001
:0040B033 8BCE mov ecx, esi
:0040B035 E8DB3F0200 call 0042F015
:0040B03A 5E pop esi
:0040B03B 5B pop ebx
:0040B03C 83C408 add esp, 00000008
:0040B03F C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B02F(C)
|
:0040B040 E8ABFCFFFF call 0040ACF0 <<-----注意这个CALL，此处先用F10带过
:0040B045 85C0 test eax, eax
:0040B047 0F849D000000 je 0040B0EA <<-------上面的CALL用F10过的话，这里就会跳
* Possible StringData Ref from Data Obj ->"Software\4Developers\RCrawler"
|
:0040B04D 8B15F88A4500 mov edx, dword ptr [00458AF8]
:0040B053 8D44240C lea eax, dword ptr [esp+0C]
:0040B057 8D4C2408 lea ecx, dword ptr [esp+08]
:0040B05B 33DB xor ebx, ebx
:0040B05D 50 push eax
:0040B05E 51 push ecx
:0040B05F 53 push ebx
:0040B060 683F000F00 push 000F003F
:0040B065 53 push ebx
:0040B066 53 push ebx
:0040B067 53 push ebx
:0040B068 52 push edx
:0040B069 6802000080 push 80000002
:0040B06E 895C2430 mov dword ptr [esp+30], ebx
:0040B072 895C242C mov dword ptr [esp+2C], ebx
* Reference To: ADVAPI32.RegCreateKeyExA, Ord:015Fh
|
:0040B076 FF1534804400 Call dword ptr [00448034]
:0040B07C 3BC3 cmp eax, ebx
:0040B07E 7531 jne 0040B0B1
* Possible StringData Ref from Data Obj ->"4D"
|
:0040B080 A1048B4500 mov eax, dword ptr [00458B04]
:0040B085 8B4C2408 mov ecx, dword ptr [esp+08]
:0040B089 57 push edi
:0040B08A 6800020000 push 00000200
:0040B08F 6810E54500 push 0045E510
:0040B094 6A03 push 00000003
:0040B096 53 push ebx
:0040B097 50 push eax
:0040B098 51 push ecx
* Reference To: ADVAPI32.RegSetvalueExA, Ord:0186h
|
:0040B099 FF1524804400 Call dword ptr [00448024]
:0040B09F 8B54240C mov edx, dword ptr [esp+0C]
:0040B0A3 8BF8 mov edi, eax
:0040B0A5 52 push edx
* Reference To: ADVAPI32.RegCloseKey, Ord:015Bh
|
:0040B0A6 FF1520804400 Call dword ptr [00448020]
:0040B0AC 3BFB cmp edi, ebx
:0040B0AE 5F pop edi
:0040B0AF 7419 je 0040B0CA
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B07E(C)
|
:0040B0B1 53 push ebx
:0040B0B2 53 push ebx