下载地址： ftp://www.newhua.com/revive31.zip
软件大小： 1079 KB
软件语言： 国外软件
软件类别： 国外软件 / 共享版 /
应用平台： Win9x/NT/2000/XP
破解工具: olldbg-cn v1.09
【作者声明】：初学Crack，只是感兴趣，没有其它目的。可能我的描述有不到之处,请大家指正
程序是vc++编的,没有壳.在0lldbg中下getwindowtexta中断就能到核心.前面部分就不写了.
加载后用户名和单位名软件填好了,就填试验码 789456123012 .运行中断后不久就到:
****************************************************************
004032A0 SUB ESP, 24
004032A3 PUSH EBX
004032A4 PUSH ESI
004032A5 MOV ESI, DWORD PTR SS:[ESP+30] ; ESI<== 0093292C,(ASCII "789456123012")
004032A9 PUSH EDI
004032AA MOVSX EAX, BYTE PTR DS:[ESI] ; EAX <==DS:[0093292C]=37 ('7')
004032AD PUSH EAX
004032AE CALL Revival.0041F880 ; 这个CALL把hex值-20
004032B3 ADD ESP, 4
004032B6 CMP EAX, 52 ; 比较第一位是不是52+20=72 ('r')
004032B9 JNZ Revival.0040340F ; 注册码的第二个条件:注册码的第一位是('r'), 把第一位改为r再试
004032BF MOVSX EAX, BYTE PTR DS:[ESI+1] ; EAX <== DS:[0093292D] = 61 ('a')
004032C3 PUSH EAX
004032C4 CALL Revival.0041F880 ; 这个CALL把hex值-20
004032C9 ADD ESP, 4
004032CC CMP EAX, 56 ; 注册码的第3个条件:注册码的第一位是56+20=76 ('v'), 把第2位改为v再试
004032CF JNZ Revival.0040340F
----------------------
CALL Revival.0041F880
|
|
0041F880 CMP DWORD PTR DS:[45DC20], 0
0041F887 PUSH ESI
0041F888 PUSH EDI
0041F889 JNZ SHORT Revival.0041F89F
0041F88B MOV EAX, DWORD PTR SS:[ESP+C] ; 这一段是比较注册码第一位的取值范围hex=61-7A (小写字母)
0041F88F CMP EAX, 61 ; 注册码的第一个条件(把试验码改为asdfghjklzxcvbnm后继续)
0041F892 JL SHORT Revival.0041F8EB
0041F894 CMP EAX, 7A
0041F897 JG SHORT Revival.0041F8EB
0041F899 SUB EAX, 20 ; EAX =61-20=41
0041F89C POP EDI
0041F89D POP ESI ; ESI <== 0093266C,(ASCII"asdfghjklzxcvbnm")
0041F89E RETN
*********************************************
下面继续分析:
004032D5 CMP BYTE PTR DS:[ESI+7], 2D ; 注册码的第4个条件:注册码的第8位2d ('-a'), 把第8位改为-再试
004032D9 JNZ Revival.0040340F
004032DF PUSH ESI ; /ESI = 0093266C,(ASCII "rvasdfg-jklzxcv")
004032E0 CALL DWORD PTR DS:[<&KERNEL32.lstr>; \lstrlenA
004032E6 CMP EAX, 0F ; EAX = 0F (注册码的长度=15位),条件5
004032E9 JNZ Revival.0040340F
004032EF MOV EDI, 2 ; EDI=2 (下面从第三位计算起)
004032F4 /MOVSX EAX, BYTE PTR DS:[ESI+EDI] ; EAX <== DS:[0093266E]=61 ('a')
004032F8 |PUSH EAX
004032F9 |CALL Revival.0041F810 ; 比较条件CALL
004032FE |ADD ESP, 4
00403301 |TEST EAX, EAX
00403303 |JE Revival.004033F4
00403309 |INC EDI
0040330A |CMP EDI, 7
0040330D \JL SHORT Revival.004032F4
0040330F MOV EDI, 8
00403314 /MOVSX EAX, BYTE PTR DS:[ESI+EDI]
00403318 |PUSH EAX
00403319 |CALL Revival.0041F810
0040331E |ADD ESP, 4
00403321 |TEST EAX, EAX
00403323 |JE Revival.004033FD
00403329 |INC EDI
0040332A |CMP EDI, 0F
0040332D \JL SHORT Revival.00403314
-----------------------------------------------------
CALL Revival.0041F810
|
|
0041F810 CMP DWORD PTR DS:[45D9DC], 1
0041F817 JLE SHORT Revival.0041F829 ;这里一定跳
0041F819 MOV ECX, DWORD PTR SS:[ESP+4] |
0041F81D PUSH 4 |
0041F81F PUSH ECX |
0041F820 CALL Revival.00423610 |
0041F825 ADD ESP, 8 \|/
0041F828 RETN .
0041F829 MOV EDX, DWORD PTR DS:[45D7D0] ; Revival.0045D7DA (寻址的基址)
0041F82F XOR EAX, EAX
0041F831 MOV ECX, DWORD PTR SS:[ESP+4] ; ECX <== SS:[0012F500]=61 ('a')
0041F835 MOV AX, WORD PTR DS:[EDX+ECX*2] ; 用ECX的值做指针,来寻址.计算方法=基址+各位hex*2
0041F839 AND EAX, 4 ; EAX =EAX AND 4 寻址得到的值再计算
0041F83C RETN ; 条件6--EAX AND 4 不等于0 ,就正确.
++++++++++++++++++++++++++++++++++++++++++++++++++++++
这是内存中数组的值:
0045D7DA ==> 20 00 20 00 20 00 .. . . .
0045D7E0 20 00 20 00 20 00 20 00 . . . .
0045D7E8 20 00 20 00 28 00 28 00 . .(.(.
0045D7F0 28 00 28 00 28 00 20 00 (.(.(. .
0045D7F8 20 00 20 00 20 00 20 00 . . . .
0045D800 20 00 20 00 20 00 20 00 . . . .
0045D808 20 00 20 00 20 00 20 00 . . . .
0045D810 20 00 20 00 20 00 20 00 . . . .
0045D818 20 00 48 00 10 00 10 00 .H...
0045D820 10 00 10 00 10 00 10 00 ....
0045D828 10 00 10 00 10 00 10 00 ....
0045D830 10 00 10 00 10 00 10 00 ....
0045D838 10 00 84 00 84 00 84 00 .??? ;经过分析发现内存中的值只有84 AND 4 不等于0
0045D840 84 00 84 00 84 00 84 00 ???? //84的偏移量=45D83A-45D7DA=60H++2 ==>6AH
0045D848 84 00 84 00 84 00 10 00 ???. //那么第三位值应该=60/2=30 ('0')++ ==>39 ('9')
0045D850 10 00 10 00 10 00 10 00 .... ;上面的计算告诉我们从第三位开始取值的范围(0-9)
0045D858 10 00 10 00 81 00 81 00 ..?? //把试验码改为:rv01234-5678901 后继续
0045D860 81 00 81 00 81 00 81 00 ????
0045D868 01 00 01 00 01 00 01 00 ....
0045D870 01 00 01 00 01 00 01 00 ....
0045D878 01 00 01 00 01 00 01 00 ....
0045D880 01 00 01 00 01 00 01 00 ....
0045D888 01 00 01 00 01 00 01 00 ....
0045D890 10 00 10 00 10 00 10 00 ....
0045D898 10 00 10 00 82 00 82 00 ..??
0045D8A0 82 00 82 00 82 00 82 00 ????
0045D8A8 02 00 02 00 02 00 02 00 ....
0045D8B0 02 00 02 00 02 00 02 00 ....
0045D8B8 02 00 02 00 02 00 02 00 ....
0045D8C0 02 00 02 00 02 00 02 00 ....
0045D8C8 02 00 02 00 02 00 02 00 ....
0045D8D0 10 00 10 00 10 00 10 00 ....