|:0040ADFA(C)
|
* Possible StringData Ref from Data Obj ->"0123456789"
|
:0040AD47 8B35FC8A4500 mov esi, dword ptr [00458AFC] <<--------字符串“0123456789”的首地址－＞ESI
:0040AD4D 83C9FF or ecx, FFFFFFFF
:0040AD50 8BFE mov edi, esi \
:0040AD52 33C0 xor eax, eax \
:0040AD54 F2 repnz \
:0040AD55 AE scasb 测试“0123456789”的长度－＞ECX
:0040AD56 F7D1 not ecx /
:0040AD58 49 dec ecx /
:0040AD59 8BC3 mov eax, ebx
:0040AD5B 33D2 xor edx, edx
:0040AD5D 8BFE mov edi, esi
:0040AD5F F7F1 div ecx <<--------此处运算后，EDX存放余数
:0040AD61 8BC3 mov eax, ebx
:0040AD63 6A01 push 00000001
:0040AD65 0FBE0C32 movsx ecx, byte ptr [edx+esi] <<-------字符串“0123456789”的每个字符按顺序依次送入ECX，每次循环送入一个
:0040AD69 33D2 xor edx, edx
:0040AD6B F7F5 div ebp <<=======EBP存放用户名长度，始终不变
:0040AD6D 0FBE8210E54500 movsx eax, byte ptr [edx+0045E510] <<---------用户名的第个字符按顺序依次送入EAX，每次循环送入一个，如果用户名长度小于循环次数，则遍历完一次用户名后，重新从用户名的第一位开始
:0040AD74 8BD0 mov edx, eax
:0040AD76 C1E205 shl edx, 05
:0040AD79 03D0 add edx, eax
:0040AD7B 8D0450 lea eax, dword ptr [eax+2*edx]
:0040AD7E 03C8 add ecx, eax
:0040AD80 8BC3 mov eax, ebx
:0040AD82 0FAFC3 imul eax, ebx
:0040AD85 0FAFC3 imul eax, ebx
:0040AD8B 8D1480 lea edx, dword ptr [eax+4*eax]
:0040AD8E 8D0450 lea eax, dword ptr [eax+2*edx]
:0040AD91 03C8 add ecx, eax
:0040AD93 33C0 xor eax, eax
:0040AD95 8BD1 mov edx, ecx
:0040AD97 83C9FF or ecx, FFFFFFFF \
:0040AD9A F2 repnz \
:0040AD9B AE scasb 测试“0123456789”的长度－＞ECX
:0040AD9C F7D1 not ecx /
:0040AD9E 8BC2 mov eax, edx /
:0040ADA0 49 dec ecx /
:0040ADA1 33D2 xor edx, edx
:0040ADA3 F7F1 div ecx <<------运算的余数－＞EDX
:0040ADA5 8D442418 lea eax, dword ptr [esp+18]
:0040ADA9 03D6 add edx, esi <<-------ESI为“0123456789”的首地址
:0040ADAB 52 push edx
:0040ADAC 50 push eax
:0040ADAD E82EEB0000 call 004198E0
:0040ADB2 83C40C add esp, 0000000C
:0040ADB5 85DB test ebx, ebx
:0040ADB7 743D je 0040ADF6 <<------------仅第一次循环时（EBX＝0）跳 \
:0040ADB9 8BC3 mov eax, ebx \
:0040ADBB 33D2 xor edx, edx \
:0040ADBD B903000000 mov ecx, 00000003 此处控制注册码的形式
:0040ADC2 F7F1 div ecx /
:0040ADC4 85D2 test edx, edx /
:0040ADC6 752E jne 0040ADF6 <<---------余数不为0则跳 /
* Possible Reference to Dialog:
|
:0040ADC8 BFEC8B4500 mov edi, 00458BEC
:0040ADCD 83C9FF or ecx, FFFFFFFF
:0040ADD0 33C0 xor eax, eax
:0040ADD2 8D542414 lea edx, dword ptr [esp+14]
:0040ADD6 F2 repnz
:0040ADD7 AE scasb
:0040ADD8 F7D1 not ecx
:0040ADDA 2BF9 sub edi, ecx
:0040ADDC 8BF7 mov esi, edi
:0040ADDE 8BFA mov edi, edx
:0040ADE0 8BD1 mov edx, ecx
:0040ADE2 83C9FF or ecx, FFFFFFFF
:0040ADE5 F2 repnz
:0040ADE6 AE scasb
:0040ADE7 8BCA mov ecx, edx
:0040ADE9 4F dec edi
:0040ADEA C1E902 shr ecx, 02
:0040ADED F3 repz
:0040ADEE A5 movsd
:0040ADEF 8BCA mov ecx, edx
:0040ADF1 83E103 and ecx, 00000003
:0040ADF4 F3 repz
:0040ADF5 A4 movsb
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040ADB7(C), :0040ADC6(C)
|
:0040ADF6 43 inc ebx
:0040ADF7 83FB09 cmp ebx, 00000009
:0040ADFA 0F8247FFFFFF jb 0040AD47
:0040AE00 8D442414 lea eax, dword ptr [esp+14]
:0040AE04 6810E64500 push 0045E610
:0040AE09 50 push eax
:0040AE0A E801570100 call 00420510
:0040AE0F 83C408 add esp, 00000008
:0040AE12 F7D8 neg eax
:0040AE14 5E pop esi
:0040AE15 5B pop ebx
:0040AE16 1BC0 sbb eax, eax
:0040AE18 5F pop edi
:0040AE19 40 inc eax
:0040AE1A 5D pop ebp
:0040AE1B 83C424 add esp, 00000024
:0040AE1E C3 ret
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
算法思想：
将用户名与固定字符串“0123456789”进行运算，以运算结果的EDX（余数）中的值为偏移量，取得此偏移量所指向的“0123456789”中的值并输出，共循环9次。注册码形式为：8267-XXXX-XXX-XX
本例中：
用户名：alphakk/OCG
注册码：8267-7626-579-75
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
＝＝＝＝＝Open Cracking Group＝＝＝＝＝＝
＝
＝
＝Registry Crawler 4.0注册码算法分析
＝ （附：注册机）
＝
＝ CrAcKeD BY alphakk/OCG
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
注册机在：http://www.newclw.com/lllufh/cgi-bin/leoboard.cgi