以下是该CrackMe的注册码算法，错误之处，请指正。
一、注册时，注册码写入CMOS中
:00401660 55 push ebp
:00401661 56 push esi
:00401662 57 push edi
:00401663 8BE9 mov ebp, ecx
:00401665 6A01 push 00000001
:00401667 E82BC60000 call 0040DC97
:0040166C 8BB510010000 mov esi, dword ptr [ebp+00000110] ; esi-->注册码
:00401672 32C9 xor cl, cl
:00401674 33C0 xor eax, eax
:00401676 8B7EF8 mov edi, dword ptr [esi-08]
:00401679 85FF test edi, edi
:0040167B 7E0C jle 00401689
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401687(C)
|
:0040167D 8A1406 mov dl, byte ptr [esi+eax] \
:00401680 02D0 add dl, al \
:00401682 02CA add cl, dl | 注册码计算
:00401684 40 inc eax /
:00401685 3BC7 cmp eax, edi /
:00401687 7CF4 jl 0040167D /
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040167B(C)
|
:00401689 B03F mov al, 3F
:0040168B 6A00 push 00000000
:0040168D E670 out 70, al ; 设置CMOS写入地址
:0040168F 0FBEC1 movsx eax, cl
:00401692 99 cdq
:00401693 B97F000000 mov ecx, 0000007F
* Possible StringData Ref from Data Obj ->"Waring..."
|
:00401698 68F8804100 push 004180F8
:0040169D F7F9 idiv ecx
* Possible StringData Ref from Data Obj ->"Please Restart the Porogram to "
->"Check your regist code."
|
:0040169F 68C0804100 push 004180C0
:004016A4 8BCD mov ecx, ebp
:004016A6 8AC2 mov al, dl
:004016A8 E671 out 71, al ; 写入CMOS中
:004016AA E88CBE0000 call 0040D53B
:004016AF 5F pop edi
:004016B0 5E pop esi
:004016B1 5D pop ebp
:004016B2 C3 ret
二、软件启动时判断：
* Reference To: USER32.SendMessageA, Ord:0214h
|
:0040145F 8B3D7C334100 mov edi, dword ptr [0041337C]
:00401465 50 push eax
:00401466 6A01 push 00000001
:00401468 6880000000 push 00000080
:0040146D 51 push ecx
:0040146E FFD7 call edi
:00401470 8B9614010000 mov edx, dword ptr [esi+00000114]
:00401476 8B461C mov eax, dword ptr [esi+1C]
:00401479 52 push edx
:0040147A 6A00 push 00000000
:0040147C 6880000000 push 00000080
:00401481 50 push eax
:00401482 FFD7 call edi
:00401484 B03F mov al, 3F
:00401486 E670 out 70, al ; 设置CMOS读取地址
:00401488 E471 in al, 71 ; 读取CMOS值，并存入AL中
:0040148A 0FBEC0 movsx eax, al
:0040148D 83F851 cmp eax, 00000051 ; 这里相等即可
:00401490 752D jne 004014BF
:00401492 6A00 push 00000000
:00401494 8D8ED4000000 lea ecx, dword ptr [esi+000000D4]
:0040149A E872D20000 call 0040E711
:0040149F 6A00 push 00000000
:004014A1 8D8E98000000 lea ecx, dword ptr [esi+00000098]
:004014A7 E865D20000 call 0040E711
:004014AC 83C65C add esi, 0000005C
* Possible StringData Ref from Data Obj ->"REGISTED,Email to wocy@263.net"
|
:004014AF 68A0804100 push 004180A0
:004014B4 8BCE mov ecx, esi
:004014B6 E8E0D10000 call 0040E69B
:004014BB 6A01 push 00000001
:004014BD EB2B jmp 004014EA
注册码算法：注册码第1位+0+注册码第2位+1+注册码第3位+2+注册码第4位+3+......+注册码第n位+(n-1)==0x51H
lijing, 2001.3.14
标 题:附上：Crackmex01e 关键原程式（VC60)。 (1千字)
发信人:wocy
时 间:2001-3-15 0:28:24
详细信息:
发信人:wocy
时 间:2001-3-15 0:28:24
详细信息:
此程式是根据注册号得一个效验值，存入cmos 得0x3f处，在启动程式得时候判断这个效验值，为81d,即可。下面是关键原代码
cmoscoolv1 Cmos信息比较程式 htpp://wocy.top263.net/soft/cmoscoolv1.zip
//////crate the verify code and save it when press the bottom ok
void CCrackmex01eDlg::Onok() //Press the buttom ok the do here
{
// TODO: Add your control notification handler code here
char ch;
char s;
UpdateData(TRUE);
int i;
for(i=0,s=0;i<m_code.GetLength ();i++) //the var m_code is your input regist code.
{
ch=m_code.GetAt(i); //get the no.x char to ch
s+=ch; //the s is the verify code
s+=i;
}
s%=127; //save the low 7 bit
_outp(0x70,0x3f); //save v.code to cmos
_outp(0x71,s);
MessageBox("Please Restart the Porogram to Check your regist code.","Waring..."); //show the dialog waring.
}
////////verify the saved code and to do the next work when begin open the program.
int i;
_outp(0x70,0x3f); //read the saved verify code
i=_inp(0x71);
if(i==81) //==81 then ...else ....
{
m_ok.ShowWindow(0); //unshow the ok bottom
m_edit.ShowWindow (0); //unshow the edit bottom
m_reg.SetWindowText("REGISTED,Email to wocy@263.net");
m_reg.ShowWindow(1); //show the text about me.
}
else //Un.....
{
m_ok.ShowWindow(1);
m_edit.ShowWindow (1);
m_reg.SetWindowText("REGISTED,Email to wocy@263.net");
m_reg.ShowWindow(0);
}
good luck.