破解工具：FI
W32Dasm V10增强版
Ollydbg v1.07b DFCG汉化增强版
Keymake 1.73
TC20
以下是破解过程，不对的地方请批评指正：
1、使用FI查一下，发现没有加壳，这下又省了一步。
2、用W32Dsm V10增强版反编译,工具栏 → “参考” → “字串符数据参考”
发现串式"您已经注册成功！
请将您的机器序列号及用户注册",双击他：
双击他后来到这里
|
:004BB726 8BC0 mov eax, eax
:004BB728 53 push ebx
:004BB729 56 push esi
:004BB72A 8BF2 mov esi, edx
:004BB72C 8BD8 mov ebx, eax
:004BB72E 8BC3 mov eax, ebx
:004BB730 E8B7000000 call 004BB7EC 关键调用
:004BB735 3C01 cmp al, 01
:004BB737 7516 jne 004BB74F
* Possible StringData Ref from Code Obj ->"您已经注册成功！
请将您的机器序列号及用户注册?
->"爰锹枷吕?以后升级时备用！"
|
:004BB739 B864B74B00 mov eax, 004BB764
:004BB73E E83D77F8FF call 00442E80
:004BB743 8BD6 mov edx, esi
:004BB745 8BC3 mov eax, ebx
:004BB747 E8D4FFFFFF call 004BB720
:004BB74C 5E pop esi
:004BB74D 5B pop ebx
:004BB74E C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004BB737(C)
|
* Possible StringData Ref from Code Obj ->"您输入的注册号码错误，请向软件提供商索取序列号"
->"！"
|
:004BB74F B8B8B74B00 mov eax, 004BB7B8
:004BB754 E82777F8FF call 00442E80
:004BB759 5E pop esi
:004BB75A 5B pop ebx
:004BB75B C3 ret
3.现在开始动态跟踪并追出注册码来。启动Ollydbg v1.07b DFCG汉化增强版，（感谢lovefire007[DFCG]和飞叶流枫为我们提供这么好的工具，我越来越喜欢了）。F3键打开ZCDYJ.exe。在代码窗口找到004BB730，F2键在此下断点。
4.按F9键运行，启动程序后会弹出注册窗口，点"马上注册" → 我的机器码为"5785775870" →在注册码处输入"87654321" → 点注册 → 程序中断于刚才我们所设的断点004BB730处，F7跟进，来到如下：
004BB7EC $ 55 PUSH EBP
004BB7ED . 8BEC MOV EBP,ESP
004BB7EF . 33C9 XOR ECX,ECX
004BB7F1 . 51 PUSH ECX
004BB7F2 . 51 PUSH ECX
004BB7F3 . 51 PUSH ECX
004BB7F4 . 51 PUSH ECX
004BB7F5 . 51 PUSH ECX
004BB7F6 . 51 PUSH ECX
004BB7F7 . 51 PUSH ECX
004BB7F8 . 53 PUSH EBX
004BB7F9 . 56 PUSH ESI
004BB7FA . 57 PUSH EDI
004BB7FB . 8BF0 MOV ESI,EAX
004BB7FD . 33C0 XOR EAX,EAX
004BB7FF . 55 PUSH EBP
004BB800 . 68 1AB94B00 PUSH ZCDYJ.004BB91A
004BB805 . 64:FF30 PUSH DWORD PTR FS:[EAX]
004BB808 . 64:8920 MOV DWORD PTR FS:[EAX],ESP
004BB80B . 8D55 F0 LEA EDX,DWORD PTR SS:[EBP-10]
004BB80E . 8B86 08030000 MOV EAX,DWORD PTR DS:[ESI+308]
004BB814 . E8 33DFF8FF CALL ZCDYJ.0044974C
004BB819 . 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
004BB81C . 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4] 会看到假注册号87654321
004BB81F . E8 6CD5F4FF CALL ZCDYJ.00408D90
004BB824 . 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
004BB827 . 8B86 24030000 MOV EAX,DWORD PTR DS:[ESI+324]
004BB82D . E8 0E060000 CALL ZCDYJ.004BBE40计算注册号
004BB832 . 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] 会看到正确注册号7920755755
004BB835 . 50 PUSH EAX
004BB836 . 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
004BB839 . 8B86 08030000 MOV EAX,DWORD PTR DS:[ESI+308]
004BB83F . E8 08DFF8FF CALL ZCDYJ.0044974C
004BB844 . 8B55 E8 MOV EDX,DWORD PTR SS:[EBP-18]
004BB847 . 58 POP EAX
004BB848 . E8 EF93F4FF CALL ZCDYJ.00404C3C
004BB84D . 74 07 JE SHORT ZCDYJ.004BB856
004BB84F . 33DB XOR EBX,EBX
004BB851 . E9 86000000 JMP ZCDYJ.004BB8DC
004BB856 > B2 01 MOV DL,1
004BB858 . A1 70B74600 MOV EAX,DWORD PTR DS:[46B770]
004BB85D . E8 0E00FBFF CALL ZCDYJ.0046B870
004BB862 . 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
004BB865 . BA 02000080 MOV EDX,80000002
004BB86A . 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
004BB86D . E8 9E00FBFF CALL ZCDYJ.0046B910
004BB872 . 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
004BB875 . BA 34B94B00 MOV EDX,ZCDYJ.004BB934 ; ASCII "\software\Netants"
004BB87A . E8 5990F4FF CALL ZCDYJ.004048D8
004BB87F . B3 01 MOV BL,1
004BB881 . 33C0 XOR EAX,EAX
004BB883 . 55 PUSH EBP
004BB884 . 68 C8B84B00 PUSH ZCDYJ.004BB8C8
004BB889 . 64:FF30 PUSH DWORD PTR FS:[EAX]
004BB88C . 64:8920 MOV DWORD PTR FS:[EAX],ESP
004BB88F . B1 01 MOV CL,1
004BB891 . 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
004BB894 . 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
004BB897 . E8 B801FBFF CALL ZCDYJ.0046BA54
004BB89C . 84C0 TEST AL,AL
004BB89E . 74 1E JE SHORT ZCDYJ.004BB8BE
004BB8A0 . 8D55 E4 LEA EDX,DWORD PTR SS:[EBP-1C]
004BB8A3 . 8B86 24030000 MOV EAX,DWORD PTR DS:[ESI+324]
004BB8A9 . E8 92050000 CALL ZCDYJ.004BBE40
004BB8AE . 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C]
004BB8B1 . BA 50B94B00 MOV EDX,ZCDYJ.004BB950 ; ASCII "width"
004BB8B6 . 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
004BB8B9 . E8 1205FBFF CALL ZCDYJ.0046BDD0
进来后一直按F8键来到004BB832 . 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
在DX处会看到注册码。用7920755755注册成功。
5.用Keymake1.73版本做它的注册机！
选择F8 → 另类注册机！
程序名称：ZCDYJ.exe
添加数据：
中断地址：004BB832
中断次数：1
第一字节：8B
指令长度：3
选择内存方式 → EDX → 生成。
6.注册号保存在HKEY_LOCAL_MACHINE\Software\Netants的width中，这一点在上边的代码中也可以看出。
删除后成为未注册版。
下面我们看看004BB82D . E8 0E060000 CALL ZCDYJ.004BBE40是如何计算注册码的。
重新启动，在004BB82D下断点，中断后F7跟进会来到：
004BBE40 /$ 55 PUSH EBP
004BBE41 |. 8BEC MOV EBP,ESP
004BBE43 |. 83C4 C4 ADD ESP,-3C
004BBE46 |. 53 PUSH EBX
004BBE47 |. 56 PUSH ESI
004BBE48 |. 57 PUSH EDI
004BBE49 |. 33C9 XOR ECX,ECX
004BBE4B |. 894D C4 MOV DWORD PTR SS:[EBP-3C],ECX
004BBE4E |. 894D C8 MOV DWORD PTR SS:[EBP-38],ECX
004BBE51 |. 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
004BBE54 |. 894D F4 MOV DWORD PTR SS:[EBP-C],ECX
004BBE57 |. 8955 FC MOV DWORD PTR SS:[EBP-4],EDX
004BBE5A |. 8BF8 MOV EDI,EAX
004BBE5C |. 33C0 XOR EAX,EAX
004BBE5E |. 55 PUSH EBP
004BBE5F |. 68 6ABF4B00 PUSH ZCDYJ.004BBF6A
004BBE64 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
004BBE67 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
004BBE6A |. 8BC7 MOV EAX,EDI
004BBE6C |. E8 BFFEFFFF CALL ZCDYJ.004BBD30
004BBE71 |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
004BBE74 |. E8 C789F4FF CALL ZCDYJ.00404840
004BBE79 |. 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
004BBE7C |. 8BC7 MOV EAX,EDI
004BBE7E |. E8 41020000 CALL ZCDYJ.004BC0C4
004BBE83 |. BE 01000000 MOV ESI,1
004BBE88 |. 8D5D CC LEA EBX,DWORD PTR SS:[EBP-34]
004BBE8B |> 8D45 C8 /LEA EAX,DWORD PTR SS:[EBP-38]下面的循环将机器码转16进制到内存75f45c
004BBE8E |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C] 每个数占双字
004BBE91 |. 4E |DEC ESI
004BBE92 |. 85D2 |TEST EDX,EDX
004BBE94 |. 74 05 |JE SHORT ZCDYJ.004BBE9B
004BBE96 |. 3B72 FC |CMP ESI,DWORD PTR DS:[EDX-4]
004BBE99 |. 72 05 |JB SHORT ZCDYJ.004BBEA0
004BBE9B |> E8 6C7BF4FF |CALL ZCDYJ.00403A0C
004BBEA0 |> 46 |INC ESI
004BBEA1 |. 8A5432 FF |MOV DL,BYTE PTR DS:[EDX+ESI-1] 依次取机器码的一位
004BBEA5 |. E8 768BF4FF |CALL ZCDYJ.00404A20
004BBEAA |. 8B45 C8 |MOV EAX,DWORD PTR SS:[EBP-38]
004BBEAD |. E8 82D3F4FF |CALL ZCDYJ.00409234
004BBEB2 |. 8903 |MOV DWORD PTR DS:[EBX],EAX
004BBEB4 |. 46 |INC ESI
004BBEB5 |. 83C3 04 |ADD EBX,4
004BBEB8 |. 83FE 0B |CMP ESI,0B
004BBEBB |.^75 CE \JNZ SHORT ZCDYJ.004BBE8B
004BBEBD |. BE 01000000 MOV ESI,1
004BBEC2 |> BB 01000000 /MOV EBX,1置外循环i初值
004BBEC7 |. 8D4D CC |LEA ECX,DWORD PTR SS:[EBP-34]
004BBECA |> 4E |/DEC ESI
004BBECB |. 83FE 07 ||CMP ESI,7
004BBECE |. 76 05 ||JBE SHORT ZCDYJ.004BBED5
004BBED0 |. E8 377BF4FF ||CALL ZCDYJ.00403A0C
004BBED5 |> 46 ||INC ESI
004BBED6 |. 8B04B7 ||MOV EAX,DWORD PTR DS:[EDI+ESI*4] 取8组变换表中第i组的地址
004BBED9 |. 4B ||DEC EBX
004BBEDA |. 85C0 ||TEST EAX,EAX
004BBEDC |. 74 05 ||JE SHORT ZCDYJ.004BBEE3
004BBEDE |. 3B58 FC ||CMP EBX,DWORD PTR DS:[EAX-4]DS:[EAX-4]为内循环最大次数
004BBEE1 |. 72 05 ||JB SHORT ZCDYJ.004BBEE8
004BBEE3 |> E8 247BF4FF ||CALL ZCDYJ.00403A0C
004BBEE8 |> 43 ||INC EBX
004BBEE9 |. 0FB64418 FF ||MOVZX EAX,BYTE PTR DS:[EAX+EBX-1] 取第i组变换表第j个字符
004BBEEE |. 03C3 ||ADD EAX,EBX 结果加j
004BBEF0 |. 71 05 ||JNO SHORT ZCDYJ.004BBEF7
004BBEF2 |. E8 1D7BF4FF ||CALL ZCDYJ.00403A14
004BBEF7 |> 3301 ||XOR EAX,DWORD PTR DS:[ECX] 异或机器码第j个字符
004BBEF9 |. 51 ||PUSH ECX
004BBEFA |. B9 0A000000 ||MOV ECX,0A送除数10
004BBEFF |. 99 ||CDQ
004BBF00 |. F7F9 ||IDIV ECX
004BBF02 |. 59 ||POP ECX
004BBF03 |. 8911 ||MOV DWORD PTR DS:[ECX],EDX 余数送入暂存区，此暂存区也是机器码的位置。
004BBF05 |. 43 ||INC EBX 内循环循环次数加1
004BBF06 |. 83C1 04 ||ADD ECX,4
004BBF09 |. 83FB 0B ||CMP EBX,0B 内循环循环次数为B-1
004BBF0C |.^75 BC |\JNZ SHORT ZCDYJ.004BBECA
004BBF0E |. 46 |INC ESI 外循环循环次数加1
004BBF0F |. 83FE 09 |CMP ESI,9 外循环循环次数
004BBF12 |.^75 AE \JNZ SHORT ZCDYJ.004BBEC2 未完转上
004BBF14 |. BE 0A000000 MOV ESI,0A
004BBF19 |. 8D5D CC LEA EBX,DWORD PTR SS:[EBP-34]
004BBF1C |> 8D55 C4 /LEA EDX,DWORD PTR SS:[EBP-3C]
004BBF1F |. 8B03 |MOV EAX,DWORD PTR DS:[EBX]
004BBF21 |. E8 AAD2F4FF |CALL ZCDYJ.004091D0
004BBF26 |. 8B55 C4 |MOV EDX,DWORD PTR SS:[EBP-3C]
004BBF29 |. 8D45 F8 |LEA EAX,DWORD PTR SS:[EBP-8]
004BBF2C |. E8 CF8BF4FF |CALL ZCDYJ.00404B00
004BBF31 |. 83C3 04 |ADD EBX,4
004BBF34 |. 4E |DEC ESI
004BBF35 |.^75 E5 \JNZ SHORT ZCDYJ.004BBF1C
004BBF37 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004BBF3A |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
004BBF3D |. E8 5289F4FF CALL ZCDYJ.00404894
004BBF42 |. 33C0 XOR EAX,EAX
004BBF44 |. 5A POP EDX
004BBF45 |. 59 POP ECX
004BBF46 |. 59 POP ECX
004BBF47 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
004BBF4A |. 68 71BF4B00 PUSH ZCDYJ.004BBF71
004BBF4F |> 8D45 C4 LEA EAX,DWORD PTR SS:[EBP-3C]
004BBF52 |. BA 02000000 MOV EDX,2
004BBF57 |. E8 0889F4FF CALL ZCDYJ.00404864
004BBF5C |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
004BBF5F |. BA 02000000 MOV EDX,2
004BBF64 |. E8 FB88F4FF CALL ZCDYJ.00404864
004BBF69 \. C3 RETN
8组变换表为：
序号 地址 内 容 ASCII码
1---013E1814 40 53 59 5E 26 2B 40 21 25 51 @SY^&+@!%Q
2---013E5BB4 21 24 21 40 24 21 23 40 5E 26 !$!@$!#@^&
3---013E2C08 26 31 41 53 44 46 71 77 23 40 &1ASDFqw#@
4---013A2870 53 40 23 25 36 42 62 4E 51 7C S@#%6BbNQ|
5---013E4008 40 34 5E 33 25 36 33 34 35 23 @4^3%6345#
6---013A2888 3C 3E 3F 53 57 31 32 34 33 74 <>?SW1243t
7---013E6F00 24 23 40 25 5E 24 26 2A 2A 28 $#@%^$&**(
8---013E5B84 48 59 4B 28 5E 23 63 61 73 5F HYK(^#cas_
我的表达能力太有限，总觉得没说清楚。如你懂得TC，还是自己看下面的注册机吧。算法不算太难的。
7.相应TC2.0注册机：
#include <stdio.h>
#include <stdlib.h>
#include <conio.h>
void main(void)
{int b[10];
int a[]={0x40,0x53,0x59,0x5E,0x26,0x2B,0x40,0x21,0x25,0x51,
0x21,0x24,0x21,0x40,0x24,0x21,0x23,0x40,0x5E,0x26,
0x26,0x31,0x41,0x53,0x44,0x46,0x71,0x77,0x23,0x40,
0x53,0x40,0x23,0x25,0x36,0x42,0x62,0x4E,0x51,0x7C,
0x40,0x34,0x5E,0x33,0x25,0x36,0x33,0x34,0x35,0x23,
0x3C,0x3E,0x3F,0x53,0x57,0x31,0x32,0x34,0x33,0x74,
0x24,0x23,0x40,0x25,0x5E,0x24,0x26,0x2A,0x2A,0x28,
0x48,0x59,0x4B,0x28,0x5E,0x23,0x63,0x61,0x73,0x5F};
int i,j,s,bv,*p1,*p2;
p1=a;
p2=b;
clrscr();
printf("\n**********************************************************\n");
printf("足彩大赢家网络共享版 V4.1 注册机\n");
printf("作者: 青锋剑客[DFCG] ( 2002/09/20 )\n");
printf("**********************************************************\n\n");
printf("本机序列号 : ");
for (i=0;i<10;i++)
scanf("%1d",&b[i]);
for (i=0;i<8;i++)
for (j=0;j<10;j++)
{s=*(p1+i*10+j)+j+1;
bv=*(p2+j);
b[j]=(s^bv)%10; }
printf("\n你的注册码 : ");
for (i=0;i<10;i++) printf("%d",b[i]);
getch();
}