RER DVD to 3GP Converter 3.2.0.0825算法分析

tianxj · 发表于 2008-9-12 12:34:14

【破文标题】RER DVD to 3GP Converter 3.2.0.0825算法分析
【破文作者】tianxj
【作者邮箱】tianxj_2007@126.com
【作者主页】WwW.ChiNaPYG.CoM
【破解工具】PEiD,OD
【破解平台】Windows XP
【软件名称】RER DVD to 3GP Converter 3.2.0.0825
【软件大小】26217KB
【软件类别】国外软件/视频转换
【软件授权】共享版
【软件语言】英文
【运行环境】Win9x/Me/NT/2000/XP/2003
【更新时间】2008-9-8
【原版下载】华军软件园
【保护方式】注册码
【软件简介】RERDVD的3gp转换器可以转换的DVD文件的移动电话3gp/3g2视频和MP3音频。您可以在完成转换的任务，与3个简单的步骤，您可以享受无损质量，和您最喜爱的视频，音频。
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------
【破解内容】
--------------------------------------------------------------
**************************************************************
一、运行程序，进行注册，输入错误的注册信息进行检测，有提示信息
"Activation Failed! Invalid license code."
**************************************************************
二、用PEiD对DVDto3GPConverter.exe查壳，为 Microsoft Visual C++ 7.0 Method2 [Debug]
**************************************************************
三、运行OD，打开DVDto3GPConverter.exe,用F12暂停发现
==============================================================
0012DBE0 77D505CF ? USER32.MessageBoxExA                                                                USER32.77D505CA
         0012DBDC
0012DBE4 003C090E    hOwner = 003C090E ('Activate RER DVD to 3GP Conve...',class='#32770',parent=008A089
0012DBE8 00464A38    Text =
0012DBEC 00467B38    Title = "Failed"
0012DBF0 00000040    Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0012DBF4 00000000    LanguageID = 0 (LANG_NEUTRAL)
0012DBFC 7C1CE579 ? USER32.MessageBoxA                                                                MFC71.7C1CE573
         0012DBF8
0012DC00 003C090E    hOwner = 003C090E ('Activate RER DVD to 3GP Conve...',class='#32770',parent=008A089
0012DC04 00464A38    Text = "Activation Failed! Invalid license code."
0012DC08 00467B38    Title = "Failed"
0012DC0C 00000040    Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0012DC14 00401EBC ? <JMP.&MFC71.#4104>
DVDto3GP.00401EB7
==============================================================

00401DA0 . 6A FF PUSH -1
00401DA2 . 68 1D064200 PUSH DVDto3GP.0042061D ; SE 处理程序安装
00401DA7 . 64:A1 0000000>MOV EAX,DWORD PTR FS:[0]
00401DAD . 50 PUSH EAX
00401DAE . 64:8925 00000>MOV DWORD PTR FS:[0],ESP
00401DB5 . 83EC 0C SUB ESP,0C
00401DB8 . 56 PUSH ESI
00401DB9 . 8BF1 MOV ESI,ECX
00401DBB . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
00401DBF . FF15 38424200 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199
00401DC5 . 8D4424 04 LEA EAX,DWORD PTR SS:[ESP+4]
00401DC9 . 50 PUSH EAX
00401DCA . 8D4E 74 LEA ECX,DWORD PTR DS:[ESI+74]
00401DCD . C74424 1C 000>MOV DWORD PTR SS:[ESP+1C],0
00401DD5 . E8 96DB0100 CALL <JMP.&MFC71.#3761> ; //取用户名
00401DDA . 51 PUSH ECX
00401DDB . 8D5424 08 LEA EDX,DWORD PTR SS:[ESP+8]
00401DDF . 8BCC MOV ECX,ESP
00401DE1 . 896424 10 MOV DWORD PTR SS:[ESP+10],ESP
00401DE5 . 52 PUSH EDX
00401DE6 . FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
00401DEC . 8B8E C8000000 MOV ECX,DWORD PTR DS:[ESI+C8]
00401DF2 . FF15 28404200 CALL DWORD PTR DS:[<&Control.DvdProxy::RegisteProduct>] ; Control.DvdProxy::RegisteProduct
00401DF8 . 85C0 TEST EAX,EAX
00401DFA . 8B86 CC000000 MOV EAX,DWORD PTR DS:[ESI+CC]
00401E00 . 75 6A JNZ SHORT DVDto3GP.00401E6C
00401E02 . 05 5C010000 ADD EAX,15C
00401E07 . 50 PUSH EAX
00401E08 . 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]
00401E0C . FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
00401E12 . 8B8E CC000000 MOV ECX,DWORD PTR DS:[ESI+CC]
00401E18 . 81C1 60010000 ADD ECX,160
00401E1E . 51 PUSH ECX
00401E1F . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
00401E23 . C64424 1C 01 MOV BYTE PTR SS:[ESP+1C],1
00401E28 . FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
00401E2E . 6A 40 PUSH 40
00401E30 . 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]
00401E34 . C64424 1C 02 MOV BYTE PTR SS:[ESP+1C],2
00401E39 . FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD
00401E3F . 50 PUSH EAX
00401E40 . 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]
00401E44 . FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD
00401E4A . 50 PUSH EAX
00401E4B . 8BCE MOV ECX,ESI
00401E4D . E8 0CDB0100 CALL <JMP.&MFC71.#4104>
00401E52 . 8B16 MOV EDX,DWORD PTR DS:[ESI]
00401E54 . 8BCE MOV ECX,ESI
00401E56 . FF92 54010000 CALL DWORD PTR DS:[EDX+154]
00401E5C . 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
00401E60 . FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00401E66 . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
00401E6A . EB 5E JMP SHORT DVDto3GP.00401ECA
00401E6C > 05 64010000 ADD EAX,164
00401E71 . 50 PUSH EAX
00401E72 . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
00401E76 . FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
00401E7C . 8B8E CC000000 MOV ECX,DWORD PTR DS:[ESI+CC]
00401E82 . 81C1 68010000 ADD ECX,168
00401E88 . 51 PUSH ECX
00401E89 . 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]
00401E8D . C64424 1C 03 MOV BYTE PTR SS:[ESP+1C],3
00401E92 . FF15 F8414200 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
00401E98 . 6A 40 PUSH 40
00401E9A . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
00401E9E . C64424 1C 04 MOV BYTE PTR SS:[ESP+1C],4
00401EA3 . FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD
00401EA9 . 50 PUSH EAX
00401EAA . 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]
00401EAE . FF15 F4414200 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD
00401EB4 . 50 PUSH EAX
00401EB5 . 8BCE MOV ECX,ESI
00401EB7 . E8 A2DA0100 CALL <JMP.&MFC71.#4104> ; //错误提示
00401EBC . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
00401EC0 . FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00401EC6 . 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
00401ECA > FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00401ED0 . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
00401ED4 . FF15 E0414200 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00401EDA . 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10]
00401EDE . 64:890D 00000>MOV DWORD PTR FS:[0],ECX
00401EE5 . 5E POP ESI
00401EE6 . 83C4 18 ADD ESP,18
00401EE9 . C3 RETN
==============================================================
0037ADA0 > 6A FF PUSH -1
0037ADA2 68 E9973800 PUSH Control.003897E9
0037ADA7 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0037ADAD 50 PUSH EAX
0037ADAE 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
0037ADB5 51 PUSH ECX
0037ADB6 56 PUSH ESI
0037ADB7 57 PUSH EDI
0037ADB8 8BF1 MOV ESI,ECX
0037ADBA 51 PUSH ECX
0037ADBB 8D4424 20 LEA EAX,DWORD PTR SS:[ESP+20]
0037ADBF 8BCC MOV ECX,ESP
0037ADC1 896424 0C MOV DWORD PTR SS:[ESP+C],ESP
0037ADC5 50 PUSH EAX
0037ADC6 C74424 1C 00000>MOV DWORD PTR SS:[ESP+1C],0
0037ADCE FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
0037ADD4 8B4E 0C MOV ECX,DWORD PTR DS:[ESI+C]
0037ADD7 E8 84B9FFFF CALL Control.AVProxy::RegisteProduct ; //F7
0037ADDC 8BF8 MOV EDI,EAX
0037ADDE 85FF TEST EDI,EDI
0037ADE0 75 0A JNZ SHORT Control.0037ADEC
0037ADE2 8B4E 08 MOV ECX,DWORD PTR DS:[ESI+8]
0037ADE5 C741 20 0100000>MOV DWORD PTR DS:[ECX+20],1
0037ADEC 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
0037ADF0 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
0037ADF6 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
0037ADFA 8BC7 MOV EAX,EDI
0037ADFC 5F POP EDI
0037ADFD 64:890D 0000000>MOV DWORD PTR FS:[0],ECX
0037AE04 5E POP ESI
0037AE05 83C4 10 ADD ESP,10
0037AE08 C2 0400 RETN 4
==============================================================
00376760 > 6A FF PUSH -1
00376762 68 28923800 PUSH Control.00389228
00376767 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0037676D 50 PUSH EAX
0037676E 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
00376775 81EC 54040000 SUB ESP,454
0037677B A1 F4553900 MOV EAX,DWORD PTR DS:[3955F4]
00376780 53 PUSH EBX
00376781 55 PUSH EBP
00376782 56 PUSH ESI
00376783 898424 5C040000 MOV DWORD PTR SS:[ESP+45C],EAX
0037678A 57 PUSH EDI
0037678B 8BE9 MOV EBP,ECX
0037678D 8D4424 20 LEA EAX,DWORD PTR SS:[ESP+20]
00376791 33DB XOR EBX,EBX
00376793 50 PUSH EAX
00376794 899C24 70040000 MOV DWORD PTR SS:[ESP+470],EBX
0037679B 83CE FF OR ESI,FFFFFFFF
0037679E E8 2DD1FFFF CALL Control.003738D0
003767A3 8BC8 MOV ECX,EAX
003767A5 E8 96C7FFFF CALL Control.PgcConfigData::GetPgcName
003767AA 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34]
003767AE C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],1
003767B6 E8 1B150100 CALL <JMP.&Util.RegUtil::RegUtil>
003767BB 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]
003767BF C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],2
003767C7 E8 F40E0100 CALL Control.003876C0
003767CC 51 PUSH ECX
003767CD 8D9424 78040000 LEA EDX,DWORD PTR SS:[ESP+478]
003767D4 8BCC MOV ECX,ESP
003767D6 896424 14 MOV DWORD PTR SS:[ESP+14],ESP
003767DA 52 PUSH EDX
003767DB C68424 74040000>MOV BYTE PTR SS:[ESP+474],3
003767E3 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
003767E9 51 PUSH ECX
003767EA 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28]
003767EE 8BCC MOV ECX,ESP
003767F0 896424 20 MOV DWORD PTR SS:[ESP+20],ESP
003767F4 50 PUSH EAX
003767F5 C68424 78040000>MOV BYTE PTR SS:[ESP+478],4
003767FD FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
00376803 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
00376807 C68424 74040000>MOV BYTE PTR SS:[ESP+474],3
0037680F E8 3C120100 CALL Control.00387A50 ; //F7
00376814 0FB6C0 MOVZX EAX,AL
00376817 3BC3 CMP EAX,EBX
00376819 0F84 50020000 JE Control.00376A6F
0037681F 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
00376823 FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199
00376829 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]
0037682D 51 PUSH ECX
0037682E C68424 70040000>MOV BYTE PTR SS:[ESP+470],5
00376836 E8 71140100 CALL <JMP.&Util.AppUtil::GetAppPath>
0037683B 8B10 MOV EDX,DWORD PTR DS:[EAX]
0037683D 68 DCB33800 PUSH Control.0038B3DC ; ASCII "config.ini"
00376842 52 PUSH EDX
00376843 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28]
00376847 68 CCB33800 PUSH Control.0038B3CC ; ASCII "%s\config\%s"
0037684C 50 PUSH EAX
0037684D C68424 80040000>MOV BYTE PTR SS:[ESP+480],6
00376855 FF15 E0B03800 CALL DWORD PTR DS:[<&MFC71.#2322>] ; MFC71.7C146A9D
0037685B 83C4 14 ADD ESP,14
0037685E 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]
00376862 C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],5
0037686A FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00376870 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18]
00376874 E8 45140100 CALL <JMP.&Util.ProfileUtil::ProfileUtil>
00376879 51 PUSH ECX
0037687A 8BCC MOV ECX,ESP
0037687C 896424 14 MOV DWORD PTR SS:[ESP+14],ESP
00376880 68 10B43800 PUSH Control.0038B410 ; ASCII "RegPath"
00376885 C68424 74040000>MOV BYTE PTR SS:[ESP+474],7
0037688D FF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C
00376893 51 PUSH ECX
00376894 8BCC MOV ECX,ESP
00376896 896424 40 MOV DWORD PTR SS:[ESP+40],ESP
0037689A 68 C4B33800 PUSH Control.0038B3C4 ; ASCII "convert"
0037689F C68424 78040000>MOV BYTE PTR SS:[ESP+478],8
003768A7 FF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C
003768AD 51 PUSH ECX
003768AE 8D5424 28 LEA EDX,DWORD PTR SS:[ESP+28]
003768B2 8BCC MOV ECX,ESP
003768B4 896424 38 MOV DWORD PTR SS:[ESP+38],ESP
003768B8 52 PUSH EDX
003768B9 C68424 7C040000>MOV BYTE PTR SS:[ESP+47C],9
003768C1 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
003768C7 8D4424 34 LEA EAX,DWORD PTR SS:[ESP+34]
003768CB 50 PUSH EAX
003768CC 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28]
003768D0 C68424 7C040000>MOV BYTE PTR SS:[ESP+47C],7
003768D8 E8 DB130100 CALL <JMP.&Util.ProfileUtil::GetContentFromProfile>
003768DD 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]
003768E1 C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],0A
003768E9 E8 E8130100 CALL <JMP.&Util.RegUtil::RegUtil>
003768EE 33C0 XOR EAX,EAX
003768F0 B9 00010000 MOV ECX,100
003768F5 8D7C24 60 LEA EDI,DWORD PTR SS:[ESP+60]
003768F9 F3:AB REP STOS DWORD PTR ES:[EDI]
003768FB 8D4C24 60 LEA ECX,DWORD PTR SS:[ESP+60]
003768FF 51 PUSH ECX
00376900 8D8C24 78040000 LEA ECX,DWORD PTR SS:[ESP+478]
00376907 C68424 70040000>MOV BYTE PTR SS:[ESP+470],0B
0037690F FF15 D0B03800 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD
00376915 50 PUSH EAX
00376916 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
0037691A E8 A10F0100 CALL Control.003878C0
0037691F 8D5424 60 LEA EDX,DWORD PTR SS:[ESP+60]
00376923 52 PUSH EDX
00376924 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34]
00376928 FF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C
0037692E 51 PUSH ECX
0037692F 8D4424 34 LEA EAX,DWORD PTR SS:[ESP+34]
00376933 8BCC MOV ECX,ESP
00376935 896424 30 MOV DWORD PTR SS:[ESP+30],ESP
00376939 50 PUSH EAX
0037693A C68424 74040000>MOV BYTE PTR SS:[ESP+474],0C
00376942 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
00376948 C68424 70040000>MOV BYTE PTR SS:[ESP+470],0D
00376950 51 PUSH ECX
00376951 8BCC MOV ECX,ESP
00376953 896424 40 MOV DWORD PTR SS:[ESP+40],ESP
00376957 68 B8B53800 PUSH Control.0038B5B8 ; ASCII "SerialCode"
0037695C FF15 DCB03800 CALL DWORD PTR DS:[<&MFC71.#304>] ; MFC71.7C16A59C
00376962 51 PUSH ECX
00376963 8D5424 34 LEA EDX,DWORD PTR SS:[ESP+34]
00376967 8BCC MOV ECX,ESP
00376969 896424 1C MOV DWORD PTR SS:[ESP+1C],ESP
0037696D 52 PUSH EDX
0037696E C68424 7C040000>MOV BYTE PTR SS:[ESP+47C],0E
00376976 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
0037697C 68 01000080 PUSH 80000001
00376981 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34]
00376985 C68424 7C040000>MOV BYTE PTR SS:[ESP+47C],0C
0037698D E8 7A130100 CALL <JMP.&Util.RegUtil::SetRegContent>
00376992 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C]
00376996 8BF0 MOV ESI,EAX
00376998 FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199
0037699E 8D4C24 40 LEA ECX,DWORD PTR SS:[ESP+40]
003769A2 FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199
003769A8 8D4C24 44 LEA ECX,DWORD PTR SS:[ESP+44]
003769AC FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199
003769B2 8D4C24 48 LEA ECX,DWORD PTR SS:[ESP+48]
003769B6 FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199
003769BC 8D4C24 5C LEA ECX,DWORD PTR SS:[ESP+5C]
003769C0 FF15 C8B03800 CALL DWORD PTR DS:[<&MFC71.#310>] ; MFC71.7C173199
003769C6 895C24 4C MOV DWORD PTR SS:[ESP+4C],EBX
003769CA 895C24 58 MOV DWORD PTR SS:[ESP+58],EBX
003769CE 895C24 54 MOV DWORD PTR SS:[ESP+54],EBX
003769D2 83EC 24 SUB ESP,24
003769D5 8D4424 60 LEA EAX,DWORD PTR SS:[ESP+60]
003769D9 8BCC MOV ECX,ESP
003769DB 896424 50 MOV DWORD PTR SS:[ESP+50],ESP
003769DF 50 PUSH EAX
003769E0 C68424 94040000>MOV BYTE PTR SS:[ESP+494],0F
003769E8 C74424 78 64000>MOV DWORD PTR SS:[ESP+78],64
003769F0 E8 0BF6FFFF CALL Control.00376000
003769F5 8B4D 00 MOV ECX,DWORD PTR SS:[EBP]
003769F8 E8 3D120100 CALL <JMP.&Convert.AVConverterBridge::SetProductInfo>
003769FD 8D4C24 5C LEA ECX,DWORD PTR SS:[ESP+5C]
00376A01 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00376A07 8D4C24 48 LEA ECX,DWORD PTR SS:[ESP+48]
00376A0B FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00376A11 8D4C24 44 LEA ECX,DWORD PTR SS:[ESP+44]
00376A15 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00376A1B 8D4C24 40 LEA ECX,DWORD PTR SS:[ESP+40]
00376A1F FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00376A25 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C]
00376A29 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00376A2F 8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+30]
00376A33 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00376A39 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]
00376A3D C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],0A
00376A45 E8 80120100 CALL <JMP.&Util.RegUtil::~RegUtil>
00376A4A 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28]
00376A4E FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00376A54 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18]
00376A58 C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],5
00376A60 E8 4D120100 CALL <JMP.&Util.ProfileUtil::~ProfileUtil>
00376A65 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
00376A69 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00376A6F 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]
00376A73 C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],2
00376A7B E8 80A5FFFF CALL Control.DvdData::Check
00376A80 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34]
00376A84 C68424 6C040000>MOV BYTE PTR SS:[ESP+46C],1
00376A8C E8 39120100 CALL <JMP.&Util.RegUtil::~RegUtil>
00376A91 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20]
00376A95 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00376A9B 8D8C24 74040000 LEA ECX,DWORD PTR SS:[ESP+474]
00376AA2 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00376AA8 8B8C24 64040000 MOV ECX,DWORD PTR SS:[ESP+464]
00376AAF 64:890D 0000000>MOV DWORD PTR FS:[0],ECX
00376AB6 8B8C24 60040000 MOV ECX,DWORD PTR SS:[ESP+460]
00376ABD 8BC6 MOV EAX,ESI
00376ABF E8 CD150100 CALL Control.00388091
00376AC4 5F POP EDI
00376AC5 5E POP ESI
00376AC6 5D POP EBP
00376AC7 5B POP EBX
00376AC8 81C4 60040000 ADD ESP,460
00376ACE C2 0400 RETN 4
==============================================================
00387A50 6A FF PUSH -1
00387A52 68 22AD3800 PUSH Control.0038AD22
00387A57 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
00387A5D 50 PUSH EAX
00387A5E 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
00387A65 81EC B8000000 SUB ESP,0B8
00387A6B 53 PUSH EBX
00387A6C 55 PUSH EBP
00387A6D 56 PUSH ESI
00387A6E 8BF1 MOV ESI,ECX
00387A70 57 PUSH EDI
00387A71 897424 14 MOV DWORD PTR SS:[ESP+14],ESI
00387A75 51 PUSH ECX
00387A76 8D8424 E0000000 LEA EAX,DWORD PTR SS:[ESP+E0]
00387A7D 8BCC MOV ECX,ESP
00387A7F 896424 14 MOV DWORD PTR SS:[ESP+14],ESP
00387A83 50 PUSH EAX
00387A84 C78424 D8000000>MOV DWORD PTR SS:[ESP+D8],1
00387A8F 33FF XOR EDI,EDI
00387A91 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
00387A97 8BCE MOV ECX,ESI
00387A99 E8 32FCFFFF CALL Control.003876D0 ; //注册码是否符合要求的格式
00387A9E 84C0 TEST AL,AL
00387AA0 0F84 49010000 JE Control.00387BEF
00387AA6 8B2D 80B13800 MOV EBP,DWORD PTR DS:[<&MSVCR71.toupper>] ; MSVCR71.toupper
00387AAC 33DB XOR EBX,EBX
00387AAE 8D7424 68 LEA ESI,DWORD PTR SS:[ESP+68]
00387AB2 83FF 04 CMP EDI,4
00387AB5 75 04 JNZ SHORT Control.00387ABB
00387AB7 33FF XOR EDI,EDI
00387AB9 EB 23 JMP SHORT Control.00387ADE
00387ABB 53 PUSH EBX
00387ABC 8D8C24 E0000000 LEA ECX,DWORD PTR SS:[ESP+E0]
00387AC3 FF15 54B13800 CALL DWORD PTR DS:[<&MFC71.#865>] ; //逐位取试练码ASC值
00387AC9 0FBEC8 MOVSX ECX,AL
00387ACC 51 PUSH ECX
00387ACD FFD5 CALL EBP
00387ACF 0FBED0 MOVSX EDX,AL
00387AD2 83EA 41 SUB EDX,41 ; //EDX=EDX-41
00387AD5 83C4 04 ADD ESP,4
00387AD8 8916 MOV DWORD PTR DS:[ESI],EDX
00387ADA 47 INC EDI
00387ADB 83C6 04 ADD ESI,4
00387ADE 43 INC EBX
00387ADF 83FB 18 CMP EBX,18
00387AE2 ^ 7C CE JL SHORT Control.00387AB2 ; //循环,分别将试练码中的字母的ASC值减41h保存
00387AE4 68 80000000 PUSH 80
00387AE9 51 PUSH ECX
00387AEA 8D8424 E0000000 LEA EAX,DWORD PTR SS:[ESP+E0]
00387AF1 8BCC MOV ECX,ESP
00387AF3 896424 18 MOV DWORD PTR SS:[ESP+18],ESP
00387AF7 50 PUSH EAX
00387AF8 FF15 B8B03800 CALL DWORD PTR DS:[<&MFC71.#297>] ; MFC71.7C14E575
00387AFE 8D8C24 C0000000 LEA ECX,DWORD PTR SS:[ESP+C0]
00387B05 51 PUSH ECX
00387B06 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20]
00387B0A E8 81FCFFFF CALL Control.00387790
00387B0F 8B5424 68 MOV EDX,DWORD PTR SS:[ESP+68]
00387B13 8B4C24 70 MOV ECX,DWORD PTR SS:[ESP+70]
00387B17 8B4424 6C MOV EAX,DWORD PTR SS:[ESP+6C]
00387B1B 895424 18 MOV DWORD PTR SS:[ESP+18],EDX
00387B1F 8B5424 74 MOV EDX,DWORD PTR SS:[ESP+74]
00387B23 894C24 20 MOV DWORD PTR SS:[ESP+20],ECX
00387B27 8B4C24 7C MOV ECX,DWORD PTR SS:[ESP+7C]
00387B2B 894424 1C MOV DWORD PTR SS:[ESP+1C],EAX
00387B2F 8B4424 78 MOV EAX,DWORD PTR SS:[ESP+78]
00387B33 895424 24 MOV DWORD PTR SS:[ESP+24],EDX
00387B37 8B9424 80000000 MOV EDX,DWORD PTR SS:[ESP+80]
00387B3E 894C24 2C MOV DWORD PTR SS:[ESP+2C],ECX
00387B42 8B8C24 88000000 MOV ECX,DWORD PTR SS:[ESP+88]
00387B49 894424 28 MOV DWORD PTR SS:[ESP+28],EAX
00387B4D 8B8424 84000000 MOV EAX,DWORD PTR SS:[ESP+84]
00387B54 895424 30 MOV DWORD PTR SS:[ESP+30],EDX
00387B58 8B9424 8C000000 MOV EDX,DWORD PTR SS:[ESP+8C]
00387B5F 894C24 38 MOV DWORD PTR SS:[ESP+38],ECX
00387B63 8B8C24 94000000 MOV ECX,DWORD PTR SS:[ESP+94]
00387B6A 894424 34 MOV DWORD PTR SS:[ESP+34],EAX
00387B6E 8B8424 90000000 MOV EAX,DWORD PTR SS:[ESP+90]
00387B75 895424 3C MOV DWORD PTR SS:[ESP+3C],EDX
00387B79 8B9424 98000000 MOV EDX,DWORD PTR SS:[ESP+98]
00387B80 894C24 44 MOV DWORD PTR SS:[ESP+44],ECX
00387B84 8B8C24 A0000000 MOV ECX,DWORD PTR SS:[ESP+A0]
00387B8B 894424 40 MOV DWORD PTR SS:[ESP+40],EAX
00387B8F 8B8424 9C000000 MOV EAX,DWORD PTR SS:[ESP+9C]
00387B96 895424 48 MOV DWORD PTR SS:[ESP+48],EDX
00387B9A 8B9424 A4000000 MOV EDX,DWORD PTR SS:[ESP+A4]
00387BA1 894C24 50 MOV DWORD PTR SS:[ESP+50],ECX
00387BA5 894424 4C MOV DWORD PTR SS:[ESP+4C],EAX
00387BA9 895424 54 MOV DWORD PTR SS:[ESP+54],EDX
00387BAD B3 01 MOV BL,1
00387BAF 33C9 XOR ECX,ECX
00387BB1 8B6C0C 18 MOV EBP,DWORD PTR SS:[ESP+ECX+18] ; //试练码第i位运算值
00387BB5 8B840C B8000000 MOV EAX,DWORD PTR SS:[ESP+ECX+B8] ; //根据"ER DVD to 3GP Converter"算出来的4个常数
00387BBC 8B7C0C 28 MOV EDI,DWORD PTR SS:[ESP+ECX+28] ; //试练码第i+5位运算值
00387BC0 8B740C 48 MOV ESI,DWORD PTR SS:[ESP+ECX+48] ; //试练码第i+10位运算值
00387BC4 8B540C 38 MOV EDX,DWORD PTR SS:[ESP+ECX+38] ; //试练码第i+15位运算值
00387BC8 03C5 ADD EAX,EBP
00387BCA 03C7 ADD EAX,EDI
00387BCC 03C6 ADD EAX,ESI
00387BCE 03C2 ADD EAX,EDX ; //四数之和
00387BD0 99 CDQ
00387BD1 BE 1A000000 MOV ESI,1A
00387BD6 F7FE IDIV ESI
00387BD8 3B940C A8000000 CMP EDX,DWORD PTR SS:[ESP+ECX+A8] ; //除以1Ah的的余数和试练码第i+20位运算值比较
00387BDF 89540C 58 MOV DWORD PTR SS:[ESP+ECX+58],EDX
00387BE3 75 0A JNZ SHORT Control.00387BEF ; //不等则跳
00387BE5 83C1 04 ADD ECX,4
00387BE8 83F9 10 CMP ECX,10
00387BEB ^ 7C C4 JL SHORT Control.00387BB1 ; //循环
00387BED EB 02 JMP SHORT Control.00387BF1
00387BEF 32DB XOR BL,BL
00387BF1 8D8C24 D8000000 LEA ECX,DWORD PTR SS:[ESP+D8]
00387BF8 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00387BFE 8D8C24 DC000000 LEA ECX,DWORD PTR SS:[ESP+DC]
00387C05 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
00387C0B 8B8C24 C8000000 MOV ECX,DWORD PTR SS:[ESP+C8]
00387C12 5F POP EDI
00387C13 5E POP ESI
00387C14 5D POP EBP
00387C15 8AC3 MOV AL,BL
00387C17 64:890D 0000000>MOV DWORD PTR FS:[0],ECX
00387C1E 5B POP EBX
00387C1F 81C4 C4000000 ADD ESP,0C4
00387C25 C2 0800 RETN 8
==============================================================
003876D0 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
003876D6 6A FF PUSH -1
003876D8 68 F9AC3800 PUSH Control.0038ACF9
003876DD 50 PUSH EAX
003876DE 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
003876E5 53 PUSH EBX
003876E6 56 PUSH ESI
003876E7 57 PUSH EDI
003876E8 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
003876EC C74424 14 00000>MOV DWORD PTR SS:[ESP+14],0
003876F4 33FF XOR EDI,EDI ; //EDI=0
003876F6 FF15 D0B03800 CALL DWORD PTR DS:[<&MFC71.#876>] ; MFC71.7C158BCD
003876FC 8D50 01 LEA EDX,DWORD PTR DS:[EAX+1]
003876FF 90 NOP
00387700 8A08 MOV CL,BYTE PTR DS:[EAX]
00387702 40 INC EAX
00387703 84C9 TEST CL,CL
00387705 ^ 75 F9 JNZ SHORT Control.00387700
00387707 2BC2 SUB EAX,EDX
00387709 83F8 18 CMP EAX,18
0038770C 75 62 JNZ SHORT Control.00387770 ; //注册码长度必须为24位
0038770E 8B1D 80B13800 MOV EBX,DWORD PTR DS:[<&MSVCR71.toupper>] ; MSVCR71.toupper
00387714 33F6 XOR ESI,ESI ; //ESI=0
00387716 EB 08 JMP SHORT Control.00387720
00387718 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
0038771F 90 NOP
00387720 56 PUSH ESI
00387721 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20]
00387725 FF15 54B13800 CALL DWORD PTR DS:[<&MFC71.#865>] ; //逐位取试练码ASC值
0038772B 0FBEC0 MOVSX EAX,AL
0038772E 50 PUSH EAX
0038772F FFD3 CALL EBX
00387731 83C4 04 ADD ESP,4
00387734 83FF 04 CMP EDI,4
00387737 75 08 JNZ SHORT Control.00387741 ; //每隔4位不跳
00387739 3C 2D CMP AL,2D
0038773B 75 33 JNZ SHORT Control.00387770 ; //不是“-”就跳
0038773D 33FF XOR EDI,EDI ; //EDI=0
0038773F EB 09 JMP SHORT Control.0038774A
00387741 3C 41 CMP AL,41
00387743 7C 2B JL SHORT Control.00387770 ; //小于41h则跳,即"A"
00387745 3C 5A CMP AL,5A
00387747 7F 27 JG SHORT Control.00387770 ; //大于5Ah则跳,即"Z"
00387749 47 INC EDI
0038774A 46 INC ESI
0038774B 83FE 18 CMP ESI,18
0038774E ^ 7C D0 JL SHORT Control.00387720 ; //循环
00387750 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
00387754 FF15 C4B03800 CALL DWORD PTR DS:[<&MFC71.#578>] ; MFC71.7C1771B1
0038775A B0 01 MOV AL,1
0038775C 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
00387760 64:890D 0000000>MOV DWORD PTR FS:[0],ECX
00387767 5F POP EDI
00387768 5E POP ESI
00387769 5B POP EBX
0038776A 83C4 0C ADD ESP,0C
0038776D C2 0400 RETN 4

复制代码

**************************************************************
【破解总结】
--------------------------------------------------------------
【算法总结】
1.注册码形式为**X-**X-**X-**X-**X,X为英文大写字母
2.前4组字母可以是任意字母,第5组字母是根据前4组字母运算所得
--------------------------------------------------------------
【算法注册机】
Private Sub Command1_Click()
Dim C(24), X(4), n, i As Integer
Dim M(24) As String
For n = 1 To 20
C(n) = Int(Rnd() * 26 + 65)
M(n) = Chr(C(n))
Next
X(1) = &H4
X(2) = &H14
X(3) = &HA
X(4) = &H0
For i = 1 To 4
C(i + 20) = ((C(i) + C(i + 5) + C(i + 10) + C(i + 15) - &H41 * 4 + X(i)) Mod &H1A) + &H41
M(i + 20) = Chr(C(i + 20))
Next
Text1.Text = M(1) & M(2) & M(3) & M(4) & "-" & M(6) & M(7) & M(8) & M(9) & "-" & M(11) & M(12) & M(13) & M(14) & "-" & M(16)

& M(17) & M(18) & M(19) & "-" & M(21) & M(22) & M(23) & M(24)
End Sub
--------------------------------------------------------------
【注册信息】
保存在
[HKEY_USERS\S-1-5-21-4062119504-2798039762-1529167351-500\Software\RER Soft, Inc.\DVD to 3GP Converter]
删除可以重新玩 ^_^
--------------------------------------------------------------
感谢飘云老大、猫老大、Nisy老大以及很多前辈们的学习教程以及所有帮助过我的论坛兄弟姐妹们！谢谢
提前祝我的论坛兄弟姐妹们中秋节快乐！！
--------------------------------------------------------------
【版权声明】破文是学习的手记，兴趣是成功的源泉；本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!

wgz001 · 发表于 2008-9-12 14:51:50

厉害学习下不知道自己什么时候也能这个样子哦 :loveliness:

qifeon · 发表于 2008-9-12 15:05:00

支持，精彩，学习了。

鬼魅幽灵 · 发表于 2008-9-12 15:19:09

问一下，那个用F12暂停法怎么用？是OD载入后，按F9运行后马上按F12吗？

月之精灵 · 发表于 2008-9-12 15:23:33

学习了，老大最近精进了不少啊/:good

chn-2000 · 发表于 2008-9-12 16:33:16

注册之后不要点击确定

然后F12暂停

具体的可以参考一下视频教程中的过程

老海 · 发表于 2008-9-14 15:05:38

算法分析的很透，在这里学习了。

yoyoaihuahua · 发表于 2008-9-14 18:47:32

回帖支持下楼主

帅有什么用，碰到卒也要到处躲!!QQ图标 office2007 繁体字问道推广人 microsoft office

		自动登录	找回密码
密码			加入我们

[原创] RER DVD to 3GP Converter 3.2.0.0825算法分析

相关帖子

回复 4# 的帖子

.