User Time Administrator 4.6.4.3算法分析

tianxj · 发表于 2008-9-13 18:47:14

【破文标题】User Time Administrator 4.6.4.3算法分析
【破文作者】tianxj
【作者邮箱】[email protected]
【作者主页】WwW.ChiNaPYG.CoM
【破解工具】PEiD,OD
【破解平台】Windows XP
【软件名称】User Time Administrator 4.6.4.3
【软件大小】2758KB
【软件类别】国外软件/开关定时
【软件授权】共享版
【软件语言】英文
【运行环境】Win9x/Me/NT/2000/XP/2003
【更新时间】2008-9-12
【原版下载】自己找一下
【保护方式】注册码
【软件简介】一种实用工具，可让您限制时间为PC用户，并限制他们进入。如果您担心您的孩子可能会花费太多时间上网或玩游戏-或者您不想他/她使用您的电脑当您要么睡觉或离家出走-这种类型的软件提供了一个解决方案。
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------
【破解内容】
--------------------------------------------------------------
**************************************************************
一、运行程序，进行注册，输入错误的注册信息进行检测，有提示信息
"Key is not valid !"
**************************************************************
二、用PEiD对utcc.exe查壳，为 Borland Delphi 6.0 - 7.0
**************************************************************
三、运行OD，打开utcc.exe，用F12暂停法
==============================================================
调用堆栈：主线程, 条目 14
地址=0012F458
堆栈=005ADF5A
函数过程 / 参数=? <JMP.&user32.MessageBoxA>
调用来自=utcc.005ADF55
结构=0012F454
==============================================================

005ADD70 /. 55 PUSH EBP
005ADD71 |. 8BEC MOV EBP, ESP
005ADD73 |. B9 07000000 MOV ECX, 7
005ADD78 |> 6A 00 /PUSH 0
005ADD7A |. 6A 00 |PUSH 0
005ADD7C |. 49 |DEC ECX
005ADD7D |.^ 75 F9 \JNZ SHORT utcc.005ADD78
005ADD7F |. 53 PUSH EBX
005ADD80 |. 56 PUSH ESI
005ADD81 |. 8BF0 MOV ESI, EAX
005ADD83 |. 8B1D 74F55C00 MOV EBX, DWORD PTR DS:[5CF574] ; utcc.005D5C98
005ADD89 |. 33C0 XOR EAX, EAX
005ADD8B |. 55 PUSH EBP
005ADD8C |. 68 F6DF5A00 PUSH utcc.005ADFF6
005ADD91 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
005ADD94 |. 64:8920 MOV DWORD PTR FS:[EAX], ESP
005ADD97 |. 8BCB MOV ECX, EBX
005ADD99 |. A1 0CF95C00 MOV EAX, DWORD PTR DS:[5CF90C]
005ADD9E |. 8B00 MOV EAX, DWORD PTR DS:[EAX]
005ADDA0 |. 8B15 9CD35A00 MOV EDX, DWORD PTR DS:[5AD39C] ; utcc.005AD3E8
005ADDA6 |. E8 ED53EDFF CALL utcc.00483198
005ADDAB |. 8B03 MOV EAX, DWORD PTR DS:[EBX]
005ADDAD |. 8B80 78030000 MOV EAX, DWORD PTR DS:[EAX+378]
005ADDB3 |. B2 01 MOV DL, 1
005ADDB5 |. E8 8E56EBFF CALL utcc.00463448
005ADDBA |. 8D55 F8 LEA EDX, DWORD PTR SS:[EBP-8]
005ADDBD |. B8 0CE05A00 MOV EAX, utcc.005AE00C ; ASCII "Registration"
005ADDC2 |. E8 75E0F7FF CALL utcc.0052BE3C
005ADDC7 |. 8B55 F8 MOV EDX, DWORD PTR SS:[EBP-8]
005ADDCA |. 8D45 FC LEA EAX, DWORD PTR SS:[EBP-4]
005ADDCD |. E8 767BE5FF CALL utcc.00405948
005ADDD2 |. 8B55 FC MOV EDX, DWORD PTR SS:[EBP-4]
005ADDD5 |. 8B03 MOV EAX, DWORD PTR DS:[EBX]
005ADDD7 |. E8 7C57EBFF CALL utcc.00463558
005ADDDC |. 8D55 F0 LEA EDX, DWORD PTR SS:[EBP-10]
005ADDDF |. B8 24E05A00 MOV EAX, utcc.005AE024 ; ASCII "Registration name"
005ADDE4 |. E8 53E0F7FF CALL utcc.0052BE3C
005ADDE9 |. 8B55 F0 MOV EDX, DWORD PTR SS:[EBP-10]
005ADDEC |. 8D45 F4 LEA EAX, DWORD PTR SS:[EBP-C]
005ADDEF |. E8 547BE5FF CALL utcc.00405948
005ADDF4 |. 8B55 F4 MOV EDX, DWORD PTR SS:[EBP-C]
005ADDF7 |. 8B03 MOV EAX, DWORD PTR DS:[EBX]
005ADDF9 |. 8B80 60030000 MOV EAX, DWORD PTR DS:[EAX+360]
005ADDFF |. E8 5457EBFF CALL utcc.00463558
005ADE04 |. 8D55 E8 LEA EDX, DWORD PTR SS:[EBP-18]
005ADE07 |. B8 40E05A00 MOV EAX, utcc.005AE040 ; ASCII "Registration key"
005ADE0C |. E8 2BE0F7FF CALL utcc.0052BE3C
005ADE11 |. 8B55 E8 MOV EDX, DWORD PTR SS:[EBP-18]
005ADE14 |. 8D45 EC LEA EAX, DWORD PTR SS:[EBP-14]
005ADE17 |. E8 2C7BE5FF CALL utcc.00405948
005ADE1C |. 8B55 EC MOV EDX, DWORD PTR SS:[EBP-14]
005ADE1F |. 8B03 MOV EAX, DWORD PTR DS:[EBX]
005ADE21 |. 8B80 68030000 MOV EAX, DWORD PTR DS:[EAX+368]
005ADE27 |. E8 2C57EBFF CALL utcc.00463558
005ADE2C |. 8B03 MOV EAX, DWORD PTR DS:[EBX]
005ADE2E |. 8B10 MOV EDX, DWORD PTR DS:[EAX]
005ADE30 |. FF92 FC000000 CALL NEAR DWORD PTR DS:[EDX+FC]
005ADE36 |. 48 DEC EAX
005ADE37 |. 0F85 3F010000 JNZ utcc.005ADF7C
005ADE3D |. 8D55 E0 LEA EDX, DWORD PTR SS:[EBP-20]
005ADE40 |. 8B03 MOV EAX, DWORD PTR DS:[EBX]
005ADE42 |. 8B80 64030000 MOV EAX, DWORD PTR DS:[EAX+364]
005ADE48 |. E8 DB56EBFF CALL utcc.00463528
005ADE4D |. 8B45 E0 MOV EAX, DWORD PTR SS:[EBP-20] ; //用户名
005ADE50 |. 8D55 E4 LEA EDX, DWORD PTR SS:[EBP-1C]
005ADE53 |. E8 64C6E5FF CALL utcc.0040A4BC
005ADE58 |. 8B45 E4 MOV EAX, DWORD PTR SS:[EBP-1C] ; //用户名
005ADE5B |. 50 PUSH EAX
005ADE5C |. 8D55 D8 LEA EDX, DWORD PTR SS:[EBP-28]
005ADE5F |. 8B03 MOV EAX, DWORD PTR DS:[EBX]
005ADE61 |. 8B80 6C030000 MOV EAX, DWORD PTR DS:[EAX+36C]
005ADE67 |. E8 BC56EBFF CALL utcc.00463528
005ADE6C |. 8B45 D8 MOV EAX, DWORD PTR SS:[EBP-28] ; //试练码
005ADE6F |. 8D55 DC LEA EDX, DWORD PTR SS:[EBP-24]
005ADE72 |. E8 45C6E5FF CALL utcc.0040A4BC
005ADE77 |. 8B55 DC MOV EDX, DWORD PTR SS:[EBP-24] ; //试练码
005ADE7A |. A1 78F45C00 MOV EAX, DWORD PTR DS:[5CF478]
005ADE7F |. 8B00 MOV EAX, DWORD PTR DS:[EAX]
005ADE81 |. 59 POP ECX ; //用户名
005ADE82 |. E8 51690100 CALL utcc.005C47D8 ; //关键CALL
005ADE87 |. 84C0 TEST AL, AL
005ADE89 |. 0F84 A6000000 JE utcc.005ADF35 ; //关键跳转
005ADE8F |. 6A 40 PUSH 40
005ADE91 |. B8 0CE05A00 MOV EAX, utcc.005AE00C ; ASCII "Registration"
005ADE96 |. E8 C5EB0000 CALL utcc.005BCA60
005ADE9B |. 50 PUSH EAX
005ADE9C |. B8 5CE05A00 MOV EAX, utcc.005AE05C ; ASCII "Thank you for your registration!"
005ADEA1 |. E8 BAEB0000 CALL utcc.005BCA60
005ADEA6 |. 50 PUSH EAX
005ADEA7 |. 8B03 MOV EAX, DWORD PTR DS:[EBX]
005ADEA9 |. E8 16D7EBFF CALL utcc.0046B5C4
005ADEAE |. 50 PUSH EAX ; |hOwner
005ADEAF |. E8 38ACE5FF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
005ADEB4 |. A1 78F45C00 MOV EAX, DWORD PTR DS:[5CF478]
005ADEB9 |. 8B00 MOV EAX, DWORD PTR DS:[EAX]
005ADEBB |. E8 906B0100 CALL utcc.005C4A50
005ADEC0 |. 8D55 CC LEA EDX, DWORD PTR SS:[EBP-34]
005ADEC3 |. B8 88E05A00 MOV EAX, utcc.005AE088 ; ASCII "Registered by"
005ADEC8 |. E8 6FDFF7FF CALL utcc.0052BE3C
005ADECD |. FF75 CC PUSH DWORD PTR SS:[EBP-34]
005ADED0 |. 68 9CE05A00 PUSH utcc.005AE09C
005ADED5 |. 8D45 C8 LEA EAX, DWORD PTR SS:[EBP-38]
005ADED8 |. 8B15 44F15C00 MOV EDX, DWORD PTR DS:[5CF144]
005ADEDE |. E8 7581E5FF CALL utcc.00406058
005ADEE3 |. FF75 C8 PUSH DWORD PTR SS:[EBP-38]
005ADEE6 |. 8D45 D0 LEA EAX, DWORD PTR SS:[EBP-30]
005ADEE9 |. BA 03000000 MOV EDX, 3
005ADEEE |. E8 F181E5FF CALL utcc.004060E4
005ADEF3 |. 8B55 D0 MOV EDX, DWORD PTR SS:[EBP-30]
005ADEF6 |. 8D45 D4 LEA EAX, DWORD PTR SS:[EBP-2C]
005ADEF9 |. E8 4A7AE5FF CALL utcc.00405948
005ADEFE |. 8B55 D4 MOV EDX, DWORD PTR SS:[EBP-2C]
005ADF01 |. 8B86 6C030000 MOV EAX, DWORD PTR DS:[ESI+36C]
005ADF07 |. E8 4C56EBFF CALL utcc.00463558
005ADF0C |. A1 3CF15C00 MOV EAX, DWORD PTR DS:[5CF13C]
005ADF11 |. 8B80 7C030000 MOV EAX, DWORD PTR DS:[EAX+37C]
005ADF17 |. 33D2 XOR EDX, EDX
005ADF19 |. E8 2A55EBFF CALL utcc.00463448
005ADF1E |. A1 3CF15C00 MOV EAX, DWORD PTR DS:[5CF13C]
005ADF23 |. 8B80 78030000 MOV EAX, DWORD PTR DS:[EAX+378]
005ADF29 |. C780 5C020000 01>MOV DWORD PTR DS:[EAX+25C], 1
005ADF33 |. EB 47 JMP SHORT utcc.005ADF7C
005ADF35 |> 6A 30 PUSH 30
005ADF37 |. B8 0CE05A00 MOV EAX, utcc.005AE00C ; ASCII "Registration"
005ADF3C |. E8 1FEB0000 CALL utcc.005BCA60
005ADF41 |. 50 PUSH EAX
005ADF42 |. B8 A8E05A00 MOV EAX, utcc.005AE0A8 ; ASCII "Key is not valid !"
005ADF47 |. E8 14EB0000 CALL utcc.005BCA60
005ADF4C |. 50 PUSH EAX
005ADF4D |. 8B03 MOV EAX, DWORD PTR DS:[EBX]
005ADF4F |. E8 70D6EBFF CALL utcc.0046B5C4
005ADF54 |. 50 PUSH EAX ; |hOwner
005ADF55 |. E8 92ABE5FF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
005ADF5A |. 8B03 MOV EAX, DWORD PTR DS:[EBX]
005ADF5C |. E8 1B68E5FF CALL utcc.0040477C
005ADF61 |. A1 3CF15C00 MOV EAX, DWORD PTR DS:[5CF13C]
005ADF66 |. C780 94020000 02>MOV DWORD PTR DS:[EAX+294], 2
005ADF70 |. A1 3CF15C00 MOV EAX, DWORD PTR DS:[5CF13C]
005ADF75 |. E8 A211EDFF CALL utcc.0047F11C
005ADF7A |. EB 07 JMP SHORT utcc.005ADF83
005ADF7C |> 8B03 MOV EAX, DWORD PTR DS:[EBX]
005ADF7E |. E8 F967E5FF CALL utcc.0040477C
005ADF83 |> 33C0 XOR EAX, EAX
005ADF85 |. 5A POP EDX
005ADF86 |. 59 POP ECX
005ADF87 |. 59 POP ECX
005ADF88 |. 64:8910 MOV DWORD PTR FS:[EAX], EDX
005ADF8B |. 68 FDDF5A00 PUSH utcc.005ADFFD
005ADF90 |> 8D45 C8 LEA EAX, DWORD PTR SS:[EBP-38]
005ADF93 |. BA 03000000 MOV EDX, 3
005ADF98 |. E8 437FE5FF CALL utcc.00405EE0
005ADF9D |. 8D45 D4 LEA EAX, DWORD PTR SS:[EBP-2C]
005ADFA0 |. E8 1B77E5FF CALL utcc.004056C0
005ADFA5 |. 8D45 D8 LEA EAX, DWORD PTR SS:[EBP-28]
005ADFA8 |. E8 1377E5FF CALL utcc.004056C0
005ADFAD |. 8D45 DC LEA EAX, DWORD PTR SS:[EBP-24]
005ADFB0 |. E8 0B77E5FF CALL utcc.004056C0
005ADFB5 |. 8D45 E0 LEA EAX, DWORD PTR SS:[EBP-20]
005ADFB8 |. E8 0377E5FF CALL utcc.004056C0
005ADFBD |. 8D45 E4 LEA EAX, DWORD PTR SS:[EBP-1C]
005ADFC0 |. E8 FB76E5FF CALL utcc.004056C0
005ADFC5 |. 8D45 E8 LEA EAX, DWORD PTR SS:[EBP-18]
005ADFC8 |. E8 FB7EE5FF CALL utcc.00405EC8
005ADFCD |. 8D45 EC LEA EAX, DWORD PTR SS:[EBP-14]
005ADFD0 |. E8 EB76E5FF CALL utcc.004056C0
005ADFD5 |. 8D45 F0 LEA EAX, DWORD PTR SS:[EBP-10]
005ADFD8 |. E8 EB7EE5FF CALL utcc.00405EC8
005ADFDD |. 8D45 F4 LEA EAX, DWORD PTR SS:[EBP-C]
005ADFE0 |. E8 DB76E5FF CALL utcc.004056C0
005ADFE5 |. 8D45 F8 LEA EAX, DWORD PTR SS:[EBP-8]
005ADFE8 |. E8 DB7EE5FF CALL utcc.00405EC8
005ADFED |. 8D45 FC LEA EAX, DWORD PTR SS:[EBP-4]
005ADFF0 |. E8 CB76E5FF CALL utcc.004056C0
005ADFF5 \. C3 RETN
005ADFF6 .^ E9 5D6FE5FF JMP utcc.00404F58
005ADFFB .^ EB 93 JMP SHORT utcc.005ADF90
005ADFFD . 5E POP ESI
005ADFFE . 5B POP EBX
005ADFFF . 8BE5 MOV ESP, EBP
005AE001 . 5D POP EBP
005AE002 . C3 RETN
==============================================================
005C47D8 /$ 55 PUSH EBP
005C47D9 |. 8BEC MOV EBP, ESP
005C47DB |. 51 PUSH ECX
005C47DC |. B9 07000000 MOV ECX, 7
005C47E1 |> 6A 00 /PUSH 0
005C47E3 |. 6A 00 |PUSH 0
005C47E5 |. 49 |DEC ECX
005C47E6 |.^ 75 F9 \JNZ SHORT utcc.005C47E1
005C47E8 |. 51 PUSH ECX
005C47E9 |. 874D FC XCHG DWORD PTR SS:[EBP-4], ECX
005C47EC |. 53 PUSH EBX
005C47ED |. 56 PUSH ESI
005C47EE |. 894D F8 MOV DWORD PTR SS:[EBP-8], ECX
005C47F1 |. 8955 FC MOV DWORD PTR SS:[EBP-4], EDX
005C47F4 |. 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4] ; //试练码
005C47F7 |. E8 4413E4FF CALL utcc.00405B40
005C47FC |. 8B45 F8 MOV EAX, DWORD PTR SS:[EBP-8] ; //用户名
005C47FF |. E8 3C13E4FF CALL utcc.00405B40
005C4804 |. 33C0 XOR EAX, EAX
005C4806 |. 55 PUSH EBP
005C4807 |. 68 E5495C00 PUSH utcc.005C49E5
005C480C |. 64:FF30 PUSH DWORD PTR FS:[EAX]
005C480F |. 64:8920 MOV DWORD PTR FS:[EAX], ESP
005C4812 |. 33DB XOR EBX, EBX
005C4814 |. 8D45 E8 LEA EAX, DWORD PTR SS:[EBP-18]
005C4817 |. 8B55 FC MOV EDX, DWORD PTR SS:[EBP-4]
005C481A |. E8 390FE4FF CALL utcc.00405758
005C481F |. A1 3CF75C00 MOV EAX, DWORD PTR DS:[5CF73C]
005C4824 |. 8B55 FC MOV EDX, DWORD PTR SS:[EBP-4] ; //试练码
005C4827 |. E8 E80EE4FF CALL utcc.00405714
005C482C |. A1 F0F85C00 MOV EAX, DWORD PTR DS:[5CF8F0]
005C4831 |. 8B55 F8 MOV EDX, DWORD PTR SS:[EBP-8] ; //用户名
005C4834 |. E8 DB0EE4FF CALL utcc.00405714
005C4839 |. 8B55 E8 MOV EDX, DWORD PTR SS:[EBP-18] ; //试练码
005C483C |. 8BC2 MOV EAX, EDX
005C483E |. 85C0 TEST EAX, EAX
005C4840 |. 74 05 JE SHORT utcc.005C4847
005C4842 |. 83E8 04 SUB EAX, 4
005C4845 |. 8B00 MOV EAX, DWORD PTR DS:[EAX]
005C4847 |> 83F8 0B CMP EAX, 0B
005C484A |. 0F8E F7000000 JLE utcc.005C4947 ; //注册码长度大于0Bh
005C4850 |. 8BC2 MOV EAX, EDX
005C4852 |. 85C0 TEST EAX, EAX
005C4854 |. 74 05 JE SHORT utcc.005C485B
005C4856 |. 83E8 04 SUB EAX, 4
005C4859 |. 8B00 MOV EAX, DWORD PTR DS:[EAX]
005C485B |> 83F8 0E CMP EAX, 0E
005C485E |. 0F8F E3000000 JG utcc.005C4947 ; //注册码长度小于等于0Eh
005C4864 |. 8D45 F4 LEA EAX, DWORD PTR SS:[EBP-C]
005C4867 |. 50 PUSH EAX
005C4868 |. B9 06000000 MOV ECX, 6
005C486D |. BA 01000000 MOV EDX, 1
005C4872 |. 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4] ; //试练码
005C4875 |. E8 3E13E4FF CALL utcc.00405BB8
005C487A |. 8B15 F0F85C00 MOV EDX, DWORD PTR DS:[5CF8F0] ; utcc.005CF144
005C4880 |. 8B12 MOV EDX, DWORD PTR DS:[EDX]
005C4882 |. 8D45 D0 LEA EAX, DWORD PTR SS:[EBP-30]
005C4885 |. B9 FC495C00 MOV ECX, utcc.005C49FC ; ASCII "User Time Administrator"
005C488A |. E8 4911E4FF CALL utcc.004059D8 ; //用户名与"User Time Administrator"相连
005C488F |. 8B45 D0 MOV EAX, DWORD PTR SS:[EBP-30] ; //相连字符串
005C4892 |. 8D55 D4 LEA EDX, DWORD PTR SS:[EBP-2C]
005C4895 |. E8 9A2BFBFF CALL utcc.00577434 ; //MD5初始化
005C489A |. 8D45 D4 LEA EAX, DWORD PTR SS:[EBP-2C]
005C489D |. 8D55 E4 LEA EDX, DWORD PTR SS:[EBP-1C]
005C48A0 |. E8 1B2BFBFF CALL utcc.005773C0 ; //MD5运算
005C48A5 |. 8B45 E4 MOV EAX, DWORD PTR SS:[EBP-1C] ; //相连字符串MD5值大写
005C48A8 |. 8D55 F0 LEA EDX, DWORD PTR SS:[EBP-10]
005C48AB |. E8 A858E4FF CALL utcc.0040A158
005C48B0 |. 8D45 EC LEA EAX, DWORD PTR SS:[EBP-14]
005C48B3 |. E8 080EE4FF CALL utcc.004056C0
005C48B8 |. 8D45 CC LEA EAX, DWORD PTR SS:[EBP-34]
005C48BB |. 50 PUSH EAX
005C48BC |. B9 02000000 MOV ECX, 2
005C48C1 |. BA 01000000 MOV EDX, 1
005C48C6 |. 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4]
005C48C9 |. E8 EA12E4FF CALL utcc.00405BB8 ; //取试练码1.2位
005C48CE |. 8B45 CC MOV EAX, DWORD PTR SS:[EBP-34]
005C48D1 |. E8 7661E4FF CALL utcc.0040AA4C
005C48D6 |. 8BF0 MOV ESI, EAX
005C48D8 |. 8D45 C8 LEA EAX, DWORD PTR SS:[EBP-38]
005C48DB |. 50 PUSH EAX
005C48DC |. B9 02000000 MOV ECX, 2
005C48E1 |. BA 03000000 MOV EDX, 3
005C48E6 |. 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4]
005C48E9 |. E8 CA12E4FF CALL utcc.00405BB8 ; //取试练码3.4位
005C48EE |. 8B45 C8 MOV EAX, DWORD PTR SS:[EBP-38]
005C48F1 |. E8 5661E4FF CALL utcc.0040AA4C
005C48F6 |. 03F0 ADD ESI, EAX
005C48F8 |. 8D45 C4 LEA EAX, DWORD PTR SS:[EBP-3C]
005C48FB |. 50 PUSH EAX
005C48FC |. B9 02000000 MOV ECX, 2
005C4901 |. BA 05000000 MOV EDX, 5
005C4906 |. 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4]
005C4909 |. E8 AA12E4FF CALL utcc.00405BB8 ; //取试练码5.6位
005C490E |. 8B45 C4 MOV EAX, DWORD PTR SS:[EBP-3C]
005C4911 |. E8 3661E4FF CALL utcc.0040AA4C
005C4916 |. 03F0 ADD ESI, EAX ; //取左边6位,每2个一组累加
005C4918 |. 8B5D FC MOV EBX, DWORD PTR SS:[EBP-4]
005C491B |. 85DB TEST EBX, EBX
005C491D |. 74 05 JE SHORT utcc.005C4924
005C491F |. 83EB 04 SUB EBX, 4
005C4922 |. 8B1B MOV EBX, DWORD PTR DS:[EBX] ; //试练码长度
005C4924 |> 8D45 C0 LEA EAX, DWORD PTR SS:[EBP-40]
005C4927 |. 50 PUSH EAX
005C4928 |. 8BD3 MOV EDX, EBX ; //试练码长度
005C492A |. 4A DEC EDX ; //EDX=EDX-1
005C492B |. B9 02000000 MOV ECX, 2
005C4930 |. 8B45 FC MOV EAX, DWORD PTR SS:[EBP-4]
005C4933 |. E8 8012E4FF CALL utcc.00405BB8 ; //取试练码右边2位
005C4938 |. 8B45 C0 MOV EAX, DWORD PTR SS:[EBP-40]
005C493B |. E8 0C61E4FF CALL utcc.0040AA4C
005C4940 |. 3BF0 CMP ESI, EAX ; //累加值与右边2位的值比较
005C4942 |. 0F94C0 SETE AL
005C4945 |. 8BD8 MOV EBX, EAX
005C4947 |> 84DB TEST BL, BL
005C4949 |. 74 72 JE SHORT utcc.005C49BD
005C494B |. A1 70F95C00 MOV EAX, DWORD PTR DS:[5CF970]
005C4950 |. 8B00 MOV EAX, DWORD PTR DS:[EAX]
005C4952 |. 8B4D F4 MOV ECX, DWORD PTR SS:[EBP-C]
005C4955 |. BA 1C4A5C00 MOV EDX, utcc.005C4A1C ; ASCII "KY"
005C495A |. E8 799CECFF CALL utcc.0048E5D8
005C495F |. A1 70F95C00 MOV EAX, DWORD PTR DS:[5CF970]
005C4964 |. 8B00 MOV EAX, DWORD PTR DS:[EAX]
005C4966 |. 8B4D FC MOV ECX, DWORD PTR SS:[EBP-4]
005C4969 |. BA 284A5C00 MOV EDX, utcc.005C4A28 ; ASCII "UK"
005C496E |. E8 659CECFF CALL utcc.0048E5D8
005C4973 |. A1 70F95C00 MOV EAX, DWORD PTR DS:[5CF970]
005C4978 |. 8B00 MOV EAX, DWORD PTR DS:[EAX]
005C497A |. 8B4D F8 MOV ECX, DWORD PTR SS:[EBP-8]
005C497D |. BA 344A5C00 MOV EDX, utcc.005C4A34 ; ASCII "UN"
005C4982 |. E8 519CECFF CALL utcc.0048E5D8
005C4987 |. A1 70F95C00 MOV EAX, DWORD PTR DS:[5CF970]
005C498C |. 8B00 MOV EAX, DWORD PTR DS:[EAX]
005C498E |. 8B4D F0 MOV ECX, DWORD PTR SS:[EBP-10]
005C4991 |. BA 404A5C00 MOV EDX, utcc.005C4A40 ; ASCII "ES"
005C4996 |. E8 3D9CECFF CALL utcc.0048E5D8
005C499B |. A1 70F95C00 MOV EAX, DWORD PTR DS:[5CF970]
005C49A0 |. 8B00 MOV EAX, DWORD PTR DS:[EAX]
005C49A2 |. 8B4D EC MOV ECX, DWORD PTR SS:[EBP-14]
005C49A5 |. BA 4C4A5C00 MOV EDX, utcc.005C4A4C ; ASCII "DS"
005C49AA |. E8 299CECFF CALL utcc.0048E5D8
005C49AF |. A1 70F95C00 MOV EAX, DWORD PTR DS:[5CF970]
005C49B4 |. 8B00 MOV EAX, DWORD PTR DS:[EAX]
005C49B6 |. B2 01 MOV DL, 1
005C49B8 |. E8 239BECFF CALL utcc.0048E4E0
005C49BD |> 33C0 XOR EAX, EAX
005C49BF |. 5A POP EDX
005C49C0 |. 59 POP ECX
005C49C1 |. 59 POP ECX
005C49C2 |. 64:8910 MOV DWORD PTR FS:[EAX], EDX
005C49C5 |. 68 EC495C00 PUSH utcc.005C49EC
005C49CA |> 8D45 C0 LEA EAX, DWORD PTR SS:[EBP-40]
005C49CD |. BA 05000000 MOV EDX, 5
005C49D2 |. E8 0D0DE4FF CALL utcc.004056E4
005C49D7 |. 8D45 E4 LEA EAX, DWORD PTR SS:[EBP-1C]
005C49DA |. BA 07000000 MOV EDX, 7
005C49DF |. E8 000DE4FF CALL utcc.004056E4
005C49E4 \. C3 RETN
005C49E5 .^ E9 6E05E4FF JMP utcc.00404F58
005C49EA .^ EB DE JMP SHORT utcc.005C49CA
005C49EC . 8BC3 MOV EAX, EBX
005C49EE . 5E POP ESI
005C49EF . 5B POP EBX
005C49F0 . 8BE5 MOV ESP, EBP
005C49F2 . 5D POP EBP
005C49F3 . C3 RETN

复制代码

**************************************************************
【破解总结】
--------------------------------------------------------------
【算法总结】
1.注册码和用户名无关
2.注册码长度为12或13或14位
3.注册码左边6位每2个一组累加值必须等于右边2位的值
--------------------------------------------------------------
【算法注册机】
(略)
--------------------------------------------------------------
【注册信息】
一组可用的注册码
用户名：(任意)
注册码：222222666666
--------------------------------------------------------------
感谢飘云老大、猫老大、Nisy老大以及很多前辈们的学习教程以及所有帮助过我的论坛兄弟姐妹们！谢谢
--------------------------------------------------------------
【版权声明】破文是学习的手记，兴趣是成功的源泉；本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!

Luckly · 发表于 2008-9-13 19:20:01

感谢tianxj 老大的学习教程/:18

brave5168 · 发表于 2008-9-20 00:43:52

感谢各位前辈了.

		自动登录	找回密码
密码			加入我们

[原创] User Time Administrator 4.6.4.3算法分析

相关帖子