Magic Photo Editor 4.9 算法分析

tianxj · 发表于 2009-1-29 00:27:56

【破文标题】Magic Photo Editor 4.9 算法分析
【破文作者】tianxj
【作者邮箱】tianxj_2007@126.com
【作者主页】WwW.ChiNaPYG.CoM
【破解工具】PEiD,OD
【破解平台】雨林木风Windows XP sp3
【软件名称】Magic Photo Editor 4.9
【软件大小】3167KB
【软件类别】国外软件/图像处理
【软件授权】共享版
【软件语言】英文
【运行环境】Win9x/Me/NT/2000/XP/2003
【更新时间】2009-1-12
【原版下载】华军软件园
【保护方式】注册码
【软件简介】一个图片编辑工具。可以轻松地将一张图片中的某些部份合成到另一张图片中，成为一张有特殊效果的图片。
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------
【破解内容】
--------------------------------------------------------------
**************************************************************
一、运行程序，进行注册，输入错误的注册信息进行检测，有提示信息
**************************************************************
二、用PEiD对MagicPhoto.exe查壳，为 Borland Delphi 6.0 - 7.0
**************************************************************
三、运行OD，打开MagicPhoto.exe，右键—超级字串参考—查找ASCII.
==============================================================

004831B4 /. 55 PUSH EBP
004831B5 |. 8BEC MOV EBP,ESP
004831B7 |. B9 05000000 MOV ECX,5
004831BC |> 6A 00 /PUSH 0
004831BE |. 6A 00 |PUSH 0
004831C0 |. 49 |DEC ECX
004831C1 |.^ 75 F9 \JNZ SHORT MagicPho.004831BC
004831C3 |. 51 PUSH ECX
004831C4 |. 53 PUSH EBX
004831C5 |. 56 PUSH ESI
004831C6 |. 8BD8 MOV EBX,EAX
004831C8 |. 33C0 XOR EAX,EAX
004831CA |. 55 PUSH EBP
004831CB |. 68 72334800 PUSH MagicPho.00483372
004831D0 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
004831D3 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
004831D6 |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
004831DC |. 8B10 MOV EDX,DWORD PTR DS:[EAX]
004831DE |. FF52 50 CALL DWORD PTR DS:[EDX+50]
004831E1 |. 3C 01 CMP AL,1
004831E3 |. 0F85 18010000 JNZ MagicPho.00483301
004831E9 |. 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
004831EC |. 8BB3 00030000 MOV ESI,DWORD PTR DS:[EBX+300]
004831F2 |. 8BC6 MOV EAX,ESI
004831F4 |. E8 8F39FBFF CALL MagicPho.00436B88
004831F9 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; //假码
004831FC |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
004831FF |. E8 EC54F8FF CALL MagicPho.004086F0
00483204 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] ; //假码
00483207 |. 8BC6 MOV EAX,ESI
00483209 |. E8 AA39FBFF CALL MagicPho.00436BB8
0048320E |. 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
00483211 |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
00483217 |. E8 6C39FBFF CALL MagicPho.00436B88
0048321C |. 837D F4 00 CMP DWORD PTR SS:[EBP-C],0
00483220 |. 0F84 CF000000 JE MagicPho.004832F5 ; //假码为空则跳
00483226 |. 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
00483229 |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
0048322F |. E8 5439FBFF CALL MagicPho.00436B88
00483234 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] ; //假码
00483237 |. 8D55 F0 LEA EDX,DWORD PTR SS:[EBP-10]
0048323A |. E8 6152F8FF CALL MagicPho.004084A0
0048323F |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10] ; //假码
00483242 |. E8 4DA4FFFF CALL MagicPho.0047D694 ; //关键CALL
00483247 |. 84C0 TEST AL,AL
00483249 |. 0F84 9A000000 JE MagicPho.004832E9
0048324F |. 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
00483252 |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
00483258 |. E8 2B39FBFF CALL MagicPho.00436B88
0048325D |. 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18] ; //假码
00483260 |. E8 E713F8FF CALL MagicPho.0040464C ; //取假码长度
00483265 |. 83F8 0B CMP EAX,0B
00483268 |. 75 7F JNZ SHORT MagicPho.004832E9 ; //假码长度不等于11则跳
0048326A |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C]
0048326D |. 50 PUSH EAX
0048326E |. 8D55 DC LEA EDX,DWORD PTR SS:[EBP-24]
00483271 |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
00483277 |. E8 0C39FBFF CALL MagicPho.00436B88
0048327C |. 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24]
0048327F |. 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
00483282 |. E8 1952F8FF CALL MagicPho.004084A0
00483287 |. 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20] ; //假码
0048328A |. B9 01000000 MOV ECX,1
0048328F |. BA 0B000000 MOV EDX,0B
00483294 |. E8 0B16F8FF CALL MagicPho.004048A4 ; //取假码第11位
00483299 |. 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] ; //假码第11位
0048329C |. BA 88334800 MOV EDX,MagicPho.00483388 ; U
004832A1 |. E8 EA14F8FF CALL MagicPho.00404790
004832A6 |. 75 41 JNZ SHORT MagicPho.004832E9 ; //假码第11位不为"U"则跳
004832A8 |. 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
004832AB |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
004832B1 |. E8 D238FBFF CALL MagicPho.00436B88
004832B6 |. 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C]
004832B9 |. 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28]
004832BC |. E8 DF51F8FF CALL MagicPho.004084A0
004832C1 |. 8B55 D8 MOV EDX,DWORD PTR SS:[EBP-28]
004832C4 |. B8 94334800 MOV EAX,MagicPho.00483394 ; magic.bin
004832C9 |. E8 FEA4FFFF CALL MagicPho.0047D7CC
004832CE |. A1 149B4800 MOV EAX,DWORD PTR DS:[489B14]
004832D3 |. BA A8334800 MOV EDX,MagicPho.004833A8 ; Y
004832D8 |. E8 0B11F8FF CALL MagicPho.004043E8
004832DD |. B8 B4334800 MOV EAX,MagicPho.004833B4 ; Successfully Registered!
004832E2 |. E8 35D4FAFF CALL MagicPho.0043071C
004832E7 |. EB 22 JMP SHORT MagicPho.0048330B
004832E9 |> B8 D8334800 MOV EAX,MagicPho.004833D8 ; Invalid SerialNumber!
004832EE |. E8 29D4FAFF CALL MagicPho.0043071C
004832F3 |. EB 16 JMP SHORT MagicPho.0048330B
004832F5 |> B8 D8334800 MOV EAX,MagicPho.004833D8 ; Invalid SerialNumber!
004832FA |. E8 1DD4FAFF CALL MagicPho.0043071C
004832FF |. EB 0A JMP SHORT MagicPho.0048330B
00483301 |> B8 F8334800 MOV EAX,MagicPho.004833F8 ; Already Registered!
00483306 |. E8 11D4FAFF CALL MagicPho.0043071C
0048330B |> A1 5CAD4800 MOV EAX,DWORD PTR DS:[48AD5C]
00483310 |. E8 D708FDFF CALL MagicPho.00453BEC
00483315 |. 33C0 XOR EAX,EAX
00483317 |. 5A POP EDX
00483318 |. 59 POP ECX
00483319 |. 59 POP ECX
0048331A |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
0048331D |. 68 79334800 PUSH MagicPho.00483379
00483322 |> 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C]
00483325 |. E8 6A10F8FF CALL MagicPho.00404394
0048332A |. 8D45 D8 LEA EAX,DWORD PTR SS:[EBP-28]
0048332D |. E8 6210F8FF CALL MagicPho.00404394
00483332 |. 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00483335 |. E8 5A10F8FF CALL MagicPho.00404394
0048333A |. 8D45 E0 LEA EAX,DWORD PTR SS:[EBP-20]
0048333D |. BA 02000000 MOV EDX,2
00483342 |. E8 7110F8FF CALL MagicPho.004043B8
00483347 |. 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
0048334A |. BA 02000000 MOV EDX,2
0048334F |. E8 6410F8FF CALL MagicPho.004043B8
00483354 |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
00483357 |. E8 3810F8FF CALL MagicPho.00404394
0048335C |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
0048335F |. BA 02000000 MOV EDX,2
00483364 |. E8 4F10F8FF CALL MagicPho.004043B8
00483369 |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0048336C |. E8 2310F8FF CALL MagicPho.00404394
00483371 \. C3 RETN
00483372 .^ E9 450AF8FF JMP MagicPho.00403DBC
00483377 .^ EB A9 JMP SHORT MagicPho.00483322
00483379 . 5E POP ESI
0048337A . 5B POP EBX
0048337B . 8BE5 MOV ESP,EBP
0048337D . 5D POP EBP
0048337E . C3 RETN

复制代码

由上可知，注册码为11位，并且第11位为"U"
==============================================================

0047D694 /$ 55 PUSH EBP
0047D695 |. 8BEC MOV EBP,ESP
0047D697 |. B9 04000000 MOV ECX,4
0047D69C |> 6A 00 /PUSH 0
0047D69E |. 6A 00 |PUSH 0
0047D6A0 |. 49 |DEC ECX
0047D6A1 |.^ 75 F9 \JNZ SHORT MagicPho.0047D69C
0047D6A3 |. 51 PUSH ECX
0047D6A4 |. 53 PUSH EBX
0047D6A5 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
0047D6A8 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //假码
0047D6AB |. E8 8471F8FF CALL MagicPho.00404834
0047D6B0 |. 33C0 XOR EAX,EAX
0047D6B2 |. 55 PUSH EBP
0047D6B3 |. 68 BDD74700 PUSH MagicPho.0047D7BD
0047D6B8 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
0047D6BB |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
0047D6BE |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
0047D6C1 |. E8 B2FDFFFF CALL MagicPho.0047D478
0047D6C6 |. 8D4D EC LEA ECX,DWORD PTR SS:[EBP-14]
0047D6C9 |. 33D2 XOR EDX,EDX
0047D6CB |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; //用户名
0047D6CE |. E8 1DFBFFFF CALL MagicPho.0047D1F0 ; //将用户名重新排序
0047D6D3 |. 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14] ; //重新排序后的用户名
0047D6D6 |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
0047D6D9 |. E8 4E6DF8FF CALL MagicPho.0040442C
0047D6DE |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0047D6E1 |. 50 PUSH EAX
0047D6E2 |. B9 0A000000 MOV ECX,0A
0047D6E7 |. BA 01000000 MOV EDX,1
0047D6EC |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //假码
0047D6EF |. E8 B071F8FF CALL MagicPho.004048A4 ; //取假码第1-10位
0047D6F4 |. 8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18]
0047D6F7 |. 66:BA 0001 MOV DX,100 ; //DX=100
0047D6FB |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //假码第1-10位
0047D6FE |. E8 1DFFFFFF CALL MagicPho.0047D620 ; //将假码变形
0047D703 |. 8B55 E8 MOV EDX,DWORD PTR SS:[EBP-18] ; //变形后的假码
0047D706 |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0047D709 |. E8 1E6DF8FF CALL MagicPho.0040442C
0047D70E |. 8D4D E4 LEA ECX,DWORD PTR SS:[EBP-1C]
0047D711 |. 33D2 XOR EDX,EDX
0047D713 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //变形后的假码
0047D716 |. E8 D5FAFFFF CALL MagicPho.0047D1F0 ; //将变形后的假码重新排序
0047D71B |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C] ; //重新排序后的假码
0047D71E |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0047D721 |. E8 066DF8FF CALL MagicPho.0040442C
0047D726 |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
0047D729 |. 50 PUSH EAX
0047D72A |. B9 04000000 MOV ECX,4
0047D72F |. BA 0A000000 MOV EDX,0A
0047D734 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //重新排序后的假码
0047D737 |. E8 6871F8FF CALL MagicPho.004048A4 ; //取重新排序后的假码第10-13位
0047D73C |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
0047D73F |. 50 PUSH EAX
0047D740 |. B9 06000000 MOV ECX,6
0047D745 |. BA 05000000 MOV EDX,5
0047D74A |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //重新排序后的假码
0047D74D |. E8 5271F8FF CALL MagicPho.004048A4 ; //取重新排序后的假码第5-10位
0047D752 |. 8D45 E0 LEA EAX,DWORD PTR SS:[EBP-20]
0047D755 |. 50 PUSH EAX
0047D756 |. B9 04000000 MOV ECX,4
0047D75B |. BA 01000000 MOV EDX,1
0047D760 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; //用户名
0047D763 |. E8 3C71F8FF CALL MagicPho.004048A4 ; //取用户名第1-4位
0047D768 |. 8B55 E0 MOV EDX,DWORD PTR SS:[EBP-20] ; //用户名第1-4位
0047D76B |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] ; //重新排序后的假码第10-13位
0047D76E |. E8 1572F8FF CALL MagicPho.00404988
0047D773 |. 85C0 TEST EAX,EAX
0047D775 |. 7F 25 JG SHORT MagicPho.0047D79C
0047D777 |. 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
0047D77A |. 50 PUSH EAX
0047D77B |. B9 06000000 MOV ECX,6
0047D780 |. BA 05000000 MOV EDX,5
0047D785 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; //用户名
0047D788 |. E8 1771F8FF CALL MagicPho.004048A4 ; //取用户名第5-10位
0047D78D |. 8B55 DC MOV EDX,DWORD PTR SS:[EBP-24] ; //用户名第5-10位
0047D790 |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10] ; //重新排序后的假码第5-10位
0047D793 |. E8 F071F8FF CALL MagicPho.00404988 ; //关键比较
0047D798 |. 85C0 TEST EAX,EAX
0047D79A |. 7E 04 JLE SHORT MagicPho.0047D7A0 ; //关键跳转
0047D79C |> B3 01 MOV BL,1
0047D79E |. EB 02 JMP SHORT MagicPho.0047D7A2
0047D7A0 |> 33DB XOR EBX,EBX
0047D7A2 |> 33C0 XOR EAX,EAX
0047D7A4 |. 5A POP EDX
0047D7A5 |. 59 POP ECX
0047D7A6 |. 59 POP ECX
0047D7A7 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
0047D7AA |. 68 C4D74700 PUSH MagicPho.0047D7C4
0047D7AF |> 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
0047D7B2 |. BA 09000000 MOV EDX,9
0047D7B7 |. E8 FC6BF8FF CALL MagicPho.004043B8
0047D7BC \. C3 RETN
0047D7BD .^ E9 FA65F8FF JMP MagicPho.00403DBC
0047D7C2 .^ EB EB JMP SHORT MagicPho.0047D7AF
0047D7C4 . 8BC3 MOV EAX,EBX
0047D7C6 . 5B POP EBX
0047D7C7 . 8BE5 MOV ESP,EBP
0047D7C9 . 5D POP EBP
0047D7CA . C3 RETN

复制代码

由上可知，软件是将注册码与用户名都变形后进行比较的
==============================================================

0047D1F0 /$ 55 PUSH EBP
0047D1F1 |. 8BEC MOV EBP,ESP
0047D1F3 |. 51 PUSH ECX
0047D1F4 |. B9 0A000000 MOV ECX,0A
0047D1F9 |> 6A 00 /PUSH 0
0047D1FB |. 6A 00 |PUSH 0
0047D1FD |. 49 |DEC ECX
0047D1FE |.^ 75 F9 \JNZ SHORT MagicPho.0047D1F9
0047D200 |. 874D FC XCHG DWORD PTR SS:[EBP-4],ECX
0047D203 |. 53 PUSH EBX
0047D204 |. 56 PUSH ESI
0047D205 |. 8BF1 MOV ESI,ECX
0047D207 |. 8BDA MOV EBX,EDX
0047D209 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
0047D20C |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //用户名
0047D20F |. E8 2076F8FF CALL MagicPho.00404834
0047D214 |. 33C0 XOR EAX,EAX
0047D216 |. 55 PUSH EBP
0047D217 |. 68 6AD44700 PUSH MagicPho.0047D46A
0047D21C |. 64:FF30 PUSH DWORD PTR FS:[EAX]
0047D21F |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
0047D222 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //用户名
0047D225 |. E8 2274F8FF CALL MagicPho.0040464C ; //取用户名长度
0047D22A |. 84DB TEST BL,BL
0047D22C |. 0F84 0C010000 JE MagicPho.0047D33E
0047D232 |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
0047D235 |. 50 PUSH EAX
0047D236 |. B9 01000000 MOV ECX,1
0047D23B |. BA 03000000 MOV EDX,3
0047D240 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D243 |. E8 5C76F8FF CALL MagicPho.004048A4
0047D248 |. FF75 F8 PUSH DWORD PTR SS:[EBP-8]
0047D24B |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
0047D24E |. 50 PUSH EAX
0047D24F |. B9 01000000 MOV ECX,1
0047D254 |. BA 09000000 MOV EDX,9
0047D259 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D25C |. E8 4376F8FF CALL MagicPho.004048A4
0047D261 |. FF75 F4 PUSH DWORD PTR SS:[EBP-C]
0047D264 |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
0047D267 |. 50 PUSH EAX
0047D268 |. B9 01000000 MOV ECX,1
0047D26D |. BA 04000000 MOV EDX,4
0047D272 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D275 |. E8 2A76F8FF CALL MagicPho.004048A4
0047D27A |. FF75 F0 PUSH DWORD PTR SS:[EBP-10]
0047D27D |. 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
0047D280 |. 50 PUSH EAX
0047D281 |. B9 01000000 MOV ECX,1
0047D286 |. BA 01000000 MOV EDX,1
0047D28B |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D28E |. E8 1176F8FF CALL MagicPho.004048A4
0047D293 |. FF75 EC PUSH DWORD PTR SS:[EBP-14]
0047D296 |. 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
0047D299 |. 50 PUSH EAX
0047D29A |. B9 01000000 MOV ECX,1
0047D29F |. BA 06000000 MOV EDX,6
0047D2A4 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D2A7 |. E8 F875F8FF CALL MagicPho.004048A4
0047D2AC |. FF75 E8 PUSH DWORD PTR SS:[EBP-18]
0047D2AF |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C]
0047D2B2 |. 50 PUSH EAX
0047D2B3 |. B9 01000000 MOV ECX,1
0047D2B8 |. BA 08000000 MOV EDX,8
0047D2BD |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D2C0 |. E8 DF75F8FF CALL MagicPho.004048A4
0047D2C5 |. FF75 E4 PUSH DWORD PTR SS:[EBP-1C]
0047D2C8 |. 8D45 E0 LEA EAX,DWORD PTR SS:[EBP-20]
0047D2CB |. 50 PUSH EAX
0047D2CC |. B9 01000000 MOV ECX,1
0047D2D1 |. BA 05000000 MOV EDX,5
0047D2D6 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D2D9 |. E8 C675F8FF CALL MagicPho.004048A4
0047D2DE |. FF75 E0 PUSH DWORD PTR SS:[EBP-20]
0047D2E1 |. 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
0047D2E4 |. 50 PUSH EAX
0047D2E5 |. B9 01000000 MOV ECX,1
0047D2EA |. BA 07000000 MOV EDX,7
0047D2EF |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D2F2 |. E8 AD75F8FF CALL MagicPho.004048A4
0047D2F7 |. FF75 DC PUSH DWORD PTR SS:[EBP-24]
0047D2FA |. 8D45 D8 LEA EAX,DWORD PTR SS:[EBP-28]
0047D2FD |. 50 PUSH EAX
0047D2FE |. B9 01000000 MOV ECX,1
0047D303 |. BA 0A000000 MOV EDX,0A
0047D308 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D30B |. E8 9475F8FF CALL MagicPho.004048A4
0047D310 |. FF75 D8 PUSH DWORD PTR SS:[EBP-28]
0047D313 |. 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C]
0047D316 |. 50 PUSH EAX
0047D317 |. B9 01000000 MOV ECX,1
0047D31C |. BA 02000000 MOV EDX,2
0047D321 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D324 |. E8 7B75F8FF CALL MagicPho.004048A4
0047D329 |. FF75 D4 PUSH DWORD PTR SS:[EBP-2C]
0047D32C |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0047D32F |. BA 0A000000 MOV EDX,0A
0047D334 |. E8 D373F8FF CALL MagicPho.0040470C
0047D339 |. E9 07010000 JMP MagicPho.0047D445
0047D33E |> 8D45 D0 LEA EAX,DWORD PTR SS:[EBP-30]
0047D341 |. 50 PUSH EAX
0047D342 |. B9 01000000 MOV ECX,1
0047D347 |. BA 04000000 MOV EDX,4
0047D34C |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; //用户名
0047D34F |. E8 5075F8FF CALL MagicPho.004048A4 ; //取用户名第4位
0047D354 |. FF75 D0 PUSH DWORD PTR SS:[EBP-30]
0047D357 |. 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]
0047D35A |. 50 PUSH EAX
0047D35B |. B9 01000000 MOV ECX,1
0047D360 |. BA 0A000000 MOV EDX,0A
0047D365 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D368 |. E8 3775F8FF CALL MagicPho.004048A4 ; //取用户名第10位
0047D36D |. FF75 CC PUSH DWORD PTR SS:[EBP-34]
0047D370 |. 8D45 C8 LEA EAX,DWORD PTR SS:[EBP-38]
0047D373 |. 50 PUSH EAX
0047D374 |. B9 01000000 MOV ECX,1
0047D379 |. BA 01000000 MOV EDX,1
0047D37E |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D381 |. E8 1E75F8FF CALL MagicPho.004048A4 ; //取用户名第1位
0047D386 |. FF75 C8 PUSH DWORD PTR SS:[EBP-38]
0047D389 |. 8D45 C4 LEA EAX,DWORD PTR SS:[EBP-3C]
0047D38C |. 50 PUSH EAX
0047D38D |. B9 01000000 MOV ECX,1
0047D392 |. BA 03000000 MOV EDX,3
0047D397 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D39A |. E8 0575F8FF CALL MagicPho.004048A4 ; //取用户名第3位
0047D39F |. FF75 C4 PUSH DWORD PTR SS:[EBP-3C]
0047D3A2 |. 8D45 C0 LEA EAX,DWORD PTR SS:[EBP-40]
0047D3A5 |. 50 PUSH EAX
0047D3A6 |. B9 01000000 MOV ECX,1
0047D3AB |. BA 07000000 MOV EDX,7
0047D3B0 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D3B3 |. E8 EC74F8FF CALL MagicPho.004048A4 ; //取用户名第7位
0047D3B8 |. FF75 C0 PUSH DWORD PTR SS:[EBP-40]
0047D3BB |. 8D45 BC LEA EAX,DWORD PTR SS:[EBP-44]
0047D3BE |. 50 PUSH EAX
0047D3BF |. B9 01000000 MOV ECX,1
0047D3C4 |. BA 05000000 MOV EDX,5
0047D3C9 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D3CC |. E8 D374F8FF CALL MagicPho.004048A4 ; //取用户名第5位
0047D3D1 |. FF75 BC PUSH DWORD PTR SS:[EBP-44]
0047D3D4 |. 8D45 B8 LEA EAX,DWORD PTR SS:[EBP-48]
0047D3D7 |. 50 PUSH EAX
0047D3D8 |. B9 01000000 MOV ECX,1
0047D3DD |. BA 08000000 MOV EDX,8
0047D3E2 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D3E5 |. E8 BA74F8FF CALL MagicPho.004048A4 ; //取用户名第8位
0047D3EA |. FF75 B8 PUSH DWORD PTR SS:[EBP-48]
0047D3ED |. 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
0047D3F0 |. 50 PUSH EAX
0047D3F1 |. B9 01000000 MOV ECX,1
0047D3F6 |. BA 06000000 MOV EDX,6
0047D3FB |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D3FE |. E8 A174F8FF CALL MagicPho.004048A4 ; //取用户名第6位
0047D403 |. FF75 B4 PUSH DWORD PTR SS:[EBP-4C]
0047D406 |. 8D45 B0 LEA EAX,DWORD PTR SS:[EBP-50]
0047D409 |. 50 PUSH EAX
0047D40A |. B9 01000000 MOV ECX,1
0047D40F |. BA 02000000 MOV EDX,2
0047D414 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D417 |. E8 8874F8FF CALL MagicPho.004048A4 ; //取用户名第2位
0047D41C |. FF75 B0 PUSH DWORD PTR SS:[EBP-50]
0047D41F |. 8D45 AC LEA EAX,DWORD PTR SS:[EBP-54]
0047D422 |. 50 PUSH EAX
0047D423 |. B9 01000000 MOV ECX,1
0047D428 |. BA 09000000 MOV EDX,9
0047D42D |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0047D430 |. E8 6F74F8FF CALL MagicPho.004048A4 ; //取用户名第9位
0047D435 |. FF75 AC PUSH DWORD PTR SS:[EBP-54]
0047D438 |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0047D43B |. BA 0A000000 MOV EDX,0A
0047D440 |. E8 C772F8FF CALL MagicPho.0040470C
0047D445 |> 8BC6 MOV EAX,ESI
0047D447 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] ; //重新排序后的用户名
0047D44A |. E8 996FF8FF CALL MagicPho.004043E8
0047D44F |. 33C0 XOR EAX,EAX
0047D451 |. 5A POP EDX
0047D452 |. 59 POP ECX
0047D453 |. 59 POP ECX
0047D454 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
0047D457 |. 68 71D44700 PUSH MagicPho.0047D471
0047D45C |> 8D45 AC LEA EAX,DWORD PTR SS:[EBP-54]
0047D45F |. BA 15000000 MOV EDX,15
0047D464 |. E8 4F6FF8FF CALL MagicPho.004043B8
0047D469 \. C3 RETN
0047D46A .^ E9 4D69F8FF JMP MagicPho.00403DBC
0047D46F .^ EB EB JMP SHORT MagicPho.0047D45C
0047D471 . 5E POP ESI
0047D472 . 5B POP EBX
0047D473 . 8BE5 MOV ESP,EBP
0047D475 . 5D POP EBP
0047D476 . C3 RETN

复制代码

由上可知，软件是将用户名和注册码的第4位、第10位、第1位、第3位、第7位、第5位、第8位、第6位、第2位、第9位重新连接
==============================================================

0047D620 /$ 53 PUSH EBX
0047D621 |. 56 PUSH ESI
0047D622 |. 57 PUSH EDI
0047D623 |. 55 PUSH EBP
0047D624 |. 83C4 F8 ADD ESP,-8
0047D627 |. 8BF9 MOV EDI,ECX
0047D629 |. 8BEA MOV EBP,EDX ; //EBP=EDX
0047D62B |. 890424 MOV DWORD PTR SS:[ESP],EAX
0047D62E |. 8BC7 MOV EAX,EDI
0047D630 |. 8B1424 MOV EDX,DWORD PTR SS:[ESP] ; //假码第1-10位
0047D633 |. E8 B06DF8FF CALL MagicPho.004043E8
0047D638 |. 8BC7 MOV EAX,EDI
0047D63A |. E8 5D72F8FF CALL MagicPho.0040489C
0047D63F |. 8B1424 MOV EDX,DWORD PTR SS:[ESP] ; //假码
0047D642 |. 8A12 MOV DL,BYTE PTR DS:[EDX] ; //取假码第一位
0047D644 |. 8810 MOV BYTE PTR DS:[EAX],DL ; //保存
0047D646 |. 8B0424 MOV EAX,DWORD PTR SS:[ESP]
0047D649 |. E8 FE6FF8FF CALL MagicPho.0040464C ; //取假码长度
0047D64E |. 2C 02 SUB AL,2
0047D650 |. 72 3A JB SHORT MagicPho.0047D68C
0047D652 |. 40 INC EAX
0047D653 |. 884424 04 MOV BYTE PTR SS:[ESP+4],AL ; //AL=9
0047D657 |. B3 02 MOV BL,2 ; //BL=2
0047D659 |> 8BC7 /MOV EAX,EDI
0047D65B |. E8 3C72F8FF |CALL MagicPho.0040489C
0047D660 |. 8BF3 |MOV ESI,EBX
0047D662 |. 81E6 FF000000 |AND ESI,0FF
0047D668 |. 8B1424 |MOV EDX,DWORD PTR SS:[ESP]
0047D66B |. 8A5432 FF |MOV DL,BYTE PTR DS:[EDX+ESI-1] ; //从第2位起,依次取假码的ASCII码
0047D66F |. 0FB7CD |MOVZX ECX,BP ; //ECX=BP,BP初始值为100
0047D672 |. C1E9 08 |SHR ECX,8 ; //ECX右移8位
0047D675 |. 32D1 |XOR DL,CL ; //DL=DL xor CL
0047D677 |. 885430 FF |MOV BYTE PTR DS:[EAX+ESI-1],DL ; //保存异或结果
0047D67B |. 8B07 |MOV EAX,DWORD PTR DS:[EDI]
0047D67D |. 0FB64430 FF |MOVZX EAX,BYTE PTR DS:[EAX+ESI-1] ; //取异或结果
0047D682 |. 66:03E8 |ADD BP,AX ; //BP=BP+AX
0047D685 |. 43 |INC EBX
0047D686 |. FE4C24 04 |DEC BYTE PTR SS:[ESP+4]
0047D68A |.^ 75 CD \JNZ SHORT MagicPho.0047D659 ; //循环
0047D68C |> 59 POP ECX
0047D68D |. 5A POP EDX
0047D68E |. 5D POP EBP
0047D68F |. 5F POP EDI
0047D690 |. 5E POP ESI
0047D691 |. 5B POP EBX
0047D692 \. C3 RETN

复制代码

由上可知，软件是注册码进行运算，这个过程即可加密也可解密
**************************************************************
【破解总结】
本程序将用户名和注册码都变形后比较，是无法作内存注册机的，如果看不懂算法流程只有走爆破之路，如果再设计几个暗桩就比较完美了，值得学习。
--------------------------------------------------------------
【算法总结】
--------------------------------------------------------------
【算法注册机】
〖易语言代码〗
.版本 2

.子程序 _按钮1_被单击
.局部变量 A, 整数型
.局部变量 B, 整数型
.局部变量 C, 整数型
.局部变量 D, 整数型
.局部变量 X, 文本型
.局部变量 i, 整数型

.如果 (取文本长度 (编辑框1.内容) ＝ 0)
编辑框2.内容＝ “请输入用户名！”
.否则

X ＝编辑框1.内容
B ＝ 256
.计次循环首 (取文本长度 (X) － 1, i)
      A ＝取代码 (X, i ＋ 1)
      C ＝右移 (B, 8)
      D ＝位异或 (A, C)
      X ＝文本替换 (X, i ＋ 1, 1, 字符 (D))
      B ＝ B ＋ D
.计次循环尾 ()
编辑框2.内容＝文本替换 (X, 11, 1, “U”)

--------------------------------------------------------------
感谢飘云老大、猫老大、Nisy老大以及很多前辈们的学习教程以及徐超等所有帮助过我的论坛兄弟姐妹们！谢谢
--------------------------------------------------------------
【版权声明】破文是学习的手记，兴趣是成功的源泉；本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!

CCC_Fish · 发表于 2009-4-6 22:39:33

很严谨，很强大！学习ing.../:good

HDd1145 · 发表于 2009-4-8 10:07:41

恩，慢慢看还是能看懂一部分的。

千江月 · 发表于 2009-4-18 00:10:09

算法部分学习，很有点长啊

lixy8888 · 发表于 2009-12-1 18:38:15

很精彩的文章/:good

roczyl · 发表于 2009-12-2 11:57:11

好文章，学习了！

ljxnl · 发表于 2014-11-14 10:46:32

感谢楼主提供

xinbinchi · 发表于 2016-7-6 20:28:19

路过必顶，谢谢分享

		自动登录	找回密码
密码			加入我们

[原创] Magic Photo Editor 4.9 算法分析

相关帖子