极限杀号数字三15.00版简单算法分析+VB注册机源码

hrbx · 发表于 2006-5-17 22:27:00

【破文标题】极限杀号数字三15.00版简单算法分析+VB注册机源码
【破解作者】hrbx
【作者主页】hrbx.ys168.com
【作者邮箱】[email protected]
【破解平台】WinXP
【使用工具】flyOD1.10、Peid
【破解日期】2006-05-17
【软件名称】极限杀号数字三15.00版
【软件大小】352KB
【下载地址】https://www.chinapyg.com/viewthread.php?tid=4824&highlight=
【加壳方式】无
【软件简介】极限杀号数字三15.00版
-----------------------------------------------------------------------------------------------
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
-----------------------------------------------------------------------------------------------
【破解过程】
1.查壳。用Peid扫描脱壳后的程序，显示为：Microsoft Visual Basic 5.0 / 6.0，无壳。
2.试运行。输入注册信息：
======================
序列号:-73677970
注册码:9876543210
======================
点击"注册"按钮，提示"请重启软件"。同时注册信息保存在程序目录下的注册信息.txt.
3.OD载入程序。命令栏输入：bp CreateFileA, 回车，F9运行，中断：
77E5B476 k> 55 push ebp ; 在此中断
77E5B477 8BEC mov ebp,esp
77E5B479 FF75 08 push dword ptr ss:[ebp+8]
77E5B47C E8 11FFFFFF call kernel32.77E5B392
77E5B481 85C0 test eax,eax
继续F9运行程序，直到堆栈出现如下友好提示：
0012F6F8 660EC6D7 /CALL 到 CreateFileA 来自 MSVBVM60.660EC6D1
0012F6FC 0012F770 |FileName = "C:\jxsh1500\注册信息.txt"
0012F700 80000000 |Access = GENERIC_READ
0012F704 00000003 |ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE
命令栏输入：bc CreateFileA, 回车，消除断点，ALT+F9返回，来到：
0042943E . FF15 501140>call dword ptr ds:[<&MSVBVM60.__vbaFileOpen>]
00429444 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC] ; ALT+F9返回来到这里
0042944A . FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00429450 . 8D95 3CFEFF>lea edx,dword ptr ss:[ebp-1C4]
向上查找，来到00428630处F2下断。Ctrl+F2重新载入程序，F9运行，立即中断：
00428630 > \55 push ebp ; F2在此下断，中断后F8往下走
00428631 . 8BEC mov ebp,esp
00428633 . 83EC 0C sub esp,0C
00428636 . 68 96184000 push <jmp.&MSVBVM60.__vbaExceptHandler> ; SE 句柄安装
0042863B . 64:A1 00000>mov eax,dword ptr fs:[0]
.......................................................
省略部分代码
.......................................................
00428A4E . BA C0D84000 mov edx,极限杀号.0040D8C0 ; c:\
00428A53 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428A59 . FF15 701140>call dword ptr ds:[<&MSVBVM60.__vbaStrCopy>]
00428A5F . 8B7D 08 mov edi,dword ptr ss:[ebp+8]
00428A62 . 8D85 08FEFF>lea eax,dword ptr ss:[ebp-1F8]
00428A68 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428A6E . 50 push eax
00428A6F . 8B17 mov edx,dword ptr ds:[edi]
00428A71 . 51 push ecx
00428A72 . 57 push edi
00428A73 . FF92 980800>call dword ptr ds:[edx+898]
00428A79 . 3BC6 cmp eax,esi
00428A7B . 7D 12 jge short 极限杀号.00428A8F
00428A7D . 68 98080000 push 898
00428A82 . 68 70CC4000 push 极限杀号.0040CC70
00428A87 . 57 push edi
00428A88 . 50 push eax
00428A89 . FF15 581040>call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>
00428A8F > 8B95 08FEFF>mov edx,dword ptr ss:[ebp-1F8] ; ss:[0012F91C]=D81F31F8，C盘卷标号
00428A95 . 8B3D 141040>mov edi,dword ptr ds:[<&MSVBVM60.__vbaVarMove>] ; 0xD81F31F8=-669044232(有符号数)
00428A9B . 8995 44FEFF>mov dword ptr ss:[ebp-1BC],edx
00428AA1 . 8D95 3CFEFF>lea edx,dword ptr ss:[ebp-1C4]
00428AA7 . 8D8D 5CFFFF>lea ecx,dword ptr ss:[ebp-A4]
00428AAD . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],3
00428AB7 . FFD7 call edi
00428AB9 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428ABF . FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428AC5 . BA CCD84000 mov edx,极限杀号.0040D8CC ; d:\
00428ACA . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428AD0 . FF15 701140>call dword ptr ds:[<&MSVBVM60.__vbaStrCopy>]
00428AD6 . 8B45 08 mov eax,dword ptr ss:[ebp+8]
00428AD9 . 8D95 08FEFF>lea edx,dword ptr ss:[ebp-1F8]
00428ADF . 52 push edx
00428AE0 . 8D95 14FFFF>lea edx,dword ptr ss:[ebp-EC]
00428AE6 . 8B08 mov ecx,dword ptr ds:[eax]
00428AE8 . 52 push edx
00428AE9 . 50 push eax
00428AEA . FF91 980800>call dword ptr ds:[ecx+898]
00428AF0 . 3BC6 cmp eax,esi
00428AF2 . 7D 15 jge short 极限杀号.00428B09
00428AF4 . 8B4D 08 mov ecx,dword ptr ss:[ebp+8]
00428AF7 . 68 98080000 push 898
00428AFC . 68 70CC4000 push 极限杀号.0040CC70
00428B01 . 51 push ecx
00428B02 . 50 push eax
00428B03 . FF15 581040>call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>
00428B09 > 8B95 08FEFF>mov edx,dword ptr ss:[ebp-1F8] ; ss:[0012F91C]=1C20CE05，D盘卷标号
00428B0F . 8D8D 3CFFFF>lea ecx,dword ptr ss:[ebp-C4]
00428B15 . 8995 44FEFF>mov dword ptr ss:[ebp-1BC],edx
00428B1B . 8D95 3CFEFF>lea edx,dword ptr ss:[ebp-1C4]
00428B21 . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],3
00428B2B . FFD7 call edi
00428B2D . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428B33 . FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428B39 . 8B35 3C1140>mov esi,dword ptr ds:[<&MSVBVM60.__vbaStrVarVal>>
00428B3F . 8D85 3CFFFF>lea eax,dword ptr ss:[ebp-C4]
00428B45 . 8D8D 10FFFF>lea ecx,dword ptr ss:[ebp-F0]
00428B4B . 50 push eax
00428B4C . 51 push ecx
00428B4D . FFD6 call esi ; __vbaStrVarVal，D盘卷标号转为10进制值字符串
00428B4F . 50 push eax ; ，0x1C20FE05("471911941")
00428B50 . FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ; rtcR8ValFromBstr,字符串转为浮点数
00428B56 . DD9D 00FEFF>fstp qword ptr ss:[ebp-200] ; "471911941"-->471911941.0, st=471911941.0
00428B5C . 8D95 5CFFFF>lea edx,dword ptr ss:[ebp-A4]
00428B62 . 8D85 14FFFF>lea eax,dword ptr ss:[ebp-EC]
00428B68 . 52 push edx
00428B69 . 50 push eax
00428B6A . FFD6 call esi ; __vbaStrVarVal，C盘卷标号转为10进制值字符串
00428B6C . 50 push eax ; 0xD81F31F8 ("-669044232")
00428B6D . FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ; rtcR8ValFromBstr,字符串转为浮点数 ; "-669044232"-->-669044232.0
00428B73 . DC85 00FEFF>fadd qword ptr ss:[ebp-200] ; 两个浮点数相加，st=-197132291.0
00428B79 . 8D95 3CFEFF>lea edx,dword ptr ss:[ebp-1C4]
00428B7F . 8D4D AC lea ecx,dword ptr ss:[ebp-54]
00428B82 . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],5
00428B8C . DC05 E01240>fadd qword ptr ds:[4012E0] ; ds:[004012E0]=123454321.0000000
00428B92 . DD9D 44FEFF>fstp qword ptr ss:[ebp-1BC] ; 相加结果再加上123454321.0，st=-73677970.0
00428B98 . FFD7 call edi ; -73677970-->"-73677970",机器码
00428B9A . 8D8D 10FFFF>lea ecx,dword ptr ss:[ebp-F0]
00428BA0 . 8D95 14FFFF>lea edx,dword ptr ss:[ebp-EC]
00428BA6 . 51 push ecx
00428BA7 . 52 push edx
00428BA8 . 6A 02 push 2
00428BAA . FF15 781140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>]
00428BB0 . 83C4 0C add esp,0C
00428BB3 . 8D85 ECFEFF>lea eax,dword ptr ss:[ebp-114]
00428BB9 . 8D4D AC lea ecx,dword ptr ss:[ebp-54]
00428BBC . 8D95 DCFEFF>lea edx,dword ptr ss:[ebp-124]
00428BC2 . 50 push eax
00428BC3 . 6A 01 push 1 ; 常数,1
00428BC5 . 51 push ecx
00428BC6 . 52 push edx
00428BC7 . C785 F4FEFF>mov dword ptr ss:[ebp-10C],1
00428BD1 . C785 ECFEFF>mov dword ptr ss:[ebp-114],2
00428BDB . FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ; rtcMidCharVar,取第1位字符"-"
00428BE1 . 8D85 DCFEFF>lea eax,dword ptr ss:[ebp-124]
00428BE7 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428BED . 50 push eax
00428BEE . 51 push ecx
00428BEF . FFD6 call esi
00428BF1 . 50 push eax
00428BF2 . FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ; rtcR8ValFromBstr,字符串转为浮点数
00428BF8 . DD9D 34FEFF>fstp qword ptr ss:[ebp-1CC] ; st=0.0
00428BFE . 8D95 2CFEFF>lea edx,dword ptr ss:[ebp-1D4]
00428C04 . 8D4D CC lea ecx,dword ptr ss:[ebp-34]
00428C07 . C785 2CFEFF>mov dword ptr ss:[ebp-1D4],5
00428C11 . FFD7 call edi
00428C13 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428C19 . FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428C1F . 8D95 DCFEFF>lea edx,dword ptr ss:[ebp-124]
00428C25 . 8D85 ECFEFF>lea eax,dword ptr ss:[ebp-114]
00428C2B . 52 push edx
00428C2C . 50 push eax
00428C2D . 6A 02 push 2
00428C2F . FFD3 call ebx
00428C31 . 83C4 0C add esp,0C
00428C34 . 8D8D ECFEFF>lea ecx,dword ptr ss:[ebp-114]
00428C3A . 8D55 AC lea edx,dword ptr ss:[ebp-54]
00428C3D . 8D85 DCFEFF>lea eax,dword ptr ss:[ebp-124]
00428C43 . 51 push ecx
00428C44 . 6A 02 push 2 ; 常数,2
00428C46 . 52 push edx
00428C47 . 50 push eax
00428C48 . C785 F4FEFF>mov dword ptr ss:[ebp-10C],1
00428C52 . C785 ECFEFF>mov dword ptr ss:[ebp-114],2
00428C5C . FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ; rtcMidCharVar,取第2位字符"7"
00428C62 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00428C68 . 8D95 14FFFF>lea edx,dword ptr ss:[ebp-EC]
00428C6E . 51 push ecx
00428C6F . 52 push edx
00428C70 . FFD6 call esi
00428C72 . 50 push eax
00428C73 . FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ; rtcR8ValFromBstr,字符串转为浮点数
00428C79 . DD9D 34FEFF>fstp qword ptr ss:[ebp-1CC] ; st=7.0
00428C7F . 8D95 2CFEFF>lea edx,dword ptr ss:[ebp-1D4]
00428C85 . 8D4D BC lea ecx,dword ptr ss:[ebp-44]
00428C88 . C785 2CFEFF>mov dword ptr ss:[ebp-1D4],5
00428C92 . FFD7 call edi
00428C94 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428C9A . FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428CA0 . 8D85 DCFEFF>lea eax,dword ptr ss:[ebp-124]
00428CA6 . 8D8D ECFEFF>lea ecx,dword ptr ss:[ebp-114]
00428CAC . 50 push eax
00428CAD . 51 push ecx
00428CAE . 6A 02 push 2
00428CB0 . FFD3 call ebx
00428CB2 . 83C4 0C add esp,0C
00428CB5 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00428CBB . 8D45 AC lea eax,dword ptr ss:[ebp-54]
00428CBE . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00428CC4 . 52 push edx
00428CC5 . 6A 03 push 3 ; 常数,3
00428CC7 . 50 push eax
00428CC8 . 51 push ecx
00428CC9 . C785 F4FEFF>mov dword ptr ss:[ebp-10C],1
00428CD3 . C785 ECFEFF>mov dword ptr ss:[ebp-114],2
00428CDD . FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ; rtcMidCharVar,取第3位字符"3"
00428CE3 . 8D95 DCFEFF>lea edx,dword ptr ss:[ebp-124]
00428CE9 . 8D85 14FFFF>lea eax,dword ptr ss:[ebp-EC]
00428CEF . 52 push edx
00428CF0 . 50 push eax
00428CF1 . FFD6 call esi
00428CF3 . 50 push eax
00428CF4 . FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ; rtcR8ValFromBstr,字符串转为浮点数
00428CFA . DD9D 34FEFF>fstp qword ptr ss:[ebp-1CC] ; st=3.0
00428D00 . 8D95 2CFEFF>lea edx,dword ptr ss:[ebp-1D4]
00428D06 . 8D4D 9C lea ecx,dword ptr ss:[ebp-64]
00428D09 . C785 2CFEFF>mov dword ptr ss:[ebp-1D4],5
00428D13 . FFD7 call edi
00428D15 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428D1B . FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428D21 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00428D27 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00428D2D . 51 push ecx
00428D2E . 52 push edx
00428D2F . 6A 02 push 2
00428D31 . FFD3 call ebx
00428D33 . 83C4 0C add esp,0C
00428D36 . 8D85 ECFEFF>lea eax,dword ptr ss:[ebp-114]
00428D3C . 8D4D AC lea ecx,dword ptr ss:[ebp-54]
00428D3F . 8D95 DCFEFF>lea edx,dword ptr ss:[ebp-124]
00428D45 . 50 push eax
00428D46 . 6A 04 push 4 ; 常数,4
00428D48 . 51 push ecx
00428D49 . 52 push edx
00428D4A . C785 F4FEFF>mov dword ptr ss:[ebp-10C],1
00428D54 . C785 ECFEFF>mov dword ptr ss:[ebp-114],2
00428D5E . FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ; rtcMidCharVar,取第4位字符"6"
00428D64 . 8D85 DCFEFF>lea eax,dword ptr ss:[ebp-124]
00428D6A . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428D70 . 50 push eax
00428D71 . 51 push ecx
00428D72 . FFD6 call esi
00428D74 . 50 push eax
00428D75 . FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ; rtcR8ValFromBstr,字符串转为浮点数
00428D7B . DD9D 34FEFF>fstp qword ptr ss:[ebp-1CC] ; st=6.0
00428D81 . 8D95 2CFEFF>lea edx,dword ptr ss:[ebp-1D4]
00428D87 . 8D4D 8C lea ecx,dword ptr ss:[ebp-74]
00428D8A . C785 2CFEFF>mov dword ptr ss:[ebp-1D4],5
00428D94 . FFD7 call edi
00428D96 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428D9C . FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428DA2 . 8D95 DCFEFF>lea edx,dword ptr ss:[ebp-124]
00428DA8 . 8D85 ECFEFF>lea eax,dword ptr ss:[ebp-114]
00428DAE . 52 push edx
00428DAF . 50 push eax
00428DB0 . 6A 02 push 2
00428DB2 . FFD3 call ebx
00428DB4 . 83C4 0C add esp,0C
00428DB7 . 8D8D ECFEFF>lea ecx,dword ptr ss:[ebp-114]
00428DBD . 8D55 AC lea edx,dword ptr ss:[ebp-54]
00428DC0 . 8D85 DCFEFF>lea eax,dword ptr ss:[ebp-124]
00428DC6 . 51 push ecx
00428DC7 . 6A 05 push 5 ; 常数,5
00428DC9 . 52 push edx
00428DCA . 50 push eax
00428DCB . C785 F4FEFF>mov dword ptr ss:[ebp-10C],1
00428DD5 . C785 ECFEFF>mov dword ptr ss:[ebp-114],2
00428DDF . FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ; rtcMidCharVar,取第5位字符"7"
00428DE5 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00428DEB . 8D95 14FFFF>lea edx,dword ptr ss:[ebp-EC]
00428DF1 . 51 push ecx
00428DF2 . 52 push edx
00428DF3 . FFD6 call esi
00428DF5 . 50 push eax
00428DF6 . FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ; rtcR8ValFromBstr,字符串转为浮点数
00428DFC . DD9D 34FEFF>fstp qword ptr ss:[ebp-1CC] ; st=7.0
00428E02 . 8D95 2CFEFF>lea edx,dword ptr ss:[ebp-1D4]
00428E08 . 8D8D 7CFFFF>lea ecx,dword ptr ss:[ebp-84]
00428E0E . C785 2CFEFF>mov dword ptr ss:[ebp-1D4],5
00428E18 . FFD7 call edi
00428E1A . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428E20 . FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428E26 . 8D85 DCFEFF>lea eax,dword ptr ss:[ebp-124]
00428E2C . 8D8D ECFEFF>lea ecx,dword ptr ss:[ebp-114]
00428E32 . 50 push eax
00428E33 . 51 push ecx
00428E34 . 6A 02 push 2
00428E36 . FFD3 call ebx
00428E38 . 83C4 0C add esp,0C
00428E3B . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00428E41 . 8D45 AC lea eax,dword ptr ss:[ebp-54]
00428E44 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00428E4A . 52 push edx
00428E4B . 6A 06 push 6 ; 常数,6
00428E4D . 50 push eax
00428E4E . 51 push ecx
00428E4F . C785 F4FEFF>mov dword ptr ss:[ebp-10C],1
00428E59 . C785 ECFEFF>mov dword ptr ss:[ebp-114],2
00428E63 . FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ; rtcMidCharVar,取第6位字符"7"
00428E69 . 8D95 DCFEFF>lea edx,dword ptr ss:[ebp-124]
00428E6F . 8D85 14FFFF>lea eax,dword ptr ss:[ebp-EC]
00428E75 . 52 push edx
00428E76 . 50 push eax
00428E77 . FFD6 call esi
00428E79 . 50 push eax
00428E7A . FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ; rtcR8ValFromBstr,字符串转为浮点数
00428E80 . DD9D 34FEFF>fstp qword ptr ss:[ebp-1CC] ; st=7.0
00428E86 . 8D95 2CFEFF>lea edx,dword ptr ss:[ebp-1D4]
00428E8C . 8D8D 6CFFFF>lea ecx,dword ptr ss:[ebp-94]
00428E92 . C785 2CFEFF>mov dword ptr ss:[ebp-1D4],5
00428E9C . FFD7 call edi
00428E9E . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428EA4 . FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428EAA . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00428EB0 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00428EB6 . 51 push ecx
00428EB7 . 52 push edx
00428EB8 . 6A 02 push 2
00428EBA . FFD3 call ebx
00428EBC . 83C4 0C add esp,0C
00428EBF . 8D85 ECFEFF>lea eax,dword ptr ss:[ebp-114]
00428EC5 . 8D4D AC lea ecx,dword ptr ss:[ebp-54]
00428EC8 . 8D95 DCFEFF>lea edx,dword ptr ss:[ebp-124]
00428ECE . 50 push eax
00428ECF . 6A 07 push 7 ; 常数,7
00428ED1 . 51 push ecx
00428ED2 . 52 push edx
00428ED3 . C785 F4FEFF>mov dword ptr ss:[ebp-10C],1
00428EDD . C785 ECFEFF>mov dword ptr ss:[ebp-114],2
00428EE7 . FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ; rtcMidCharVar,取第7位字符"9"
00428EED . 8D85 DCFEFF>lea eax,dword ptr ss:[ebp-124]
00428EF3 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428EF9 . 50 push eax
00428EFA . 51 push ecx
00428EFB . FFD6 call esi
00428EFD . 50 push eax
00428EFE . FF15 F41140>call dword ptr ds:[<&MSVBVM60.#581>] ; rtcR8ValFromBstr,字符串转为浮点数
00428F04 . DD9D 34FEFF>fstp qword ptr ss:[ebp-1CC] ; st=9.0
00428F0A . 8D95 2CFEFF>lea edx,dword ptr ss:[ebp-1D4]
00428F10 . 8D8D 4CFFFF>lea ecx,dword ptr ss:[ebp-B4]
00428F16 . C785 2CFEFF>mov dword ptr ss:[ebp-1D4],5
00428F20 . FFD7 call edi
00428F22 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00428F28 . FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00428F2E . 8D95 DCFEFF>lea edx,dword ptr ss:[ebp-124]
00428F34 . 8D85 ECFEFF>lea eax,dword ptr ss:[ebp-114]
00428F3A . 52 push edx
00428F3B . 50 push eax
00428F3C . 6A 02 push 2
00428F3E . FFD3 call ebx
00428F40 . 6A 00 push 0
00428F42 . 6A 07 push 7
00428F44 . 6A 01 push 1
00428F46 . 8D8D 18FFFF>lea ecx,dword ptr ss:[ebp-E8]
00428F4C . 6A 0C push 0C
00428F4E . 51 push ecx
00428F4F . 6A 10 push 10
00428F51 . 68 80080000 push 880
00428F56 . FF15 E81040>call dword ptr ds:[<&MSVBVM60.__vbaRedim>]
00428F5C . 8B35 A01140>mov esi,dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]
00428F62 . 83C4 28 add esp,28
00428F65 . 8D55 CC lea edx,dword ptr ss:[ebp-34]
00428F68 . 8D85 3CFEFF>lea eax,dword ptr ss:[ebp-1C4]
00428F6E . 6A 01 push 1
00428F70 . 52 push edx
00428F71 . 8D8D ECFEFF>lea ecx,dword ptr ss:[ebp-114]
00428F77 . 50 push eax
00428F78 . 51 push ecx
00428F79 . C785 44FEFF>mov dword ptr ss:[ebp-1BC],3 ; 常数1－3
00428F83 . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],2
00428F8D . FFD6 call esi ; __vbaVarAdd,取出的第1个数加上常数1;
00428F8F . 8D95 DCFEFF>lea edx,dword ptr ss:[ebp-124] ; 0+3=3
00428F95 . 50 push eax
00428F96 . 52 push edx
00428F97 . FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ; rtcRightCharVar,取右边1个字符，"3"
00428F9D . 8B85 18FFFF>mov eax,dword ptr ss:[ebp-E8]
00428FA3 . 8D95 DCFEFF>lea edx,dword ptr ss:[ebp-124]
00428FA9 . 8B48 14 mov ecx,dword ptr ds:[eax+14]
00428FAC . C1E1 04 shl ecx,4
00428FAF . 898D 98FDFF>mov dword ptr ss:[ebp-268],ecx
00428FB5 . 8B48 0C mov ecx,dword ptr ds:[eax+C]
00428FB8 . 8B85 98FDFF>mov eax,dword ptr ss:[ebp-268]
00428FBE . 2BC8 sub ecx,eax
00428FC0 . 83C1 10 add ecx,10
00428FC3 . FFD7 call edi
00428FC5 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00428FCB . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00428FD1 . 51 push ecx
00428FD2 . 52 push edx
00428FD3 . 6A 02 push 2
00428FD5 . FFD3 call ebx
00428FD7 . 83C4 0C add esp,0C
00428FDA . 8D45 CC lea eax,dword ptr ss:[ebp-34]
00428FDD . 8D4D BC lea ecx,dword ptr ss:[ebp-44]
00428FE0 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00428FE6 . 6A 01 push 1
00428FE8 . 50 push eax
00428FE9 . 51 push ecx
00428FEA . 52 push edx
00428FEB . C785 44FEFF>mov dword ptr ss:[ebp-1BC],7 ; 常数2－7
00428FF5 . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],2
00428FFF . FFD6 call esi ; __vbaVarAdd,取出的第1个数与第2个数相加
00429001 . 50 push eax ; 0+7=7
00429002 . 8D85 3CFEFF>lea eax,dword ptr ss:[ebp-1C4]
00429008 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
0042900E . 50 push eax
0042900F . 51 push ecx
00429010 . FFD6 call esi ; __vbaVarAdd,相加结果加上常数2
00429012 . 8D95 CCFEFF>lea edx,dword ptr ss:[ebp-134] ; 7+7=14
00429018 . 50 push eax
00429019 . 52 push edx
0042901A . FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ; rtcRightCharVar,取右边1个字符，"4"
00429020 . 8B85 18FFFF>mov eax,dword ptr ss:[ebp-E8]
00429026 . B9 02000000 mov ecx,2
0042902B . 8D95 CCFEFF>lea edx,dword ptr ss:[ebp-134]
00429031 . 2B48 14 sub ecx,dword ptr ds:[eax+14]
00429034 . C1E1 04 shl ecx,4
00429037 . 0348 0C add ecx,dword ptr ds:[eax+C]
0042903A . FFD7 call edi
0042903C . 8D85 CCFEFF>lea eax,dword ptr ss:[ebp-134]
00429042 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00429048 . 50 push eax
00429049 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
0042904F . 51 push ecx
00429050 . 52 push edx
00429051 . 6A 03 push 3
00429053 . FFD3 call ebx
00429055 . B8 02000000 mov eax,2 ; EAX＝2,常数3－2
0042905A . 83C4 10 add esp,10
0042905D . 8985 44FEFF>mov dword ptr ss:[ebp-1BC],eax
00429063 . 8985 3CFEFF>mov dword ptr ss:[ebp-1C4],eax
00429069 . 8D45 CC lea eax,dword ptr ss:[ebp-34]
0042906C . 6A 01 push 1
0042906E . 8D4D BC lea ecx,dword ptr ss:[ebp-44]
00429071 . 50 push eax
00429072 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00429078 . 51 push ecx
00429079 . 52 push edx
0042907A . FFD6 call esi ; __vbaVarAdd,取出的第1个数与第2个数相加
0042907C . 50 push eax ; 0+7=7
0042907D . 8D45 9C lea eax,dword ptr ss:[ebp-64]
00429080 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00429086 . 50 push eax
00429087 . 51 push ecx
00429088 . FFD6 call esi ; __vbaVarAdd,取出的第1,2，3个数相加
0042908A . 50 push eax ; 0+7+3＝10
0042908B . 8D95 3CFEFF>lea edx,dword ptr ss:[ebp-1C4]
00429091 . 8D85 CCFEFF>lea eax,dword ptr ss:[ebp-134]
00429097 . 52 push edx
00429098 . 50 push eax
00429099 . FFD6 call esi ; __vbaVarAdd,相加结果加上常数3
0042909B . 8D8D BCFEFF>lea ecx,dword ptr ss:[ebp-144] ; 10+2=12
004290A1 . 50 push eax
004290A2 . 51 push ecx
004290A3 . FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ; rtcRightCharVar,取右边1个字符，"2"
004290A9 . 8B85 18FFFF>mov eax,dword ptr ss:[ebp-E8]
004290AF . B9 03000000 mov ecx,3
004290B4 . 8D95 BCFEFF>lea edx,dword ptr ss:[ebp-144]
004290BA . 2B48 14 sub ecx,dword ptr ds:[eax+14]
004290BD . C1E1 04 shl ecx,4
004290C0 . 0348 0C add ecx,dword ptr ds:[eax+C]
004290C3 . FFD7 call edi
004290C5 . 8D95 BCFEFF>lea edx,dword ptr ss:[ebp-144]
004290CB . 8D85 CCFEFF>lea eax,dword ptr ss:[ebp-134]
004290D1 . 52 push edx
004290D2 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
004290D8 . 50 push eax
004290D9 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
004290DF . 51 push ecx
004290E0 . 52 push edx
004290E1 . 6A 04 push 4
004290E3 . FFD3 call ebx
004290E5 . B8 02000000 mov eax,2 ; EAX＝2,常数4－2
004290EA . 83C4 14 add esp,14
004290ED . 8985 44FEFF>mov dword ptr ss:[ebp-1BC],eax
004290F3 . 8985 3CFEFF>mov dword ptr ss:[ebp-1C4],eax
004290F9 . 8D45 CC lea eax,dword ptr ss:[ebp-34]
004290FC . 6A 01 push 1
004290FE . 8D4D BC lea ecx,dword ptr ss:[ebp-44]
00429101 . 50 push eax
00429102 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00429108 . 51 push ecx
00429109 . 52 push edx
0042910A . FFD6 call esi ; __vbaVarAdd,取出的第1个数与第2个数相加
0042910C . 50 push eax ; 0+7=7
0042910D . 8D45 9C lea eax,dword ptr ss:[ebp-64]
00429110 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00429116 . 50 push eax
00429117 . 51 push ecx
00429118 . FFD6 call esi ; __vbaVarAdd,取出的第1,2，3个数相加
0042911A . 50 push eax ; 0+7+3＝10
0042911B . 8D55 8C lea edx,dword ptr ss:[ebp-74]
0042911E . 8D85 CCFEFF>lea eax,dword ptr ss:[ebp-134]
00429124 . 52 push edx
00429125 . 50 push eax
00429126 . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3,4个数相加
00429128 . 8D8D 3CFEFF>lea ecx,dword ptr ss:[ebp-1C4] ; 0+7+3+6=16
0042912E . 50 push eax
0042912F . 51 push ecx
00429130 . 8D95 BCFEFF>lea edx,dword ptr ss:[ebp-144]
00429136 . 52 push edx
00429137 . FFD6 call esi ; __vbaVarAdd,相加结果加上常数4
00429139 . 50 push eax ; 16+2=18
0042913A . 8D85 ACFEFF>lea eax,dword ptr ss:[ebp-154]
00429140 . 50 push eax
00429141 . FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ; rtcRightCharVar,取右边1个字符，"8"
00429147 . 8B85 18FFFF>mov eax,dword ptr ss:[ebp-E8]
0042914D . B9 04000000 mov ecx,4
00429152 . 8D95 ACFEFF>lea edx,dword ptr ss:[ebp-154]
00429158 . 2B48 14 sub ecx,dword ptr ds:[eax+14]
0042915B . C1E1 04 shl ecx,4
0042915E . 0348 0C add ecx,dword ptr ds:[eax+C]
00429161 . FFD7 call edi
00429163 . 8D8D ACFEFF>lea ecx,dword ptr ss:[ebp-154]
00429169 . 8D95 BCFEFF>lea edx,dword ptr ss:[ebp-144]
0042916F . 51 push ecx
00429170 . 8D85 CCFEFF>lea eax,dword ptr ss:[ebp-134]
00429176 . 52 push edx
00429177 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
0042917D . 50 push eax
0042917E . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00429184 . 51 push ecx
00429185 . 52 push edx
00429186 . 6A 05 push 5
00429188 . FFD3 call ebx
0042918A . 83C4 18 add esp,18
0042918D . 8D45 CC lea eax,dword ptr ss:[ebp-34]
00429190 . 8D4D BC lea ecx,dword ptr ss:[ebp-44]
00429193 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00429199 . 6A 01 push 1
0042919B . 50 push eax
0042919C . 51 push ecx
0042919D . 52 push edx
0042919E . C785 44FEFF>mov dword ptr ss:[ebp-1BC],8 ; 常数5－8
004291A8 . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],2
004291B2 . FFD6 call esi ; __vbaVarAdd,取出的第1个数与第2个数相加
004291B4 . 50 push eax ; 0+7=7
004291B5 . 8D45 9C lea eax,dword ptr ss:[ebp-64]
004291B8 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
004291BE . 50 push eax
004291BF . 51 push ecx
004291C0 . FFD6 call esi ; __vbaVarAdd,取出的第1,2，3个数相加
004291C2 . 50 push eax ; 0+7+3＝10
004291C3 . 8D55 8C lea edx,dword ptr ss:[ebp-74]
004291C6 . 8D85 CCFEFF>lea eax,dword ptr ss:[ebp-134]
004291CC . 52 push edx
004291CD . 50 push eax
004291CE . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3,4个数相加
004291D0 . 8D8D 7CFFFF>lea ecx,dword ptr ss:[ebp-84] ; 0+7+3+6=16
004291D6 . 50 push eax
004291D7 . 8D95 BCFEFF>lea edx,dword ptr ss:[ebp-144]
004291DD . 51 push ecx
004291DE . 52 push edx
004291DF . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3,4,5个数相加
004291E1 . 50 push eax ; 0+7+3+6+7=23
004291E2 . 8D85 3CFEFF>lea eax,dword ptr ss:[ebp-1C4]
004291E8 . 8D8D ACFEFF>lea ecx,dword ptr ss:[ebp-154]
004291EE . 50 push eax
004291EF . 51 push ecx
004291F0 . FFD6 call esi ; __vbaVarAdd,相加结果加上常数5
004291F2 . 8D95 9CFEFF>lea edx,dword ptr ss:[ebp-164] ; 23+8=31
004291F8 . 50 push eax
004291F9 . 52 push edx
004291FA . FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ; rtcRightCharVar,取右边1个字符，"1"
00429200 . 8B85 18FFFF>mov eax,dword ptr ss:[ebp-E8]
00429206 . B9 05000000 mov ecx,5
0042920B . 8D95 9CFEFF>lea edx,dword ptr ss:[ebp-164]
00429211 . 2B48 14 sub ecx,dword ptr ds:[eax+14]
00429214 . C1E1 04 shl ecx,4
00429217 . 0348 0C add ecx,dword ptr ds:[eax+C]
0042921A . FFD7 call edi
0042921C . 8D85 9CFEFF>lea eax,dword ptr ss:[ebp-164]
00429222 . 8D8D ACFEFF>lea ecx,dword ptr ss:[ebp-154]
00429228 . 50 push eax
00429229 . 8D95 BCFEFF>lea edx,dword ptr ss:[ebp-144]
0042922F . 51 push ecx
00429230 . 8D85 CCFEFF>lea eax,dword ptr ss:[ebp-134]
00429236 . 52 push edx
00429237 . 50 push eax
00429238 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
0042923E . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00429244 . 51 push ecx
00429245 . 52 push edx
00429246 . 6A 06 push 6
00429248 . FFD3 call ebx
0042924A . 83C4 1C add esp,1C
0042924D . 8D45 CC lea eax,dword ptr ss:[ebp-34]
00429250 . 8D4D BC lea ecx,dword ptr ss:[ebp-44]
00429253 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00429259 . 6A 01 push 1
0042925B . 50 push eax
0042925C . 51 push ecx
0042925D . 52 push edx
0042925E . C785 44FEFF>mov dword ptr ss:[ebp-1BC],7 ; 常数6－7
00429268 . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],2
00429272 . FFD6 call esi ; __vbaVarAdd,取出的第1个数与第2个数相加
00429274 . 50 push eax ; 0+7=7
00429275 . 8D45 9C lea eax,dword ptr ss:[ebp-64]
00429278 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
0042927E . 50 push eax
0042927F . 51 push ecx
00429280 . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3个数相加
00429282 . 50 push eax ; 0+7+3＝10
00429283 . 8D55 8C lea edx,dword ptr ss:[ebp-74]
00429286 . 8D85 CCFEFF>lea eax,dword ptr ss:[ebp-134]
0042928C . 52 push edx
0042928D . 50 push eax
0042928E . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3,4个数相加
00429290 . 8D8D 7CFFFF>lea ecx,dword ptr ss:[ebp-84] ; 0+7+3+6=16
00429296 . 50 push eax
00429297 . 8D95 BCFEFF>lea edx,dword ptr ss:[ebp-144]
0042929D . 51 push ecx
0042929E . 52 push edx
0042929F . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3,4,5个数相加
004292A1 . 50 push eax ; 0+7+3+6+7=23
004292A2 . 8D85 6CFFFF>lea eax,dword ptr ss:[ebp-94]
004292A8 . 8D8D ACFEFF>lea ecx,dword ptr ss:[ebp-154]
004292AE . 50 push eax
004292AF . 51 push ecx
004292B0 . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3,4,5,6数相加
004292B2 . 50 push eax ; 0+7+3+6+7+7=30
004292B3 . 8D95 3CFEFF>lea edx,dword ptr ss:[ebp-1C4]
004292B9 . 8D85 9CFEFF>lea eax,dword ptr ss:[ebp-164]
004292BF . 52 push edx
004292C0 . 50 push eax
004292C1 . FFD6 call esi ; __vbaVarAdd,相加结果加上常数6
004292C3 . 8D8D 8CFEFF>lea ecx,dword ptr ss:[ebp-174] ; 30+7=37
004292C9 . 50 push eax
004292CA . 51 push ecx
004292CB . FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ; rtcRightCharVar,取右边1个字符，"7"
004292D1 . 8B85 18FFFF>mov eax,dword ptr ss:[ebp-E8]
004292D7 . B9 06000000 mov ecx,6
004292DC . 8D95 8CFEFF>lea edx,dword ptr ss:[ebp-174]
004292E2 . 2B48 14 sub ecx,dword ptr ds:[eax+14]
004292E5 . C1E1 04 shl ecx,4
004292E8 . 0348 0C add ecx,dword ptr ds:[eax+C]
004292EB . FFD7 call edi
004292ED . 8D95 8CFEFF>lea edx,dword ptr ss:[ebp-174]
004292F3 . 8D85 9CFEFF>lea eax,dword ptr ss:[ebp-164]
004292F9 . 52 push edx
004292FA . 8D8D ACFEFF>lea ecx,dword ptr ss:[ebp-154]
00429300 . 50 push eax
00429301 . 8D95 BCFEFF>lea edx,dword ptr ss:[ebp-144]
00429307 . 51 push ecx
00429308 . 8D85 CCFEFF>lea eax,dword ptr ss:[ebp-134]
0042930E . 52 push edx
0042930F . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00429315 . 50 push eax
00429316 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
0042931C . 51 push ecx
0042931D . 52 push edx
0042931E . 6A 07 push 7
00429320 . FFD3 call ebx
00429322 . 83C4 20 add esp,20
00429325 . 8D45 CC lea eax,dword ptr ss:[ebp-34]
00429328 . 8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042932B . C785 44FEFF>mov dword ptr ss:[ebp-1BC],7 ; 常数7－7
00429335 . 6A 01 push 1
00429337 . 50 push eax
00429338 . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],2
00429342 . 51 push ecx
00429343 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
00429349 . 52 push edx
0042934A . FFD6 call esi ; __vbaVarAdd,取出的第1个数与第2个数相加
0042934C . 50 push eax ; 0+7=10
0042934D . 8D45 9C lea eax,dword ptr ss:[ebp-64]
00429350 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00429356 . 50 push eax
00429357 . 51 push ecx
00429358 . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3,数相加
0042935A . 50 push eax ; 0+7+3=13
0042935B . 8D55 8C lea edx,dword ptr ss:[ebp-74]
0042935E . 8D85 CCFEFF>lea eax,dword ptr ss:[ebp-134]
00429364 . 52 push edx
00429365 . 50 push eax
00429366 . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3,4数相加
00429368 . 8D8D 7CFFFF>lea ecx,dword ptr ss:[ebp-84] ; 0+7+3+6=16
0042936E . 50 push eax
0042936F . 8D95 BCFEFF>lea edx,dword ptr ss:[ebp-144]
00429375 . 51 push ecx
00429376 . 52 push edx
00429377 . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3,4,5数相加
00429379 . 50 push eax ; 0+7+3+6+7=23
0042937A . 8D85 6CFFFF>lea eax,dword ptr ss:[ebp-94]
00429380 . 8D8D ACFEFF>lea ecx,dword ptr ss:[ebp-154]
00429386 . 50 push eax
00429387 . 51 push ecx
00429388 . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3,4,5,6数相加
0042938A . 50 push eax ; 0+7+3+6+7+7=30
0042938B . 8D95 4CFFFF>lea edx,dword ptr ss:[ebp-B4]
00429391 . 8D85 9CFEFF>lea eax,dword ptr ss:[ebp-164]
00429397 . 52 push edx
00429398 . 50 push eax
00429399 . FFD6 call esi ; __vbaVarAdd,取出的第1,2,3,4,5,6,7数相加
0042939B . 8D8D 3CFEFF>lea ecx,dword ptr ss:[ebp-1C4] ; 0+7+3+6+7+7+9=39
004293A1 . 50 push eax
004293A2 . 8D95 8CFEFF>lea edx,dword ptr ss:[ebp-174]
004293A8 . 51 push ecx
004293A9 . 52 push edx
004293AA . FFD6 call esi ; __vbaVarAdd,相加结果加上常数7
004293AC . 50 push eax ; 39+7=46
004293AD . 8D85 7CFEFF>lea eax,dword ptr ss:[ebp-184]
004293B3 . 50 push eax
004293B4 . FF15 CC1140>call dword ptr ds:[<&MSVBVM60.#619>] ; rtcRightCharVar,取右边1个字符，"6"
004293BA . 8B85 18FFFF>mov eax,dword ptr ss:[ebp-E8] ; 依次连接所得的7个字符即为真码"3428176"
004293C0 . B9 07000000 mov ecx,7
004293C5 . 8D95 7CFEFF>lea edx,dword ptr ss:[ebp-184]
004293CB . 2B48 14 sub ecx,dword ptr ds:[eax+14]
004293CE . C1E1 04 shl ecx,4
004293D1 . 0348 0C add ecx,dword ptr ds:[eax+C]
004293D4 . FFD7 call edi
004293D6 . 8D8D 7CFEFF>lea ecx,dword ptr ss:[ebp-184]
004293DC . 8D95 8CFEFF>lea edx,dword ptr ss:[ebp-174]
004293E2 . 51 push ecx
004293E3 . 8D85 9CFEFF>lea eax,dword ptr ss:[ebp-164]
004293E9 . 52 push edx
004293EA . 8D8D ACFEFF>lea ecx,dword ptr ss:[ebp-154]
004293F0 . 50 push eax
004293F1 . 8D95 BCFEFF>lea edx,dword ptr ss:[ebp-144]
004293F7 . 51 push ecx
004293F8 . 8D85 CCFEFF>lea eax,dword ptr ss:[ebp-134]
004293FE . 52 push edx
004293FF . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00429405 . 50 push eax
00429406 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
0042940C . 51 push ecx
0042940D . 52 push edx
0042940E . 6A 08 push 8
00429410 . FFD3 call ebx
00429412 . 8B45 08 mov eax,dword ptr ss:[ebp+8]
00429415 . 83C4 24 add esp,24
00429418 . 83C0 60 add eax,60
0042941B . 8B08 mov ecx,dword ptr ds:[eax]
0042941D . 51 push ecx
0042941E . 68 D8D84000 push 极限杀号.0040D8D8
00429423 . FF15 481040>call dword ptr ds:[<&MSVBVM60.__vbaStrCat>]
00429429 . 8BD0 mov edx,eax
0042942B . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
00429431 . FF15 C41140>call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]
00429437 . 50 push eax
00429438 . 6A 01 push 1
0042943A . 6A FF push -1
0042943C . 6A 01 push 1
0042943E . FF15 501140>call dword ptr ds:[<&MSVBVM60.__vbaFileOpen>] ; 打开文件
00429444 . 8D8D 14FFFF>lea ecx,dword ptr ss:[ebp-EC]
0042944A . FF15 EC1140>call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]
00429450 . 8D95 3CFEFF>lea edx,dword ptr ss:[ebp-1C4]
00429456 . 8D4D DC lea ecx,dword ptr ss:[ebp-24]
00429459 . C785 44FEFF>mov dword ptr ss:[ebp-1BC],0
00429463 . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],2
0042946D . FFD7 call edi
0042946F > 6A 01 push 1
00429471 . FF15 601140>call dword ptr ds:[<&MSVBVM60.#571>] ; MSVBVM60.rtcEndOfFile
00429477 . 66:85C0 test ax,ax
0042947A . 0F85 BE0000>jnz 极限杀号.0042953E
00429480 . 8D95 1CFFFF>lea edx,dword ptr ss:[ebp-E4]
00429486 . 6A 01 push 1
00429488 . 52 push edx
00429489 . FF15 401040>call dword ptr ds:[<&MSVBVM60.__vbaLineInputVar>>
0042948F . 8D85 1CFFFF>lea eax,dword ptr ss:[ebp-E4]
00429495 . 8D8D ECFEFF>lea ecx,dword ptr ss:[ebp-114]
0042949B . 50 push eax
0042949C . 51 push ecx
0042949D . C785 44FEFF>mov dword ptr ss:[ebp-1BC],5
004294A7 . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],8002
004294B1 . FF15 5C1040>call dword ptr ds:[<&MSVBVM60.__vbaLenVar>]
004294B7 . 8D95 3CFEFF>lea edx,dword ptr ss:[ebp-1C4]
004294BD . 50 push eax
004294BE . 52 push edx
004294BF . FF15 041040>call dword ptr ds:[<&MSVBVM60.__vbaVarTstGt>]
004294C5 . 66:85C0 test ax,ax
004294C8 .^ 74 A5 je short 极限杀号.0042946F
004294CA . 8D45 DC lea eax,dword ptr ss:[ebp-24]
004294CD . 8D8D 3CFEFF>lea ecx,dword ptr ss:[ebp-1C4]
004294D3 . 50 push eax
004294D4 . 8D95 ECFEFF>lea edx,dword ptr ss:[ebp-114]
004294DA . 51 push ecx
004294DB . 52 push edx
004294DC . C785 44FEFF>mov dword ptr ss:[ebp-1BC],1
004294E6 . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],2
004294F0 . FFD6 call esi
004294F2 . 8BD0 mov edx,eax
004294F4 . 8D4D DC lea ecx,dword ptr ss:[ebp-24]
004294F7 . FFD7 call edi
004294F9 . 8D45 DC lea eax,dword ptr ss:[ebp-24]
004294FC . 8D8D 3CFEFF>lea ecx,dword ptr ss:[ebp-1C4]
00429502 . 50 push eax
00429503 . 51 push ecx
00429504 . C785 44FEFF>mov dword ptr ss:[ebp-1BC],1
0042950E . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],8002
00429518 . FF15 D41040>call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>]
0042951E . 66:85C0 test ax,ax
00429521 .^ 0F84 48FFFF>je 极限杀号.0042946F
00429527 . 8D95 1CFFFF>lea edx,dword ptr ss:[ebp-E4]
0042952D . 8D8D 2CFFFF>lea ecx,dword ptr ss:[ebp-D4]
00429533 . FF15 B81140>call dword ptr ds:[<&MSVBVM60.__vbaVarCopy>]
00429539 .^ E9 31FFFFFF jmp 极限杀号.0042946F
0042953E > BF 01000000 mov edi,1
00429543 . 57 push edi
00429544 . FF15 C81040>call dword ptr ds:[<&MSVBVM60.__vbaFileClose>] ; 关闭文件
0042954A . 8D55 DC lea edx,dword ptr ss:[ebp-24]
0042954D . 8D85 3CFEFF>lea eax,dword ptr ss:[ebp-1C4]
00429553 . 52 push edx
00429554 . 50 push eax
00429555 . C785 44FEFF>mov dword ptr ss:[ebp-1BC],0
0042955F . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],8002
00429569 . FF15 D41040>call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>] ; 比较文件内容是否为空
0042956F . 66:85C0 test ax,ax
00429572 . 74 26 je short 极限杀号.0042959A ; 不为空则跳
00429574 . 8D95 3CFEFF>lea edx,dword ptr ss:[ebp-1C4]
0042957A . 8D8D 2CFFFF>lea ecx,dword ptr ss:[ebp-D4]
00429580 . C785 44FEFF>mov dword ptr ss:[ebp-1BC],极限杀号.0040D8F0 ; 1234567,文件内容为空则赋值注册码为1234567
0042958A . C785 3CFEFF>mov dword ptr ss:[ebp-1C4],8
00429594 . FF15 B81140>call dword ptr ds:[<&MSVBVM60.__vbaVarCopy>]
0042959A > 8B75 08 mov esi,dword ptr ss:[ebp+8]
0042959D . B8 02000000 mov eax,2
004295A2 . 8D8D 3CFEFF>lea ecx,dword ptr ss:[ebp-1C4]
004295A8 . 8985 3CFEFF>mov dword ptr ss:[ebp-1C4],eax
004295AE . 8985 2CFEFF>mov dword ptr ss:[ebp-1D4],eax
004295B4 . 8985 1CFEFF>mov dword ptr ss:[ebp-1E4],eax
004295BA . 8D95 2CFEFF>lea edx,dword ptr ss:[ebp-1D4]
004295C0 . 51 push ecx
004295C1 . 8D85 1CFEFF>lea eax,dword ptr ss:[ebp-1E4]
004295C7 . 52 push edx
004295C8 . 8D8D B0FDFF>lea ecx,dword ptr ss:[ebp-250]
004295CE . 50 push eax
004295CF . 8D95 C0FDFF>lea edx,dword ptr ss:[ebp-240]
004295D5 . 51 push ecx
004295D6 . 8D45 DC lea eax,dword ptr ss:[ebp-24]
004295D9 . 52 push edx
004295DA . 50 push eax
004295DB . 66:C746 7A >mov word ptr ds:[esi+7A],0
004295E1 . 89BD 44FEFF>mov dword ptr ss:[ebp-1BC],edi
004295E7 . C785 34FEFF>mov dword ptr ss:[ebp-1CC],7
004295F1 . 89BD 24FEFF>mov dword ptr ss:[ebp-1DC],edi
004295F7 . FF15 6C1040>call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>]
004295FD . 8B3D 901140>mov edi,dword ptr ds:[<&MSVBVM60.__vbaI4Var>]
00429603 > 85C0 test eax,eax
00429605 . 0F84 CD0000>je 极限杀号.004296D8
0042960B . 8D8D ECFEFF>lea ecx,dword ptr ss:[ebp-114]
00429611 . 8D55 DC lea edx,dword ptr ss:[ebp-24]
00429614 . 51 push ecx
00429615 . 52 push edx
00429616 . C785 F4FEFF>mov dword ptr ss:[ebp-10C],1
00429620 . C785 ECFEFF>mov dword ptr ss:[ebp-114],2
0042962A . FFD7 call edi
0042962C . 50 push eax
0042962D . 8D85 2CFFFF>lea eax,dword ptr ss:[ebp-D4]
00429633 . 8D8D DCFEFF>lea ecx,dword ptr ss:[ebp-124]
00429639 . 50 push eax
0042963A . 51 push ecx
0042963B . FF15 BC1040>call dword ptr ds:[<&MSVBVM60.#632>] ; rtcMidCharVar,依次取假码第一位字符
00429641 . 66:8B56 7A mov dx,word ptr ds:[esi+7A]
00429645 . 8D85 2CFEFF>lea eax,dword ptr ss:[ebp-1D4]
0042964B . 8D4D DC lea ecx,dword ptr ss:[ebp-24]
0042964E . 50 push eax
0042964F . 51 push ecx
00429650 . 66:8995 34F>mov word ptr ss:[ebp-1CC],dx
00429657 . C785 2CFEFF>mov dword ptr ss:[ebp-1D4],2
00429661 . FFD7 call edi
00429663 . 8BD0 mov edx,eax
00429665 . 8B85 18FFFF>mov eax,dword ptr ss:[ebp-E8]
0042966B . 8B48 14 mov ecx,dword ptr ds:[eax+14]
0042966E . 2BD1 sub edx,ecx
00429670 . 8B48 0C mov ecx,dword ptr ds:[eax+C]
00429673 . C1E2 04 shl edx,4
00429676 . 03D1 add edx,ecx
00429678 . 8D85 DCFEFF>lea eax,dword ptr ss:[ebp-124]
0042967E . 52 push edx
0042967F . 8D8D CCFEFF>lea ecx,dword ptr ss:[ebp-134]
00429685 . 50 push eax
00429686 . 51 push ecx
00429687 . FF15 941140>call dword ptr ds:[<&MSVBVM60.__vbaVarCmpEq>] ; 取出假码逐位与真码比较
0042968D . 8D95 BCFEFF>lea edx,dword ptr ss:[ebp-144]
00429693 . 50 push eax
00429694 . 52 push edx
00429695 . FF15 001040>call dword ptr ds:[<&MSVBVM60.__vbaVarSub>]
0042969B . 50 push eax
0042969C . FF15 441140>call dword ptr ds:[<&MSVBVM60.__vbaI2Var>]
004296A2 . 66:8946 7A mov word ptr ds:[esi+7A],ax ; AX赋值给ds:[esi+7A],不等时AX为0
004296A6 . 8D85 DCFEFF>lea eax,dword ptr ss:[ebp-124]
004296AC . 8D8D ECFEFF>lea ecx,dword ptr ss:[ebp-114]
004296B2 . 50 push eax
004296B3 . 51 push ecx
004296B4 . 6A 02 push 2
004296B6 . FFD3 call ebx
004296B8 . 83C4 0C add esp,0C
004296BB . 8D95 B0FDFF>lea edx,dword ptr ss:[ebp-250]
004296C1 . 8D85 C0FDFF>lea eax,dword ptr ss:[ebp-240]
004296C7 . 8D4D DC lea ecx,dword ptr ss:[ebp-24]
004296CA . 52 push edx
004296CB . 50 push eax
004296CC . 51 push ecx
004296CD . FF15 E41140>call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>]
004296D3 .^ E9 2BFFFFFF jmp 极限杀号.00429603
004296D8 > 66:837E 7A >cmp word ptr ds:[esi+7A],7 ; ds:[esi+7A]中的值与7比较
004296DD 0F84 A30300>je 极限杀号.00429A86 ; 相等则跳，暴破点，改为jmp
004296E3 . 8B16 mov edx,dword ptr ds:[esi]
004296E5 . 56 push esi
-----------------------------------------------------------------------------------------------
【破解总结】
1.程序取C盘和D盘卷标号转为有符号10进制数相加后再加上123454321，结果转为字符串形式即为机器码。
2.取机器码前7位进行运算，内置7个常数用于每次的运算，每次运算完取右边一位字符，最后将7个字符连接即为真码。
一组可用注册码：
======================
序列号:-73677970
注册码:3428176
======================
注册信息保存在程序目录下的注册信息.txt,消除则又是未注册状态。
暴破更改以下位置：
004296DD je 极限杀号.00429A86 ; je====>jmp
【VB注册机源码】
Private Sub Generate_Click()
On Error Resume Next
Dim Serial As String
Dim RegCode As String
Dim i As Integer
Dim num1, num2, num3, num4, num5, num6, num7 As Integer
Dim str1, str2, str3, str4, str5, str6, str7 As String
If Len(Text1.Text) < 7 Then
Text2.Text = "序列号错误！"
Else
Serial = Text1.Text
If Asc(Mid(Serial, 1, 1)) = &H2D Then
num1 = 3
Else
num1 = Mid(Serial, 1, 1) + 3
End If
str1 = Right(num1, 1)
num2 = (num1 - 3) + Mid(Serial, 2, 1)
num2 = num2 + 7
str2 = Right(num2, 1)
num3 = (num2 - 7) + Mid(Serial, 3, 1)
num3 = num3 + 2
str3 = Right(num3, 1)
num4 = (num3 - 2) + Mid(Serial, 4, 1)
num4 = num4 + 2
str4 = Right(num4, 1)
num5 = (num4 - 2) + Mid(Serial, 5, 1)
num5 = num5 + 8
str5 = Right(num5, 1)
num6 = (num5 - 8) + Mid(Serial, 6, 1)
num6 = num6 + 7
str6 = Right(num6, 1)
num7 = (num6 - 7) + Mid(Serial, 7, 1)
num7 = num7 + 7
str7 = Right(num7, 1)
RegCode = str1 & str2 & str3 & str4 & str5 & str6 & str7
Text2.Text = RegCode
End If
End Sub
-----------------------------------------------------------------------------------------------
【版权声明】本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!

复制代码

风球 · 发表于 2006-5-17 22:42:37

学习了```

fantasy · 发表于 2006-5-18 14:25:06

学习了看到vb的程序就头疼

lhl8730 · 发表于 2006-5-19 09:18:36

VB写的，好文章，学习！

渔歌子 · 发表于 2006-5-19 13:19:49

VB玩的转啊，学习下。

寒湖鹤影 · 发表于 2006-5-19 14:12:14

VB很难搞呀，注册机画面不错呀

yangjiuli · 发表于 2006-5-19 16:16:03

请教了,我参照你的方法.表面上是成功了.可是一运行,软件又提示未注册.不知何故.是否还有其他的爆破点.我的机器码是1297419196,能帮吗?先谢了!

hrbx · 发表于 2006-5-19 18:25:40

试试这个：

序列号：1297419196
注册码：4041110

Enjoy it!

yangjiuli · 发表于 2006-5-20 12:20:14

谢谢.菜鸟向大虾致敬!了不起!

lhl8730 · 发表于 2006-5-21 10:12:04

刚学VB，试一下做了个注册机

[ 本帖最后由 lhl8730 于 2006-5-23 12:12 编辑 ]

		自动登录	找回密码
密码			加入我们

[原创] 极限杀号数字三15.00版简单算法分析+VB注册机源码

相关帖子

注册机