求高手帮我分析一下这个注册码算法

duchuan · 发表于 2009-10-9 20:25:46

00D59120 6A FF          push -1                            ; 注册码算法
00D59122 68 302AD800    push 00D82A30
00D59127 64:A1 00000000  mov    eax, dword ptr fs:[0]
00D5912D 50             push eax
00D5912E 64:8925 0000000>mov    dword ptr fs:[0], esp
00D59135 83EC 30       sub    esp, 30
00D59138 53             push ebx
00D59139 8B5C24 44    mov    ebx, dword ptr [esp+44]       ; 3364117033138028
00D5913D 55             push ebp
00D5913E 56             push esi
00D5913F 8D43 0D       lea    eax, dword ptr [ebx+D]          ; 028
00D59142 57             push edi                            ; 333333-333333-333333-333333
00D59143 8BF1          mov    esi, ecx
00D59145 50             push eax                            ; 028
00D59146 E8 CD340100    call 00D6C618
00D5914B 8AC8          mov    cl, al                         ; al=1c
00D5914D 83C4 04       add    esp, 4                         ; esp=0139fe68
00D59150 80E1 0F       and    cl, 0F                         ; cl=1c
00D59153 884C24 13    mov    byte ptr [esp+13], cl          ; cl=0c(form feed) 堆栈ss:[0139fe7f]=00
00D59157 8D4C24 20    lea    ecx, dword ptr [esp+20]       ; 堆栈地址=0139FE8C  ecx=0039420c
00D5915B C0E8 04       shr    al, 4                         ; al=1C
00D5915E 884424 50    mov    byte ptr [esp+50], al          ; al=01 堆栈 ss:[0139febc]=30 ('0')
00D59162 E8 89EEFFFF    call 00D57FF0
00D59167 8D4C24 28    lea    ecx, dword ptr [esp+28]       ; 堆栈地址=0139FE94
00D5916B E8 A0410000    call 00D5D310
00D59170 33C9          xor    ecx, ecx                      ; ecx=00000000
00D59172 8BD3          mov    edx, ebx                      ; ebx=00394230, (ASCII "3364117033138028")
00D59174 894C24 31    mov    dword ptr [esp+31], ecx       ; ecx=00000000
00D59178 8D6E 10       lea    ebp, dword ptr [esi+10]       ; 地址=00B22158
00D5917B 8B02          mov    eax, dword ptr [edx]          ; ds:[00394230]=34363333
00D5917D 894C24 35    mov    dword ptr [esp+35], ecx       ; ecx=00000000
00D59181 894C24 39    mov    dword ptr [esp+39], ecx       ; ecx=00000000
00D59185 894424 30    mov    dword ptr [esp+30], eax       ; eax=34363333
00D59189 66:894C24 3D mov    word ptr [esp+3D], cx          ; cx=0000
00D5918E 8D43 08       lea    eax, dword ptr [ebx+8]          ; 地址=00394238, (ASCII "33138028")
00D59191 884C24 3F    mov    byte ptr [esp+3F], cl          ; cl=00
00D59195 66:8B4A 04    mov    cx, word ptr [edx+4]          ; ds:[00394234]=3131
00D59199 66:894C24 34 mov    word ptr [esp+34], cx          ; cx=3131
00D5919E 8B08          mov    ecx, dword ptr [eax]          ; ds:[00394238]=33313333
00D591A0 8A52 06       mov    dl, byte ptr [edx+6]          ; ds:[00394236]=37 ('7')
00D591A3 55             push ebp                            ; ebp=00B22158
00D591A4 885424 3A    mov    byte ptr [esp+3A], dl          ; dl=37 ('7')
00D591A8 8A50 04       mov    dl, byte ptr [eax+4]          ; ds:[0039423C]=38 ('8')
00D591AB 8D46 0A       lea    eax, dword ptr [esi+A]          ; 地址=00B22152
00D591AE 8D7E 08       lea    edi, dword ptr [esi+8]          ; 地址=00B22150
00D591B1 894424 20    mov    dword ptr [esp+20], eax       ; eax=00B22152
00D591B5 50             push eax                            ; eax=00B22152
00D591B6 8D46 0B       lea    eax, dword ptr [esi+B]          ; 地址=00B22153
00D591B9 885424 43    mov    byte ptr [esp+43], dl          ; dl=38 ('8')
00D591BD 894424 20    mov    dword ptr [esp+20], eax       ; eax=00B22153
00D591C1 50             push eax                            ; eax=00B22153
00D591C2 8D46 0C       lea    eax, dword ptr [esi+C]          ; 地址=00B22154
00D591C5 8B5424 60    mov    edx, dword ptr [esp+60]       ; 堆栈 ss:[0139FEC0]=00394500, (ASCII "333333-333333-333333-333333")
00D591C9 894424 20    mov    dword ptr [esp+20], eax       ; eax=00B22154
00D591CD 50             push eax                            ; eax=00B22154
00D591CE 8D46 09       lea    eax, dword ptr [esi+9]          ; 地址=00B22151
00D591D1 894C24 47    mov    dword ptr [esp+47], ecx       ; ecx=33313333
00D591D5 50             push eax                            ; eax=00B22151
00D591D6 8D4424 44    lea    eax, dword ptr [esp+44]       ; 堆栈地址=0139FE9C, (ASCII "336411733138")
00D591DA 57             push edi                            ; edi=00B22150
00D591DB 50             push eax                            ; eax=0139FE9C, (ASCII "336411733138")
00D591DC 51             push ecx                            ; ecx=33313333
00D591DD C74424 68 00000>mov    dword ptr [esp+68], 0          ; 堆栈 ss:[0139FEB4]=FFFFFFFF
00D591E5 8BCC          mov    ecx, esp                      ; esp=0139FE4C
00D591E7 896424 44    mov    dword ptr [esp+44], esp       ; esp=0139FE4C
00D591EB 52             push edx                            ; edx=00394500, (ASCII "333333-333333-333333-333333")
00D591EC E8 4EE30100    call 00D7753F
00D591F1 8D4C24 48    lea    ecx, dword ptr [esp+48]       ; 堆栈地址=0139FE94
00D591F5 E8 66410000    call 00D5D360
00D591FA 85C0          test eax, eax                      ; eax=00000000
00D591FC 74 1B          je    short 00D59219                ; 跳转未实现
00D591FE 8D4C24 28    lea    ecx, dword ptr [esp+28]       ; 堆栈地址=0139FE94
00D59202 C74424 48 FFFFF>mov    dword ptr [esp+48], -1          ; 堆栈 ss:[0139FEB4]=00000000
00D5920A E8 41410000    call 00D5D350
00D5920F B8 01000000    mov    eax, 1                         ; eax=00000000
00D59214 E9 DA010000    jmp    00D593F3
00D59219 8A4424 50    mov    al, byte ptr [esp+50]
00D5921D 8A0F          mov    cl, byte ptr [edi]
00D5921F 3AC1          cmp    al, cl
00D59221 0F84 B6010000 je    00D593DD
00D59227 0F84 B0010000 je    00D593DD
00D5922D 90             nop
00D5922E 3AC1          cmp    al, cl
00D59230 0F85 A7010000 jnz    00D593DD
00D59236 8B5424 14    mov    edx, dword ptr [esp+14]
00D5923A 803A 07       cmp    byte ptr [edx], 7
00D5923D 0F84 A9000000 je    00D592EC
00D59243 51             push ecx
00D59244 8BC4          mov    eax, esp
00D59246 896424 54    mov    dword ptr [esp+54], esp
00D5924A 50             push eax
00D5924B E8 D4CF0100    call 00D76224
00D59250 51             push ecx
00D59251 8BCC          mov    ecx, esp
00D59253 896424 58    mov    dword ptr [esp+58], esp
00D59257 6A 00          push 0
00D59259 6A 00          push 0
00D5925B 6A 00          push 0
00D5925D 6A 01          push 1
00D5925F E8 DC9EFFFF    call 00D53140
00D59264 8D4C24 2C    lea    ecx, dword ptr [esp+2C]
00D59268 51             push ecx
00D59269 8BCD          mov    ecx, ebp
00D5926B E8 70A1FFFF    call 00D533E0
00D59270 8BC8          mov    ecx, eax
00D59272 E8 49090000    call 00D59BC0
00D59277 85C0          test eax, eax
00D59279 74 71          je    short 00D592EC
00D5927B 8D4C24 54    lea    ecx, dword ptr [esp+54]
00D5927F E8 8CEDFFFF    call 00D58010
00D59284 8BCD          mov    ecx, ebp
00D59286 C64424 48 01 mov    byte ptr [esp+48], 1
00D5928B E8 F0A0FFFF    call 00D53380
00D59290 8D0480       lea    eax, dword ptr [eax+eax*4]
00D59293 8BCD          mov    ecx, ebp
00D59295 8D3480       lea    esi, dword ptr [eax+eax*4]
00D59298 E8 F3A0FFFF    call 00D53390
00D5929D 8D04B0       lea    eax, dword ptr [eax+esi*4]
00D592A0 8BCD          mov    ecx, ebp
00D592A2 8D0480       lea    eax, dword ptr [eax+eax*4]
00D592A5 8D3480       lea    esi, dword ptr [eax+eax*4]
00D592A8 E8 F3A0FFFF    call 00D533A0
00D592AD 8D14B0       lea    edx, dword ptr [eax+esi*4]
00D592B0 8D4424 54    lea    eax, dword ptr [esp+54]
00D592B4 52             push edx
00D592B5 68 68D1D800    push 00D8D168                      ; ASCII "m_tmExpireDate=%d"
00D592BA 50             push eax
00D592BB E8 56D40100    call 00D76716
00D592C0 83C4 0C       add    esp, 0C
00D592C3 8D4C24 54    lea    ecx, dword ptr [esp+54]
00D592C7 C64424 48 00 mov    byte ptr [esp+48], 0
00D592CC E8 44E20100    call 00D77515
00D592D1 8D4C24 28    lea    ecx, dword ptr [esp+28]
00D592D5 C74424 48 FFFFF>mov    dword ptr [esp+48], -1
00D592DD E8 6E400000    call 00D5D350
00D592E2 B8 10000000    mov    eax, 10
00D592E7 E9 07010000    jmp    00D593F3
00D592EC 8B7C24 54    mov    edi, dword ptr [esp+54]
00D592F0 83C9 FF       or    ecx, FFFFFFFF
00D592F3 33C0          xor    eax, eax
00D592F5 8D96 E8000000 lea    edx, dword ptr [esi+E8]
00D592FB F2:AE          repne scas byte ptr es:[edi]
00D592FD F7D1          not    ecx
00D592FF 2BF9          sub    edi, ecx
00D59301 8BC1          mov    eax, ecx
00D59303 8BF7          mov    esi, edi
00D59305 8BFA          mov    edi, edx
00D59307 C1E9 02       shr    ecx, 2
00D5930A F3:A5          rep    movs dword ptr es:[edi], dword p>
00D5930C 8BC8          mov    ecx, eax
00D5930E 83E1 03       and    ecx, 3
00D59311 F3:A4          rep    movs byte ptr es:[edi], byte ptr>
00D59313 8B0D BC39D900 mov    ecx, dword ptr [D939BC]
00D59319 C681 AC010000 0>mov    byte ptr [ecx+1AC], 0
00D59320 8A43 04       mov    al, byte ptr [ebx+4]
00D59323 3C 38          cmp    al, 38
00D59325 0F84 9D000000 je    00D593C8
00D5932B 8B7424 18    mov    esi, dword ptr [esp+18]
00D5932F 8A06          mov    al, byte ptr [esi]
00D59331 3C 01          cmp    al, 1
00D59333 74 11          je    short 00D59346
00D59335 3C 02          cmp    al, 2
00D59337 74 0D          je    short 00D59346
00D59339 8B15 BC39D900 mov    edx, dword ptr [D939BC]
00D5933F C682 AC010000 0>mov    byte ptr [edx+1AC], 1
00D59346 8B4424 1C    mov    eax, dword ptr [esp+1C]
00D5934A 8038 01       cmp    byte ptr [eax], 1
00D5934D 74 0D          je    short 00D5935C
00D5934F 8B0D BC39D900 mov    ecx, dword ptr [D939BC]
00D59355 C681 AC010000 0>mov    byte ptr [ecx+1AC], 2
00D5935C 8BCD          mov    ecx, ebp
00D5935E E8 1DA0FFFF    call 00D53380
00D59363 8D0480       lea    eax, dword ptr [eax+eax*4]
00D59366 8BCD          mov    ecx, ebp
00D59368 8D3C80       lea    edi, dword ptr [eax+eax*4]
00D5936B E8 20A0FFFF    call 00D53390
00D59370 8D04B8       lea    eax, dword ptr [eax+edi*4]
00D59373 8BCD          mov    ecx, ebp
00D59375 8D0480       lea    eax, dword ptr [eax+eax*4]
00D59378 8D3C80       lea    edi, dword ptr [eax+eax*4]
00D5937B E8 20A0FFFF    call 00D533A0
00D59380 8B5424 14    mov    edx, dword ptr [esp+14]
00D59384 8D0CB8       lea    ecx, dword ptr [eax+edi*4]
00D59387 8A02          mov    al, byte ptr [edx]
00D59389 84C0          test al, al
00D5938B 74 18          je    short 00D593A5
00D5938D 3C 07          cmp    al, 7
00D5938F 75 0C          jnz    short 00D5939D
00D59391 81F9 BF7B3301 cmp    ecx, 1337BBF
00D59397 75 0C          jnz    short 00D593A5
00D59399 3AC0          cmp    al, al
00D5939B 74 14          je    short 00D593B1
00D5939D 81F9 BF7B3301 cmp    ecx, 1337BBF
00D593A3 75 0C          jnz    short 00D593B1
00D593A5 A1 BC39D900    mov    eax, dword ptr [D939BC]
00D593AA C680 AC010000 0>mov    byte ptr [eax+1AC], 3
00D593B1 803E 02       cmp    byte ptr [esi], 2
00D593B4 75 12          jnz    short 00D593C8
00D593B6 803A 04       cmp    byte ptr [edx], 4
00D593B9 76 0D          jbe    short 00D593C8
00D593BB 8B0D BC39D900 mov    ecx, dword ptr [D939BC]
00D593C1 C681 AC010000 0>mov    byte ptr [ecx+1AC], 4
00D593C8 8D4C24 28    lea    ecx, dword ptr [esp+28]
00D593CC C74424 48 FFFFF>mov    dword ptr [esp+48], -1
00D593D4 E8 773F0000    call 00D5D350
00D593D9 33C0          xor    eax, eax
00D593DB EB 16          jmp    short 00D593F3
00D593DD 8D4C24 28    lea    ecx, dword ptr [esp+28]
00D593E1 C74424 48 FFFFF>mov    dword ptr [esp+48], -1
00D593E9 E8 623F0000    call 00D5D350
00D593EE B8 02000000    mov    eax, 2
00D593F3 8B4C24 40    mov    ecx, dword ptr [esp+40]       ; 堆栈 ss:[0139FEAC]=0139FEFC
00D593F7 5F             pop    edi                            ; 堆栈 [0139FE6C]=00394500 (00394500), ASCII "333333-333333-333333-333333"
00D593F8 5E             pop    esi                            ; 堆栈 [0139FE70]=0012D5A4 (0012D5A4)
00D593F9 5D             pop    ebp                            ; 堆栈 [0139FE74]=FFFFFFFF
00D593FA 64:890D 0000000>mov    dword ptr fs:[0], ecx          ; ecx=0139FEFC
00D59401 5B             pop    ebx                            ; 堆栈 [0139FE78]=00000104
00D59402 83C4 3C       add    esp, 3C                         ; esp=0139FE7C
00D59405 C2 0800       retn 8                               ; 返回到 00425B24 (CstMain3.00425B24)

这段汇编我大部分看不明白，请高手指点一下，帮我简单说说这段汇编大概的意思.谢谢了

HDd1145 · 发表于 2009-10-11 11:40:14

提示: 作者被禁止或删除内容自动屏蔽

sniy · 发表于 2009-10-11 11:44:08

确实你单纯的给出一段汇编代码确实没法分析 ...
上目标文件

duchuan · 发表于 2009-10-11 12:57:54

彩神通-胆杀版，本机注册.

consult1026913 · 发表于 2009-10-14 09:36:02

我觉得也要把文件传上来，虽然我不会，我想高手一定会帮忙的

mseec · 发表于 2009-10-14 16:24:38

光看这个就能破解出来就太厉害了

		自动登录	找回密码
密码			加入我们

[求助] 求高手帮我分析一下这个注册码算法

相关帖子