《新狐电脑传真》V1.0注册算法分析

　　目的：属技术交流，无其它目的，请不要任意散布或用用商业用途。初学破解,如有不对的地方欢迎批评

指出。
工具：softice,w32Dasm,ollydbg
试炼码：
序列号：107570653072
注册码：654321

查找出错信息

:004DC023 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004DC026 8BC1                    mov eax, ecx
:004DC028 99                      cdq
:004DC029 3B55FC                  cmp edx, dword ptr [ebp-04]
:004DC02C 754E                    jne 004DC07C  ====>出错
:004DC02E 3B45F8                  cmp eax, dword ptr [ebp-08]
:004DC031 7549                    jne 004DC07C =====>出错
:004DC033 33D2                    xor edx, edx
:004DC035 8B8378030000            mov eax, dword ptr [ebx+00000378]
:004DC03B 8B08                    mov ecx, dword ptr [eax]
:004DC03D FF5164                  call [ecx+64]
:004DC040 B201                    mov dl, 01
:004DC042 8B8308030000            mov eax, dword ptr [ebx+00000308]
:004DC048 8B08                    mov ecx, dword ptr [eax]
:004DC04A FF5164                  call [ecx+64]
:004DC04D 33D2                    xor edx, edx
:004DC04F 8B8384030000            mov eax, dword ptr [ebx+00000384]
:004DC055 E8BAA2F6FF              call 00446314
:004DC05A 8B8394030000            mov eax, dword ptr [ebx+00000394]
:004DC060 E8D7C0FEFF              call 004C813C
:004DC065 6A00                    push 00000000
:004DC067 668B0D04C14D00          mov cx, word ptr [004DC104]
:004DC06E B202                    mov dl, 02

* Possible StringData Ref from Code Obj ->"软件登记注册成功"
                                 |
:004DC070 B810C14D00              mov eax, 004DC110
:004DC075 E81E36F6FF              call 0043F698
:004DC07A EB15                    jmp 004DC091

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004DC02C(C), :004DC031(C)
|
:004DC07C 6A00                    push 00000000
:004DC07E 668B0D04C14D00          mov cx, word ptr [004DC104]
:004DC085 B201                    mov dl, 01

* Possible StringData Ref from Code Obj ->"软件注册号错误"
                                
--------------------------------------------------------------------------
在od中动态分析出关键部分：

004DBFA1  |.  33C0          XOR EAX,EAX
004DBFA3  |.  55            PUSH EBP
004DBFA4  |.  68 AFC04D00   PUSH faxnow.004DC0AF
004DBFA9  |.  64:FF30       PUSH DWORD PTR FS:[EAX]
004DBFAC  |.  64:8920       MOV DWORD PTR FS:[EAX],ESP
004DBFAF  |.  8D45 F4       LEA EAX,DWORD PTR SS:[EBP-C]
004DBFB2  |.  BA C4C04D00   MOV EDX,faxnow.004DC0C4                  ;  ASCII "00000000"
004DBFB7  |.  E8 C48EF2FF   CALL faxnow.00404E80
004DBFBC  |.  8D4D F4       LEA ECX,DWORD PTR SS:[EBP-C]
004DBFBF  |.  BA D8C04D00   MOV EDX,faxnow.004DC0D8
004DBFC4  |.  B8 F8C04D00   MOV EAX,faxnow.004DC0F8
004DBFC9  |.  E8 E637F6FF   CALL faxnow.0043F7B4                    
;  显示注册框,取输入的注册码
004DBFCE  |.  3C 01         CMP AL,1
004DBFD0  |.  0F85 BB000000 JNZ faxnow.004DC091
004DBFD6  |.  8D55 E0       LEA EDX,DWORD PTR SS:[EBP-20]
004DBFD9  |.  8B45 F4       MOV EAX,DWORD PTR SS:[EBP-C]             
;  注册码入eax
004DBFDC  |.  E8 C3D4F2FF   CALL faxnow.004094A4                    
;  把注册码入edx处地址
004DBFE1  |.  8B45 E0       MOV EAX,DWORD PTR SS:[EBP-20]            
;  注册码入eax
004DBFE4  |.  E8 0BD8F2FF   CALL faxnow.004097F4                     
;  转换为十六进制
004DBFE9  |.  8945 F8       MOV DWORD PTR SS:[EBP-8],EAX             
;  把转换后的数保存在[EBP-8]中
004DBFEC  |.  8955 FC       MOV DWORD PTR SS:[EBP-4],EDX
004DBFEF  |.  6A 00         PUSH 0
004DBFF1  |.  68 D2010000   PUSH 1D2
004DBFF6  |.  8B45 F8       MOV EAX,DWORD PTR SS:[EBP-8]
004DBFF9  |.  8B55 FC       MOV EDX,DWORD PTR SS:[EBP-4]
004DBFFC  |.  E8 DF9DF2FF   CALL faxnow.00405DE0                    
;  注册码的十六进制除以1D2(即为466)
004DC001  |.  8945 F8       MOV DWORD PTR SS:[EBP-8],EAX             
;  商入[ebp-8]
004DC004  |.  8955 FC       MOV DWORD PTR SS:[EBP-4],EDX         
   ;  余数入[ebp-4]
004DC007  |.  8B45 F8       MOV EAX,DWORD PTR SS:[EBP-8]
004DC00A  |.  8B55 FC       MOV EDX,DWORD PTR SS:[EBP-4]
004DC00D  |.  2D B3730700   SUB EAX,773B3                         
  ;  再减去773B3
004DC012  |.  83DA 00       SBB EDX,0                              
;  带借位减法，下面要比较是否为0，反推得edx必须是0
004DC015  |.  8945 F8       MOV DWORD PTR SS:[EBP-8],EAX
004DC018  |.  8955 FC       MOV DWORD PTR SS:[EBP-4],EDX
004DC01B  |.  8D45 E4       LEA EAX,DWORD PTR SS:[EBP-1C]
004DC01E  |.  E8 E1F4FFFF   CALL faxnow.004DB504                    
;  取cpu的ID,我的为670(H),即为1648
004DC023  |.  8B4D E4       MOV ECX,DWORD PTR SS:[EBP-1C]            
;  cpuid入ecx
004DC026  |.  8BC1          MOV EAX,ECX                             
;  eax=ecx
004DC028  |.  99            CDQ
004DC029  |.  3B55 FC       CMP EDX,DWORD PTR SS:[EBP-4]            
;  比较[ebp-4]是否为0
004DC02C  |.  75 4E         JNZ SHORT faxnow.004DC07C               
;  不等则跳
004DC02E  |.  3B45 F8       CMP EAX,DWORD PTR SS:[EBP-8]
004DC031  |.  75 49         JNZ SHORT faxnow.004DC07C               
;  不等则跳
004DC033  |.  33D2          XOR EDX,EDX
004DC035  |.  8B83 78030000 MOV EAX,DWORD PTR DS:[EBX+378]
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
总结：
　 反推:cpuid为670，加上773B3，为77A23，再乘以1d2,得D9C53B6，转换为十进制即为注册码：

228348854

爆破：在004DC02C及004DC031处，把其nop掉即可。

木马克星5.33.60破解过程(1)：【上一篇】
中级实例教程—之《楚汉棋缘V1.36》(6)：【下一篇】