当前位置：首页 > 软件开发 > net
firefox

世纪葵花--桌面直播录像机系统5.2

【前    言】：这个软件有很多地方不明白,所以发出来和大家探讨一下!(在这里也要谢谢安靖)
【下载页面】http://www.softreg.com.cn/shareware_view.asp?id=/3e781f2b-1927-46bd-bb4e-567a2fe09680/
【文章作者】：辉仔yock[dfcg][ycg]
【作者声明】：本人发表这篇文章只是为了学习和研究!!!请不用于商业用途或是将本文方法制作的注册机任意传播,读者看了文章后所做的事情与我无关,我也不会负责,请读者看了文章后三思而后行!最后希望大家在经济基础好的时候,支持共享软件!
【破解工具】：ollydbg  w32dasm  

—————————————————————————————————  
【过    程】：
主程序sfcapcaster.exe没有加壳,事用microsoft visual c++ 6.0编写的!
用w32dasm反汇编,根据参考字串很快找到关键!
用ollydbg加载sfcapcaster.exe

选择帮助-->注册-->输入用户名yock196(用户名要大于5位)-->邮箱地址(可以不填,下面不做运算!-->输入20位的假注册码khsc-987654321abcdef(开头五位一定要是"khsc-")

下断点004147d4来到下面:

:004147bf e83ae40100              call 00432bfe
                                 //这里事取得用户名位数

:004147c4 8b07                    mov eax, dword ptr [edi]
:004147c6 c744242000000000        mov [esp+20], 00000000
:004147ce 8b40f8                  mov eax, dword ptr [eax-08]
:004147d1 83f805                  cmp eax, 00000005
                                 //比较用户名是否小于5位

:004147d4 7d13                    jge 004147e9
:004147d6 6a00                    push 00000000
:004147d8 6a10                    push 00000010

* possible stringdata ref from data obj ->"请输入长度大于5的用户名称"
                                 |
:004147da 68a05b4500              push 00455ba0
:004147df e8cf410200              call 004389b3
:004147e4 e91e010000              jmp 00414907

* referenced by a (u)nconditional or (c)onditional jump at address:
|:004147d4(c)
|
:004147e9 8d4c2410                lea ecx, dword ptr [esp+10]
:004147ed 8d7e5c                  lea edi, dword ptr [esi+5c]
:004147f0 6a05                    push 00000005
:004147f2 51                      push ecx
:004147f3 8bcf                    mov ecx, edi
:004147f5 e8b18a0100              call 0042d2ab
:004147fa 8b00                    mov eax, dword ptr [eax]

* possible stringdata ref from data obj ->"khsc-"
                                 |
:004147fc 68985b4500              push 00455b98
:00414801 50                      push eax
:00414802 e8f59e0000              call 0041e6fc
                                 //比较注册码的前面五位是否"khsc-"

:00414807 83c408                  add esp, 00000008
:0041480a 85c0                    test eax, eax
:0041480c 7511                    jne 0041481f
                                 //不是就跳下去出错

:0041480e 8b17                    mov edx, dword ptr [edi]
:00414810 837af814                cmp dword ptr [edx-08], 00000014
                                 //比较注册码是否等于20位

:00414814 0f95c0                  setne al
:00414817 84c0                    test al, al
:00414819 7504                    jne 0041481f
                                 //不是的话跳下去出错

:0041481b 32db                    xor bl, bl
:0041481d eb02                    jmp 00414821

* referenced by a (u)nconditional or (c)onditional jump at addresses:
|:0041480c(c), :00414819(c)
|
:0041481f b301                    mov bl, 01

* referenced by a (u)nconditional or (c)onditional jump at address:
|:0041481d(u)
|
:00414821 8d4c2410                lea ecx, dword ptr [esp+10]
:00414825 e85fe60100              call 00432e89
:0041482a 84db                    test bl, bl
:0041482c 7413                    je 00414841
                                 //输入的注册码如果不符合上面的条件就不跳走!
                                 //符合反之
                                 //这里可以说是一个暗桩,我第一次以为这样注册成功了!
                                 //其实不是的,符合上面的条件,但不是真的注册码一样是未注册!

:0041482e 6a00                    push 00000000
:00414830 6a10                    push 00000010

* possible stringdata ref from data obj ->"注册失败！"
                                 |
:00414832 688c5b4500              push 00455b8c
:00414837 e877410200              call 004389b3
:0041483c e9c6000000              jmp 00414907

* referenced by a (u)nconditional or (c)onditional jump at address:
|:0041482c(c)                     //上面来到这里!

......
......
                                 //省略一部分用处不大的代码

:0041488d 8d442418                lea eax, dword ptr [esp+18]
:00414891 50                      push eax
                                 //用户名

:00414892 e829090000              call 004151c0
                                 //来到这里是把我的用户名经过运算后得出一串数字"298103222272636"
                                 //但是感觉上用处不大,我认为根本就没有!

:00414897 83c40c                  add esp, 0000000c
:0041489a 50                      push eax
:0041489b 8d4c2410                lea ecx, dword ptr [esp+10]
:0041489f c644242402              mov [esp+24], 02
:004148a4 e819e70100              call 00432fc2
:004148a9 8d4c2410                lea ecx, dword ptr [esp+10]
:004148ad c644242000              mov [esp+20], 00
:004148b2 e8d2e50100              call 00432e89
:004148b7 51                      push ecx
:004148b8 8d542410                lea edx, dword ptr [esp+10]
:004148bc 8bcc                    mov ecx, esp
:004148be 89642418                mov dword ptr [esp+18], esp
:004148c2 52                      push edx
:004148c3 e836e30100              call 00432bfe
:004148c8 8bce                    mov ecx, esi
:004148ca e861000000              call 00414930
:004148cf 6a00                    push 00000000
:004148d1 8bce                    mov ecx, esi
:004148d3 e838010000              call 00414a10
:004148d8 8bce                    mov ecx, esi
:004148da e8e1030000              call 00414cc0
                                 //根据w32dasm的提示得知这个call里面是注册成功但出的窗口!
                                 //跟进去!

:004148df 8bce                    mov ecx, esi
:004148e1 e87a030000              call 00414c60
                                 //根据w32dasm的提示得知这个call里面是注册成功但出的窗口!
                                 //跟进去!

:004148e6 8b461c                  mov eax, dword ptr [esi+1c]
:004148e9 6a00                    push 00000000
:004148eb 6a00                    push 00000000
:004148ed 6892040000              push 00000492
:004148f2 50                      push eax

* reference to: user32.sendmessagea, ord:0214h
                                 |
:004148f3 ff1574654400            call dword ptr [00446574]
                                 //这个地方是最不明白的了!
                                 //用"安靖"的注册码注册就在这里但出成功的窗口!
                                 //用我自己追出来的注册码,这里是没有反映的!但也能注册成功!
                                 //还请高手指点!

:004148f9 8bce                    mov ecx, esi
:004148fb e86de00100              call 0043296d
:00414900 8bce                    mov ecx, esi
:00414902 e81ef60100              call 00433f25
------------------------------------------------------------------
上面004148da的call来到这里:
* referenced by a call at address:
|:004148da   
|
:00414cc0 51                      push ecx
:00414cc1 56                      push esi
:00414cc2 8bf1                    mov esi, ecx
:00414cc4 57                      push edi
:00414cc5 8d442408                lea eax, dword ptr [esp+08]
:00414cc9 6a05                    push 00000005
:00414ccb 50                      push eax
:00414ccc 8d8ef4010000            lea ecx, dword ptr [esi+000001f4]
:00414cd2 e8d4850100              call 0042d2ab
:00414cd7 8b00                    mov eax, dword ptr [eax]
:00414cd9 50                      push eax
:00414cda e8129a0000              call 0041e6f1
:00414cdf 83c404                  add esp, 00000004
:00414ce2 8d4c2408                lea ecx, dword ptr [esp+08]
:00414ce6 8bf8                    mov edi, eax
:00414ce8 e89ce10100              call 00432e89
:00414ced 8b8ee8010000            mov ecx, dword ptr [esi+000001e8]
:00414cf3 51                      push ecx
:00414cf4 e887020000              call 00414f80
:00414cf9 83c404                  add esp, 00000004
:00414cfc 3bf8                    cmp edi, eax
                                 //关键比较...
                                 //edi和eax寄存器分别存着真假注册码的前五位数的十六进制值!

:00414cfe 8986e8010000            mov dword ptr [esi+000001e8], eax
:00414d04 7509                    jne 00414d0f
                                 //这里跳走的话就...

:00414d06 6a01                    push 00000001
:00414d08 8bce                    mov ecx, esi
:00414d0a e8b1feffff              call 00414bc0
                                 //这里进去有三个跳转,这三个跳转不跳的话就出现注册成功窗口!

* referenced by a (u)nconditional or (c)onditional jump at address:
|:00414d04(c)
|
:00414d0f 5f                      pop edi
:00414d10 5e                      pop esi
:00414d11 59                      pop ecx
:00414d12 c3                      ret
------------------------------------------------------------------
上面004148e1的call来到这里:
* referenced by a call at address:
|:004148e1   
|
:00414c60 51                      push ecx
:00414c61 56                      push esi
:00414c62 57                      push edi
:00414c63 8bf1                    mov esi, ecx
:00414c65 6a05                    push 00000005
:00414c67 8d44240c                lea eax, dword ptr [esp+0c]
:00414c6b 6a05                    push 00000005
:00414c6d 50                      push eax
:00414c6e 8d8ef4010000            lea ecx, dword ptr [esi+000001f4]
:00414c74 e820850100              call 0042d199
:00414c79 8b00                    mov eax, dword ptr [eax]
:00414c7b 50                      push eax
:00414c7c e8709a0000              call 0041e6f1
:00414c81 83c404                  add esp, 00000004
:00414c84 8d4c2408                lea ecx, dword ptr [esp+08]
:00414c88 8bf8                    mov edi, eax
:00414c8a e8fae10100              call 00432e89
:00414c8f 8b8eec010000            mov ecx, dword ptr [esi+000001ec]
:00414c95 51                      push ecx
:00414c96 e8b5030000              call 00415050
:00414c9b 83c404                  add esp, 00000004
:00414c9e 3bf8                    cmp edi, eax
                                 //和上面一样,关键比较...
                                 //edi和eax寄存器分别存着真假注册码的前五位数的十六进制值!

:00414ca0 8986ec010000            mov dword ptr [esi+000001ec], eax
:00414ca6 7509                    jne 00414cb1
:00414ca8 6a02                    push 00000002
:00414caa 8bce                    mov ecx, esi
:00414cac e80fffffff              call 00414bc0
                                 //和上面一样
                                 //这里进去有三个跳转,这三个跳转不跳的话就出现注册成功窗口!

* referenced by a (u)nconditional or (c)onditional jump at address:
|:00414ca6(c)
|
:00414cb1 5f                      pop edi
:00414cb2 5e                      pop esi
:00414cb3 59                      pop ecx
:00414cb4 c3                      ret
------------------------------------------------------------------
这里就是00414cac和00414d0a的call来到的地方:

* referenced by a call at addresses:
|:00414586   , :00414cac   , :00414d0a   
|
:00414bc0 56                      push esi
:00414bc1 8bf1                    mov esi, ecx
:00414bc3 e8cca20200              call 0043ee94
:00414bc8 8b5004                  mov edx, dword ptr [eax+04]
:00414bcb 8b442408                mov eax, dword ptr [esp+08]
:00414bcf 48                      dec eax
:00414bd0 7452                    je 00414c24
:00414bd2 48                      dec eax
:00414bd3 7436                    je 00414c0b
                                 //我追出来的正确注册码和"安靖"的注册码在这里都跳走了!

:00414bd5 48                      dec eax
:00414bd6 0f8580000000            jne 00414c5c
:00414bdc 6a00                    push 00000000
:00414bde 6a01                    push 00000001
:00414be0 8bca                    mov ecx, edx
:00414be2 c7825802000001000000    mov dword ptr [ebx+00000258], 00000001
:00414bec e8affffeff              call 00404ba0
:00414bf1 6a00                    push 00000000
:00414bf3 6a00                    push 00000000

* possible stringdata ref from data obj ->"注册成功, 请重新启动程序!"
                                 |
:00414bf5 68c05b4500              push 00455bc0
:00414bfa e8b43d0200              call 004389b3
:00414bff 6a00                    push 00000000

* reference to: user32.postquitmessage, ord:01e0h
                                 |
:00414c01 ff1564644400            call dword ptr [00446464]
:00414c07 5e                      pop esi
:00414c08 c20400                  ret 0004
------------------------------------------------------------------
【总    结】：
我追出的注册码(邮箱不填也可以):
yock196
khsc-3518239909*****(后面五位随便)

安靖兄的注册码:
anjing
khsc-351821842415032

注册信息保存在c:\windows\system\sysxcasterdrv.sys
用我追出来的注册码按注册后没有反应(但也能成功!)
用安靖兄的注册码按注册后会弹出"注册成功, 请重新启动程序!"的框!
我想可能是我没有追到核心,所以想和大家探讨一下!
我问过安靖了,可是没有解决问题!好没头绪,希望又朋友能帮我看看!
最后在这里真心感谢你花了那么多时间看这篇文章!谢谢了... 

（）

 ↓相关文章：
© 2006-2008 All Rights Reserved