教菜鸟写注册机——实战篇（看雪论坛精华6优秀文章－算法奖）

教菜鸟写注册机——实战篇

前面我们折腾了半天都是在跟CRACKME过不去，可能有人觉得没意思了，这次咱们来个有实际意义的，呵呵，一个发布不久的软件——麻将拼图V1.04，这里来下：

http://skycn.softreg.com.cn/product.asp?id=/E5DCF286-05EE-4AA8-8ABE-9524013EFADA

用W32DASM反下，找串式参考“注册失败！”到下面：（分析见后）

代码:--------------------------------------------------------------------------------
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402E16(C)
|
:00402E3F 8B3D88974000mov edi, dword ptr [00409788]
:00402E45 B940000000 mov ecx, 00000040
:00402E4A 33C0xor eax, eax
:00402E4C 8B6C2414mov ebp, dword ptr [esp+14]
:00402E50 F3 repz
:00402E51 AB stosd
:00402E52 8B3D7C974000mov edi, dword ptr [0040977C]
:00402E58 B940000000 mov ecx, 00000040
:00402E5D F3 repz
:00402E5E AB stosd
:00402E5F 8B0D88974000mov ecx, dword ptr [00409788]

* Reference To: USER32.SendDlgItemMessageA, Ord:020Fh
|
:00402E65 8B1D38714000mov ebx, dword ptr [00407138] ;注意
:00402E6B 51 push ecx ;用户名存放地址[409788]
:00402E6C 6A10push 00000010
:00402E6E 6A0Dpush 0000000D ;WM_GETTEXT

* Possible Reference to Dialog: DialogID_0070, CONTROL_ID:03E8, ""
|
:00402E70 68E8030000 push 000003E8 ;控件ID
:00402E75 55 push ebp
:00402E76 FFD3call ebx ;得到用户名
:00402E78 8B157C974000mov edx, dword ptr [0040977C]
:00402E7E 52 push edx ;注册码地址[40977C]
:00402E7F 6A10push 00000010
:00402E81 6A0Dpush 0000000D ;WM_GETTEXT

* Possible Reference to Dialog: DialogID_0070, CONTROL_ID:03E9, ""
|
:00402E83 68E9030000 push 000003E9 ;控件ID
:00402E88 55 push ebp
:00402E89 FFD3call ebx ;得到注册码
:00402E8B A188974000 mov eax, dword ptr [00409788]
:00402E90 803800 cmp byte ptr [eax], 00
:00402E93 0F8438010000je 00402FD1
:00402E99 8B0D7C974000mov ecx, dword ptr [0040977C]
:00402E9F 803900 cmp byte ptr [ecx], 00
:00402EA2 0F8429010000je 00402FD1
:00402EA8 50 push eax ;压入用户名
:00402EA9 E822FEFFFF call 00402CD0 ;关键CALL
:00402EAE 8B3D7C974000mov edi, dword ptr [0040977C] ;假码
:00402EB4 A188974000 mov eax, dword ptr [00409788] ;真码
:00402EB9 83C404 add esp, 00000004
:00402EBC 8BF7mov esi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402EDC(C)
|
:00402EBE 8A10mov dl, byte ptr [eax]
:00402EC0 8ACAmov cl, dl
:00402EC2 3A16cmp dl, byte ptr [esi]
:00402EC4 751Cjne 00402EE2
:00402EC6 84C9test cl, cl
:00402EC8 7414je 00402EDE
:00402ECA 8A5001 mov dl, byte ptr [eax+01]
:00402ECD 8ACAmov cl, dl
:00402ECF 3A5601 cmp dl, byte ptr [esi+01]
:00402ED2 750Ejne 00402EE2
:00402ED4 83C002 add eax, 00000002
:00402ED7 83C602 add esi, 00000002
:00402EDA 84C9test cl, cl
:00402EDC 75E0jne 00402EBE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402EC8(C)
|
:00402EDE 33C0xor eax, eax
:00402EE0 EB05jmp 00402EE7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402EC4(C), :00402ED2(C)
|
:00402EE2 1BC0sbb eax, eax
:00402EE4 83D8FF sbb eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402EE0(U)
|
:00402EE7 85C0test eax, eax
:00402EE9 0F848D000000je 00402F7C

* Possible StringData Ref from Data Obj ->"52341546";骗人的:D
|
:00402EEF BEA4904000 mov esi, 004090A4
:00402EF4 8BC7mov eax, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402F14(C)
|
:00402EF6 8A10mov dl, byte ptr [eax]
:00402EF8 8ACAmov cl, dl
:00402EFA 3A16cmp dl, byte ptr [esi]
:00402EFC 751Cjne 00402F1A
:00402EFE 84C9test cl, cl
:00402F00 7414je 00402F16
:00402F02 8A5001 mov dl, byte ptr [eax+01]
:00402F05 8ACAmov cl, dl
:00402F07 3A5601 cmp dl, byte ptr [esi+01]
:00402F0A 750Ejne 00402F1A
:00402F0C 83C002 add eax, 00000002
:00402F0F 83C602 add esi, 00000002
:00402F12 84C9test cl, cl
:00402F14 75E0jne 00402EF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402F00(C)
|
:00402F16 33C0xor eax, eax
:00402F18 EB05jmp 00402F1F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402EFC(C), :00402F0A(C)
|
:00402F1A 1BC0sbb eax, eax
:00402F1C 83D8FF sbb eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402F18(U)
|
:00402F1F 85C0test eax, eax
:00402F21 7459je 00402F7C
:00402F23 A180974000 mov eax, dword ptr [00409780]
:00402F28 6A00push 00000000
:00402F2A 83F803 cmp eax, 00000003

* Possible StringData Ref from Data Obj ->"用户注册"
|
:00402F2D 6898904000 push 00409098
:00402F32 7D23jge 00402F57

* Possible StringData Ref from Data Obj ->"注册码错误！请重新输入！"
|
:00402F34 687C904000 push 0040907C
:00402F39 55 push ebp

* Reference To: USER32.MessageBoxA, Ord:01BEh
|
:00402F3A FF1534714000Call dword ptr [00407134]
:00402F40 A180974000 mov eax, dword ptr [00409780]
:00402F45 5F pop edi
:00402F46 40 inc eax
:00402F47 5E pop esi
:00402F48 A380974000 mov dword ptr [00409780], eax
:00402F4D 5D pop ebp
:00402F4E B801000000 mov eax, 00000001
:00402F53 5B pop ebx
:00402F54 C21000 ret 0010
--------------------------------------------------------------------------------

根据错误错息找串式参考，很容易找到上面这些。然后从这个函数的开头开始分析。

首先值得一提的是程序取得文本框文本的方法。在这个程序中如果你下GetWindowText,GetDlgItemText这些断点都不能断到，那么它是靠的什么方法呢？我们可以在402E65这一句看到把一个API函数SendDlgItemMessage的地址给了EBX，然后下面两次调用EBX。可以想到这就是取用户名和注册码了，具体说明见下：

LONG SendDlgItemMessage(

HWND hDlg, // 对话框句柄
int nIDDlgItem, // 控件的ID
UINT Msg, // 要发送的消息
WPARAM wParam, // 消息的第一个附加值
LPARAM lParam // 消息的第二个附加值
) ;

对照上面的程序，可以发现它向ID为3E8h即1000的控件（用资源编辑工具可以发现这就是用户名的输入框）发送一个编号为0D的消息，这个消息表示什么呢？在winuser.h里有定义：

#define WM_SETTEXT0x000C
#define WM_GETTEXT0x000D
#define WM_GETTEXTLENGTH 0x000E

呵呵，不出所料是WM_GETTEXT。再来看WM_GETTEXT的附加值有什么意义

WM_GETTEXT
wParam = (WPARAM) cchTextMax; // number of characters to copy 得到的字串长度
lParam = (LPARAM) lpszText; // address of buffer for text 字串存放的地址

再看上面的程序就很明显了，第一个CALL的wParam为10，字串长度，lParam为[409788]，这是用户名的位置，记好。第二个CALL得到假注册码放在[40977C]。

很不错的方式，躲开了常见的API，让我想起了DELPHI。

接下去是判断是否为空。然后把用户名PUSH进了，接着CALL。呵呵~~~~还不快跟进：

[ 本帖最后由 booohr 于 2006-6-17 15:45 编辑 ]

代码:--------------------------------------------------------------------------------
* Referenced by a CALL at Addresses:
|:00402EA9 , :004030ED
|
:00402CD0 53 push ebx
:00402CD1 56 push esi
:00402CD2 57 push edi
:00402CD3 8B7C2410mov edi, dword ptr [esp+10] ;EDI指向用户名
:00402CD7 32DBxor bl, bl
:00402CD9 8BCFmov ecx, edi
:00402CDB 8A07mov al, byte ptr [edi]
:00402CDD 84C0test al, al
:00402CDF 740Aje 00402CEB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402CE9(C)
|
:00402CE1 02D8add bl, al ;各字符累加起来
:00402CE3 8A4101 mov al, byte ptr [ecx+01] ;循环取字符
:00402CE6 41 inc ecx
:00402CE7 84C0test al, al ;是否取完
:00402CE9 75F6jne 00402CE1 ;这是一个循环

;注意参与计算的是AL,BL,即只取累加结果的低8位放在BL

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402CDF(C)
|
:00402CEB A178974000 mov eax, dword ptr [00409778]
:00402CF0 33F6xor esi, esi
:00402CF2 A384974000 mov dword ptr [00409784], eax
:00402CF7 A174974000 mov eax, dword ptr [00409774]
:00402CFC 85C0test eax, eax
:00402CFE 7E2Djle 00402D2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402D2B(C)
|
:00402D00 8A0C3E mov cl, byte ptr [esi+edi] ;EDI指向用户名,ESI循环变量,取字符
:00402D03 32CBxor cl, bl ;每次取的字符与上面累加结果BL异或
:00402D05 51 push ecx ;把异或所得结果压入
:00402D06 E895FFFFFF call 00402CA0 ;关键CALL，跟进
{
:00402CA0 0FBE442404 movsx eax, byte ptr [esp+04] ;EAX=上面压入的结果
:00402CA5 030584974000add eax, dword ptr [00409784] ;[409784]最初是989681h
:00402CAB 69C0697DAE42imul eax, 42AE7D69
:00402CB1 0531D40000 add eax, 0000D431; D431h=54321 :D
:00402CB6 A384974000 mov dword ptr [00409784], eax ;把结果放回,下次计算要用
:00402CBB C1F810 sar eax, 10 ;右移10位
:00402CBE 83E00F and eax, 0000000F;只取最低4位（见后）
:00402CC1 C3 ret
}
:00402D0B 83C404 add esp, 00000004
:00402D0E 88043E mov byte ptr [esi+edi], al ;AL是上面CALL返回的结果
:00402D11 3C0Acmp al, 0A
:00402D13 0FBEC0 movsx eax, al
:00402D16 7D05jge 00402D1D ;如果AL>=0A就跳
:00402D18 83C030 add eax, 00000030;如果AL<0A就加30h
:00402D1B EB03jmp 00402D20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402D16(C)
|
:00402D1D 83C041 add eax, 00000041;如果AL>=0A就加41h

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402D1B(U)
|
:00402D20 88043E mov byte ptr [esi+edi], al ;把结果放好,这可是最后注册码哟
:00402D23 A174974000 mov eax, dword ptr [00409774] ;[409774]是常量8
:00402D28 46 inc esi ;ESI是循环变量
:00402D29 3BF0cmp esi, eax
:00402D2B 7CD3jl 00402D00 ;这里是一个循环

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402CFE(C)
|
:00402D2D C6043800mov byte ptr [eax+edi], 00
:00402D31 5F pop edi
:00402D32 5E pop esi
:00402D33 5B pop ebx
:00402D34 C3 ret
--------------------------------------------------------------------------------

先说说关于位操作的事。上面有一个SAR，这个和SHR有一些区别，就在最高位的处理上。我也说不太明白，举个例子 11011100 shr 4 = 00001101 而 11011100 sar 4 = 11111101。不过这里右移10位，我们只取最后4位，所以高10位的变化是影响不到的，可以简单的用右移(>> )来取代。还有要说的就是AND，有一个AND 0000000F，我说是只取最低4位，可能有菜鸟不明白，其实AND只要有一个操作数为0，结果肯定为0，如果一个操作数是1，结果肯定等于另一个操作数。比方说我们如果想“屏蔽”一个八位数的第三四位，只要让它AND 11110011就行了。同理，因为0F=1111，所以AND 0000000F等于只取出了最后面的四位。

可以发现经过这个CALL后形成的一个新的字串，仍然放在原用户名的位置。接下来的代码把它们取出，逐位比较，不等就跳。。。自己看看吧，练习一下，很简单的。

最后要说的是它还设了个陷阱，后面有一个固定字串"52341546"，输入这个会提示成功注册，但其实下次启动又成未注册了。

整理下思路，先把用户名累加，把结果再和用户名的每位进行一些计算，就得到正确的注册码了。很简单的是不是？

代码:--------------------------------------------------------------------------------
#include
#include
#include

void main()
{
char name[20]={0};
char password[20]={0};
unsigned int s=0,k=0,i;

printf("Please input your name:");
scanf("%s",name);
int len=strlen(name);
for (i=0;i {
s+=name;
s%=0x100;//取低8位
}
int LOCAL=0x989681;
for (i=0;i<8;i++)
{
k=s^name;
k=(k+LOCAL)*0x42AE7D69+0xD431;
LOCAL=k;
k>>=0x10;//SAR
k%=0x10;//取最低4位
if (k>=0xA) k+=0x41;
else k+=0x30;
password=k;
}
printf("Your password is : %s\n",password);
printf("Keygen by RoBa\nEnjoy Cracking!\n");
}
--------------------------------------------------------------------------------

一个可用的用户名：RoBa
注册码：0P6N0089

好熟悉的ID是maxthon有关的吧。