以前加入BCG时写的几篇破文4

标 题:Crack之亲历手迹5------CD Data Rescue1.1 (7千字)
发信人:y97523  [发短消息]
时 间:2002-03-09 20:02:22
阅读次数:168
详细信息:

Crack之亲历手迹5------CD Data Rescue1.1
追出序列号(由号得到Name)
CD Data Rescue1.1获得序列号的获得、比较、警告函数
:u ecs:0041575b l 300
015F:0041575B NOP
015F:0041575C NOP
015F:0041575D NOP
015F:0041575E NOP
015F:0041575F NOP
015F:00415760 PUSH FF
015F:00415762 PUSH 00450FE9
015F:00415767 MOV EAX,FS:[00000000]
015F:0041576D PUSH EAX
015F:0041576E MOV FS:[00000000],ESP
015F:00415775 SUB ESP,00000358
015F:0041577B PUSH EBX
015F:0041577C PUSH EBP
015F:0041577D MOV EBP,ECX
015F:0041577F PUSH ESI
015F:00415780 PUSH EDI
015F:00415781 LEA ECX,[ESP+10]
015F:00415785 CALL 00440AE0
015F:0041578A MOV EAX,[EBP+60]
015F:0041578D MOV DWORD PTR [ESP+00000370],00000000
015F:00415798 DEC EAX
015F:00415799 MOV [EBP+60],EAX
015F:0041579C JNZ 004157A5
015F:0041579E MOV ECX,EBP
015F:004157A0 CALL 0044EC72
015F:004157A5 PUSH 01
015F:004157A7 MOV ECX,EBP
015F:004157A9 CALL 0044ECF6;Call UPdateData(True)
015F:004157AE MOV EAX,[EBP+000002E8];eax=&name
015F:004157B4 MOV ESI,00474924
015F:004157B9 MOV DL,[EAX]
015F:004157BB MOV BL,[ESI]
015F:004157BD MOV CL,DL
015F:004157BF CMP DL,BL
015F:004157C1 JNZ 004157E1;jmp
015F:004157C3 TEST CL,CL
015F:004157C5 JZ 004157DD
015F:004157C7 MOV DL,[EAX+01]
015F:004157CA MOV BL,[ESI+01]
015F:004157CD MOV CL,DL
015F:004157CF CMP DL,BL
015F:004157D1 JNZ 004157E1
015F:004157D3 ADD EAX,02
015F:004157D6 ADD ESI,02
015F:004157D9 TEST CL,CL
015F:004157DB JNZ 004157B9
015F:004157DD XOR EAX,EAX
015F:004157DF JMP 004157E6
015F:004157E1 SBB EAX,EAX;jmp from 004157C1
015F:004157E3 SBB EAX,-01
015F:004157E6 TEST EAX,EAX
015F:004157E8 JZ 004159E7
015F:004157EE MOV EAX,[EBP+000002EC];eax=&lecense
015F:004157F4 LEA EBX,[EBP+000002EC]
015F:004157FA MOV ESI,00474924
015F:004157FF MOV DL,[EAX]
015F:00415801 MOV CL,DL
015F:00415803 CMP DL,[ESI]
015F:00415805 JNZ 00415823;jmp
015F:00415807 TEST CL,CL
015F:00415809 JZ 0041581F
015F:0041580B MOV DL,[EAX+01]
015F:0041580E MOV CL,DL
015F:00415810 CMP DL,[ESI+01]
015F:00415813 JNZ 00415823
015F:00415815 ADD EAX,02
015F:00415818 ADD ESI,02
015F:0041581B TEST CL,CL
015F:0041581D JNZ 004157FF
015F:0041581F XOR EAX,EAX
015F:00415821 JMP 00415828
015F:00415823 SBB EAX,EAX;jmp from 00415805
015F:00415825 SBB EAX,-01
015F:00415828 TEST EAX,EAX
015F:0041582A JZ 004159E7
015F:00415830 MOV EAX,[EBP+000002F0];eax=&code
015F:00415836 LEA EDI,[EBP+000002F0]
015F:0041583C MOV ESI,00474924
015F:00415841 MOV DL,[EAX]
015F:00415843 MOV CL,DL
015F:00415845 CMP DL,[ESI]
015F:00415847 JNZ 00415865;jmp
015F:00415849 TEST CL,CL
015F:0041584B JZ 00415861
015F:0041584D MOV DL,[EAX+01]
015F:00415850 MOV CL,DL
015F:00415852 CMP DL,[ESI+01]
015F:00415855 JNZ 00415865
015F:00415857 ADD EAX,02
015F:0041585A ADD ESI,02
015F:0041585D TEST CL,CL
015F:0041585F JNZ 00415841
015F:00415861 XOR EAX,EAX
015F:00415863 JMP 0041586A
015F:00415865 SBB EAX,EAX;jmp from 00415847
015F:00415867 SBB EAX,-01
015F:0041586A TEST EAX,EAX
015F:0041586C JZ 004159E7
015F:00415872 PUSH ECX
015F:00415873 MOV ECX,ESP
015F:00415875 MOV [ESP+20],ESP
015F:00415879 PUSH EDI
015F:0041587A CALL 0044E99C;Call MFC
015F:0041587F PUSH ECX
015F:00415880 MOV BYTE PTR [ESP+00000378],01
015F:00415888 MOV ECX,ESP
015F:0041588A MOV [ESP+20],ESP
015F:0041588E PUSH EBX
015F:0041588F CALL 0044E99C;Call MFC
015F:00415894 PUSH ECX
015F:00415895 LEA EAX,[EBP+000002E8];eax=&name
015F:0041589B MOV ECX,ESP
015F:0041589D MOV [ESP+20],ESP
015F:004158A1 PUSH EAX
015F:004158A2 MOV BYTE PTR [ESP+00000380],02
015F:004158AA CALL 0044E99C;Call MFC
015F:004158AF LEA ECX,[ESP+1C]
015F:004158B3 MOV BYTE PTR [ESP+0000037C],00
015F:004158BB CALL 00440B90;???????????
015F:004158C0 TEST EAX,EAX
015F:004158C2 MOV [EBP+64],EAX
015F:004158C5 PUSH 00
015F:004158C7 JNZ 0041595A;跳到注册成功处
015F:004158CD LEA ECX,[ESP+24]
015F:004158D1 CALL 0043CD70
015F:004158D6 PUSH ECX
015F:004158D7 MOV BYTE PTR [ESP+00000374],03
015F:004158DF MOV ECX,ESP
015F:004158E1 MOV [ESP+18],ESP
015F:004158E5 PUSH 0046DE80
015F:004158EA CALL 0044E9A2
015F:004158EF LEA ECX,[ESP+24]
015F:004158F3 CALL 0043CE90
015F:004158F8 LEA ECX,[ESP+20]
015F:004158FC CALL 0044EC06
015F:00415901 LEA ECX,[ESP+000000C4]
015F:00415908 MOV BYTE PTR [ESP+00000370],06
015F:00415910 CALL 0042AEA0
015F:00415915 LEA ECX,[ESP+00000084]
015F:0041591C MOV BYTE PTR [ESP+00000370],05
015F:00415924 CALL 00446640
015F:00415929 LEA ECX,[ESP+00000080]
015F:00415930 MOV BYTE PTR [ESP+00000370],04
015F:00415938 CALL 0044E996
015F:0041593D LEA ECX,[ESP+20]
015F:00415941 MOV BYTE PTR [ESP+00000370],00
015F:00415949 CALL 0044E9CC
015F:0041594E MOV ECX,EBP
015F:00415950 CALL 0044EC72
015F:00415955 JMP 004159E7
015F:0041595A LEA ECX,[ESP+000001C8]
015F:00415961 CALL 0043CD70
015F:00415966 PUSH ECX
015F:00415967 MOV BYTE PTR [ESP+00000374],07
015F:0041596F MOV ECX,ESP
015F:00415971 MOV [ESP+18],ESP
015F:00415975 PUSH 0046DE64
015F:0041597A CALL 0044E9A2;Call MFC
015F:0041597F LEA ECX,[ESP+000001C8]
015F:00415986 CALL 0043CE90
015F:0041598B LEA ECX,[ESP+000001C4]
015F:00415992 CALL 0044EC06；Call MFC42.显示密码错误对话框
015F:00415997 LEA ECX,[ESP+00000268]
015F:0041599E MOV BYTE PTR [ESP+00000370],0A
015F:004159A6 CALL 0042AEA0
015F:004159AB LEA ECX,[ESP+00000228]
015F:004159B2 MOV BYTE PTR [ESP+00000370],09
015F:004159BA CALL 00446640
015F:004159BF LEA ECX,[ESP+00000224]
015F:004159C6 MOV BYTE PTR [ESP+00000370],08
015F:004159CE CALL 0044E996
015F:004159D3 LEA ECX,[ESP+000001C4]
015F:004159DA MOV BYTE PTR [ESP+00000370],00
015F:004159E2 CALL 0044E9CC
015F:004159E7 LEA ECX,[ESP+10]
015F:004159EB MOV DWORD PTR [ESP+00000370],FFFFFFFF
015F:004159F6 CALL 00440B20
015F:004159FB MOV ECX,[ESP+00000368]
015F:00415A02 POP EDI
015F:00415A03 POP ESI
015F:00415A04 POP EBP
015F:00415A05 MOV FS:[00000000],ECX
015F:00415A0C POP EBX
015F:00415A0D ADD ESP,00000364
015F:00415A13 RET
015F:00415A14 NOP
015F:00415A15 NOP
015F:00415A16 NOP