本帖最后由 s1986q 于 2022-8-30 19:59 编辑
五子棋软件地址
https://www.52pojie.cn/thread-1655658-1-1.html
exeinfo：
是Borland Delphi
上dede软件：
注册按钮事件地址：
00475B20
[Asm] 纯文本查看 复制代码 00475B8C E8CBFCFFFF call 0047585C
00475B91 803D48D3470000 cmp byte ptr [$0047D348], $00
00475B98 750C jnz 00475BA6
* Possible String Reference to: '名字和注册号不匹配！请重新输入！'
|
00475B9A B8205C4700 mov eax, $00475C20
* Reference to : TMessageForm._PROC_004503D0()
|
00475B9F E82CA8FDFF call 004503D0
00475BA4 EB14 jmp 00475BBA
* Possible String Reference to: '恭喜你已经成功注册！'
|
00475BA6 B84C5C4700 mov eax, $00475C4C
* Reference to : TMessageForm._PROC_004503D0()
|
00475BAB E820A8FDFF call 004503D0
关键call 也是算法call：
00475B8C E8CBFCFFFF call 0047585C
软件有重启校验
会在windows目录下生成Five99.ini文件，内容如下:
[C] 纯文本查看 复制代码 [Register]
Name=
RegNo=
Name为用户名
RegNo为真码
上 IDA f5[C] 纯文本查看 复制代码 int sub_47585C()
{
int v0; // ecx
int v1; // ecx
int v2; // esi
unsigned __int8 *v3; // ecx
char *v4; // ebx
int v5; // ecx
char *v6; // eax
int v7; // ecx
char *v8; // ebx
int v9; // ecx
char *v10; // eax
int v11; // ecx
char *v12; // eax
char *v13; // edx
struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList; // [esp-Ch] [ebp-250h] BYREF
int *v16; // [esp-8h] [ebp-24Ch]
int *v17; // [esp-4h] [ebp-248h]
unsigned int v18; // [esp+0h] [ebp-244h]
int v19; // [esp+8h] [ebp-23Ch]
int v20; // [esp+Ch] [ebp-238h] BYREF
int v21; // [esp+10h] [ebp-234h] BYREF
char v22[257]; // [esp+14h] [ebp-230h] BYREF
char v23; // [esp+115h] [ebp-12Fh] BYREF
char v24; // [esp+116h] [ebp-12Eh] BYREF
char v25[96]; // [esp+11Bh] [ebp-129h] BYREF
char v26; // [esp+17Bh] [ebp-C9h] BYREF
unsigned __int8 v27; // [esp+1DFh] [ebp-65h] BYREF
int savedregs; // [esp+244h] [ebp+0h] BYREF
v20 = 0;
v21 = 0;
v17 = &savedregs;
v16 = (int *)&unk_475A39;
ExceptionList = NtCurrentTeb()->NtTib.ExceptionList;
__writefsdword(0, (unsigned int)&ExceptionList);
(**(void (__fastcall ***)(const char *, const char *, int *, _DWORD, struct _EXCEPTION_REGISTRATION_RECORD *, void *, int *))dword_47D34C)(
"Name",
"register",
&v21,
0,
ExceptionList,
&unk_475A39,
&savedregs);
sub_403D98(255, v21);
LOBYTE(v0) = 100;
sub_402A0C(v0, v22);
v17 = 0;
v16 = &v20;
(**(void (__fastcall ***)(const char *, const char *, int *, _DWORD))dword_47D34C)("RegNo", "register", &v20, 0);
sub_403D98(255, v20);
LOBYTE(v1) = 100;
sub_402A0C(v1, v22);
if ( v27 && v25[95] == 6 )
{
v2 = v27 + 1;
v3 = &v27;
v4 = &v23;
do
{
*v4++ = *v3++ % 0xAu + 49;
--v2;
}
while ( v2 );
v5 = v27;
if ( v27 )
{
v6 = &v23 + v27;
do
*v6-- += 2 * (v27 - v5--);
while ( v5 );
}
if ( v27 < 6u )
{
v7 = v27 + 1;
if ( v7 <= 6 )
{
v8 = &v22[v7 + 256];
do
{
v8[1] = ((unsigned __int8)*v8 - 46) % 10 + 48;
++v7;
++v8;
}
while ( v7 != 7 );
}
}
v9 = 6;
v10 = v25;
do
{
*v10 += 6 * (6 - v9);
if ( (unsigned __int8)*v10 > 0x7Eu )
*v10 -= 120;
if ( (unsigned __int8)*v10 < 0x21u )
*v10 += 33;
--v9;
--v10;
}
while ( v9 );
v25[1] = 0;
byte_47D348 = 1;
v11 = 6;
v12 = &v24;
v13 = &v26;
while ( *v12 == *v13 )
{
++v13;
++v12;
if ( !--v11 )
goto LABEL_23;
}
byte_47D348 = 0;
}
else
{
byte_47D348 = 0;
}
LABEL_23:
__writefsdword(0, v18);
return sub_403B60(v19, 2, &loc_475A40);
}
注册算法：
[C] 纯文本查看 复制代码 //qwertyuiopasdfghjklzxcvbnm
#include <string.h>
#include <stdio.h>
void print_hex(char *buffer, int len){
int i;
printf("******************start code**********************************\n");
for(i = 0; i <= len; i++){
printf("0x%02X ",buffer[i]);
if((i!=0)&&(i%15==0))
printf("\n");
}
printf("\n");
printf("********************end code************************************\n");
}
int main(int argc, char *argv[])
{
int v0;
// esi
char *v1;
// ecx
char *v2;
// ebx
int v3;
// ecx
char *v4;
// eax
int v5;
// ecx
char *v6;
// ebx
int v7;
// ecx
char *v8;
// eax
char v20[257]={0};
int v23=0;
// [esp+116h] [ebp-12Eh] BYREF
//const char *str = "www.5";
char v25[255]={0};
char v19[255]={0};
printf("输入用户名:\n");
scanf("%s",v19);
v25[0]=strlen((char*)v19);
strcpy(v25+1,v19);
printf("%d\n",v25[0]);
print_hex(v25,v25[0]+1);
// 注册码必须是6位
v23 = 6;
if (v25[0] && v23 == 6)
{
v0 = v25[0] + 1;
v1 = v25;
v2 = v20;
do
{
*v2++ = *v1++ % 0xAu + 49;
--v0;
}
while (v0);
v3 = v25[0];
if (v25[0])
{
v4 = v20 + v25[0];
do
*v4-- += 2 * (v25[0] - v3--);
while (v3);
}
if (v25[0] < 6u)
{
v5 = v25[0] + 1;
if (v5 <= 6)
{
v6 = v20 + v25[0];
// 补齐6位
do
{
*(v6 + 1) = (*v6 - 46) % 10 + 48;
++v5;
++v6;
}
while (v5 != 7);
}
}
v7 = 6;
v8 = v20 + v7;
do
{
*v8 += 6 * (6 - v7);
if ((unsigned char)*v8 > 0x7Eu)
*v8 -= 120;
if ((unsigned char)*v8 < 0x21u)
*v8 += 33;
--v7;
--v8;
}
while (v7);
// if (v25[0] > 6)
*(v8 + 7) =0;
}
print_hex(v8,strlen(v8));
printf("注册码：%s\n",v8+1);
}
五子棋.zip
(319.56 KB, 下载次数: 160)
| 
[复制链接]
发表于 2022-8-28 13:08
