¤¤¤ 破解 GIF movie Gear V2.62 ¤¤¤
飞 雪 于 2001.2.24
最近，我发现了一个玩破解的好材料，非常适合我这样的初学者做注册机的练习：GIF
movie Gear。这个程序是从第二期《家佳电脑文摘》上找来的，也可到它的网址http://www
.gamani.com下载。它的验证过程粗一看是先根据你输入的注册码经过一番运算求出值a,再
由NAME经过一番运算求出值b,最后比较，相等则注册成功。也就是说你从内存中是找不到真
正的注册码的，要破解只有两种方法：改程式码（暴力）或反推注册码。我开始时写的注册
机是按照上面的思路作的，用了4 个循环来穷举码a，与先前的b作对比。后来调试时发现小
题大作了，仔细一看原来b即是注册码！只要把它转换成十进制即可。那么程序中求a的过程在干什么？
原来仅仅是把字符型的注册码转换成整型的注册码，别无他意，打了这么大一个
勺子真菜！当然我的源程序还是能正确算出注册码的，只是效率减低90%（多算了一次嘛，
要是码子要取20位，难道我要做20个嵌套的循环？爱机爱机别害怕，说什么也不让你受这种
苦!!!）
本人也是第一次写破文，不当之处请玩家多多指正。
先说结论：
方法①
查找： 3B F0 75 0A B8 01
改为： -- -- 90 90 -- --
即将： :42B838 750A jne 0042B844
改为： :42B838 9090 nop nop；因是两个字节，所以改为两个NOP，即：9090
注册信息在注册表的
HKEY_CURRENT_USER\Software\gamani\GIFMovieGear\2.0\regcode ; regname处。
方法②
计算注册码。注册机源程文后附上。
以下是破解过程：
用TRW2000 1.22载入movgear.exe，点 Help->register now... , 填好NAME：flysnow SN:mvg2s-ABCDEF
（当然是错的码了，至于为什么这么奇怪，后面会看到的；形如mvg2s???****，mvg2^??**** 其中 ??为
任意字符，^表示非's'的字符,****是关键！下面的具体运算时位数从这开始
）。
还是请可爱的万能中断吧 BPX HMEMCPY（太喜欢她了，就象大众情人:-）; F5返后，点“O
K”，被捉住啦!太好了，那我就不客气了，呵呵。 BD * 暂时屏蔽掉，猛按F12共10-1次，
再按F10到:0042B9FD处看看：
* Reference To: USER32.GetWindowTextA, Ord:013Fh
|
:0042B9F4 8B1D34694600 mov ebx, dword ptr [00466934]
:0042B9FA 50 push eax
:0042B9FB FFD3 call ebx
:0042B9FD 8D442478 lea eax, dword ptr [esp+78]
* Possible Reference to Dialog: DialogID_0064
|
:0042BA01 6A64 push 00000064
:0042BA03 50 push eax
* Possible Reference to Dialog: DialogID_0091, CONTROL_ID:0450, ""
|
:0042BA04 6850040000 push 00000450
:0042BA09 56 push esi
:0042BA0A FFD7 call edi
:0042BA0C 50 push eax
:0042BA0D FFD3 call ebx
:0042BA0F 8D4C2478 lea ecx, dword ptr [esp+78] //将我输入的假注册码装入ECX
:0042BA13 8D542414 lea edx, dword ptr [esp+14] //将NAME装入EDX
:0042BA17 51 push ecx
:0042BA18 52 push edx
:0042BA19 E872FDFFFF call 0042B790 // <#####>
//这就是比较注册码的调用了，没说的，先记账，待会儿再用F8找它算帐吧！
:0042BA1E 83C408 add esp, 00000008
:0042BA21 85C0 test eax, eax //比较的结果，1为正确。若R EAX 1是治标不治本的。
:0042BA23 0F84A6000000 je 0042BACF //改这句也同样,重启后又是未注册版本了
:0042BA29 8D442410 lea eax, dword ptr [esp+10]
:0042BA2D 8D4C240C lea ecx, dword ptr [esp+0C]
:0042BA31 50 push eax
:0042BA32 51 push ecx
:0042BA33 6A00 push 00000000
:0042BA35 683F000F00 push 000F003F
:0042BA3A 6A00 push 00000000
:0042BA3C 6874B44400 push 0044B474
:0042BA41 6A00 push 00000000
//以下为处理注册表，把用户注册信息写入注册表，每次启动程序时要读出来验算，所以改
上面的:0042BA21处没用。要改就要改判断code的地方, :42B838 750A 这句，Why ? 走下去
便知。
......
* Possible StringData Ref from Data Obj ->"RegName"
|
:0042BA73 6868724400 push 00447268
:0042BA78 50 push eax
:0042BA79 FFD3 call ebx
:0042BA7B 8D7C2478 lea edi, dword ptr [esp+78]
:0042BA7F 83C9FF or ecx, FFFFFFFF
:0042BA82 33C0 xor eax, eax
:0042BA84 8B54240C mov edx, dword ptr [esp+0C]
:0042BA88 F2 repnz
:0042BA89 AE scasb
:0042BA8A F7D1 not ecx
:0042BA8C 51 push ecx
:0042BA8D 8D4C247C lea ecx, dword ptr [esp+7C]
:0042BA91 51 push ecx
:0042BA92 6A01 push 00000001
:0042BA94 50 push eax
* Possible StringData Ref from Data Obj ->"RegCode"
|
:0042BA95 6870724400 push 00447270
:0042BA9A 52 push edx
:0042BA9B FFD3 call ebx
:0042BA9D 8B44240C mov eax, dword ptr [esp+0C]
:0042BAA1 50 push eax
* Reference To: ADVAPI32.RegCloseKey, Ord:0117h
|
:0042BAA2 FF156C654600 Call dword ptr [0046656C]
* Possible StringData Ref from Data Obj ->"Software\Loani\MG260"
|
:0042BAA8 6878724400 push 00447278
:0042BAAD 6802000080 push 80000002
* Reference To: ADVAPI32.RegDeleteKeyA, Ord:011Eh
|
:0042BAB2 FF1564654600 Call dword ptr [00466564]
:0042BAB8 6A01 push 00000001
:0042BABA 56 push esi
* Reference To: USER32.EndDialog, Ord:00B4h
|
:0042BABB FF15D8694600 Call dword ptr [004669D8]
:0042BAC1 33C0 xor eax, eax
:0042BAC3 5F pop edi
:0042BAC4 5E pop esi
:0042BAC5 5B pop ebx
:0042BAC6 81C4D0000000 add esp, 000000D0
:0042BACC C21000 ret 0010
至此注册表项登记完毕，返回调用
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BA23(C)
|
:0042BACF 6A30 push 00000030
* Possible Reference to String Resource ID=40213: "Invalid Registration Info" //看到这种东西(Invalid...)一般总是走过头啦。
|
:0042BAD1 68159D0000 push 00009D15
* Possible Reference to String Resource ID=40212: "The information you have provided is invalid. Please be sure"
|
:0042BAD6 68149D0000 push 00009D14
:0042BADB 56 push esi
:0042BADC E8FF00FEFF call 0040BBE0 //讨厌的破框来啦！记着这个让我痛苦的地方
:0042BAE1 83C410 add esp, 00000010
.....
从<#####>...看过来
再次注册，直接入题吧： BPX 42BA19，中断后F8进入：
* Referenced by a CALL at Addresses:
|:0042B8D9 , :0042BA19
|
:0042B790 53 push ebx
:0042B791 55 push ebp
:0042B792 8B6C2410 mov ebp, dword ptr [esp+10]
:0042B796 56 push esi
:0042B797 57 push edi
:0042B798 807D006D cmp byte ptr [ebp+00], 6D //比较第一位码是否是6D，即‘ m ’
:0042B79C 0F85A2000000 jne 0042B844 //跳到那就玩完了
:0042B7A2 807D0176 cmp byte ptr [ebp+01], 76 //比较第二位码是否是76，即‘ v ’
:0042B7A6 0F8598000000 jne 0042B844
:0042B7AC 807D0267 cmp byte ptr [ebp+02], 67 //比较第三位码是否是6D，即‘ g ’
:0042B7B0 0F858E000000 jne 0042B844
:0042B7B6 807D0332 cmp byte ptr [ebp+03], 32 //比较第四位码是否是6D，即‘ 2 ’
:0042B7BA 0F8584000000 jne 0042B844
开始乱输的话在这儿可以改过来。以下一段代码是比较黑名单的过程，比完后到：
.....
:0042B7E8 807D0473 cmp byte ptr [ebp+04], 73 //还在比较第五位是不是‘ s ’
:0042B7EC 7501 jne 0042B7EF
//不是的话想干什么？我还是老实地跟上吧。其实是‘ s ’则跳，直接从第7位取出作比
较而已，即若是当初注册码为mvg2?-ABCDEF的话（?不为's'的字符）取“BCDE”4位。否则
从输入的mvg2s-ABCDEF中第1+7位开始取出：即“CDEF” 4位。
:0042B7EE 45 inc ebp
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B7EC(C)
|
:0042B7EF 83C507 add ebp, 00000007
:0042B7F2 55 push ebp
:0042B7F3 E8F8BC0000 call 004374F0 -------〖2〗-------
//关键处到了!这个CALL是转换注册码,准备F8去见见面吧. 见下面 〖2〗;从那儿返回后再接下去比较NAME的运算和
:0042B7F8 8B542418 mov edx, dword ptr [esp+18]
:0042B7FC 83C404 add esp, 00000004
:0042B7FF 8BFA mov edi, edx
:0042B801 33C9 xor ecx, ecx
:0042B803 8A12 mov dl, byte ptr [edx]
:0042B805 BEFE060000 mov esi, 000006FE //这是给你的本钱哟，拿着吧，别嫌少
:0042B80A 84D2 test dl, dl
:0042B80C 7428 je 0042B836
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B834(C)
|
:0042B80E 41 inc ecx
:0042B80F 0FBED2 movsx edx, dl
:0042B812 8BD9 mov ebx, ecx
:0042B814 0FAFDA imul ebx, edx //位数(1-4)与字符值相乘
:0042B817 03F3 add esi, ebx
:0042B819 81FEFD0D0000 cmp esi, 00000DFD
:0042B81F 7E06 jle 0042B827 //小于等于DFD则到0042B827
:0042B821 81EEFD0D0000 sub esi, 00000DFD //否则减去DFD
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B81F(C)
|
:0042B827 83F90A cmp ecx, 0000000A
:0042B82A 7E02 jle 0042B82E
:0042B82C 33C9 xor ecx, ecx
//明白了：它比较Name字串长度,它先取0-10位计算；从11位起将位数清零再循环计算，把和累加。
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B82A(C)
|
:0042B82E 8A5701 mov dl, byte ptr [edi+01]
:0042B831 47 inc edi
:0042B832 84D2 test dl, dl
:0042B834 75D8 jne 0042B80E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B80C(C)
|
:0042B836 3BF0 cmp esi, eax
//高潮在此! ESI放着根据NAME算出的值（本例是577H）
//EAX处放的是根据输入的字符型注册码换算成16进制. 在TRW下输入? ESI 就拣到$30 啦。R eax 577 就暂时行啦。
:0042B838 750A jne 0042B844 //改吧改吧：NOP NOP （9090）不要太粗鲁啦
:0042B83A B801000000 mov eax, 00000001
//走到这步就行啦，得胜回朝了。安装协议怎么说的？不得修改程式吧？还是....
:0042B83F 5F pop edi
:0042B840 5E pop esi
:0042B841 5D pop ebp
:0042B842 5B pop ebx
:0042B843 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042B79C(C), :0042B7A6(C), :0042B7B0(C), :0042B7BA(C), :0042B7DB(C)
|:0042B838(C)
|
:0042B844 5F pop edi
:0042B845 5E pop esi
:0042B846 5D pop ebp
:0042B847 33C0 xor eax, eax
:0042B849 5B pop ebx
:0042B84A C3 ret
......
------- 〖2〗-------
* Referenced by a CALL at Addresses:
|:0040DDEC , :0040DE23 , :0040DE9E , :0040E037 , :0040E075
|:0040E0FD , :0040EC4F , :0040EC98 , :0040ECBB , :0042B48F
|:0042B7F3 , :0043385C , :00433ACC
|
:004374F0 8B442404 mov eax, dword ptr [esp+04]
:004374F4 50 push eax
:004374F5 E856FFFFFF call 00437450 //再进去吧，坚持就是胜利!... ---〖3〗---
:004374FA 83C404 add esp, 00000004
:004374FD C3 ret
---〖3〗---
* Referenced by a CALL at Addresses:
|:004374F5 , :0043C6ED , :0043C721 , :0043C759
|
:00437450 53 push ebx
:00437451 55 push ebp
:00437452 56 push esi
:00437453 57 push edi
:00437454 8B7C2414 mov edi, dword ptr [esp+14]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437487(U)
|
:00437458 833D5C82440001 cmp dword ptr [0044825C], 00000001
:0043745F 7E11 jle 00437472
:00437461 33C0 xor eax, eax
:00437463 6A08 push 00000008
:00437465 8A07 mov al, byte ptr [edi]
:00437467 50 push eax
:00437468 E8E32D0000 call 0043A250 //???
:0043746D 83C408 add esp, 00000008
:00437470 EB10 jmp 00437482 //只有过去喽!... -〖4〗-
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043745F(C)
|
* Possible StringData Ref from Data Obj ->" ((((( "
->" H"
|
:00437472 8B1550804400 mov edx, dword ptr [00448050]
:00437478 33C9 xor ecx, ecx
:0043747A 8A0F mov cl, byte ptr [edi]
:0043747C 8A044A mov al, byte ptr [edx+2*ecx]
//查从内存:00448050开始处的表格，它想干什么？原来是保证那4 位注册码必须为0-9，才可使al为84，
即edx+2*ecx=20+2*[0,1,...9]；其中EDX的地址恒为44805A，即20。ecx只要是0-9中任意数
字，乘以2再加上EDX必映射到值为84的内存地址。
:0043747F 83E008 and eax, 00000008 //和1000（Bin）作与运算，
-〖4〗-
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437470(U)
|
:00437482 85C0 test eax, eax //从〖4〗过来的
:00437484 7403 je 00437489
:00437486 47 inc edi
:00437487 EBCF jmp 00437458
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437484(C)
|
:00437489 33C0 xor eax, eax
:0043748B 8A07 mov al, byte ptr [edi]
:0043748D 47 inc edi
:0043748E 8BF0 mov esi, eax
:00437490 83FE2D cmp esi, 0000002D
:00437493 8BEE mov ebp, esi
:00437495 7405 je 0043749C
:00437497 83FE2B cmp esi, 0000002B
:0043749A 7507 jne 004374A3
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437495(C)
|
:0043749C 33C9 xor ecx, ecx
:0043749E 8A0F mov cl, byte ptr [edi]
:004374A0 47 inc edi
:004374A1 8BF1 mov esi, ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043749A(C)
|
:004374A3 33DB xor ebx, ebx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374D9(U)
|
:004374A5 833D5C82440001 cmp dword ptr [0044825C], 00000001
:004374AC 7E0D jle 004374BB
:004374AE 6A04 push 00000004
:004374B0 56 push esi
:004374B1 E89A2D0000 call 0043A250
:004374B6 83C408 add esp, 00000008
:004374B9 EB0C jmp 004374C7
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374AC(C)
|
* Possible StringData Ref from Data Obj ->" ((((( "
->" H"
|
:004374BB 8B1550804400 mov edx, dword ptr [00448050]
:004374C1 8A0472 mov al, byte ptr [edx+2*esi]
:004374C4 83E004 and eax, 00000004
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374B9(U)
|
:004374C7 85C0 test eax, eax
:004374C9 7410 je 004374DB
:004374CB 8D049B lea eax, dword ptr [ebx+4*ebx]
//这个表达式《1》记下来，写注册机用
:004374CE 33C9 xor ecx, ecx
:004374D0 8A0F mov cl, byte ptr [edi]
:004374D2 47 inc edi
:004374D3 8D5C46D0 lea ebx, dword ptr [esi+2*eax-30]
//这个表达式就是被我误解的,Sorry ! 作用： char --> int
:004374D7 8BF1 mov esi, ecx
:004374D9 EBCA jmp 004374A5
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374C9(C)
|
:004374DB 83FD2D cmp ebp, 0000002D //还比什么？让我在注册码后加n个‘ - ’？
:004374DE 8BC3 mov eax, ebx
:004374E0 7502 jne 004374E4
:004374E2 F7D8 neg eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374E0(C)
|
:004374E4 5F pop edi
:004374E5 5E pop esi
:004374E6 5D pop ebp
:004374E7 5B pop ebx
:004374E8 C3 ret
// 回老家喽! 要转几趟车?
-------------------------------------------------------------------------------
好啦，下面写出注册机（多余的穷举法部分就省略了）：（这样才温柔嘛!改程序可是违法
的噢...）
/***********************************************
* GIF movie Gear V2.62 注册机 *
* 在Borland c++ 3.1下编译通过；其他的C版本料 *
* 想也无不可，若在Turbo C下需适当修改。 *
***********************************************/
#include
#include
#include
int GetCode(char *);
void main(void)
{
char name[127]="";
int SUM=0x00;
char * Copyright="\n<< Made by flysnow. E-mail: flysnow0359_cn@sina.com . -2001.2.24- >>";
char * SoftNameInf="\nThe registration code for GIF Movie Gear 2.62 .";
cout<"\n\nPlease input your name:"<<<"Your registration code is mvg2s???"<" OR\n mvg2*??"
<<<" and '?,*' for any char , but '*' is not 's'. Enjoy ! ^O^ ";
cout<0xDFD) { ESI-=0xDFD; }
ESI+=s[i+p]*(i+1);
EBX=ESI;
if(EBX>0xDFD) { EBX-=0xDFD; }
if(i>=10)
{
i=0;
p+=10,len-=10;
}
else
i++;
}
return ESI;
}
---------------------------------------------------------------
最后想说：
破解共享软件很好玩嘛，虽然追了几天很累很烦，只要成功了绝对值！这比玩游戏更有
趣．．．（我那可怜的Ｐ１６６还能玩什么游戏？！）我小时候就喜欢猜谜语，现在玩玩这
个就象儿时的感觉啦．我学了C终于有用啦。如果注册码卖1分钱一个，我这下不大发而特发
了吗？！我这个人是不是废话挺多的？可习惯了呀，要是打字水平再高点的话还要多哇．哧
哧，废话多也有大派用场的时候...如果女友生大气时这么一堆堆一层层出来，说不定逗得
她化废话为神奇（小燕子：化力气为浆糊！），要不试试？？ ？？？ 对了，破了半天不知
这个软件是干什么的，忘记看啦，真对不起... Bye !
飞 雪 flysnow0359_cn@sina.com , 2001.2.24
|
国产软件每日一破(1) (彩票快车V1.07破解记录)
软件名称：彩票快车V1.07 [国产]
来源 2001-02-19 海阔天空502k
软件授权：共享软件
注册费用：28元人民币
软件下载 ftp://ftp.bj.software.chinese.com/software/soft_others/cpkc.zip
软件简介：
全国各地电脑福利电脑体育彩票最具实力的分析管理投注软件，及时快捷的数据更新！
适用于全国各省、市的各类电脑体育、福利彩票。电脑随机选号的范围可以自行指定。
用后感觉不错,推荐,祝中大奖.
程序不修改Windows注册表的任何内容,没有加壳.
[一]暴力破解
W32DASM金版=>串式参考"您的彩票快车已注册成功，希望多提宝贵意见。谢谢"=>
只有1处,找到后,向上找第一个跳转语句,即(2)处,此为关键跳转.(1)处为关键比较.
:004A8BE0 C1E003 shl eax, 03
:004A8BE3 2BC2 sub eax, edx
:004A8BE5 3BD8 cmp ebx, eax *********(1)关键比较
:004A8BE7 0F858B010000 jne 004A8D78 (2)关键跳转
^^=>84(爆破) ************
:004A8BED A1947C4B00 mov eax, dword ptr [004B7C94]
:004A8BF2 8B15EC794B00 mov edx, dword ptr [004B79EC]
:004A8BF8 8B12 mov edx, dword ptr [edx]
:004A8BFA E8B9AFF5FF call 00403BB8
:004A8BFF 6A01 push 00000001
* Possible StringData Ref from Code Obj ->"彩票快提示窗口" (丢掉车字,国产的"质量"!!!)
|
:004A8C01 B9608E4A00 mov ecx, 004A8E60
* Possible StringData Ref from Code Obj ->"您的彩票快车已注册成功，希望多提宝贵意见。谢谢"
->"！"
|
:004A8C06 BA708E4A00 mov edx, 004A8E70
:004A8C0B A1147C4B00 mov eax, dword ptr [004B7C14]
:004A8C10 8B00 mov eax, dword ptr [eax]
w32dasm中(2)处底部偏移地址为A7FE7,用ultraedit修改0F85..=>0F84..
改完后再启动,软件注册菜单消失.
[二]追注册码
1.软件注册菜单中填入姓名,电话,电子邮件后,点生成用户码,信息
存在当前目录下lotteryrapido.ini中,我的用户码是16131363
[彩票快车]
姓名=风飘雪
电话=68394831
电子邮件=gd1@yeah.net
用户码=16131363
注册码=
2.试填入注册码,发现注册码必须是8位(可用穷举法,haha!!)
输入11111111
3.启动trw2000,下中断
bpx 4a8be5
go 点注册,被拦
? eax
eax=77777777(在哪里,在哪里见过你,你的笑容这麽熟悉)
想起舒淇和天心MM的电影我爱777
? ebx
ebx=368098003
4.琢磨368098003÷7=52585429
5.填入52585429,点注册,ok,ok!!!
作者 风飘雪
主页 http://duba.126.com
e-mail gd1@yeah.net
|