BYR Achieve · 镜像论坛

Parser Generator 2 （PGReg.exe）先PEiD载入，检测无壳。直接OD载入。F9运行，输入注册码“11111111”，确定后弹出注册失败对话框，F12暂停。按ALT+K进入call stack，如下 Call stack of main thread Address Stack Procedure / arguments Called from Frame ... 0012F574 000208C0 hOwner = 000208C0 ('Parser Generator Registration',cla 0012F578 003A4090 Text = "Please enter a valid serial number." 0012F57C 003A3FA8 Title = "Parser Generator Registration" 0012F580 00000030 Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL 0012F584 00000000 LanguageID = 0 (LANG_NEUTRAL) 0012F58C 73DE9872 ? USER32.MessageBoxA MFC42.73DE986C 0012F588 0012F590 000208C0 hOwner = 000208C0 ('Parser Generator Registration',cla 0012F594 003A4090 Text = "Please enter a valid serial number." 0012F598 003A3FA8 Title = "Parser Generator Registration" 0012F59C 00000030 Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL 0012F6CC 73E38DFA ? MFC42.#1200 MFC42.73E38DF5 0012F62C 0012F6F4 00401ADA <jmp.&MFC42.#1199> PGReg.00401AD5 0012F6F0 ~~~~~~~~~~~~~~双击此处，来到调用注册失败对话框的地方 00401AD3 . 6A 66 push 66 00401AD5 . E8 2E0A0000 call <jmp.&MFC42.#1199> <-------------此处调用对话框 00401ADA . 8B47 20 mov eax, dword ptr [edi+20] 向上移至函数入口，下断： 00401A3F 90 nop 00401A40 . 64:A1 0000000>mov eax, dword ptr fs:[0] <-------------此处F2下断 00401A46 . 6A FF push -1 00401A48 . 68 38294000 push 00402938 00401A4D . 50 push eax 00401A4E . 64:8925 00000>mov dword ptr fs:[0], esp 00401A55 . 83EC 08 sub esp, 8 再次运行，注册，F8单步跟 00401A85 . E8 840A0000 call <jmp.&MFC42.#3874> ; 取注册码 00401A8A . 8B5424 0C mov edx, dword ptr [esp+C] 00401A8E . 8D4C24 10 lea ecx, dword ptr [esp+10] 00401A92 . 51 push ecx 00401A93 . 52 push edx 00401A94 . E8 47020000 call 00401CE0 <---------------F7跟进此处 00401D07 |. 3C 50 cmp al, 50 <---------------注意这种地方，判断 00401D09 |. 74 07 je short 00401D12 al是否为50，不是则退出 00401D0B |. 5F pop edi 00401D0C |. 5E pop esi 00401D0D |. 5D pop ebp 00401D0E |. 33C0 xor eax, eax 退出是返回0 00401D10 |. 5B pop ebx 00401D11 |. C3 retn 类似以上的地方还有： 00401D16 |. 3C 47 cmp al, 47 00401D18 |. 74 07 je short 00401D21 00401D25 |. 3C 53 cmp al, 53 00401D27 |. 74 0B je short 00401D34 00401D29 |. 3C 4D cmp al, 4D 00401D2B |. 74 07 je short 00401D34 把收集到的cmp & je分析一下，可以看到注册码的前3个字符应该是PGS或PGM，对应ascii 50、47、53（M是4D）。知道了这点后，重新注册一下，调整注册码为：PGS11111 从比较开头3个字符的地方跳到此处， 00401D34 |> \8B2D 44324000 mov ebp, dword ptr [<&MSVCRT._ismbcd>; msvcrt._ismbcdigit 00401D3A |. 46 inc esi 00401D3B |. 33DB xor ebx, ebx 00401D3D |> 8A06 /mov al, byte ptr [esi] 00401D3F |. 3C 80 |cmp al, 80 00401D41 |. 73 4E |jnb short 00401D91 00401D43 |. 0FBEC0 |movsx eax, al 00401D46 |. 50 |push eax 00401D47 |. FFD5 |call ebp ; 判断eax值是否为数字 _ismbcdigit 00401D49 |. 83C4 04 |add esp, 4 00401D4C |. 85C0 |test eax, eax 00401D4E |. 74 41 |je short 00401D91 00401D50 |. 46 |inc esi 00401D51 |. 43 |inc ebx 00401D52 |. 83FB 05 |cmp ebx, 5 ; 看是否已验证5个数字，如果是则退出 00401D55 |.^ 7C E6 \jl short 00401D3D 00401D57 |. 8A0E mov cl, byte ptr [esi] ; \此处向下若干行忽略注册码尾的空格 00401D59 |. 8BC6 mov eax, esi 00401D5B |. 80F9 20 cmp cl, 20 00401D5E |. 75 09 jnz short 00401D69 00401D60 |> 8A4E 01 /mov cl, byte ptr [esi+1] 00401D63 |. 46 |inc esi 00401D64 |. 80F9 20 |cmp cl, 20 00401D67 |.^ 74 F7 \je short 00401D60 ; / 00401D69 |> 803E 00 cmp byte ptr [esi], 0 ; 判断注册码是否结束 00401D6C |. 74 07 je short 00401D75 ; 是则跳，不是则注册失败至此，得到注册码的算法PGSxxxxx或PGMxxxxx，x必须为数字，长度为8个字符。以下为不怎么重要的分析，可以跳过。 00401D75 |> \8B7424 18 mov esi, dword ptr [esp+18] 00401D79 |. 85F6 test esi, esi 00401D7B |. 74 38 je short 00401DB5 00401D7D |. 2BC7 sub eax, edi ; 注册码长度 00401D7F |. 40 inc eax 00401D80 |. 50 push eax 00401D81 |. E8 B2070000 call <jmp.&MFC42.#823> ; 非配内存 00401D86 |. 8BD0 mov edx, eax 00401D88 |. 83C4 04 add esp, 4 00401D8B |. 85D2 test edx, edx 00401D8D |. 8916 mov dword ptr [esi], edx 00401D8F |. 75 07 jnz short 00401D98 ; 分配内存成功则跳 00401D91 |> 5F pop edi 00401D92 |. 5E pop esi 00401D93 |. 5D pop ebp 00401D94 |. 33C0 xor eax, eax 00401D96 |. 5B pop ebx 00401D97 |. C3 retn 00401D98 |> 83C9 FF or ecx, FFFFFFFF ; \ 00401D9B |. 33C0 xor eax, eax 00401D9D |. F2:AE repne scas byte ptr es:[edi] 00401D9F |. F7D1 not ecx ; /注册码长度+1 00401DA1 |. 2BF9 sub edi, ecx ; edi = 注册码第一位 00401DA3 |. 8BC1 mov eax, ecx 00401DA5 |. 8BF7 mov esi, edi 00401DA7 |. 8BFA mov edi, edx ; edi 为刚分配的内存 00401DA9 |. C1E9 02 shr ecx, 2 00401DAC |. F3:A5 rep movs dword ptr es:[edi], dword p>; 保存注册码 00401DAE |. 8BC8 mov ecx, eax 00401DB0 |. 83E1 03 and ecx, 3 00401DB3 |. F3:A4 rep movs byte ptr es:[edi], byte ptr> 00401DB5 |> 5F pop edi 00401DB6 |. 5E pop esi 00401DB7 |. 5D pop ebp 00401DB8 |. B8 01000000 mov eax, 1 ; 返回1 00401DBD |. 5B pop ebx 00401DBE \. C3 retn

破解Parse Generator 2.0