木馬剋星

[psac]

算法以前發過了,再寫也沒意思,這次主要談談如何可以昇級.
自上次答應作者不再破解之後,我的9.99++可昇級版就沒有再更新了(別以為我和作者有一腿,我向毛主席保證,我是清白的),誰知前兩天逛他的網站,他竟在他的論壇說封了我的所有破解版(真是個小人),並且還說他現在的版本有保護多麼的強,請大家破解,於是我下了個0301版看了一下,趁著酒性把強姦他的過程寫了出來,讓高手見笑了.

0301版和他以前的版本不同在於對昇級地址加了密,他的昇級地址是http://www.luosoft.com/cgi-bin/test.pl?name=用戶名,如果用戶名不是他服務器裡的就顯示NO OK,軟體就會說你不是註冊用戶.
如果用戶名正確,就會得到一個病毒庫檔案的地址,具他自己講病毒庫地址30分鐘換一次(真是變態).

我們現在所能做的就是將他的昇級地址換成我們自己的服務器地址,軟體通過我們的服務器認證後獲得病毒庫檔案,但是他的昇級地址顯示的是"Fn2yhGnF7PxJGNVN4g6IinGmjFDbkxlXXTpPy0ZkMN6UvUS9Ipls24II"只有在軟體執行時通過幾千行的變態算法後才還原成http://www.luosoft.com/cgi-bin/test.pl?name=,最後存放在下面的[edx]中.

原檔案:
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004B4B79(C)
|
:004B4B38 8A06 mov al, byte ptr [esi]
:004B4B3A 8845F7 mov byte ptr [ebp-09], al
:004B4B3D 8B4B34 mov ecx, dword ptr [ebx+34]
:004B4B40 8B5330 mov edx, dword ptr [ebx+30]
:004B4B43 8BC3 mov eax, ebx
:004B4B45 8B38 mov edi, dword ptr [eax]
:004B4B47 FF5760 call [edi+60]
:004B4B4A 8B4334 mov eax, dword ptr [ebx+34]
:004B4B4D 8A00 mov al, byte ptr [eax]
:004B4B4F 3206 xor al, byte ptr [esi]
:004B4B51 8B55F8 mov edx, dword ptr [ebp-08]
:004B4B54 8802 mov byte ptr [edx], al------通過不知名的幾千行變態算法計算後將最終的昇級地址放在[edx]中,我們就改了他.
:004B4B56 8B4B38 mov ecx, dword ptr [ebx+38]
:004B4B59 49 dec ecx
:004B4B5A 8B5330 mov edx, dword ptr [ebx+30]
:004B4B5D 8B4330 mov eax, dword ptr [ebx+30]
:004B4B60 40 inc eax
:004B4B61 E862DEF4FF call 004029C8
:004B4B66 8B4330 mov eax, dword ptr [ebx+30]
:004B4B69 034338 add eax, dword ptr [ebx+38]
:004B4B6C 48 dec eax
:004B4B6D 8A55F7 mov dl, byte ptr [ebp-09]
:004B4B70 8810 mov byte ptr [eax], dl
:004B4B72 46 inc esi
:004B4B73 FF45F8 inc [ebp-08]
:004B4B76 FF4DF0 dec [ebp-10]
:004B4B79 75BD jne 004B4B38
:004B4B7B 5F pop edi
:004B4B7C 5E pop esi
:004B4B7D 5B pop ebx
:004B4B7E 8BE5 mov esp, ebp
:004B4B80 5D pop ebp
:004B4B81 C20400 ret 0004


修改後的代碼:
:004B4B0A 807B2400 cmp byte ptr [ebx+24], 00
:004B4B0E 7516 jne 004B4B26

* Possible StringData Ref from Code Obj ->"Cipher not initialized"
|
:004B4B10 B98C4B4B00 mov ecx, 004B4B8C
:004B4B15 B201 mov dl, 01

* Possible StringData Ref from Code Obj ->"EDCP_blockcipher岪"
|
:004B4B17 A1C4404B00 mov eax, dword ptr [004B40C4]
:004B4B1C E83780F5FF call 0040CB58
:004B4B21 E832EEF4FF call 00403958

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004B4B0E(C)
|
:004B4B26 B868747470 mov eax, 70747468
:004B4B2B 8902 mov dword ptr [edx], eax
:004B4B2D B83A2F2F66 mov eax, 662F2F3A
:004B4B32 894204 mov dword ptr [edx+04], eax
:004B4B35 B87265652E mov eax, 2E656572
:004B4B3A 894208 mov dword ptr [edx+08], eax
:004B4B3D B868626973 mov eax, 73696268
:004B4B42 89420C mov dword ptr [edx+0C], eax
:004B4B45 B8702E636F mov eax, 6F632E70
:004B4B4A 894210 mov dword ptr [edx+10], eax
:004B4B4D B86D2F6C65 mov eax, 656C2F6D
:004B4B52 894214 mov dword ptr [edx+14], eax
:004B4B55 B86F7A656D mov eax, 6D657A6F
:004B4B5A 894218 mov dword ptr [edx+18], eax
:004B4B5D B82F736865 mov eax, 6568732F
:004B4B62 89421C mov dword ptr [edx+1C], eax
:004B4B65 B86E676A69 mov eax, 696A676E
:004B4B6A 894220 mov dword ptr [edx+20], eax
:004B4B6D B82E617370 mov eax, 7073612E
:004B4B72 894224 mov dword ptr [edx+24], eax
:004B4B75 B83F6D7A3D mov eax, 3D7A6D3F
:004B4B7A 894228 mov dword ptr [edx+28], eax
:004B4B7D 5B pop ebx
:004B4B7E 8BE5 mov esp, ebp
:004B4B80 5D pop ebp
:004B4B81 C20400 ret 0004
上面這段代碼就是將我的昇級地址http://free.hbisp.com/leozem/shengji.asp?mz=替換進去,dword ptr [edx]也就是他最終的昇級地址所存放的位置.

接下來就是講如何做昇級服務器了,開啟記事本,打入下列代碼:
<%
if request("mz")="leozem" then -----註冊名是否為leozem
response.write ("昇級檔案的地址")-----是就顯示病毒庫的下載地址
else
response.write ("no ok")-----不是則顯示"NO OK"
end if
%>

然後儲存為shengji.asp放到你的服務器上,他的病毒庫檔案有很多方法可以獲得,在這就不講了.

:005434B8 8B83D8020000 mov eax, dword ptr [ebx+000002D8]
:005434BE 8B8010010100 mov eax, dword ptr [eax+00010110]

* Possible StringData Ref from Code Obj ->"no ok"
|
:005434C4 BA80365400 mov edx, 00543680
:005434C9 E8060EECFF call 004042D4---是否顯示"NO OK"
:005434CE 753D jne 0054350D-----不是從得到的昇級地址下載昇級檔案.
:005434D0 33D2 xor edx, edx
:005434D2 A1C8375800 mov eax, dword ptr [005837C8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0054348F(C)
|
:005434D7 8B08 mov ecx, dword ptr [eax]
:005434D9 FF515C call [ecx+5C]
:005434DC A16CA65600 mov eax, dword ptr [0056A66C]
:005434E1 803800 cmp byte ptr [eax], 00---是否為英文版,是就跳
:005434E4 740C je 005434F2

* Possible StringData Ref from Code Obj ->"服務器認證錯誤!你不是合法用戶."
|
:005434E6 B890365400 mov eax, 00543690
:005434EB E89087F1FF call 0045BC80
:005434F0 EB0A jmp 005434FC


他以前的版本,在殺毒時需要連接網路,但到了這版卻不需要,可能是他顧著對付我,整天只進行有保護的研究,疏忽了這點,但軟體的代碼中還儲存有殺毒時的服務器認證,NND這版連我的大名也進了他的軟體,搞什麼鬼,我可不怕你,我的硬碟保修期還沒過,呵呵.

* Possible StringData Ref from Code Obj ->"loezem"
|
:0055E89A B874EE5500 mov eax, 0055EE74
:0055E89F E80C5CEAFF call 004044B0---啟動判斷軟體中是否含有loezem,估計是怕我改他的軟體,但是可氣的是竟把我的leozem寫成loezem,暈.如果軟體中含有loezem只是報錯誤,還好,沒有格我的盤.
:0055E8A4 85C0 test eax, eax
:0055E8A6 0F8F25050000 jg 0055EDD1
:0055E8AC 8D55E8 lea edx, dword ptr [ebp-18]
:0055E8AF A11C385800 mov eax, dword ptr [0058381C]
:0055E8B4 E8DB79EDFF call 00436294
:0055E8B9 8B45E8 mov eax, dword ptr [ebp-18]
:0055E8BC 8D55EC lea edx, dword ptr [ebp-14]
:0055E8BF E8B8A7EAFF call 0040907C
:0055E8C4 8B55EC mov edx, dword ptr [ebp-14]

* Possible StringData Ref from Code Obj ->"loezem"
|
:0055E8C7 B874EE5500 mov eax, 0055EE74
:0055E8CC E8DF5BEAFF call 004044B0
:0055E8D1 85C0 test eax, eax
:0055E8D3 0F8FF8040000 jg 0055EDD1
:0055E8D9 8D55E0 lea edx, dword ptr [ebp-20]
:0055E8DC A11C385800 mov eax, dword ptr [0058381C]
:0055E8E1 E8AE79EDFF call 00436294
:0055E8E6 8B45E0 mov eax, dword ptr [ebp-20]
:0055E8E9 8D55E4 lea edx, dword ptr [ebp-1C]
:0055E8EC E88BA7EAFF call 0040907C
:0055E8F1 8B55E4 mov edx, dword ptr [ebp-1C]

* Possible StringData Ref from Code Obj ->"loezem"
|
:0055E8F4 B874EE5500 mov eax, 0055EE74
:0055E8F9 E8B25BEAFF call 004044B0
:0055E8FE 85C0 test eax, eax
:0055E900 0F8FCB040000 jg 0055EDD1
:0055E906 8D55D8 lea edx, dword ptr [ebp-28]
:0055E909 A11C385800 mov eax, dword ptr [0058381C]
:0055E90E E88179EDFF call 00436294
:0055E913 8B45D8 mov eax, dword ptr [ebp-28]
:0055E916 8D55DC lea edx, dword ptr [ebp-24]
:0055E919 E85EA7EAFF call 0040907C
:0055E91E 8B55DC mov edx, dword ptr [ebp-24]

* Possible StringData Ref from Code Obj ->"loezem"
|
:0055E921 B874EE5500 mov eax, 0055EE74
:0055E926 E8855BEAFF call 004044B0
:0055E92B 85C0 test eax, eax
:0055E92D 0F8F9E040000 jg 0055EDD1
:0055E933 8D55D0 lea edx, dword ptr [ebp-30]
:0055E936 A11C385800 mov eax, dword ptr [0058381C]
:0055E93B E85479EDFF call 00436294
:0055E940 8B45D0 mov eax, dword ptr [ebp-30]
:0055E943 8D55D4 lea edx, dword ptr [ebp-2C]
:0055E946 E831A7EAFF call 0040907C
:0055E94B 8B55D4 mov edx, dword ptr [ebp-2C]

* Possible StringData Ref from Code Obj ->"破解"
|
:0055E94E B884EE5500 mov eax, 0055EE84
:0055E953 E8585BEAFF call 004044B0----軟體中是否含有"破解"
:0055E958 85C0 test eax, eax
:0055E95A 0F8F71040000 jg 0055EDD1
:0055E960 8D55C8 lea edx, dword ptr [ebp-38]
:0055E963 A11C385800 mov eax, dword ptr [0058381C]
:0055E968 E82779EDFF call 00436294
:0055E96D 8B45C8 mov eax, dword ptr [ebp-38]
:0055E970 8D55CC lea edx, dword ptr [ebp-34]
:0055E973 E804A7EAFF call 0040907C
:0055E978 8B55CC mov edx, dword ptr [ebp-34]

* Possible StringData Ref from Code Obj ->"破解"
|
:0055E97B B884EE5500 mov eax, 0055EE84
:0055E980 E82B5BEAFF call 004044B0
:0055E985 85C0 test eax, eax
:0055E987 0F8F44040000 jg 0055EDD1
:0055E98D 8D55C0 lea edx, dword ptr [ebp-40]
:0055E990 A11C385800 mov eax, dword ptr [0058381C]
:0055E995 E8FA78EDFF call 00436294
:0055E99A 8B45C0 mov eax, dword ptr [ebp-40]
:0055E99D 8D55C4 lea edx, dword ptr [ebp-3C]
:0055E9A0 E8D7A6EAFF call 0040907C
:0055E9A5 8B55C4 mov edx, dword ptr [ebp-3C]

* Possible StringData Ref from Code Obj ->"破解"
|
:0055E9A8 B884EE5500 mov eax, 0055EE84
:0055E9AD E8FE5AEAFF call 004044B0
:0055E9B2 85C0 test eax, eax
:0055E9B4 0F8F17040000 jg 0055EDD1
:0055E9BA B201 mov dl, 01

接下來說說,他以前版本的殺毒認證,由於找不到以前的版本了,只能口述.
1.將掃到的木馬的本機地址(如:木馬在D:\SS\ss.eXE),則發送http://www.luosoft.com/cgi-bin/iparmor1.pl?name=用戶名!D:\SS\ss.eXE,如果用戶名不是他服務器裡有的,就顯示NO OK,如果有,就返回D:\SS\ss.eXE,此時軟體就將D:\SS\ss.eXE刪除.
2.如果顯示NO OK就說你不是註冊用戶,並在註冊表中刪除你的註冊項.
3.如果返回的不是D:\SS\ss.eXE,則返回什麼他就刪除什麼.
4.如果返回空就顯示"從起電腦才能策底清除木馬"(這是在玩你哈).
但此方法有一個BUG，就是當檔案名中有%20時，就無法刪除，因為%20變成網址就是空格。
解決方法:
開啟記事本,打入下列代碼:
%>
response.write request("name")
%>
呵呵，就像中文內碼XXXX一樣，你任意輸入註冊碼都沒有用，哈哈~~~

● 您不得對本軟體進行反向工程、反編譯和反彙編。
我按他說的，可是我根據一些人提供的訊息，也沒有什麼，就是一些數位，哈哈，寫了一個程序，我自己的哦~~~可是我執行了自己的程序後，他的中文內碼XXXX就說我註冊了，你說怎麼辦吧，我可不是有意的哦~~~

訊息如下：
3727
6969
10696
73468482
73474954
23479853
73474954
84370855

7096
6969
14065
73468482
73481395
23479853
73481395
84376222

哈哈，如果你會分析，也可以讓它免費哦~~~
木馬剋星用的是IceLock算法，挺老的


IceLock, v2.0b
==============

Copyright 1996,97 - B. Walker
IceBrakr@ix.netcom.com


See the end of this section for history information, and new features!

Well folks, here it is, finally, the new version! This is the easiest way to
handle registration of your delphi applications. Or, at least, the easiest
for me. Oh, and legal stuff, this component is FreeWare, I make no
guarantees, or warranties of any kind, you use this at your own risk. And
I definately do not guarantee it is secure. I, and others, have tried to
hack using this, with no success...so It's probably "pretty good
protection"...nothing is perfect..

On to usage...

First, customize IceLock:

modify the following Constants:

UserPad
ProgPad
MasterKey (this is an array of values for masking the record, when
written to a file)

** The defaults will work just fine, but, if you use the defaults, anybody
with this component can create valid keys for your applications!!. **

In the Create method modify the variable initialization for:

fSeedVal1 { These can also be set at design time }
fSeedVal2
Seed { Set in the Create Method, because it's Private! }
And any others you may wish to modify...

This will make your copy of IceLock, ** much ** different from anybody
elses. If you are really worried about hackers, read further into the
source, there are plenty of notes for further obfuscating the keys/files.

Next, install this component in your component palette, it automatically
installs into the 'Samples' page. Now, to use it, drop on your main form,
modify the properties (most particularly IceString1 and IceString2..
possibly also the KeyFileName). And you are affectively done, for a
minimum install...call LoadKeyFile then either check the result of
LoadKeyFile, or check the IsRegistered variable to see if it's registered.

A better example of usage is in the IceReg application, included with
version 1.0. This application is a fully functional database, for
tracking users/applications and keys... Make sure that you re-build this
application, using the copy of IceLock that you have modified/installed
into delphi...otherwise, the keys created will be invalid!.

** The Most important thing to remember!! When you create keys for users, the
** fProgKey1 and fProgKey2 must be the same when you check the key!!! This
** is why I suggest modifying the above mentioned const/variables, and then
** specify unique IceStrings for each application, this is the easiest way to
** go...(unless you find an easier way...)

Last bit, have fun with this... All I ask is that you give credit where
it is due....and if you come up with cool enhancements, please send them to
me, so I can keep track of modifications, and re-release with a new version
number... If you find a hole, that you cannot plug, let me know, again, I
can probably plug it..and re-release.


History
-------

v1.0 - Initial release, with a few buggies. After receiving a lot of
questions and suggestions ....requests for feature, and a new version
of the source code from Jorge Cue (Thanks!), we are now at....

v2.0 - Fixed the bugs (I hope), fixed the source code to compile under
Delphi version 1, 2 AND 3!! Added the following files, so you do not
have to recompile the library everytime you switch from different versions
of Delphi. Note: There may still be a problem using it in Delphi1, if you
first install in 2/3, If you get Unit file format error, just erase
ICELOCK.DCU, and Delphi will rebuild it:

ilock16.pas : Delphi 1 component.
ilock32.pas : Delphi 2 component.
ilock332.pas : Delphi 3 component.

- All version will support the same key! (assuming your program is
using the same IceString1 and IceString2. Also, now the ProgramKeys
should calculate the same for all versions. NOTE: The key files are
transportable in both 32-bit versions, but the 32-bit keys will not
work in 16-bit (see below)
- Jorge Cue had added a HDSerialNumber to the registration record.
problem is, he had to use ASM to get the HD Serial. This works when
compiled using D1, but only under Win95 (or something like that). I
modified his GetHdSerialNumber to be a little more portable, if not
as secure under Win3.1. For 16-bit apps, I use GetWinFlags to get a
longint with information about the current version and operating mode
of windows. Under Win32 I use the Win32 API function GetVolumeInformation
to actually get the HD serial number. These procedures will require
a user to re-enter his/her Registered Name and Key if the environment/
HD serial number changes.
- The last change Jorge Cue implemented was, Licensetype. In the
code he sent me, he used an enumerated type, I changed it to a
boolean property "DemoLicense". This will be set to true when a user
enters a key you have generated with DemoLicense set to true. I also
added a TrialDays property, that lets you select the number of days
a trial license is good for. This way, when a user enters their key,
and it happens to be a demo key, the systems automatically generates
an expiration date, and includes it in the key. This requires that
you program not allow them to enter the key again! Of course,
users could just delete the key and start again...of course you
could modify the program to put the key somewhere strange (or even the
registry), and maybe mark it read-only/hidden....on and on...sorry, I'm
rambling.
- Now LoadKey will return ieExpired or ieNotSameHD if the license
is expired, or the environment/HDserial changes. See error constants
for the rest.
- New (cheezy...and much smaller) demo program. Very basic. For a more
detailed demo, get Icelock 1.0
- Oh, and last, but not least, the source code is not as heavily
commented as v1.0. Sorry, but I lack the ambition to comment it again
with all the changes.

Thanks again to Jorge Cue, and all the other folks who have given
me feedback on this (and in one case sent me a license to a spiffy
Delphi 1.0 expert!)

****************************************************************************)

unit IceLock;

interface

uses
Classes;

const
(** Error Constants **)
ieOkay = 0; { Everything Okay }
ieInvalidKey = 1; { Key is invalide }
ieFileError = 2; { Some file error occurred, check LastIoResult for }
{ error code }
ieNotSameHD = 3; {+++ This KeyFile was not make on this Hard Disk }
ieExpired = 4; {+++ Temporary License Has Expired }

(** Feel free to change these to mind fuck others, this allows an
added level of security against other programers who have this code **)
UserPad = #42;
ProgPad = #42;

{$I CRCTAB.INC } { The CRC Lookup Table.. You're best bet is to NOT MUCK }
{ WITH THIS!! If you do, it could affect the security }
{ of the keys.. }

type
{$IFDEF WIN32}
sstring = ShortString;
{$ELSE}
sstring = string;
{$ENDIF}

{ String for holding Keys }
KeyString = String[9];

{ String for holding Names }
NameString = String[50];


rIceRecord = record
Name : NameString;
Key : KeyString;
HDSerialNo : LongInt; {+++ New field to hold HD Serial Number }
DemoLicense : Boolean; {+++ Keep License Type As Required }
ExpirationDate: TDateTime; {+++ Date ltTemporary license is over }
end;

{ This is a Record and it's associated pointer, which is used to
"encrypt/decrypt" the IceRecord, before storage in a file...
Note that it will adjust to any changes made to rIceRecord.. }
aIceArray = Array[1..SizeOf(rIceRecord)] of Byte;
pIceArray = ^aIceArray;

{ Buffer for calculating CRC values }
CRCBuffType = ARRAY[0..70] OF BYTE;

(**************************************************************************)
(*** ***)
(*** Here it is!!! The tIceLock Component!! ***)
(*** ***)
(**************************************************************************)
tIceLock = class(TComponent)
private
(** The following fields are available for design time modification, via
the object inspector. Note that they are all read directly from the
variable, but written using the appropriate Set procedure **)

{ Ice1/Ice2, these two are character strings used to build the
corresponding ProgKeys, which identify the program that the key belongs
to. These allow you to create keys for specific application.
Note that these keys will be truncated to 70 characters. }
fIce1 : sstring;
fIce2 : sstring;

{ Created, based on Ice1/Ice2, also the user can override these values
via the object inspector or the corresponding Properties. This allows
ANOTHER level of security, in that you could define them anywhere in
your code, multiple times...etc... BUT!!! You must make sure that they
are the same when you generate keys for your registered users!!
Otherwise, you'll be giving them bogus keys!!!! }
fProgKey1 : LongInt;
fProgKey2 : LongInt;

{ Another level of security, these are the seed values, used to create
the ProgKeys, based on Ice, you can changes these also.. }
fSeedVal1 : LongInt;
fSeedVal2 : LongInt;

{ Kind of obvious, this hold the file name for your keys, again allows
different key names for different applications }
fKeyFileName : sstring;

(** The following Private fields/procedure, are really private!, ie: no
direct access at all *)
Seed : LongInt; { Set in Create }
UserName : NameString; { Set by LoadKeyFile, or PutKey }
UserKey : KeyString; { Set by LoadKeyFile, or PutKey }
fDemoLicense : Boolean; {+++ Set by LoadKeyFile }
fExpirationDate: TDateTime; {+++ Set by LoadKeyFile or SetExpirationDate }
fTrialDays : Integer; { Number of days for demo license }

{ Procedures used to set Private variables }
procedure SetIce1(s : sstring);
procedure SetIce2(s : sstring);
procedure SetProgKey1(l : LongInt);
procedure SetProgKey2(l : LongInt);
procedure SetSeedVal1(l : LongInt);
procedure SetSeedVal2(l : LongInt);
procedure SetKeyFileName(fn : sstring);

{ Procedures used internally only ! }
procedure EncryptRecord(p : Pointer);
function CalcCRCBuffer(CRC_Value: LONGINT;
cBuffer: CRCBuffType ): LONGINT;
function HexLongInt(L : LongInt) : KeyString;
procedure InitProgramKeys;
{+++ This function gets the Hard Disk Serial Number }
function GetHDSerialNumber: LongInt;
procedure SetExpirationDate(ed: TDateTime);

function GetExpirationDate: TDateTime;
{ End Private declarations }
protected
{ End Protected declarations }
public
LastIoResult : integer; { Holds the last ioresult from save/loadkeyfile }
IsRegistered : boolean; { nuff said }

{ Creates a key, based on ProgKey1/ProgKey2/Name, returns KeyString }
function BuildUserKey(Name : NameString; IsDemo : boolean) : KeyString;

{ Checks a Name/Key combination, returns boolean result }
Function CheckKey(n : NameString;k : KeyString) : boolean;

{ Get's the current value of UserName or UserKey }
function GetKey : KeyString;
function GetName : NameString;

{ PutKey attempts to put Name/key into Username/Userkey, returns
result ieOkay if successful, ieInvalidKey for invalid key,
If the key is invalid Username/Userkey are not change }
function PutKey(name : NameString; Key : KeyString) : integer;

{ These two functions save/load current key to the currently selected
fKeyFileName Property.. }
function SaveKeyFile : Integer;
function LoadKeyFile : Integer;


{ The obvious create/destroy thingies....}
constructor Create(AOwner: TComponent); override;
{ End Public declarations }
published
{ Note: IceString1, IceString2, IceSeed1, IceSeed2 Must be alphabetically
less that ProgramKey1 and ProgramKey2!! Delphi sets these values, from
information created at design time, in the Object Inspector, in Alpha Order.
....anytime you set any Ice value, the component re-initializes the
Program Keys....so if they came first (alpha-wise), any changes you
made during design time, would not stick!! This should keep things
properly synchronised..}

property IceString1 : sstring read fIce1 write SetIce1;
property IceString2 : sstring read fIce2 write SetIce2;
property IceSeed1 : LongInt read fSeedVal1 write SetSeedVal1;
property IceSeed2 : LongInt read fSeedVal2 write SetSeedVal2;
property ProgramKey1 : LongInt read fProgKey1 write SetProgKey1;
property ProgramKey2 : LongInt read fProgKey2 write SetProgKey2;
property KeyFile : sstring read fKeyFileName write SetKeyFileName;
property TrialDays : integer read fTrialDays write fTrialDays;
property DemoLicense : Boolean read fDemoLicense write fDemoLicense;
property ExpirationDate : tDateTime read GetExpirationDate write SetExpirationDate;
{ End Published declarations }
end;


implementation

uses
SysUtils, {+++ Date }
WinProcs; {+++ DOS3Call }



{==============================

>> procedure tIceLock.SetIce1(s : string);

> Description : Set's value for fIce1, then re-inits the
program keys based on the new value.
Truncates passed string to 70 Characters.

==============================}
procedure tIceLock.SetIce1(s : sstring);
begin
if length(s) < 71 then fIce1 := s
else fIce1 := copy(s,1,70);
InitProgramKeys;
end;

{==============================

>> procedure tIceLock.SetIce2(s : string);

> Description : See SetIce1

==============================}
procedure tIceLock.SetIce2(s : sstring);
begin
if length(s) < 71 then fIce2 := s
else fIce2 := copy(s,1,70);
InitProgramKeys;
end;

{==============================

>> procedure tIceLock.SetProgKey1(l : LongInt);

> Description : This allows the programmer to set an absolute
value for the Program keys. Note, if you
do this, you MUST make sure to create keys
using this ProgramKey..otherwise you'lL be
creating useless keys!!

Also, if you change either Ice or SeedVal's
(which call InitProgramKeys), your changes
will be erased! This may be usefull to
confound hackers...maybe set values a few
times, then change an IceString.... This
could be very frustrating, hacking the ASM
code...

==============================}
procedure tIceLock.SetProgKey1(l : LongInt);
begin
fProgKey1 := l;
end;


{==============================

>> procedure tIceLock.SetProgKey2(l : LongInt);

> Description : see SetProgKey1

==============================}
procedure tIceLock.SetProgKey2(l : LongInt);
begin
fProgKey2 := l;
end;

{==============================

>> procedure tIceLock.SetSeedVal1(l : LongInt);

> Description : This value is used to seed the CRC creation
process with a unique value.. Also re-inits
the ProgramKeys using the new value.

呵！好像看了一篇諜對諜的小說ㄝ！
question:
leozem = psac ??