WaterWall 5.01算法淺析

[psac]

WaterWall(5.01)是一個相當棒的桌面桌布系統管理工具,具有多種與眾不同的控制功能,
它集桌面桌布的幻燈播放,聲音,桌面覆載日曆和圖像素材下載伺服器於一身,並
可設定多個期限提醒功能及時獲取通告和設定關機計時器.文件本身並不大,但它
在桌面桌布效果方面的處理極其出色,配置體貼細緻,即使不使用任何桌布,依靠
桌面背景設定和日曆的版面和顏色調整也是變化無窮.當然如果你相下載的話可以
到http://www.pegtop.de/去下載,我的這個版本是已經漢化過了的!
好了,這個軟體由於是明碼比較所以我就不說了,我們只是來分析一下如何寫出自己的
註冊機.我們可以跟到如下地方:

004886E3 |. 6A 03 PUSH 3 ; /Arg3 = 00000003
004886E5 |. 6A 05 PUSH 5 ; |Arg2 = 00000005
004886E7 |. 6A 07 PUSH 7 ; |Arg1 = 00000007
004886E9 |. 8D55 DF LEA EDX,DWORD PTR SS:[EBP-21] ; |
004886EC |. B1 01 MOV CL,1 ; | 計算1
004886EE |. 8BC3 MOV EAX,EBX ; |
004886F0 |. E8 C7FEFFFF CALL WATERWAL.004885BC ; \WATERWAL.004885BC
004886F5 |. 8845 F0 MOV BYTE PTR SS:[EBP-10],AL
004886F8 |. 6A 04 PUSH 4 ; /Arg3 = 00000004
004886FA |. 6A 0A PUSH 0A ; |Arg2 = 0000000A
004886FC |. 6A 0C PUSH 0C ; |Arg1 = 0000000C
004886FE |. 8D55 DF LEA EDX,DWORD PTR SS:[EBP-21] ; |
00488701 |. B1 02 MOV CL,2 ; | 計算2
00488703 |. 8BC3 MOV EAX,EBX ; |
00488705 |. E8 B2FEFFFF CALL WATERWAL.004885BC ; \WATERWAL.004885BC
0048870A |. 8845 F1 MOV BYTE PTR SS:[EBP-F],AL
0048870D |. 6A 0B PUSH 0B ; /Arg3 = 0000000B
0048870F |. 6A 0D PUSH 0D ; |Arg2 = 0000000D
00488711 |. 6A 0F PUSH 0F ; |Arg1 = 0000000F
00488713 |. 8D55 DF LEA EDX,DWORD PTR SS:[EBP-21] ; |
00488716 |. B1 09 MOV CL,9 ; | 計算3
00488718 |. 8BC3 MOV EAX,EBX ; |
0048871A |. E8 9DFEFFFF CALL WATERWAL.004885BC ; \WATERWAL.004885BC
0048871F |. 8845 F2 MOV BYTE PTR SS:[EBP-E],AL
00488722 |. 6A 08 PUSH 8 ; /Arg3 = 00000008
00488724 |. 6A 0E PUSH 0E ; |Arg2 = 0000000E
00488726 |. 6A 10 PUSH 10 ; |Arg1 = 00000010
00488728 |. 8D55 DF LEA EDX,DWORD PTR SS:[EBP-21] ; |
0048872B |. B1 06 MOV CL,6 ; | 計算4
0048872D |. 8BC3 MOV EAX,EBX ; |
0048872F |. E8 88FEFFFF CALL WATERWAL.004885BC ; \WATERWAL.004885BC
00488734 |. 8845 F3 MOV BYTE PTR SS:[EBP-D],AL


00488737 |. 6A 10 PUSH 10 ; /Arg3 = 00000010
00488739 |. 6A 02 PUSH 2 ; |Arg2 = 00000002
0048873B |. 6A 0F PUSH 0F ; |Arg1 = 0000000F
0048873D |. 8D55 DF LEA EDX,DWORD PTR SS:[EBP-21] ; |
00488740 |. B1 01 MOV CL,1 ; | 計算5
00488742 |. 8BC3 MOV EAX,EBX ; |
00488744 |. E8 73FEFFFF CALL WATERWAL.004885BC ; \WATERWAL.004885BC;這個作為例子跟入
00488749 |. 8845 F4 MOV BYTE PTR SS:[EBP-C],AL
0048874C |. 6A 0E PUSH 0E ; /Arg3 = 0000000E
0048874E |. 6A 04 PUSH 4 ; |Arg2 = 00000004
00488750 |. 6A 0D PUSH 0D ; |Arg1 = 0000000D
00488752 |. 8D55 DF LEA EDX,DWORD PTR SS:[EBP-21] ; |
00488755 |. B1 03 MOV CL,3 ; | 計算6
00488757 |. 8BC3 MOV EAX,EBX ; |
00488759 |. E8 5EFEFFFF CALL WATERWAL.004885BC ; \WATERWAL.004885BC
0048875E |. 8845 F5 MOV BYTE PTR SS:[EBP-B],AL
00488761 |. 6A 0C PUSH 0C ; /Arg3 = 0000000C
00488763 |. 6A 06 PUSH 6 ; |Arg2 = 00000006
00488765 |. 6A 0B PUSH 0B ; |Arg1 = 0000000B
00488767 |. 8D55 DF LEA EDX,DWORD PTR SS:[EBP-21] ; |
0048876A |. B1 05 MOV CL,5 ; | 計算7
0048876C |. 8BC3 MOV EAX,EBX ; |
0048876E |. E8 49FEFFFF CALL WATERWAL.004885BC ; \WATERWAL.004885BC
00488773 |. 8845 F6 MOV BYTE PTR SS:[EBP-A],AL
00488776 |. 6A 0A PUSH 0A ; /Arg3 = 0000000A
00488778 |. 6A 08 PUSH 8 ; |Arg2 = 00000008
0048877A |. 6A 09 PUSH 9 ; |Arg1 = 00000009
0048877C |. 8D55 DF LEA EDX,DWORD PTR SS:[EBP-21] ; |
0048877F |. B1 07 MOV CL,7 ; | 計算8
00488781 |. 8BC3 MOV EAX,EBX ; |
00488783 |. E8 34FEFFFF CALL WATERWAL.004885BC ; \WATERWAL.004885BC
00488788 |. 8845 F7 MOV BYTE PTR SS:[EBP-9],AL
0048878B |. BB 08000000 MOV EBX,8
00488790 |. 8D4D F0 LEA ECX,DWORD PTR SS:[EBP-10]
00488793 |> 33C0 /XOR EAX,EAX
00488795 |. 8A01 |MOV AL,BYTE PTR DS:[ECX]
00488797 |. BF 0A000000 |MOV EDI,0A
0048879C |. 99 |CDQ
0048879D |. F7FF |IDIV EDI
0048879F |. 83C2 30 |ADD EDX,30
004887A2 |. 8811 |MOV BYTE PTR DS:[ECX],DL
004887A4 |. 41 |INC ECX
004887A5 |. 4B |DEC EBX
004887A6 |.^75 EB \JNZ SHORT WATERWAL.00488793 ;該循環是通過上面的8個字串來取數



我們在上面488744(計算5後的CaLL)處跟入:
004885BC /$ 55 PUSH EBP
004885BD |. 8BEC MOV EBP,ESP
004885BF |. 83C4 F8 ADD ESP,-8
004885C2 |. 884D FB MOV BYTE PTR SS:[EBP-5],CL ;把cl=1儲存
004885C5 |. 8955 FC MOV DWORD PTR SS:[EBP-4],EDX
004885C8 |. 8D55 FA LEA EDX,DWORD PTR SS:[EBP-6]
004885CB |. 8B7D FC MOV EDI,DWORD PTR SS:[EBP-4]
004885CE |. 31DB XOR EBX,EBX
004885D0 |. 8A5D FB MOV BL,BYTE PTR SS:[EBP-5] ;bl=1
004885D3 |. 8A041F MOV AL,BYTE PTR DS:[EDI+EBX] ;取一個字串
004885D6 |. 8A5D 10 MOV BL,BYTE PTR SS:[EBP+10] ;取參數Arg3,即10H
004885D9 |. 32041F XOR AL,BYTE PTR DS:[EDI+EBX] ;取數進行xor
004885DC |. 8A5D 0C MOV BL,BYTE PTR SS:[EBP+C] ;取Arg2,即2
004885DF |. 8A0C1F MOV CL,BYTE PTR DS:[EDI+EBX] ;取數送給cl
004885E2 |. D2C0 ROL AL,CL ;
004885E4 |. 8A5D 08 MOV BL,BYTE PTR SS:[EBP+8] ;取Arg1,即0FH
004885E7 |. 32041F XOR AL,BYTE PTR DS:[EDI+EBX]
004885EA |. 8845 FA MOV BYTE PTR SS:[EBP-6],AL
004885ED |. 8A02 MOV AL,BYTE PTR DS:[EDX] ;AL即最後的運算結果,出來後儲存進字母表
004885EF |. 59 POP ECX
004885F0 |. 59 POP ECX
004885F1 |. 5D POP EBP
004885F2 \. C2 0C00 RETN 0C

我想大家應該看懂了吧,它是判斷註冊名是否大於4個,如果是的話則湊足8個,
然後PWW24JAN和8個大寫的字串相連接,然後使用CALL WATERWAL.004885BC算出8
個數字用於在後面算出註冊碼.註冊成功後在註冊表位置:
HKEY_LOCAL_MACHINE\Software\Pegtop\WaterWall\RegName寫入信息.
由於篇幅的關係,下面給出註冊機的關鍵部分:

Generate proc hWnd
local TempName[120]:byte
local MiMa[50]:byte
pushad
lea edi,KeyName
invoke lstrlen, addr KeyName
mov nLen,9
cmp eax,4
jl @1
cmp eax,7
jg @2 ;大於8個就跳
sub nLen,eax
invoke lstrcpyn,addr TempName,addr KeyName,nLen ;複製字串以補足8個
invoke lstrcat,addr KeyName,addr TempName ;連接起來,補足8個了吧
invoke lstrcpy,addr RealKeyName,addr KeyName ;複製到RealKeyName裡
jmp @3
@2: invoke lstrcpyn,addr RealKeyName,addr KeyName,nLen ;只複製前8個字串
@3: invoke strupr ;把小寫字母轉換成大寫字母,MASM32里面沒有所以要自己寫
invoke lstrcpy,addr KKeyName,addr Sepe ;Copy "PWW24JAN"
invoke lstrcat,addr KKeyName,addr RealKeyName ;
mov ecx,0
lea esi,MiMa
invoke GetOneChar,7H,5H,3H,1H ;使用CALL WATERWAL.004885BC,算出數字
mov [esi+ecx],al ;al為出口參數,儲存到MiMa裡面
inc ecx
invoke GetOneChar,0CH,0AH,4H,2H
mov [esi+ecx],al
inc ecx
invoke GetOneChar,0FH,0DH,0BH,9H
mov [esi+ecx],al
inc ecx
invoke GetOneChar,10H,0EH,8H,6H
mov [esi+ecx],al
inc ecx
invoke GetOneChar,0FH,2H,10H,1H
mov [esi+ecx],al
inc ecx
invoke GetOneChar,0DH,4H,0EH,3H
mov [esi+ecx],al
inc ecx
invoke GetOneChar,0BH,6H,0CH,5H
mov [esi+ecx],al
inc ecx
invoke GetOneChar,9H,8H,0AH,7H
mov [esi+ecx],al
lea esi,GoogBoy ;用於存放真正的註冊碼
mov ebx,8 ;註冊碼規定了是8位
lea ecx,MiMa
@4: xor eax,eax
mov al,[ecx]
mov edi,0AH
cdq
idiv edi
add edx,30H
mov [esi],dl
inc ecx
inc esi
dec ebx
jnz @4
invoke SetDlgItemText,hWnd,REGKEY,addr GoogBoy
jmp @5
@1: invoke SetDlgItemText,hWnd,REGKEY,addr Error
@5:
popad
ret
Generate endp

下面是GetOneChar的部分:
;依次傳遞參數Arg1,Arg2,Arg3,而Arg4則是傳入的CL的值,可以看上面的反彙編程式碼

GetOneChar proc Arg1,Arg2,Arg3,Arg4
push ebx
push ecx
push edi
xor eax,eax
xor ebx,ebx
xor ecx,ecx
mov bl,byte ptr Arg4
mov edi,offset KKeyName
mov al,[edi+ebx-1]
mov bl,byte ptr Arg3
xor al,[edi+ebx-1]
mov bl,byte ptr Arg2
mov cl,[edi+ebx-1]
rol al,cl
mov bl,byte ptr Arg1
xor al,[edi+ebx-1] ;al作為出口參數
pop edi
pop ecx
pop ebx
ret
GetOneChar endp



下面給出一組註冊碼:
Name:dengkeng[DFCG]
Key :95097319





Made By dengkeng[DFCG][YCG]
E-mail:shellc0de@sohu.com
歡迎轉載,請保持文章的完整性