一次苦中作乐的追码过程（上）

【作者主页】: http://hi.baidu.com/beyond0769
【软件名称】: 1 Privacy Eraser 2.5
【下载地址】: http://www.onlinedown.net/soft/51674.htm

 

参考文章作者：BeyondMe

原文地址：http://blog.sina.com.cn/s/blog_88d6921f0102vrea.html

 

今天我们要研究的算法软件是Borland Delphi 6.0 - 7.0 写的，不用我多说了可以下按钮事件，或者直接搜索字符串都可以定位到关键地方。

004FAA48 /. 55 push ebp ; 按钮事件

004FAA49 |. 8BEC mov ebp,esp

004FAA4B |. 6A 00 push 0x0

004FAA4D |. 6A 00 push 0x0

004FAA4F |. 6A 00 push 0x0

004FAA51 |. 53 push ebx

004FAA52 |. 8BD8 mov ebx,eax

004FAA54 |. 33C0 xor eax,eax

004FAA56 |. 55 push ebp

004FAA57 |. 68 0DAB4F00 push PrivacyE.004FAB0D

004FAA5C |. 64:FF30 push dword ptr fs:[eax]

004FAA5F |. 64:8920 mov dword ptr fs:[eax],esp

004FAA62 |. 8D55 FC lea edx,[local.1]

004FAA65 |. 8B83 74040000 mov eax,dword ptr ds:[ebx+0x474] ; PrivacyE.0047D9F0

004FAA6B |. E8 BCB3F6FF call PrivacyE.00465E2C

004FAA70 |. 8B45 FC mov eax,[local.1] ; 假码长度

004FAA73 |. 50 push eax

004FAA74 |. 6A 00 push 0x0

004FAA76 |. 8D55 F8 lea edx,[local.2]

004FAA79 |. 8B83 70040000 mov eax,dword ptr ds:[ebx+0x470] ; 假码

004FAA7F |. E8 A8B3F6FF call PrivacyE.00465E2C ; 获取机器码长度

004FAA84 |. 8B55 F8 mov edx,[local.2] ; 机器码 2152332188

004FAA87 |. 33C9 xor ecx,ecx

004FAA89 |. 8B83 DC030000 mov eax,dword ptr ds:[ebx+0x3DC]

004FAA8F |. E8 E05DFFFF call PrivacyE.004F0874 ; 关键call

004FAA94 |. 3C 01 cmp al,0x1

004FAA96 |. 75 48 jnz short PrivacyE.004FAAE0

004FAA98 |. B8 24AB4F00 mov eax,PrivacyE.004FAB24 ; Successfully Registered. Please restart the application in order to changes to take effect.

004FAA9D |. E8 D696F3FF call PrivacyE.00434178

004FAAA2 |. 6A 01 push 0x1

004FAAA4 |. 6A 00 push 0x0

004FAAA6 |. 6A 00 push 0x0

004FAAA8 |. 8D55 F4 lea edx,[local.3]

004FAAAB |. A1 98245000 mov eax,dword ptr ds:[0x502498]

004FAAB0 |. 8B00 mov eax,dword ptr ds:[eax] ; PrivacyE.004F800C

004FAAB2 |. E8 61CFF8FF call PrivacyE.00487A18

004FAAB7 |. 8B45 F4 mov eax,[local.3]

004FAABA |. E8 65A1F0FF call PrivacyE.00404C24

004FAABF |. 50 push eax

004FAAC0 |. 68 80AB4F00 push PrivacyE.004FAB80 ; open

004FAAC5 |. 8BC3 mov eax,ebx

004FAAC7 |. E8 5C1CF7FF call PrivacyE.0046C728

004FAACC |. 50 push eax ; |hWnd = 014D3A14

004FAACD |. E8 2A72F3FF call <jmp.&shell32.ShellExecuteA> ; \ShellExecuteA

004FAAD2 |. A1 98245000 mov eax,dword ptr ds:[0x502498]

004FAAD7 |. 8B00 mov eax,dword ptr ds:[eax] ; PrivacyE.004F800C

004FAAD9 |. E8 66C9F8FF call PrivacyE.00487444

004FAADE |. EB 0A jmp short PrivacyE.004FAAEA

004FAAE0 |> B8 90AB4F00 mov eax,PrivacyE.004FAB90 ; Incorrect Registration Code!

004FAAE5 |. E8 8E96F3FF call PrivacyE.00434178

004FAAEA |> 33C0 xor eax,eax

004FAAEC |. 5A pop edx ; PrivacyE.004673D2

004FAAED |. 59 pop ecx ; PrivacyE.004673D2

004FAAEE |. 59 pop ecx ; PrivacyE.004673D2

004FAAEF |. 64:8910 mov dword ptr fs:[eax],edx

004FAAF2 |. 68 14AB4F00 push PrivacyE.004FAB14

004FAAF7 |> 8D45 F4 lea eax,[local.3]

004FAAFA |. E8 659CF0FF call PrivacyE.00404764

004FAAFF |. 8D45 F8 lea eax,[local.2]

004FAB02 |. BA 02000000 mov edx,0x2

004FAB07 |. E8 7C9CF0FF call PrivacyE.00404788

004FAB0C \. C3 retn

 

进入004FAA8F |. E8 E05DFFFF call PrivacyE.004F0874 ; 关键call

 

 

004F0874 $ 55 push ebp 关键call

004F0875 . 8BEC mov ebp,esp

004F0877 . 83C4 BC add esp,-0x44

004F087A . 53 push ebx

004F087B . 56 push esi ; PrivacyE.0045CF44

004F087C . 57 push edi

004F087D . 33DB xor ebx,ebx

004F087F . 895D BC mov dword ptr ss:[ebp-0x44],ebx 数据清0

004F0882 . 895D C0 mov dword ptr ss:[ebp-0x40],ebx

004F0885 . 895D C4 mov dword ptr ss:[ebp-0x3C],ebx

004F0888 . 895D C8 mov dword ptr ss:[ebp-0x38],ebx

004F088B . 895D DC mov dword ptr ss:[ebp-0x24],ebx

004F088E . 895D F0 mov dword ptr ss:[ebp-0x10],ebx

004F0891 . 895D EC mov dword ptr ss:[ebp-0x14],ebx

004F0894 . 895D E8 mov dword ptr ss:[ebp-0x18],ebx

004F0897 . 894D F8 mov dword ptr ss:[ebp-0x8],ecx

004F089A . 8955 FC mov dword ptr ss:[ebp-0x4],edx ; 2152332188

004F089D . 8BD8 mov ebx,eax

004F089F . 8B45 FC mov eax,dword ptr ss:[ebp-0x4]

004F08A2 . E8 6D43F1FF call PrivacyE.00404C14

004F08A7 . 8B45 F8 mov eax,dword ptr ss:[ebp-0x8] ; 2152332188

004F08AA . E8 6543F1FF call PrivacyE.00404C14

004F08AF . 8B45 0C mov eax,dword ptr ss:[ebp+0xC] ; 假码

004F08B2 . E8 5D43F1FF call PrivacyE.00404C14

004F08B7 . 8B45 08 mov eax,dword ptr ss:[ebp+0x8] ; 00000

004F08BA . E8 5543F1FF call PrivacyE.00404C14

004F08BF . 33C0 xor eax,eax

004F08C1 . 55 push ebp

004F08C2 . 68 AC0B4F00 push PrivacyE.004F0BAC

004F08C7 . 64:FF30 push dword ptr fs:[eax]

004F08CA . 64:8920 mov dword ptr fs:[eax],esp

004F08CD > E8 5668F1FF call <jmp.&kernel32.GetTickCount> ; [GetTickCount

004F08D2 . 8BF0 mov esi,eax

004F08D4 . 68 D0070000 push 0x7D0 ; /Timeout = 2000. ms

004F08D9 . E8 A6E4F1FF call <jmp.&kernel32.Sleep> ; \延迟

004F08DE . 8B43 54 mov eax,dword ptr ds:[ebx+0x54]

004F08E1 . 8078 04 00 cmp byte ptr ds:[eax+0x4],0x0

004F08E5 . 74 0A je short PrivacyE.004F08F1

004F08E7 . 8D55 FC lea edx,dword ptr ss:[ebp-0x4]

004F08EA . 8BC3 mov eax,ebx

004F08EC . E8 A7F9FFFF call PrivacyE.004F0298

004F08F1 > E8 3268F1FF call <jmp.&kernel32.GetTickCount> ; [GetTickCount

004F08F6 . 81C6 CF070000 add esi,0x7CF

004F08FC . 3BC6 cmp eax,esi ; PrivacyE.0045CF44

004F08FE .^ 72 CD jb short PrivacyE.004F08CD

004F0900 . 8B45 FC mov eax,dword ptr ss:[ebp-0x4] ; 2152332188

004F0903 . E8 1C41F1FF call PrivacyE.00404A24 ; 获取机器码长度

004F0908 . 3B43 58 cmp eax,dword ptr ds:[ebx+0x58] ; 长度和32对比

004F090B . 7F 19 jg short PrivacyE.004F0926

004F090D . 8B45 FC mov eax,dword ptr ss:[ebp-0x4] ; 2152332188

004F0910 . E8 0F41F1FF call PrivacyE.00404A24 ; 获取机器码长度

004F0915 . 3B43 5C cmp eax,dword ptr ds:[ebx+0x5C] ; 和5对比

004F0918 . 7C 0C jl short PrivacyE.004F0926

004F091A . 8B45 0C mov eax,dword ptr ss:[ebp+0xC] ; 假码

004F091D . E8 0241F1FF call PrivacyE.00404A24 ; 假码长度

004F0922 . 85C0 test eax,eax

004F0924 . 75 09 jnz short PrivacyE.004F092F

004F0926 > C645 F7 00 mov byte ptr ss:[ebp-0x9],0x0

004F092A . E9 33020000 jmp PrivacyE.004F0B62

004F092F > 8D55 DC lea edx,dword ptr ss:[ebp-0x24]

004F0932 . 8B45 0C mov eax,dword ptr ss:[ebp+0xC] ; 假码

004F0935 . E8 6A85F1FF call PrivacyE.00408EA4

004F093A . 8B55 DC mov edx,dword ptr ss:[ebp-0x24] ; 假码

004F093D . 8D45 0C lea eax,dword ptr ss:[ebp+0xC]

004F0940 . E8 B73EF1FF call PrivacyE.004047FC

004F0945 . C645 F7 00 mov byte ptr ss:[ebp-0x9],0x0

004F0949 . B1 01 mov cl,0x1

004F094B . 8B55 0C mov edx,dword ptr ss:[ebp+0xC] ; 假码

004F094E . 8BC3 mov eax,ebx

004F0950 . E8 03FBFFFF call PrivacyE.004F0458

004F0955 . 84C0 test al,al

004F0957 . 0F85 05020000 jnz PrivacyE.004F0B62

004F095D . 33C9 xor ecx,ecx

004F095F . 55 push ebp

004F0960 . 68 E80A4F00 push PrivacyE.004F0AE8

004F0965 . 64:FF31 push dword ptr fs:[ecx]

004F0968 . 64:8921 mov dword ptr fs:[ecx],esp

004F096B . 8D45 F0 lea eax,dword ptr ss:[ebp-0x10]

004F096E . 8B55 0C mov edx,dword ptr ss:[ebp+0xC] ; 假码

004F0971 . 8A52 01 mov dl,byte ptr ds:[edx+0x1] ; 假码的第二位

004F0974 . E8 D33FF1FF call PrivacyE.0040494C

004F0979 . 8D45 D8 lea eax,dword ptr ss:[ebp-0x28]

004F097C . 8B55 0C mov edx,dword ptr ss:[ebp+0xC] ; 假码

004F097F . 8A52 09 mov dl,byte ptr ds:[edx+0x9] ; 指向假码的第10位

004F0982 . 8850 01 mov byte ptr ds:[eax+0x1],dl

004F0985 . C600 01 mov byte ptr ds:[eax],0x1

004F0988 . 8D55 D8 lea edx,dword ptr ss:[ebp-0x28]

004F098B . 8D45 D4 lea eax,dword ptr ss:[ebp-0x2C]

004F098E . E8 7927F1FF call PrivacyE.0040310C

004F0993 . 8D45 D0 lea eax,dword ptr ss:[ebp-0x30]

004F0996 . 8B55 0C mov edx,dword ptr ss:[ebp+0xC] ; 假码

004F0999 . 8A52 07 mov dl,byte ptr ds:[edx+0x7] ; 指向假码的第8位

004F099C . 8850 01 mov byte ptr ds:[eax+0x1],dl

004F099F . C600 01 mov byte ptr ds:[eax],0x1

004F09A2 . 8D55 D0 lea edx,dword ptr ss:[ebp-0x30]

004F09A5 . 8D45 D4 lea eax,dword ptr ss:[ebp-0x2C]

004F09A8 . B1 02 mov cl,0x2

004F09AA . E8 2D27F1FF call PrivacyE.004030DC

004F09AF . 8D55 D4 lea edx,dword ptr ss:[ebp-0x2C] ; 合并10位和8位字符串

004F09B2 . 8D45 EC lea eax,dword ptr ss:[ebp-0x14]

004F09B5 . E8 0E40F1FF call PrivacyE.004049C8

004F09BA . 8D45 D8 lea eax,dword ptr ss:[ebp-0x28]

004F09BD . 8B55 0C mov edx,dword ptr ss:[ebp+0xC] ; PrivacyE.0045CF65

004F09C0 . 8A52 03 mov dl,byte ptr ds:[edx+0x3] ; 指向假码的第4位

004F09C3 . 8850 01 mov byte ptr ds:[eax+0x1],dl

004F09C6 . C600 01 mov byte ptr ds:[eax],0x1

004F09C9 . 8D55 D8 lea edx,dword ptr ss:[ebp-0x28]

004F09CC . 8D45 D4 lea eax,dword ptr ss:[ebp-0x2C]

004F09CF . E8 3827F1FF call PrivacyE.0040310C

004F09D4 . 8D45 D0 lea eax,dword ptr ss:[ebp-0x30]

004F09D7 . 8B55 0C mov edx,dword ptr ss:[ebp+0xC] ; PrivacyE.0045CF65

004F09DA . 8A52 05 mov dl,byte ptr ds:[edx+0x5] ; 指向假码的第6位

004F09DD . 8850 01 mov byte ptr ds:[eax+0x1],dl

004F09E0 . C600 01 mov byte ptr ds:[eax],0x1

004F09E3 . 8D55 D0 lea edx,dword ptr ss:[ebp-0x30]

004F09E6 . 8D45 D4 lea eax,dword ptr ss:[ebp-0x2C]

004F09E9 . B1 02 mov cl,0x2

004F09EB . E8 EC26F1FF call PrivacyE.004030DC ; 合并 4 6

004F09F0 . 8D55 D4 lea edx,dword ptr ss:[ebp-0x2C]

004F09F3 . 8D45 CC lea eax,dword ptr ss:[ebp-0x34]

004F09F6 . E8 1127F1FF call PrivacyE.0040310C

004F09FB . 8D45 D0 lea eax,dword ptr ss:[ebp-0x30]

004F09FE . 8B55 0C mov edx,dword ptr ss:[ebp+0xC] ; PrivacyE.0045CF65

004F0A01 . 8A52 0B mov dl,byte ptr ds:[edx+0xB] ; 指向假码的第12位

004F0A04 . 8850 01 mov byte ptr ds:[eax+0x1],dl

004F0A07 . C600 01 mov byte ptr ds:[eax],0x1

004F0A0A . 8D55 D0 lea edx,dword ptr ss:[ebp-0x30]

004F0A0D . 8D45 CC lea eax,dword ptr ss:[ebp-0x34]

004F0A10 . B1 03 mov cl,0x3

004F0A12 . E8 C526F1FF call PrivacyE.004030DC

004F0A17 . 8D55 CC lea edx,dword ptr ss:[ebp-0x34] ; 4 6 12位合并

004F0A1A . 8D45 E8 lea eax,dword ptr ss:[ebp-0x18]

004F0A1D . E8 A63FF1FF call PrivacyE.004049C8 ; 03 34 36 43 01 43 46 00 02 34 36 00 01 34 00 00

004F0A22 . 8D45 C8 lea eax,dword ptr ss:[ebp-0x38] ; 上面所有合并的字符 全部有序写到内存

004F0A25 . 8B4D F0 mov ecx,dword ptr ss:[ebp-0x10] ; 假码第二位

004F0A28 . BA C80B4F00 mov edx,PrivacyE.004F0BC8 ; $

004F0A2D . E8 3E40F1FF call PrivacyE.00404A70

004F0A32 . 8B45 C8 mov eax,dword ptr ss:[ebp-0x38] ; 假码第二位加上特定字符 $2 记为X1

004F0A35 . BA FFFF0000 mov edx,0xFFFF

004F0A3A . E8 358BF1FF call PrivacyE.00409574

004F0A3F . 8BF0 mov esi,eax ; 2 转换为16进制的02

004F0A41 . 8D45 C4 lea eax,dword ptr ss:[ebp-0x3C]

004F0A44 . 8B4D EC mov ecx,dword ptr ss:[ebp-0x14] ; A8

004F0A47 . BA C80B4F00 mov edx,PrivacyE.004F0BC8 ; $

004F0A4C . E8 1F40F1FF call PrivacyE.00404A70

004F0A51 . 8B45 C4 mov eax,dword ptr ss:[ebp-0x3C] ; $A8 记为X2

004F0A54 . BA FFFF0000 mov edx,0xFFFF

004F0A59 . E8 168BF1FF call PrivacyE.00409574

004F0A5E . 8BF8 mov edi,eax ; A8 转换为16进制的00000A8

004F0A60 . 8D45 C0 lea eax,dword ptr ss:[ebp-0x40]

004F0A63 . 8B4D E8 mov ecx,dword ptr ss:[ebp-0x18] ; 46C

004F0A66 . BA C80B4F00 mov edx,PrivacyE.004F0BC8 ; $

004F0A6B . E8 0040F1FF call PrivacyE.00404A70

004F0A70 . 8B45 C0 mov eax,dword ptr ss:[ebp-0x40] ; $46C 记为X3

004F0A73 . BA FFFF0000 mov edx,0xFFFF

004F0A78 . E8 F78AF1FF call PrivacyE.00409574

004F0A7D . 8BD7 mov edx,edi ; 46C 转换16进制46c

004F0A7F . 0BD6 or edx,esi ; edx=A8 esi=2

004F0A81 . 0BD0 or edx,eax

004F0A83 . 81FA FFFF0000 cmp edx,0xFFFF

004F0A89 . 75 0F jnz short PrivacyE.004F0A9A 关键判断1 这一定要跳走

004F0A8B . 64:8F05 00000>pop dword ptr fs:[0] ; PrivacyE.004FAA94

004F0A92 . 83C4 08 add esp,0x8

004F0A95 . E9 C8000000 jmp PrivacyE.004F0B62

004F0A9A > \8BD6 mov edx,esi edx=2

004F0A9C . 66:83F2 07 xor dx,0x7 xor X1,0x7

004F0AA0 . 8BF7 mov esi,edi

004F0AA2 . 66:81F6 B700 xor si,0xB7

004F0AA7 . 66:35 B705 xor ax,0x5B7

004F0AAB . 8BCE mov ecx,esi

 

 

小结：

当假码[1]（123456789ABCDEFG）时:
小结:
1. 取假码第2位转换成十六进制数值, 记为 X1. [这里是 2,]
2. 取假码第8和第10位转换成十六进制数值, 记为 X2. [这里是 A8,]
3. 取假码第4,第6和第12位转换成十六进制数值, 记为 X3. [这里是 $46C]
4. X1 or X2 or X3 不能等于 0xFFFF
5. DX = X1 xor 7 =5 [月份]=month
SI = X2 xor $B7 = 0x1F(31) [日期] =day

AX = X3 xor $5B7 = 0x1DB (475)[年份] =year

 

004F0AAD . E8 46AAF1FF call PrivacyE.0040B4F8 ; 关键算法:进行日期格式检测及日期计算,F7进入

 

 

0040B4F8 /$ 53 push ebx

0040B4F9 |. 56 push esi

0040B4FA |. 57 push edi

0040B4FB |. 83C4 F8 add esp,-0x8

0040B4FE |. 8BF9 mov edi,ecx

0040B500 |. 8BF2 mov esi,edx

0040B502 |. 8BD8 mov ebx,eax

0040B504 |. 54 push esp

0040B505 |. 8BCF mov ecx,edi

0040B507 |. 8BD6 mov edx,esi

0040B509 |. 8BC3 mov eax,ebx

0040B50B |. E8 18FFFFFF call PrivacyE.0040B428 关键call

0040B510 |. 84C0 test al,al

0040B512 |. 75 0A jnz short PrivacyE.0040B51E 这个一定要实现跳转

0040B514 |. A1 D4245000 mov eax,dword ptr ds:[0x5024D4] ; h6P

0040B519 |. E8 B6D8FFFF call PrivacyE.00408DD4 ; 抛出异常

0040B51E |> DD0424 fld qword ptr ss:[esp]

0040B521 |. 59 pop ecx ; PrivacyE.004F0AB2

0040B522 |. 5A pop edx ; PrivacyE.004F0AB2

0040B523 |. 5F pop edi ; PrivacyE.004F0AB2

0040B524 |. 5E pop esi ; PrivacyE.004F0AB2

0040B525 |. 5B pop ebx ; PrivacyE.004F0AB2

0040B526 \. C3 retn

 

F7进入 0040B50B |. E8 18FFFFFF call PrivacyE.0040B428 关键call

 

0040B428 /$ 55 push ebp

0040B429 |. 8BEC mov ebp,esp

0040B42B |. 83C4 F4 add esp,-0xC

0040B42E |. 53 push ebx

0040B42F |. 56 push esi

0040B430 |. 57 push edi

0040B431 |. 8BD9 mov ebx,ecx

0040B433 |. 8BFA mov edi,edx

0040B435 |. 8BF0 mov esi,eax

0040B437 |. C645 FF 00 mov byte ptr ss:[ebp-0x1],0x0

0040B43B |. 8BC6 mov eax,esi

0040B43D |. E8 AAFFFFFF call PrivacyE.0040B3EC

0040B442 |. 83E0 7F and eax,0x7F

0040B445 |. 8D0440 lea eax,dword ptr ds:[eax+eax*2]

0040B448 |. 8D04C5 E00050>lea eax,dword ptr ds:[eax*8+0x5000E0] ; _x001D_

0040B44F |. 8945 F8 mov [local.2],eax

0040B452 |. 66:83FE 01 cmp si,0x1 对比year==1

0040B456 |. 0F82 8E000000 jb PrivacyE.0040B4EA 低于跳转

0040B45C |. 66:81FE 0F27 cmp si,0x270F ; 年份必须是1-9999

0040B461 |. 0F87 83000000 ja PrivacyE.0040B4EA 高于跳转

0040B467 |. 66:83FF 01 cmp di,0x1 month==1

0040B46B |. 72 7D jb short PrivacyE.0040B4EA

0040B46D |. 66:83FF 0C cmp di,0xC ; 月份1-12

0040B471 |. 77 77 ja short PrivacyE.0040B4EA

0040B473 |. 66:83FB 01 cmp bx,0x1 day==1

0040B477 |. 72 71 jb short PrivacyE.0040B4EA

0040B479 |. 0FB7C7 movzx eax,di

0040B47C |. 8B55 F8 mov edx,[local.2]

0040B47F |. 66:3B5C42 FE cmp bx,word ptr ds:[edx+eax*2-0x2] ; 日期1-31

0040B484 |. 77 64 ja short PrivacyE.0040B4EA

0040B486 |. 0FB7C7 movzx eax,di

0040B489 |. 48 dec eax

0040B48A |. 85C0 test eax,eax

0040B48C |. 7E 11 jle short PrivacyE.0040B49F

0040B48E |. B9 01000000 mov ecx,0x1

0040B493 |> 8B55 F8 /mov edx,[local.2]

0040B496 |. 66:035C4A FE |add bx,word ptr ds:[edx+ecx*2-0x2] ; 结果保存在BX

0040B49B |. 41 |inc ecx

0040B49C |. 48 |dec eax

0040B49D |.^ 75 F4 \jnz short PrivacyE.0040B493 ; 循环计算该日期总共的天数 ebx=97 10进制151

0040B49F |> \0FB7CE movzx ecx,si

0040B4A2 |. 49 dec ecx ; 年份-1

0040B4A3 |. 8BC1 mov eax,ecx

0040B4A5 |. BE 64000000 mov esi,0x64 ; 100

0040B4AA |. 99 cdq

0040B4AB |. F7FE idiv esi

0040B4AD |. 69F1 6D010000 imul esi,ecx,0x16D ; 365*474（年数）

0040B4B3 |. 8BD1 mov edx,ecx ; 结果=173010

0040B4B5 |. 85D2 test edx,edx

0040B4B7 |. 79 03 jns short PrivacyE.0040B4BC

0040B4B9 |. 83C2 03 add edx,0x3

0040B4BC |> C1FA 02 sar edx,0x2

0040B4BF |. 03F2 add esi,edx

0040B4C1 |. 2BF0 sub esi,eax

0040B4C3 |. 8BC1 mov eax,ecx

0040B4C5 |. B9 90010000 mov ecx,0x190 ; 400

0040B4CA |. 99 cdq

0040B4CB |. F7F9 idiv ecx ; 年数 mod 400

0040B4CD |. 03F0 add esi,eax

0040B4CF |. 0FB7C3 movzx eax,bx

0040B4D2 |. 03F0 add esi,eax ; esi=当前系统年份 esi=736151 736151/365=2016

0040B4D4 |. 81EE 5A950A00 sub esi,0xA955A ; 1900年的总天数 - 2016的总天数

0040B4DA |. 8975 F4 mov [local.3],esi

0040B4DD |. DB45 F4 fild [local.3] ; 把结果浮点

0040B4E0 |. 8B45 08 mov eax,[arg.1]

0040B4E3 |. DD18 fstp qword ptr ds:[eax]

0040B4E5 |. 9B wait

0040B4E6 |. C645 FF 01 mov byte ptr ss:[ebp-0x1],0x1

0040B4EA |> 8A45 FF mov al,byte ptr ss:[ebp-0x1]

0040B4ED |. 5F pop edi

0040B4EE |. 5E pop esi

0040B4EF |. 5B pop ebx

0040B4F0 |. 8BE5 mov esp,ebp

0040B4F2 |. 5D pop ebp

0040B4F3 \. C2 0400 retn 0x4

 

小结：

1. 取假码第2位转换成十六进制数值, 记为 X1. [这里是 2,]
2. 取假码第8和第10位转换成十六进制数值, 记为 X2. [这里是 A8,]
3. 取假码第4,第6和第12位转换成十六进制数值, 记为 X3. [这里是 $46C]

DX = X1 xor 7 =5 [月份]=month
SI = X2 xor $B7 = 0x1F(31) [日期] =day

AX = X3 xor $5B7 = 0x1DB (475)[年份] =year

其实程序从一开始取假码的第几位，就知道程序不断进行对比的是哪几位，在前面取了假码的 2 4 6 8 10 12 这几个数据进行不断运算然后进行各种对比，其实影响最后的结果就是假码这几位所输入的数据一定要符合这几点

1. 这里的SI等于AX 0x270F> AX== X2 xor $B7 >1 即SI的值要在1-9999的范围里 所以可以推算出X3 接着可以推算出假码第4 第6 第12位数应该填什么

2.这里的DI其实是等于DX （注意看标记为红色的地址） 可以知道 C>DX>1 即DX范围为 1-12

3.这里的BX等于上面的SI 31>SI>1 即SI范围 1-31 所以继续可以推算出 假码第8和第10位应该填什么

0040B49F |> \0FB7CE movzx ecx,si ;

0040B4A2 |. 49 dec ecx ;

0040B4A3 |. 8BC1 mov eax,ecx

0040B4A5 |. BE 64000000 mov esi,0x64 ;

0040B4AB |. F7FE idiv esi

0040B4AD |. 69F1 6D010000 imul esi,ecx,0x16D ;

0040B4B3 |. 8BD1 mov edx,ecx ;

0040B4B5 |. 85D2 test edx,edx

0040B4B7 |. 79 03 jns short PrivacyE.0040B4BC

0040B4B9 |. 83C2 03 add edx,0x3

0040B4BC |> C1FA 02 sar edx,0x2 ;

0040B4BF |. 03F2 add esi,edx

0040B4C1 |. 2BF0 sub esi,eax

0040B4C3 |. 8BC1 mov eax,ecx

0040B4C5 |. B9 90010000 mov ecx,0x190 ;

0040B4CA |. 99 cdq

0040B4CB |. F7F9 idiv ecx ;

0040B4CD |. 03F0 add esi,eax

0040B4CF |. 0FB7C3 movzx eax,bx

0040B4D2 |. 03F0 add esi,eax ;

0040B4D4 |. 81EE 5A950A00 sub esi,0xA955A ;

上面汇编指令可以得出

SI=1DB=AX

(AX-1)*365+118-4+1+97=173276

4.计算出1900年的总天数 1900*365= 693594 然后把693594-由AX计算出的天数 AX是由假码 4 6 12位影响 即173276-6693594 =-520318 这里记为T1 然后把得出的结果进行浮点处理

来到这段代码 然而我输入的假码目前所有条件都符合，所以暂时不用修改假码！

 

004F0AAD . E8 46AAF1FF call PrivacyE.0040B4F8 ; 关键算法:进行日期格式检测及日期计算,F7进入

004F0AB2 . DD5D E0 fstp qword ptr ss:[ebp-0x20] ; -520318

004F0AB5 . 9B wait

004F0AB6 . E8 B5ACF1FF call PrivacyE.0040B770 ; 获取当前系统时间 42557为1900年到今天的天数 F7进入

004F0ABB . DC5D E0 fcomp qword ptr ss:[ebp-0x20] ; 比较

004F0ABE . DFE0 fstsw ax

004F0AC0 . 9E sahf

004F0AC1 . 76 1B jbe short PrivacyE.004F0ADE ; 不跳

 

进入004F0AB6 这个call

0040B770 /$ 83C4 E8 add esp,-0x18

0040B773 |. 8D4424 08 lea eax,dword ptr ss:[esp+0x8]

0040B777 |. 50 push eax ; /pLocaltime = 0012FC9C

0040B778 |. E8 3BB9FFFF call <jmp.&kernel32.GetLocalTime> ; \GetLocalTime

0040B77D |. 66:8B4C24 0E mov cx,word ptr ss:[esp+0xE] ; 日 6

0040B782 |. 66:8B5424 0A mov dx,word ptr ss:[esp+0xA] ; 月 7

0040B787 |. 66:8B4424 08 mov ax,word ptr ss:[esp+0x8] ; 年 2016

0040B78C |. E8 67FDFFFF call PrivacyE.0040B4F8 ; 关键算法:进行日期格式检测及日期计算,F7进入

0040B791 |. DD1C24 fstp qword ptr ss:[esp]

0040B794 |. 9B wait

0040B795 |. DD0424 fld qword ptr ss:[esp]

0040B798 |. 83C4 18 add esp,0x18

0040B79B \. C3 retn

 

0040B78C这个地址的call 是进回刚才计算日期的call 请参考上面的信息

所以得出： 我现在的时间是 2016-07-06 2016的总天数是 736151 然后1900年的总天数是693594 736151-693594=42557 最后将结果浮点型 这里记为T2

 

 

004F0AAD . E8 46AAF1FF call PrivacyE.0040B4F8 ; 关键算法:进行日期格式检测及日期计算,F7进入

004F0AB2 . DD5D E0 fstp qword ptr ss:[ebp-0x20]

004F0AB5 . 9B wait

004F0AB6 . E8 B5ACF1FF call PrivacyE.0040B770 ; 获取当前系统时间 42557为1900年到今天的天数

004F0ABB . DC5D E0 fcomp qword ptr ss:[ebp-0x20] ; T1和T2比较

004F0ABE . DFE0 fstsw ax

004F0AC0 . 9E sahf

004F0AC1 . 76 1B jbe short PrivacyE.004F0ADE ; 这个跳转一定要实现 不高于跳转 所以T1一定要大于T2

004F0AC3 . DD45 E0 fld qword ptr ss:[ebp-0x20]

004F0AC6 . D81D CC0B4F00 fcomp dword ptr ds:[0x4F0BCC]

004F0ACC . DFE0 fstsw ax

004F0ACE . 9E sahf

004F0ACF . 74 0D je short PrivacyE.004F0ADE

 

 

上图很明显看出T1<T2

所以跳转不实现，然后我们要进行修改下假码，令到这个跳转实现。

因为涉及计算，所以我们先理清下思路

我们现在想要得到的结果是T2>T1，上面已经说过了，T2是等于现在的年份的总天数-1900年的总天数

T1=(AX-1)*365+118-4+1+97-1900*365=173276-693594=-520318 1900年的总天数到由假码计算出的天数

123456789ABCDEFG

取假码第4,第6和第12位转换成十六进制数值, 记为 X3. [这里是 $46C]

AX = X3 xor $5B7 = 0x1DB (475)[年份] =year

我把上面得出的结论再复制一遍 这样比较容易分析 然后我们分析得出要符合T1>T2 必须AX>现在的年份（现在是2016）

所以我想要AX=2020吧 这个数字比较好。。 X3要xor $5B7=7E4

异或

不同 1

相同 0

01001010011 X3=253

10110110111 5B7

11111100100 7E4

4位为 2 6位为5 12位为3

更新后的假码：123255789AB3DEFG

004F0AC1 . /76 1B jbe short PrivacyE.004F0ADE ; 如果 T1 大于 T2 则跳走 不高于跳转

现在来到这个跳转后 跳转是实现的

好了，接下来继续下一步调试分析。

004F0AC1 . /76 1B jbe short PrivacyE.004F0ADE ; 如果 T1 大于 T2 则跳走 不高于跳转

004F0AC3 . |DD45 E0 fld qword ptr ss:[ebp-0x20]

004F0AC6 . |D81D CC0B4F00 fcomp dword ptr ds:[0x4F0BCC]

004F0ACC . |DFE0 fstsw ax

004F0ACE . |9E sahf

004F0ACF . |74 0D je short PrivacyE.004F0ADE

004F0AD1 . |33C0 xor eax,eax

004F0AD3 . |5A pop edx ; PrivacyE.004F0B0A

004F0AD4 . |59 pop ecx ; PrivacyE.004F0B0A

004F0AD5 . |59 pop ecx ; PrivacyE.004F0B0A

004F0AD6 . |64:8910 mov dword ptr fs:[eax],edx

004F0AD9 . |E9 84000000 jmp PrivacyE.004F0B62

004F0ADE > \33C0 xor eax,eax 正常情况下跳到这里

004F0AE0 . 5A pop edx ; PrivacyE.004F0B0A

004F0AE1 . 59 pop ecx ; PrivacyE.004F0B0A

004F0AE2 . 59 pop ecx ; PrivacyE.004F0B0A

004F0AE3 . 64:8910 mov dword ptr fs:[eax],edx

004F0AE6 . EB 11 jmp short PrivacyE.004F0AF9

004F0AE8 .^ E9 3B32F1FF jmp PrivacyE.00403D28

004F0AED . E8 6236F1FF call PrivacyE.00404154

004F0AF2 . EB 6E jmp short PrivacyE.004F0B62

004F0AF4 . E8 5B36F1FF call PrivacyE.00404154

004F0AF9 > 8D45 BC lea eax,dword ptr ss:[ebp-0x44]

004F0AFC . 50 push eax

004F0AFD . 8B4D 0C mov ecx,dword ptr ss:[ebp+0xC] ; 假码

004F0B00 . 8B55 FC mov edx,dword ptr ss:[ebp-0x4] ; 机器码

004F0B03 . 8BC3 mov eax,ebx

004F0B05 . E8 F6F0FFFF call PrivacyE.004EFC00 ; 关键算法2