160 CrackMe 之 009算法分析及易语言注册机编写

160 CrackMe 之 009算法分析及易语言注册机编写
仍旧秉承以前的宗旨,算法分析是硬道理,搞懂算法才是目的,先看看这个crackme,有没有壳,查询如下:无壳vb程序,省掉了一步脱壳,直接开始。



运行程序,随便输入用户名和密码:显示如下,弹出错误窗口



程序载入od,反汇编窗口右键查找-------所有参考文本字串,由于是vb程序,也可以直接下vb专用断点 rtcMsgbox  或者 字符串比较 断点vbastrcomp 我用的右键------所有参考文本字串,来到如下:



看到了如上内容为错误弹窗的内容,双击或者反汇编中跟随,来到如下。



于是向下翻页,来到如下代码,在段首下断
[Asm] 纯文本查看 复制代码

00401FF0   > \55                 push    ebp    这里下断
00401FF1   .  8BEC               mov     ebp, esp
00401FF3   .  83EC 0C            sub     esp, 0xC
00401FF6   .  68 26104000        push    <jmp.&MSVBVM50.__vbaExceptHandle>;  SE 处理程序安装
00401FFB   .  64:A1 00000000     mov     eax, dword ptr fs:[0]
00402001   .  50                 push    eax
00402002   .  64:8925 00000000   mov     dword ptr fs:[0], esp
00402009   .  81EC 18010000      sub     esp, 0x118
0040200F   .  53                 push    ebx
00402010   .  8B5D 08            mov     ebx, dword ptr ss:[ebp+0x8]
00402013   .  8BC3               mov     eax, ebx
00402015   .  56                 push    esi
00402016   .  83E3 FE            and     ebx, 0xFFFFFFFE
00402019   .  57                 push    edi
0040201A   .  8965 F4            mov     dword ptr ss:[ebp-0xC], esp
0040201D   .  83E0 01            and     eax, 0x1
00402020   .  8B3B               mov     edi, dword ptr ds:[ebx]
00402022   .  C745 F8 00104000   mov     dword ptr ss:[ebp-0x8], Andréna.>
00402029   .  53                 push    ebx
0040202A   .  8945 FC            mov     dword ptr ss:[ebp-0x4], eax
0040202D   .  895D 08            mov     dword ptr ss:[ebp+0x8], ebx
00402030   .  FF57 04            call    near dword ptr ds:[edi+0x4]
00402033   .  33F6               xor     esi, esi
00402035   .  53                 push    ebx
00402036   .  8975 DC            mov     dword ptr ss:[ebp-0x24], esi
00402039   .  8975 CC            mov     dword ptr ss:[ebp-0x34], esi
0040203C   .  8975 BC            mov     dword ptr ss:[ebp-0x44], esi
0040203F   .  8975 AC            mov     dword ptr ss:[ebp-0x54], esi
00402042   .  8975 A8            mov     dword ptr ss:[ebp-0x58], esi
00402045   .  8975 A4            mov     dword ptr ss:[ebp-0x5C], esi
00402048   .  8975 94            mov     dword ptr ss:[ebp-0x6C], esi
0040204B   .  8975 84            mov     dword ptr ss:[ebp-0x7C], esi
0040204E   .  89B5 74FFFFFF      mov     dword ptr ss:[ebp-0x8C], esi
00402054   .  89B5 64FFFFFF      mov     dword ptr ss:[ebp-0x9C], esi
0040205A   .  89B5 54FFFFFF      mov     dword ptr ss:[ebp-0xAC], esi
00402060   .  89B5 44FFFFFF      mov     dword ptr ss:[ebp-0xBC], esi
00402066   .  89B5 14FFFFFF      mov     dword ptr ss:[ebp-0xEC], esi
0040206C   .  89B5 F8FEFFFF      mov     dword ptr ss:[ebp-0x108], esi
00402072   .  89B5 E8FEFFFF      mov     dword ptr ss:[ebp-0x118], esi
00402078   .  FF97 FC020000      call    near dword ptr ds:[edi+0x2FC]
0040207E   .  8D4D A4            lea     ecx, dword ptr ss:[ebp-0x5C]
00402081   .  50                 push    eax
00402082   .  51                 push    ecx
00402083   .  FF15 24414000      call    near dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaObjSet
00402089   .  8BD8               mov     ebx, eax
0040208B   .  8D45 A8            lea     eax, dword ptr ss:[ebp-0x58]
0040208E   .  50                 push    eax
0040208F   .  53                 push    ebx
00402090   .  8B13               mov     edx, dword ptr ds:[ebx]
00402092   .  FF92 A0000000      call    near dword ptr ds:[edx+0xA0]
00402098   .  3BC6               cmp     eax, esi
0040209A   .  7D 12              jge     short Andréna.004020AE
0040209C   .  68 A0000000        push    0xA0
004020A1   .  68 201C4000        push    Andréna.00401C20
004020A6   .  53                 push    ebx
004020A7   .  50                 push    eax
004020A8   .  FF15 14414000      call    near dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaHresultCheckObj
004020AE   >  8B45 A8            mov     eax, dword ptr ss:[ebp-0x58]     ;  [ebp-0x58]中的用户名给eax
004020B1   .  8975 A8            mov     dword ptr ss:[ebp-0x58], esi     ;  esi=0 给 [ebp-0x58]地址
004020B4   .  8B35 FC404000      mov     esi, dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaVarMove
004020BA   .  8D55 94            lea     edx, dword ptr ss:[ebp-0x6C]
004020BD   .  8D4D BC            lea     ecx, dword ptr ss:[ebp-0x44]
004020C0   .  8945 9C            mov     dword ptr ss:[ebp-0x64], eax     ;  用户名 给 [ebp-0x64] 地址
004020C3   .  C745 94 08000000   mov     dword ptr ss:[ebp-0x6C], 0x8     ;  8 给 地址 [ebp-0x6C]
004020CA   .  FFD6               call    near esi                         ;  <&MSVBVM50.__vbaVarMove>
004020CC   .  8D4D A4            lea     ecx, dword ptr ss:[ebp-0x5C]     ;  [ebp-0x5C] 地址给ecx
004020CF   .  FF15 B4414000      call    near dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaFreeObj
004020D5   .  B8 01000000        mov     eax, 0x1                         ;  1 给eax
004020DA   .  8D8D 54FFFFFF      lea     ecx, dword ptr ss:[ebp-0xAC]
004020E0   .  8985 5CFFFFFF      mov     dword ptr ss:[ebp-0xA4], eax     ;  eax=1 给 [ebp-0xA4]地址
004020E6   .  8985 4CFFFFFF      mov     dword ptr ss:[ebp-0xB4], eax     ;  eax=1 给 [ebp-0xB4] 地址
004020EC   .  8D55 BC            lea     edx, dword ptr ss:[ebp-0x44]
004020EF   .  51                 push    ecx                              ; /Step8
004020F0   .  8D45 94            lea     eax, dword ptr ss:[ebp-0x6C]     ; |
004020F3   .  BB 02000000        mov     ebx, 0x2                         ; |2 给ebx
004020F8   .  52                 push    edx                              ; |/var18
004020F9   .  50                 push    eax                              ; ||retBuffer8
004020FA   .  899D 54FFFFFF      mov     dword ptr ss:[ebp-0xAC], ebx     ; ||ebx=2 给 地址 [ebp-0xAC]
00402100   .  899D 44FFFFFF      mov     dword ptr ss:[ebp-0xBC], ebx     ; ||ebx=2 给 地址 [ebp-0xBC]
00402106   .  FF15 18414000      call    near dword ptr ds:[<&MSVBVM50.__>; |\__vbaLenVar
0040210C   .  8D8D 44FFFFFF      lea     ecx, dword ptr ss:[ebp-0xBC]     ; |[ebp-0xBC]  地址 数值给ecx
00402112   .  50                 push    eax                              ; |End8
00402113   .  8D95 E8FEFFFF      lea     edx, dword ptr ss:[ebp-0x118]    ; |
00402119   .  51                 push    ecx                              ; |Start8
0040211A   .  8D85 F8FEFFFF      lea     eax, dword ptr ss:[ebp-0x108]    ; |
00402120   .  52                 push    edx                              ; |TMPend8
00402121   .  8D4D DC            lea     ecx, dword ptr ss:[ebp-0x24]     ; |
00402124   .  50                 push    eax                              ; |TMPstep8
00402125   .  51                 push    ecx                              ; |Counter8
00402126   .  FF15 20414000      call    near dword ptr ds:[<&MSVBVM50.__>; \__vbaVarForInit
0040212C   .  8B3D 04414000      mov     edi, dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaFreeVarList
00402132   >  85C0               test    eax, eax
00402134   .  0F84 9C000000      je      Andréna.004021D6
0040213A   .  8D55 94            lea     edx, dword ptr ss:[ebp-0x6C]
0040213D   .  8D45 DC            lea     eax, dword ptr ss:[ebp-0x24]
00402140   .  52                 push    edx
00402141   .  50                 push    eax
00402142   .  C745 9C 01000000   mov     dword ptr ss:[ebp-0x64], 0x1     ;  [ebp-0x64] 地址里是用户名 长度 ,把 1给这个地址
00402149   .  895D 94            mov     dword ptr ss:[ebp-0x6C], ebx
0040214C   .  FF15 90414000      call    near dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaI4Var
00402152   .  8D4D BC            lea     ecx, dword ptr ss:[ebp-0x44]     ; |
00402155   .  50                 push    eax                              ; |Start
00402156   .  8D55 84            lea     edx, dword ptr ss:[ebp-0x7C]     ; |
00402159   .  51                 push    ecx                              ; |dString8
0040215A   .  52                 push    edx                              ; |RetBUFFER
0040215B   .  FF15 38414000      call    near dword ptr ds:[<&MSVBVM50.#6>; \rtcMidCharVar
00402161   .  8D45 84            lea     eax, dword ptr ss:[ebp-0x7C]
00402164   .  8D4D A8            lea     ecx, dword ptr ss:[ebp-0x58]
00402167   .  50                 push    eax                              ; /String8
00402168   .  51                 push    ecx                              ; |ARG2
00402169   .  FF15 70414000      call    near dword ptr ds:[<&MSVBVM50.__>; \取用户名每一位
0040216F   .  50                 push    eax                              ; /压入用户名每一位
00402170   .  FF15 0C414000      call    near dword ptr ds:[<&MSVBVM50.#5>; \用户名每一位取十六进制给eax
00402176   .  66:8985 4CFFFFFF   mov     word ptr ss:[ebp-0xB4], ax       ;  用户名每一位十六进制给地址 [ebp-0xB4]
0040217D   .  8D55 CC            lea     edx, dword ptr ss:[ebp-0x34]
00402180   .  8D85 44FFFFFF      lea     eax, dword ptr ss:[ebp-0xBC]
00402186   .  52                 push    edx                              ; /var18
00402187   .  8D8D 74FFFFFF      lea     ecx, dword ptr ss:[ebp-0x8C]     ; |
0040218D   .  50                 push    eax                              ; |var28
0040218E   .  51                 push    ecx                              ; |saveto8
0040218F   .  899D 44FFFFFF      mov     dword ptr ss:[ebp-0xBC], ebx     ; |ebx=[ebp-0xBC] =2
00402195   .  FF15 94414000      call    near dword ptr ds:[<&MSVBVM50.__>; \__vbaVarAdd
0040219B   .  8BD0               mov     edx, eax
0040219D   .  8D4D CC            lea     ecx, dword ptr ss:[ebp-0x34]
004021A0   .  FFD6               call    near esi                         ;  [color=#ff0000]用户名每一位十六进制累加的结果给ecx[/color]
004021A2   .  8D4D A8            lea     ecx, dword ptr ss:[ebp-0x58]
004021A5   .  FF15 B8414000      call    near dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaFreeStr
004021AB   .  8D55 84            lea     edx, dword ptr ss:[ebp-0x7C]
004021AE   .  8D45 94            lea     eax, dword ptr ss:[ebp-0x6C]
004021B1   .  52                 push    edx
004021B2   .  50                 push    eax
004021B3   .  53                 push    ebx
004021B4   .  FFD7               call    near edi
004021B6   .  83C4 0C            add     esp, 0xC
004021B9   .  8D8D E8FEFFFF      lea     ecx, dword ptr ss:[ebp-0x118]
004021BF   .  8D95 F8FEFFFF      lea     edx, dword ptr ss:[ebp-0x108]
004021C5   .  8D45 DC            lea     eax, dword ptr ss:[ebp-0x24]
004021C8   .  51                 push    ecx                              ; /TMPend8
004021C9   .  52                 push    edx                              ; |TMPstep8
004021CA   .  50                 push    eax                              ; |Counter8
004021CB   .  FF15 AC414000      call    near dword ptr ds:[<&MSVBVM50.__>; \__vbaVarForNext
004021D1   .^ E9 5CFFFFFF        jmp     Andréna.00402132                 ;  [color=#ff0000]跳上去循环计算用户名每一位十六进制的和[/color]
004021D6   >  8D4D CC            lea     ecx, dword ptr ss:[ebp-0x34]
004021D9   .  8D95 54FFFFFF      lea     edx, dword ptr ss:[ebp-0xAC]
004021DF   .  51                 push    ecx                              ; /var18
004021E0   .  8D45 94            lea     eax, dword ptr ss:[ebp-0x6C]     ; |
004021E3   .  52                 push    edx                              ; |var28
004021E4   .  50                 push    eax                              ; |SaveTo8
004021E5   .  C785 5CFFFFFF D202>mov     dword ptr ss:[ebp-0xA4], 0x49960>; |499602D2 预设放在 [ebp-0xA4]=[0018F390]地址
004021EF   .  C785 54FFFFFF 0300>mov     dword ptr ss:[ebp-0xAC], 0x3     ; |3 给地址[ebp-0xAC]=[0018F388]
004021F9   .  FF15 5C414000      call    near dword ptr ds:[<&MSVBVM50.__>; \[color=#ff0000]关键call 计算出 预设 499602D2 乘以 用户名十六进制累加的结果的 积[/color]
004021FF   .  8BD0               mov     edx, eax
00402201   .  8D4D CC            lea     ecx, dword ptr ss:[ebp-0x34]
00402204   .  FFD6               call    near esi
00402206   .  8B1D A0414000      mov     ebx, dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaMidStmtVar
0040220C   .  8D4D CC            lea     ecx, dword ptr ss:[ebp-0x34]
0040220F   .  51                 push    ecx
00402210   .  6A 04              push    0x4                              ;  第4位
00402212   .  8D95 54FFFFFF      lea     edx, dword ptr ss:[ebp-0xAC]
00402218   .  6A 01              push    0x1
0040221A   .  52                 push    edx
0040221B   .  C785 5CFFFFFF 341C>mov     dword ptr ss:[ebp-0xA4], Andréna>;  (- 预设) 给地址 [ebp-0xA4] ,对以上的乘积结果的十进制第4位替换预设的
00402225   .  C785 54FFFFFF 0800>mov     dword ptr ss:[ebp-0xAC], 0x8     ;  8 给 地址 [ebp-0xAC]
0040222F   .  FFD3               call    near ebx                         ;  <&MSVBVM50.__vbaMidStmtVar>
00402231   .  8D45 CC            lea     eax, dword ptr ss:[ebp-0x34]
00402234   .  8D8D 54FFFFFF      lea     ecx, dword ptr ss:[ebp-0xAC]
0040223A   .  50                 push    eax
0040223B   .  6A 09              push    0x9                              ;  第9位
0040223D   .  6A 01              push    0x1
0040223F   .  51                 push    ecx
00402240   .  C785 5CFFFFFF 341C>mov     dword ptr ss:[ebp-0xA4], Andréna>;  - 预设 给 地址[ebp-0xA4] 对以上的乘积结果的十进制第9位替换成预设的“[size=5][color=#ff0000][b]-[/b][/color][/size]”
0040224A   .  C785 54FFFFFF 0800>mov     dword ptr ss:[ebp-0xAC], 0x8
00402254   .  FFD3               call    near ebx
00402256   .  8B45 08            mov     eax, dword ptr ss:[ebp+0x8]       ;[color=#ff0000]程序走到这里时候,看看堆栈窗口 出现了可以注册吗[/color]
00402259   .  50                 push    eax
0040225A   .  8B10               mov     edx, dword ptr ds:[eax]
0040225C   .  FF92 04030000      call    near dword ptr ds:[edx+0x304]
00402262   .  50                 push    eax
00402263   .  8D45 A4            lea     eax, dword ptr ss:[ebp-0x5C]
00402266   .  50                 push    eax
00402267   .  FF15 24414000      call    near dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaObjSet
0040226D   .  8BD8               mov     ebx, eax
0040226F   .  8D55 A8            lea     edx, dword ptr ss:[ebp-0x58]
00402272   .  52                 push    edx
00402273   .  53                 push    ebx
00402274   .  8B0B               mov     ecx, dword ptr ds:[ebx]
00402276   .  FF91 A0000000      call    near dword ptr ds:[ecx+0xA0]
0040227C   .  85C0               test    eax, eax
0040227E   .  7D 12              jge     short Andréna.00402292
00402280   .  68 A0000000        push    0xA0
00402285   .  68 201C4000        push    Andréna.00401C20
0040228A   .  53                 push    ebx
0040228B   .  50                 push    eax
0040228C   .  FF15 14414000      call    near dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaHresultCheckObj
00402292   >  8B45 A8            mov     eax, dword ptr ss:[ebp-0x58]     ;[color=#ff0000]  假码给eax[/color]
00402295   .  8D4D CC            lea     ecx, dword ptr ss:[ebp-0x34]     ;  [color=#ff0000]这里应该传送真码,在寄存器窗口ecx 上右键堆栈窗口中跟随,发现可疑注册码[/color]
00402298   .  8945 9C            mov     dword ptr ss:[ebp-0x64], eax     ;  假码 给地址 [ebp-0x64]
0040229B   .  8D45 94            lea     eax, dword ptr ss:[ebp-0x6C]
0040229E   .  50                 push    eax                              ; /var18
0040229F   .  51                 push    ecx                              ; |var28
004022A0   .  C745 A8 00000000   mov     dword ptr ss:[ebp-0x58], 0x0     ; |
004022A7   .  C745 94 08800000   mov     dword ptr ss:[ebp-0x6C], 0x8008  ; |
004022AE   .  FF15 48414000      call    near dword ptr ds:[<&MSVBVM50.__>; \__vbaVarTstEq
004022B4   .  8D4D A4            lea     ecx, dword ptr ss:[ebp-0x5C]
004022B7   .  8BD8               mov     ebx, eax
004022B9   .  FF15 B4414000      call    near dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaFreeObj
004022BF   .  8D4D 94            lea     ecx, dword ptr ss:[ebp-0x6C]
004022C2   .  FF15 00414000      call    near dword ptr ds:[<&MSVBVM50.__>;  MSVBVM50.__vbaFreeVar
004022C8   .  66:85DB            test    bx, bx
004022CB   .  0F84 C0000000      je      Andréna.00402391                 ;[color=#ff0000]  爆破关键点,跳过就挂了[/color]
004022D1   .  FF15 74414000      call    near dword ptr ds:[<&MSVBVM50.#5>;  MSVBVM50.rtcBeep

进入这个关键call   004021F9 . FF15 5C414000 call near dword ptr ds:[<&MSVBVM50.__>  来到一下代码
[Asm] 纯文本查看 复制代码

74121986 >  55                   push    ebp
74121987    33C0                 xor     eax, eax                         ; eax 清零
74121989    8BEC                 mov     ebp, esp
7412198B    83EC 1C              sub     esp, 0x1C
7412198E    3905 64F01274        cmp     dword ptr ds:[0x7412F064], eax
74121994    53                   push    ebx
74121995    56                   push    esi
74121996    8945 E8              mov     dword ptr ss:[ebp-0x18], eax
74121999    57                   push    edi
7412199A    0F85 D3670000        jnz     MSVBVM50.74128173
741219A0    A1 6CF01274          mov     eax, dword ptr ds:[0x7412F06C]
741219A5    8D48 50              lea     ecx, dword ptr ds:[eax+0x50]
741219A8    83C0 60              add     eax, 0x60
741219AB    8B7D 10              mov     edi, dword ptr ss:[ebp+0x10]
741219AE    8B5D 0C              mov     ebx, dword ptr ss:[ebp+0xC]
741219B1    8B75 08              mov     esi, dword ptr ss:[ebp+0x8]
741219B4    894D F4              mov     dword ptr ss:[ebp-0xC], ecx
741219B7    66:8B0F              mov     cx, word ptr ds:[edi]
741219BA    8945 E4              mov     dword ptr ss:[ebp-0x1C], eax
741219BD    66:8B03              mov     ax, word ptr ds:[ebx]
741219C0    66:894D FE           mov     word ptr ss:[ebp-0x2], cx
741219C4    66:8945 F2           mov     word ptr ss:[ebp-0xE], ax
741219C8    66:837D F2 11        cmp     word ptr ss:[ebp-0xE], 0x11
741219CD    0F87 B1670000        ja      MSVBVM50.74128184
741219D3    0FB745 FE            movzx   eax, word ptr ss:[ebp-0x2]       ; 2 给eax
741219D7    0FB74D F2            movzx   ecx, word ptr ss:[ebp-0xE]       ; 3 给ecx
741219DB    6BC0 12              imul    eax, eax, 0x12                   ; eax=eax*12
741219DE    03C1                 add     eax, ecx                         ; eax=eax+ecx
741219E0    3D 43010000          cmp     eax, 0x143
741219E5    0F87 04680000        ja      MSVBVM50.741281EF
741219EB    0FB690 0D1D1274      movzx   edx, byte ptr ds:[eax+0x74121D0D>
741219F2    FF2495 A51A1274      jmp     near dword ptr ds:[edx*4+0x74121>
741219F9    0FBF4F 08            movsx   ecx, word ptr ds:[edi+0x8]
741219FD    0FBF43 08            movsx   eax, word ptr ds:[ebx+0x8]
74121A01    0FAFC8               imul    ecx, eax
74121A04    0FBFC1               movsx   eax, cx
74121A07    3BC1                 cmp     eax, ecx
74121A09    0F85 A86B0000        jnz     MSVBVM50.741285B7
74121A0F    66:C745 FE 0200      mov     word ptr ss:[ebp-0x2], 0x2
74121A15    66:894E 08           mov     word ptr ds:[esi+0x8], cx
74121A19    EB 78                jmp     short MSVBVM50.74121A93
74121A1B    0FBF4F 08            movsx   ecx, word ptr ds:[edi+0x8]       ; [edi+0x8][color=#ff0000]用户名所有十六进制累计的和给ecx[/color]
74121A1F    56                   push    esi
74121A20    FF73 08              push    dword ptr ds:[ebx+0x8]
74121A23    51                   push    ecx
74121A24    E8 1DCCF3FF          call    MSVBVM50.7405E646                ; [color=#ff0000]关键call  进入(很关键)[/color]
74121A29    EB 6F                jmp     short MSVBVM50.74121A9A

进入这个call 74121A24 E8 1DCCF3FF call MSVBVM50.7405E646 来到下面代码
[Asm] 纯文本查看 复制代码

7405E646    55                   push    ebp
7405E647    8BEC                 mov     ebp, esp
7405E649    8B45 08              mov     eax, dword ptr ss:[ebp+0x8]      ; [edi+0x8] [color=#ff0000]地址里的 用户名十六进制和 给eax[/color]
7405E64C    F76D 0C[color=#ff0000]              imul[/color]    dword ptr ss:[ebp+0xC]           ; [color=#ff0000]这里是关键 [ebp+0xC]地址里的 预设499602D2和 用户名每一位十六进制累加的和 相乘[/color]
7405E64F    8B4D 10              mov     ecx, dword ptr ss:[ebp+0x10]
[color=#ff0000]7405E652    0F80 2CC70300        jo      MSVBVM50.7409AD84   程序走到这里跳一下代码[/color]
7405E658    66:C701 0300         mov     word ptr ds:[ecx], 0x3

程序运行到 7405E652 跳到一下代码:



以下图是,堆栈中的真码,和以上图中的长整数对比,是不是从相乘的结果中取的,取码规则将第四位、第九位都替换成-,即可,上面的代码里有取码的过程。

算法分析:第一步取用户名每一位的十六进制值,全部累加起来(对累加结果取10进制)
                 第二步 用上面的累加的值 乘以 作者的预设 499602D2(10进制位1234567890)
                 第三部 对乘积的结果取长整数,把结果的第四位和第九位替换成预设的“-”
附上易语言编写的注册机工程文件及注册机,一起交流学习



注册机工程文件及成品注册机.rar

(13.5 KB, 下载次数: 0)

2019-9-6 21:36 上传
点击文件名下载附件

下载积分: 吾爱币 -1 CB


THE END
喜欢就支持以下吧
点赞0
分享
评论 抢沙发
  • 管埋员

    昵称

  • 取消
    昵称