step3 简单算法分析
软件简介：为何《个人电脑》惊呼“不可想像！”？三个步骤即可完成属于你自己的屏幕保护程序！Step3 让您体会亲手制作自己的屏幕保护的美妙感觉！所有任务一次完成是本软件的关键技术，也是《个人电脑》杂志称其“超乎想像”的原因所在！-----------------------------------------------------------------------
破解作者：北极熊[DFCG]破解目的：看懂算法,找出注册码,做出VB注册机原版下载: http://member.hitel.net/~sander2/step3.exe破解工具：TRW2000 V1.23
下面是破解过程，各位慢看：
1.首先运行TRW2000隐藏，
2.启动setp3.exe，点击注册信息栏 ：
有两个框：如下填入
user name:jxtour license key:7878787878(随便填先)
3.按Ctrl+N激活TRW2000
下命令:
BPX HMEMCPY → 这里用hmemcpy这个万能断点就OK了
4.按F5返回，点击注册按钮，程序被拦截
下命令:
BC* →清除所有断点PMODULE →返回程序领空5.按F12共7次 F10 n次到如下代码:
0167:0047DA74 8B45F8 MOV EAX,[EBP-08] 用户名进eax0167:0047DA77 8D4DFC LEA ECX,[EBP-04]0167:0047DA7A 8B93EC020000 MOV EDX,[EBX+02EC]0167:0047DA80 E8B3FBFFFF CALL 0047D638 计算关键CALL,F8跟入0167:0047DA85 8B45FC MOV EAX,[EBP-04]0167:0047DA88 50 PUSH EAX0167:0047DA89 8D55F4 LEA EDX,[EBP-0C]0167:0047DA8C 8B83E0020000 MOV EAX,[EBX+02E0]0167:0047DA92 E8E120FBFF CALL 0042FB780167:0047DA97 8B55F4 MOV EDX,[EBP-0C]0167:0047DA9A 58 POP EAX0167:0047DA9B E85463F8FF CALL 00403DF4 D EAX 真注册码,可做内存注册机0167:0047DAA0 7522 JNZ 0047DAC4
F8跟入后,慢慢按F10到如下:0167:0047D66D 8945F0 MOV [EBP-10],EAX0167:0047D670 8B75F8 MOV ESI,[EBP-08] ESI=4D3H0167:0047D673 8B45F0 MOV EAX,[EBP-10]0167:0047D676 85C0 TEST EAX,EAX0167:0047D678 7E13 JNG 0047D68D0167:0047D67A BF01000000 MOV EDI,010167:0047D67F 8B55FC MOV EDX,[EBP-04] EDX="jxtour"0167:0047D682 0FB6543AFF MOVZX EDX,BYTE [EDX+EDI-01] 逐位取用户名ASCII码0167:0047D687 03F2 ADD ESI,EDX ESI=ESI+EDX0167:0047D689 47 INC EDI EDI+10167:0047D68A 48 DEC EAX EAX-1(计数)0167:0047D68B 75F2 JNZ 0047D67F 未取完继续0167:0047D68D 8B45F4 MOV EAX,[EBP-0C]0167:0047D690 E8CF63F8FF CALL 00403A640167:0047D695 33FF XOR EDI,EDI EDI=00167:0047D697 8BC6 MOV EAX,ESI EAX=ESI0167:0047D699 B924000000 MOV ECX,24 ECX=24H0167:0047D69E 99 CDQ 0167:0047D69F F7F9 IDIV ECX EAX=EAX/ECX EDX=EAX MOD ECX0167:0047D6A1 8BC2 MOV EAX,EDX EAX=EDX(除后的余数)0167:0047D6A3 E868FFFFFF CALL 0047D610 F8进入0167:0047D6A8 8BD8 MOV EBX,EAX EBX=EAX0167:0047D6AA 8BC3 MOV EAX,EBX EAX=EBX0167:0047D6AC 04D0 ADD AL,D0 AL=AL+D0H(低位计算)0167:0047D6AE 2C02 SUB AL,02 AL=AL-02H0167:0047D6B0 7221 JC 0047D6D3 有进位跳,无进位不跳0167:0047D6B2 2C17 SUB AL,17 AL=AL-17H0167:0047D6B4 741D JZ 0047D6D3 如果为零就跳,这个结果是不要的!0167:0047D6B6 2C06 SUB AL,06 AL=AL-06H0167:0047D6B8 7419 JZ 0047D6D3 如果为零就跳,这个结果是不要的!0167:0047D6BA 8D45EC LEA EAX,[EBP-14] 0167:0047D6BD 8BD3 MOV EDX,EBX 0167:0047D6BF E84865F8FF CALL 00403C0C 0167:0047D6C4 8B55EC MOV EDX,[EBP-14]0167:0047D6C7 8B45F4 MOV EAX,[EBP-0C]0167:0047D6CA E81D66F8FF CALL 00403CEC 上面这段是把计算结果变成字母或数字0167:0047D6CF 8B45F4 MOV EAX,[EBP-0C]0167:0047D6D2 47 INC EDI0167:0047D6D3 8BC7 MOV EAX,EDI 重新计算0167:0047D6D5 99 CDQ 0167:0047D6D6 F77DF0 IDIV DWORD [EBP-10]0167:0047D6D9 8BC2 MOV EAX,EDX0167:0047D6DB 40 INC EAX0167:0047D6DC 8B55FC MOV EDX,[EBP-04] EDX为用户名:"jxtour"0167:0047D6DF 0FB64402FF MOVZX EAX,BYTE [EDX+EAX-01] 取一位用户名ASCII码到eax0167:0047D6E4 2BF0 SUB ESI,EAX esi=esi-eax0167:0047D6E6 85F6 TEST ESI,ESI 0167:0047D6E8 7D03 JNL 0047D6ED 如果esi1AH就不跳0167:0047D625 EB0B JMP SHORT 0047D6320167:0047D627 8D5030 LEA EDX,[EAX+30] EDX=EAX+30H0167:0047D62A EB06 JMP SHORT 0047D6320167:0047D62C 8D5041 LEA EDX,[EAX+41] EDX=EAX+41H0167:0047D62F 83EA0A SUB EDX,BYTE +0A 0167:0047D632 8BC2 MOX EAX,EDX EAX=EDX
6.计算结果:
user name:jxtourlicense key:BZRLC68WGD
7.注册机做法略