Com Explorer 2.0 注册算法大概分析

看到看雪的精华帖有对一个叫Com Explorer的软件的注册算法分析，自己也试试。

在分析这个软件的算法的时候，我是把OD和IDA一起开着的,因为有很多库函数我

不可能逐个去分析。

注册界面

按解锁按钮弹出一个错误信息框,F12暂停程序在堆栈找到这个MessageBoxA的函数调用地址处

00409074  test esi,esi
00409076  je short comexp.0040907B
00409078  mov esi,dword ptr ds:[esi+1C]
0040907B  push 40
0040907D  push comexp.004642D4
00409082  push comexp.004641AC
00409087  push esi
00409088  call dword ptr ds:[<&USER32.MessageBoxA>>; USER32.MessageBoxA
0040908E  pop esi                                  ; comexp.004514D0
0040908F  pop ebx
00409090  add esp,8
00409093  retn

在pop esi那行下个断点然后运行程序,单步一直走完retn，来到此处

00432ACE  push ebp
00432ACF  mov ebp,esp
00432AD1  mov eax,dword ptr ss:[ebp+20]
00432AD4  push ebx
00432AD5  push esi
00432AD6  push 1
00432AD8  test eax,eax
00432ADA  pop ebx
00432ADB  je short comexp.00432AED
00432ADD  mov ecx,dword ptr ss:[ebp+8]
00432AE0  mov dword ptr ds:[eax],ecx
00432AE2  mov ecx,dword ptr ss:[ebp+14]
00432AE5  mov dword ptr ds:[eax+4],ecx
00432AE8  jmp comexp.00432BCD
00432AED  mov eax,dword ptr ss:[ebp+1C]
00432AF0  cmp eax,28
00432AF3  ja short comexp.00432B66
00432AF5  je short comexp.00432B53
00432AF7  dec eax
00432AF8  dec eax
00432AF9  je short comexp.00432B4E
00432AFB  sub eax,0A
00432AFE  je short comexp.00432B46
00432B00  dec eax
00432B01  je short comexp.00432B41
00432B03  sub eax,16
00432B06  je short comexp.00432B36
00432B08  sub eax,3
00432B0B  je short comexp.00432B23
00432B0D  dec eax
00432B0E  jnz short comexp.00432B79
00432B10  mov eax,dword ptr ss:[ebp+18]
00432B13  mov ecx,dword ptr ss:[ebp+8]
00432B16  push dword ptr ds:[eax]
00432B18  push dword ptr ds:[eax+4]
00432B1B  call dword ptr ss:[ebp+14]
00432B1E  jmp comexp.00432BCB
00432B23  mov eax,dword ptr ss:[ebp+18]
00432B26  mov ecx,dword ptr ss:[ebp+8]
00432B29  push dword ptr ds:[eax]
00432B2B  push dword ptr ds:[eax+4]
00432B2E  call dword ptr ss:[ebp+14]
00432B31  jmp comexp