|
|
final data1.0
由MAGO提供
name: xiaolou
company: aaa
sn: STD18121-4412-141872101238
bpx hmemxpy
F12 12次
:0042AB9B E85072FFFF call 00421DF0 <--进入
:0042ABA0 83C404 add esp, 00000004
:0042ABA3 85C0 test eax, eax
:0042ABA5 745F je 0042AC06 <-- jump=failure
发现
* Possible StringData Ref from Data Obj ->"STD"
|
:00421E0C 68F0EF4600 push 0046EFF0
:00421E11 8D55C8 lea edx, dword ptr [ebp-38]
:00421E14 52 push edx
:00421E15 E8F6150100 call 00433410
:00421E1A 83C408 add esp, 00000008
:00421E1D 85C0 test eax, eax
:00421E1F 7407 je 00421E28 <--sn开始3位必须是STD
:00421E21 33C0 xor eax, eax
:00421E23 E9D7020000 jmp 004220FF
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421E1F(C)
|
:00421E28 8B4508 mov eax, dword ptr [ebp+08]
:00421E2B 0FBE4808 movsx ecx, byte ptr [eax+08]
:00421E2F 83F92D cmp ecx, 0000002D <--9位是-
:00421E32 751B jne 00421E4F
:00421E34 8B5508 mov edx, dword ptr [ebp+08]
:00421E37 0FBE420D movsx eax, byte ptr [edx+0D]
:00421E3B 83F82D cmp eax, 0000002D <--14位是-
:00421E3E 750F jne 00421E4F
:00421E40 8B4D08 mov ecx, dword ptr [ebp+08]
:00421E43 51 push ecx
* Reference To: KERNEL32.lstrlenA, Ord:0308h
|
:00421E44 FF15FCD24500 Call dword ptr [0045D2FC]
:00421E4A 83F81A cmp eax, 0000001A <--sn 是26位
:00421E4D 7407 je 00421E56
......
......
再走到
:004220B2 3BD0 cmp edx, eax <--17位=EAX
:004220B4 7540 jne 004220F6
:004220B6 8B4DB8 mov ecx, dword ptr [ebp-48]
:004220B9 81E1FF000000 and ecx, 000000FF
:004220BF 8B55B4 mov edx, dword ptr [ebp-4C]
:004220C2 81E2FF000000 and edx, 000000FF
:004220C8 3BCA cmp ecx, edx <--6位及7位组成的十位数=EDX
:004220CA 752A jne 004220F6
:004220CC 8B45B0 mov eax, dword ptr [ebp-50]
:004220CF 25FF000000 and eax, 000000FF
:004220D4 8B4DFC mov ecx, dword ptr [ebp-04]
:004220D7 81E1FF000000 and ecx, 000000FF
:004220DD 3BC1 cmp eax, ecx <--4位及5位组成的十位数=ECX
:004220DF 7515 jne 004220F6
:004220E1 8B55C4 mov edx, dword ptr [ebp-3C]
:004220E4 81E2FF000000 and edx, 000000FF
:004220EA 8B45F8 mov eax, dword ptr [ebp-08]
:004220ED 25FF000000 and eax, 000000FF
:004220F2 3BD0 cmp edx, eax <--最后两位组成的十位数=EAX
:004220F4 7404 je 004220FA <--注册成功
注:请不要问我我是如何知道的, 因为基本上我都是猜出来的. |
|
