风云CM - 算法分析 & genkey实现

// 风云CM分析

// 计算用户名

00402D8A  |> \8D45 F8       LEA EAX, [LOCAL.2]

00402D8D  |.  50            PUSH EAX

00402D8E  |.  E8 8B060000   CALL <Hash_md5>                          ;  // md5(用户名)

00402D93  |.  8945 F4       MOV [LOCAL.3], EAX

00402D96  |.  8B5D F8       MOV EBX, [LOCAL.2]

00402D99  |.  85DB          TEST EBX, EBX

00402D9B  |.  74 09         JE SHORT 00402DA6

00402D9D  |.  53            PUSH EBX

00402D9E  |.  E8 0C060100   CALL 004133AF

00402DA3  |.  83C4 04       ADD ESP, 0x4

00402DA6  |>  8B45 F4       MOV EAX, [LOCAL.3]				// 2cbd779a6d41d9715d259a5d7e8bb93d

00402DBE  |.  A3 67D04100   MOV DWORD PTR DS:[0x41D067], EAX	     ; // [0x41D067] = md5(用户名)

00402E29  |.  A3 6BD04100   MOV DWORD PTR DS:[0x41D06B], EAX         ;  // md5(注册码)

// 到字节集(md5(user)) 转换成字节集

00402E71  |.  A3 6FD04100   MOV DWORD PTR DS:[0x41D06F], EAX 

// 字节集到文本

00402E76  |.  68 6FD04100   PUSH 0041D06F

00402E7B  |.  E8 18070000   CALL 00403598                            ;  字节集到文本

00402E9B  |.  A3 73D04100   MOV DWORD PTR DS:[0x41D073], EAX

0018F6C0   002DCBA8  ASCII "3263626437373961366434316439373135643235396135643765386262393364" aEnCode

// 保存长度 64

00402EFD  |.  A3 77D04100   MOV DWORD PTR DS:[0x41D077], EAX

// left(aEnCode,0,5)

00402F51  |.  A3 7BD04100   MOV DWORD PTR DS:[0x41D07B], EAX

// left(aEnCode, 10, 5)

00402FB1  |.  A3 7FD04100   MOV DWORD PTR DS:[0x41D07F], EAX

// left(aEnCode, 20, 5)

00403011  |.  A3 83D04100   MOV DWORD PTR DS:[0x41D083], EAX

// left(aEnCode, 30, 5)

00403071  |.  A3 87D04100   MOV DWORD PTR DS:[0x41D087], EAX

// left(aEnCode, 40, 5)

004030D1  |.  A3 8BD04100   MOV DWORD PTR DS:[0x41D08B], EAX

// left(aEnCode, 50, 5)

00403131  |.  A3 8FD04100   MOV DWORD PTR DS:[0x41D08F], EAX

// 再次MD5

00403170  |.  50            PUSH EAX                                 ;  // left(aEnCode,0,5)

00403171  |.  E8 A8020000   CALL <Hash_md5>

// left(MD5(left(aEnCode, 0, 5)), 0 , 5)

004031BB  |.  8945 F4       MOV [LOCAL.3], EAX

// left(aEnCode, 0, 5)

00403202  |.  8945 F0       MOV [LOCAL.4], EAX

// md5(left(aEnCode, 0, 5))

00403209  |.  E8 10020000   CALL <Hash_md5>

0040320E  |.  8945 EC       MOV [LOCAL.5], EAX

// right(md5(left(aEnCode, 0, 5)),0, 5)

00403253  |.  8945 E8       MOV [LOCAL.6], EAX

// L7 = left(MD5(left(aEnCode, 0, 5)), 0 , 5) +　right(md5(left(aEnCode, 0, 5)),0, 5)

00403266  |> \FF75 E8       PUSH [LOCAL.6]

00403269  |.  FF75 F4       PUSH [LOCAL.3]

0040326C  |.  B9 02000000   MOV ECX, 0x2

00403271  |.  E8 98F9FFFF   CALL 00402C0E                            ;  组合

00403279  |.  8945 E4       MOV [LOCAL.7], EAX

// left(L7,0, 6)

004032DA  |.  8945 E0       MOV [LOCAL.8], EAX

// upcase(left(L7, 0, 6);

00403313  |.  8945 DC       MOV [LOCAL.9], EAX

0040333E  |.  A3 93D04100   MOV DWORD PTR DS:[0x41D093], EAX

// 到了关键的地方了 下面就是关键跳

00403343  |.  E8 67050000   CALL 004038AF                            ;  // 关键的俩个函数 into

00403348  |.  E8 E0090000   CALL 00403D2D			     ; //比较eax = 1成功

0040334D  |.  8945 F8       MOV [LOCAL.2], EAX

00403350  |.  837D F8 01    CMP [LOCAL.2], 0x1

00403354  |.  0F85 4F000000 JNZ 004033A9

0040335A  |.  68 04000080   PUSH 0x80000004

0040335F  |.  6A 00         PUSH 0x0

00403361  |.  68 C1924100   PUSH 004192C1

00403366  |.  68 01030080   PUSH 0x80000301

0040336B  |.  6A 00         PUSH 0x0

0040336D  |.  68 00000000   PUSH 0x0

00403372  |.  68 04000080   PUSH 0x80000004

00403377  |.  6A 00         PUSH 0x0

00403379  |.  68 C6924100   PUSH 004192C6                            ;  ASCII "注册成功！"

0040337E  |.  68 03000000   PUSH 0x3

00403383  |.  BB 00030000   MOV EBX, 0x300

00403388  |.  E8 630E0100   CALL 004141F0

0040338D  |.  83C4 28       ADD ESP, 0x28

00403390  |.  68 64000000   PUSH 0x64

00403395  |.  68 63D04100   PUSH 0041D063

0040339A  |.  8B0424        MOV EAX, DWORD PTR SS:[ESP]

0040339D  |.  8B00          MOV EAX, DWORD PTR DS:[EAX]

0040339F  |.  8B00          MOV EAX, DWORD PTR DS:[EAX]

004033A1  |.  FF50 14       CALL DWORD PTR DS:[EAX+0x14]

004033A4  |.  E9 36000000   JMP 004033DF

// 先进 0x004038AF

// UPcase(LEFT(MD5(left(aEnCode,0,5)),2,5))

// UPcase(LEFT(MD5(left(aEnCode, 10, 5),3,5))

// UPcase(LEFT(MD5(left(aEnCode, 20, 5),4,5))

// UPcase(LEFT(MD5(left(aEnCode, 30, 5),5,5))

// UPcase(LEFT(MD5(left(aEnCode, 40, 5),6,5))

// UPcase(LEFT(MD5(left(aEnCode, 50, 5),7,5))

0041D07B  002E0450  ASCII "8F717"

0041D07F  002E03A0  ASCII "1DE45"

0041D083  002E04A0  ASCII "2F035"

0041D087  002E03E0  ASCII "2ED7B"

0041D08B  002E0470  ASCII "46F03"

0041D08F  002E0630  ASCII "DB200"

004038B8  |.  68 7BD04100   PUSH 0041D07B

004038BD  |.  E8 5CFBFFFF   CALL <Hash_md5>

004038C2  |.  8945 FC       MOV [LOCAL.1], EAX

004038C5  |.  68 01030080   PUSH 0x80000301

004038CA  |.  6A 00         PUSH 0x0

004038CC  |.  68 05000000   PUSH 0x5

004038D1  |.  68 01030080   PUSH 0x80000301

004038D6  |.  6A 00         PUSH 0x0

004038D8  |.  68 02000000   PUSH 0x2

004038DD  |.  68 04000080   PUSH 0x80000004

004038E2  |.  6A 00         PUSH 0x0

004038E4  |.  8B45 FC       MOV EAX, [LOCAL.1]                       ;  风云CM.0040333A

004038E7  |.  85C0          TEST EAX, EAX

004038E9  |.  75 05         JNZ SHORT 004038F0

004038EB  |.  B8 37924100   MOV EAX, 00419237

004038F0  |>  50            PUSH EAX

004038F1  |.  68 03000000   PUSH 0x3

004038F6  |.  BB 3C010000   MOV EBX, 0x13C

004038FB  |.  E8 90070100   CALL 00414090

00403900  |.  83C4 28       ADD ESP, 0x28

00403903  |.  8945 F8       MOV [LOCAL.2], EAX

00403934  |.  E8 37080100   CALL 00414170                            ;  upcase

0040393C  |.  8945 F4       MOV [LOCAL.3], EAX

00403967  |.  A3 7BD04100   MOV DWORD PTR DS:[0x41D07B], EAX

// 后面已经懒得分析了  剩下的就是比对了

注册机实现:

#include <iostream>

#include <string>

#include "md5.h"

using namespace std;

const string& ToUpcase(string &Text){

    for(string::size_type i = 0; i < Text.length(); ++i)

        if(Text[i] >= 'a' && Text[i] <= 'z') Text[i] = Text[i] & ~0x20;

    return Text;

}

string MD5ToAscii(const string &Binary){

    string HexTable = "0123456789ABCDEF";

    string Ascii;

    for(string::size_type i = 0; i < Binary.size(); ++i){

        char n = Binary.at(i);

        while(n){

            Ascii.insert(i*2, 1,HexTable.at(n % 16));

            n /= 16;

        }

    }

    return Ascii;

}

int main()

{

    string name;

    cout << "Input User Name:";

    cin >> name;

    // 第二部分

    string strSn1 = MD5ToAscii(MD5(name).toString());

    string strSn2 = MD5(strSn1.substr(0,5)).toString().substr(0,5);

    string strSn3 = MD5(strSn1.substr(64 - 5,5)).toString().substr(32 - 5,5);

    string strSn4 = strSn2 + strSn3;

    strSn4 = strSn4.substr(3,6);

    ToUpcase(strSn4);  // 转到大写

    // 第一部分

    string strSn5 = MD5(strSn1.substr(0,5)).toString().substr(1,5);

    ToUpcase(strSn5);

    string strSn6 = MD5(strSn1.substr(9,5)).toString().substr(2,5);

    ToUpcase(strSn6);

    string strSn7 = MD5(strSn1.substr(19,5)).toString().substr(3,5);

    ToUpcase(strSn7);

    string strSn8 = MD5(strSn1.substr(29,5)).toString().substr(4,5);

    ToUpcase(strSn8);

    string strSn9 = MD5(strSn1.substr(39,5)).toString().substr(5,5);

    ToUpcase(strSn9);

    string strSn10 = MD5(strSn1.substr(49,5)).toString().substr(6,5);

    ToUpcase(strSn10);

    char regCode[100] = {0};

    sprintf(regCode, "64-%s-%s-%s-%s-%s-%s-%s", strSn5.c_str(), strSn6.c_str(), strSn7.c_str(),

                strSn8.c_str(), strSn9.c_str(), strSn10.c_str(), strSn4.c_str());

    cout << "Your RegCode:" << regCode << endl;

    return 0;

}

风云CM分析+md5算法库+Source(genkey)

http://pan.baidu.com/s/1ntzG4m1

风云CM - 算法分析 & genkey实现的更多相关文章

[bigdata] 启动CM出现 “JDBC Driver class not found: com.mysql.jdbc.Driver” 以及“Error creating bean with name 'serverLogFetcherImpl'”问题的解决方法
问题:“JDBC Driver class not found: com.mysql.jdbc.Driver” 通过以下命令启动cm [root@hadoop1 ~]# /etc/init.d/cl ...
Fibonacci 数列算法分析
/************************************************* * Fibonacci 数列算法分析 ****************************** ...
数据结构与算法分析——C语言描述第三章的单链表
数据结构与算法分析--C语言描述第三章的单链表很基础的东西.走一遍流程.有人说学编程最简单最笨的方法就是把书上的代码敲一遍.这个我是头文件是照抄的..c源文件自己实现. list.h typede ...
AWS-CDH5.5安装 CM配置节点
在CM节点上进行安装时出现错误: ================================================================================ Pa ...
强大反调试cm的奇葩破解
系统 : Windows xp 程序 : Crackme-xp 程序下载地址 :http://pan.baidu.com/s/1slUwmVr 要求 : 编写注册机使用工具 : OD & I ...
CM添加kafka服务
下载所需的包: 在http://archive.cloudera.com/kafka/parcels/latest/ 选择合适parcel下载: ubuntu14.04的cdh5.5.1对应包 htt ...
CM给hive添加自定义jar包
使用的是cloudera manager管理的集群: hive添加自定义jar包服务端:高级:Hive 辅助 JAR 目录设置的的路径是影响所有服务端的设置,比如hue中使用到了hive查询编辑器 ...
1.7 基础知识——GP2.6 配置管理(CM)
摘要: 某某工作产品要进行配置管理,并不意味非要进行很重型的配置管理,根据实际需要采取合适的方式就可以了. 正文: GP2.6 Place designed work products of XXX ...
第四章 Leader选举算法分析
Leader选举学习leader选举算法,主要是从选举概述,算法分析与源码分析(后续章节写)三个方面进行. Leader选举概述服务器启动时期的Leader选举选举的隐式条件便是ZooKeepe ...

随机推荐

[c++]程序的内存划分理解
全局和静态数据区:用于存放全局变量和静态变量(全局变量和局部变量) 常量数据区:用于存放常量数据代码区:用于存储代码栈:用于局部变量和函数参数堆:程序员申请(程序员控制的部分,new/delet ...
DataGridView单元格合并
本文章转载:http://www.cnblogs.com/xiaofengfeng/p/3382094.html 图: 代码就是如此简单文件下载:DataGridView单元格合并源码也可以参考: ...
too many automatic redirections were attempted
用HttpClient时发现一下页面跳转现象. 页面A要求授权自动跳转到页面B, 页面B进行了授权,在HTTP Header里要求SetCookie并跳转到页面A. 再次请求页面A的时候没有带上此Co ...
【转】selenium简介及安装方法
转自:http://www.cnblogs.com/fnng/p/3157639.html 1. selenium 介绍 selenium 是一个web 的自动化测试工具,不少学习功能自动化的同学开始 ...
HDU 5536 Chip Factory 字典树
Chip Factory Time Limit: 20 Sec Memory Limit: 256 MB 题目连接 http://acm.hdu.edu.cn/showproblem.php?pid= ...
2015南阳CCPC C - The Battle of Chibi DP
C - The Battle of Chibi Time Limit: 1 Sec Memory Limit: 256 MB 题目连接无 Description Cao Cao made up a ...
Windows下载Android源代码
下载msysgit,安装官方下载:http://code.google.com/p/msysgit/downloads/list, 打开Git Bash,运行命令 cd D: git clone h ...
JavaScript 之弹出窗口总结
一.javascript 控制窗口关闭及刷新 //关闭弹窗 <script language="javascript"> window.close(); </sc ...
Cannot start service SPUserCodeV4 on computer
Cannot start service SPUserCodeV4 on computer SharePoint2010 部署问题: 当Visual Studio 2010中尝试部署Sharepoin ...
Lastest Version Carprog Full V7.28 update and EEPROM reading
Carprog Full has recently launched the newest V7.28 (with all software activated and all 21items Ada ...

风云CM - 算法分析 & genkey实现

风云CM - 算法分析 & genkey实现的更多相关文章

随机推荐

热门专题