新CrackMe160之089 - fornixcrackme1

汇编写的程序,可直接看源码

00401000 >/$  6A 00         push 0x0                                ; /pModule = NULL
00401002  |.  E8 01030000   call <jmp.&kernel32.GetModuleHandleA>   ; \GetModuleHandleA
00401007  |.  A3 9C624000   mov dword ptr ds:[0x40629C],eax
0040100C  |.  6A 03         push 0x3                                ; /RsrcName = 3.
0040100E  |.  FF35 9C624000 push dword ptr ds:[0x40629C]            ; |hInst = NULL
00401014  |.  E8 37030000   call <jmp.&user32.LoadIconA>            ; \LoadIconA
00401019  |.  A3 A0624000   mov dword ptr ds:[0x4062A0],eax
0040101E  |.  56            push esi                                ;  fornixcr.<ModuleEntryPoint>
0040101F  |.  6A 0A         push 0xA                                ; /ResourceType = RT_RCDATA
00401021  |.  6A 04         push 0x4                                ; |ResourceName = 0x4
00401023  |.  FF35 9C624000 push dword ptr ds:[0x40629C]            ; |hModule = NULL
00401029  |.  E8 D4020000   call <jmp.&kernel32.FindResourceA>      ; \FindResourceA
0040102E  |.  50            push eax
0040102F  |.  50            push eax                                ; /hResource = 0019FFCC
00401030  |.  FF35 9C624000 push dword ptr ds:[0x40629C]            ; |hModule = NULL
00401036  |.  E8 EB020000   call <jmp.&kernel32.SizeofResource>     ; \SizeofResource
0040103B  |.  A3 A4624000   mov dword ptr ds:[0x4062A4],eax
00401040  |.  58            pop eax                                 ;  kernel32.7741FCC9
00401041  |.  50            push eax                                ; /hResource = 0019FFCC
00401042  |.  FF35 9C624000 push dword ptr ds:[0x40629C]            ; |hModule = NULL
00401048  |.  E8 CD020000   call <jmp.&kernel32.LoadResource>       ; \LoadResource
0040104D  |.  50            push eax                                ; /hResource = 0019FFCC
0040104E  |.  E8 CD020000   call <jmp.&kernel32.LockResource>       ; \LockResource
00401053  |.  8BF0          mov esi,eax
00401055  |.  A1 A4624000   mov eax,dword ptr ds:[0x4062A4]
0040105A  |.  83C0 04       add eax,0x4
0040105D  |.  50            push eax                                ; /MemSize = 19FFCC (1703884.)
0040105E  |.  6A 40         push 0x40                               ; |Flags = GPTR
00401060  |.  E8 AF020000   call <jmp.&kernel32.GlobalAlloc>        ; \GlobalAlloc
00401065  |.  A3 A8624000   mov dword ptr ds:[0x4062A8],eax
0040106A  |.  8B0D A4624000 mov ecx,dword ptr ds:[0x4062A4]
00401070  |.  8908          mov dword ptr ds:[eax],ecx              ;  fornixcr.<ModuleEntryPoint>
00401072  |.  83C0 04       add eax,0x4
00401075  |.  8BF8          mov edi,eax
00401077  |.  F3:A4         rep movs byte ptr es:[edi],byte ptr ds:>
00401079  |.  5E            pop esi                                 ;  kernel32.7741FCC9
0040107A  |.  6A 00         push 0x0                                ; /lParam = NULL
0040107C  |.  68 96104000   push fornixcr.00401096                  ; |DlgProc = fornixcr.00401096
00401081  |.  6A 00         push 0x0                                ; |hOwner = NULL
00401083  |.  6A 66         push 0x66                               ; |pTemplate = 0x66
00401085  |.  FF35 9C624000 push dword ptr ds:[0x40629C]            ; |hInst = NULL
0040108B  |.  E8 AE020000   call <jmp.&user32.DialogBoxParamA>      ; \DialogBoxParamA
00401090  |.  50            push eax                                ; /ExitCode = 0x19FFCC
00401091  \.  E8 66020000   call <jmp.&kernel32.ExitProcess>        ; \ExitProcess
00401096  /.  55            push ebp
00401097  |.  8BEC          mov ebp,esp
00401099  |.  817D 0C 10010>cmp [arg.2],0x110
004010A0  |.  75 76         jnz short fornixcr.00401118
004010A2  |.  FF35 A0624000 push dword ptr ds:[0x4062A0]            ; /lParam = 0x0
004010A8  |.  6A 01         push 0x1                                ; |wParam = 0x1
004010AA  |.  68 80000000   push 0x80                               ; |Message = WM_SETICON
004010AF  |.  FF75 08       push [arg.1]                            ; |hWnd = 0x25C000
004010B2  |.  E8 AB020000   call <jmp.&user32.SendMessageA>         ; \SendMessageA
004010B7  |.  6A 00         push 0x0                                ; /lParam = 0x0
004010B9  |.  6A 13         push 0x13                               ; |wParam = 0x13
004010BB  |.  68 C5000000   push 0xC5                               ; |Message = EM_LIMITTEXT
004010C0  |.  6A 64         push 0x64                               ; |ControlID = 64 (100.)
004010C2  |.  FF75 08       push [arg.1]                            ; |hWnd = 0025C000
004010C5  |.  E8 92020000   call <jmp.&user32.SendDlgItemMessageA>  ; \SendDlgItemMessageA
004010CA  |.  6A 00         push 0x0                                ; /lParam = 0x0
004010CC  |.  6A 13         push 0x13                               ; |wParam = 0x13
004010CE  |.  68 C5000000   push 0xC5                               ; |Message = EM_LIMITTEXT
004010D3  |.  6A 65         push 0x65                               ; |ControlID = 65 (101.)
004010D5  |.  FF75 08       push [arg.1]                            ; |hWnd = 0025C000
004010D8  |.  E8 7F020000   call <jmp.&user32.SendDlgItemMessageA>  ; \SendDlgItemMessageA
004010DD  |.  68 14604000   push fornixcr.00406014                  ; /Enter_Serial_Here
004010E2  |.  6A 65         push 0x65                               ; |ControlID = 65 (101.)
004010E4  |.  FF75 08       push [arg.1]                            ; |hWnd = 0025C000
004010E7  |.  E8 7C020000   call <jmp.&user32.SetDlgItemTextA>      ; \SetDlgItemTextA
004010EC  |.  FF35 A8624000 push dword ptr ds:[0x4062A8]
004010F2  |.  E8 BA020000   call fornixcr.004013B1
004010F7  |.  68 04604000   push fornixcr.00406004                  ; /Enter_Name_Here
004010FC  |.  6A 64         push 0x64                               ; |ControlID = 64 (100.)
004010FE  |.  FF75 08       push [arg.1]                            ; |hWnd = 0025C000
00401101  |.  E8 62020000   call <jmp.&user32.SetDlgItemTextA>      ; \SetDlgItemTextA
00401106  |.  6A 64         push 0x64                               ; /ControlID = 64 (100.)
00401108  |.  FF75 08       push [arg.1]                            ; |hWnd = 0025C000
0040110B  |.  E8 3A020000   call <jmp.&user32.GetDlgItem>           ; \GetDlgItem
00401110  |.  50            push eax                                ; /hWnd = 0019FFCC
00401111  |.  E8 58020000   call <jmp.&user32.SetFocus>             ; \SetFocus
00401116  |.  EB 5A         jmp short fornixcr.00401172
00401118  |>  817D 0C 11010>cmp [arg.2],0x111
0040111F  |.  75 2F         jnz short fornixcr.00401150
00401121  |.  817D 10 EA030>cmp [arg.3],0x3EA
00401128  |.  75 0A         jnz short fornixcr.00401134
0040112A  |.  FF75 08       push [arg.1]
0040112D  |.  E8 49000000   call fornixcr.0040117B
00401132  |.  EB 3E         jmp short fornixcr.00401172
00401134  |>  837D 10 67    cmp [arg.3],0x67
00401138  |.  75 38         jnz short fornixcr.00401172
0040113A  |.  6A 00         push 0x0                                ; /Style = MB_OK|MB_APPLMODAL
0040113C  |.  68 D7614000   push fornixcr.004061D7                  ; |ABOUT CRACKME 1
00401141  |.  68 87604000   push fornixcr.00406087                  ; |Fornix's First CrackMe\n\rRulez\n\rMake a keygen. No patching\n\rClues:\n\rSerial is machine dependent\n\r\n\rMail queries, criticisms, suggestions,etc at fornix@fusionrulez.cjb.net\n\rWrite a tutorial on keygenning this and it will be put up at fusion's
00401146  |.  FF75 08       push [arg.1]                            ; |hOwner = 0025C000
00401149  |.  E8 08020000   call <jmp.&user32.MessageBoxA>          ; \MessageBoxA
0040114E  |.  EB 22         jmp short fornixcr.00401172
00401150  |>  837D 0C 10    cmp [arg.2],0x10
00401154  |.  75 13         jnz short fornixcr.00401169
00401156  |.  6A 00         push 0x0                                ; /Result = 0x0
00401158  |.  FF75 08       push [arg.1]                            ; |hWnd = 0025C000
0040115B  |.  E8 E4010000   call <jmp.&user32.EndDialog>            ; \EndDialog
00401160  |.  6A 00         push 0x0
00401162  |.  E8 4A020000   call fornixcr.004013B1
00401167  |.  EB 09         jmp short fornixcr.00401172
00401169  |>  B8 00000000   mov eax,0x0
0040116E  |.  C9            leave
0040116F  |.  C2 1000       retn 0x10
00401172  |>  B8 01000000   mov eax,0x1
00401177  |.  C9            leave
00401178  \.  C2 1000       retn 0x10
0040117B  /$  55            push ebp
0040117C  |.  8BEC          mov ebp,esp
0040117E  |.  83C4 FC       add esp,-0x4
00401181  |.  60            pushad
00401182  |.  B8 74624000   mov eax,fornixcr.00406274
00401187  |.  50            push eax                                ; /lParam = 0x19FFCC
00401188  |.  6A 14         push 0x14                               ; |wParam = 0x14
0040118A  |.  6A 0D         push 0xD                                ; |Message = WM_GETTEXT
0040118C  |.  6A 64         push 0x64                               ; |ControlID = 64 (100.)
0040118E  |.  FF75 08       push [arg.1]                            ; |hWnd = 0025C000
00401191  |.  E8 C6010000   call <jmp.&user32.SendDlgItemMessageA>  ; \SendDlgItemMessageA
00401196  |.  B8 88624000   mov eax,fornixcr.00406288
0040119B  |.  50            push eax                                ; /lParam = 0x19FFCC
0040119C  |.  6A 0A         push 0xA                                ; |wParam = 0xA
0040119E  |.  6A 0D         push 0xD                                ; |Message = WM_GETTEXT
004011A0  |.  6A 65         push 0x65                               ; |ControlID = 65 (101.)
004011A2  |.  FF75 08       push [arg.1]                            ; |hWnd = 0025C000
004011A5  |.  E8 B2010000   call <jmp.&user32.SendDlgItemMessageA>  ; \SendDlgItemMessageA
004011AA  |.  68 74624000   push fornixcr.00406274                  ; /String = ""
004011AF  |.  E8 84010000   call <jmp.&kernel32.lstrlenA>           ; \lstrlenA
004011B4  |.  8945 FC       mov [local.1],eax
004011B7  |.  83F8 04       cmp eax,0x4
004011BA  |.  77 19         ja short fornixcr.004011D5
004011BC  |.  6A 10         push 0x10                               ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
004011BE  |.  68 53604000   push fornixcr.00406053                  ; |Fornix's first Crackme
004011C3  |.  68 26604000   push fornixcr.00406026                  ; |The name should be atleast 4 characters long
004011C8  |.  FF75 08       push [arg.1]                            ; |hOwner = 0025C000
004011CB  |.  E8 86010000   call <jmp.&user32.MessageBoxA>          ; \MessageBoxA
004011D0  |.  61            popad
004011D1  |.  C9            leave
004011D2  |.  C2 0400       retn 0x4
004011D5  |>  6A 00         push 0x0                                ; /pFileSystemNameSize = NULL
004011D7  |.  6A 00         push 0x0                                ; |pFileSystemNameBuffer = NULL
004011D9  |.  6A 00         push 0x0                                ; |pFileSystemFlags = NULL
004011DB  |.  6A 00         push 0x0                                ; |pMaxFilenameLength = NULL
004011DD  |.  6A 00         push 0x0                                ; |pVolumeSerialNumber = NULL
004011DF  |.  6A 14         push 0x14                               ; |MaxVolumeNameSize = 14 (20.)
004011E1  |.  68 AC624000   push fornixcr.004062AC                  ; |VolumeNameBuffer = fornixcr.004062AC
004011E6  |.  68 00604000   push fornixcr.00406000                  ; |C:\
004011EB  |.  E8 1E010000   call <jmp.&kernel32.GetVolumeInformatio>; \GetVolumeInformationA
004011F0  |.  68 AC624000   push fornixcr.004062AC                  ; /String2 = ""
004011F5  |.  68 E8624000   push fornixcr.004062E8                  ; |String1 = fornixcr.004062E8
004011FA  |.  E8 33010000   call <jmp.&kernel32.lstrcpyA>           ; \lstrcpyA
004011FF  |.  68 74624000   push fornixcr.00406274                  ; /StringToAdd = ""
00401204  |.  68 E8624000   push fornixcr.004062E8                  ; |ConcatString = ""
00401209  |.  E8 1E010000   call <jmp.&kernel32.lstrcatA>           ; \lstrcatA
0040120E  |.  E8 40000000   call fornixcr.00401253
00401213  |.  E8 6B000000   call fornixcr.00401283
00401218  |.  E8 99000000   call fornixcr.004012B6
0040121D  |.  85C0          test eax,eax
0040121F  |.  75 19         jnz short fornixcr.0040123A
00401221  |.  B8 6A604000   mov eax,fornixcr.0040606A               ;  More Work To Do
00401226  |.  50            push eax                                ; /lParam = 0x19FFCC
00401227  |.  6A 00         push 0x0                                ; |wParam = 0x0
00401229  |.  6A 0C         push 0xC                                ; |Message = WM_SETTEXT
0040122B  |.  6A 65         push 0x65                               ; |ControlID = 65 (101.)
0040122D  |.  FF75 08       push [arg.1]                            ; |hWnd = 0025C000
00401230  |.  E8 27010000   call <jmp.&user32.SendDlgItemMessageA>  ; \SendDlgItemMessageA
00401235  |.  61            popad
00401236  |.  C9            leave
00401237  |.  C2 0400       retn 0x4
0040123A  |>  B8 7A604000   mov eax,fornixcr.0040607A               ;  Good Cracker
0040123F  |.  50            push eax                                ; /lParam = 0x19FFCC
00401240  |.  6A 00         push 0x0                                ; |wParam = 0x0
00401242  |.  6A 0C         push 0xC                                ; |Message = WM_SETTEXT
00401244  |.  6A 65         push 0x65                               ; |ControlID = 65 (101.)
00401246  |.  FF75 08       push [arg.1]                            ; |hWnd = 0025C000
00401249  |.  E8 0E010000   call <jmp.&user32.SendDlgItemMessageA>  ; \SendDlgItemMessageA
0040124E  |.  61            popad
0040124F  |.  C9            leave
00401250  \.  C2 0400       retn 0x4
00401253  /$  BE E8624000   mov esi,fornixcr.004062E8
00401258  |.  BF C0624000   mov edi,fornixcr.004062C0
0040125D  |.  BA 74624000   mov edx,fornixcr.00406274
00401262  |.  B9 04000000   mov ecx,0x4
00401267  |>  85C9          /test ecx,ecx                           ;  fornixcr.<ModuleEntryPoint>
00401269  |.  74 14         |je short fornixcr.0040127F
0040126B  |.  8A06          |mov al,byte ptr ds:[esi]
0040126D  |.  8A22          |mov ah,byte ptr ds:[edx]
0040126F  |.  32C4          |xor al,ah
00401271  |.  24 5F         |and al,0x5F
00401273  |.  0C 40         |or al,0x40
00401275  |.  34 09         |xor al,0x9
00401277  |.  8807          |mov byte ptr ds:[edi],al
00401279  |.  46            |inc esi                                ;  fornixcr.<ModuleEntryPoint>
0040127A  |.  47            |inc edi                                ;  fornixcr.<ModuleEntryPoint>
0040127B  |.  49            |dec ecx                                ;  fornixcr.<ModuleEntryPoint>
0040127C  |.  42            |inc edx                                ;  fornixcr.<ModuleEntryPoint>
0040127D  |.^ EB E8         \jmp short fornixcr.00401267
0040127F  |>  C607 24       mov byte ptr ds:[edi],0x24
00401282  \.  C3            retn
00401283  /$  BE 74624000   mov esi,fornixcr.00406274
00401288  |.  BF C0624000   mov edi,fornixcr.004062C0
0040128D  |.  BA E8624000   mov edx,fornixcr.004062E8
00401292  |.  83C7 05       add edi,0x5
00401295  |.  B9 04000000   mov ecx,0x4
0040129A  |>  85C9          /test ecx,ecx                           ;  fornixcr.<ModuleEntryPoint>
0040129C  |.  74 14         |je short fornixcr.004012B2
0040129E  |.  8A06          |mov al,byte ptr ds:[esi]
004012A0  |.  8A22          |mov ah,byte ptr ds:[edx]
004012A2  |.  32C4          |xor al,ah
004012A4  |.  24 3F         |and al,0x3F
004012A6  |.  0C 30         |or al,0x30
004012A8  |.  34 09         |xor al,0x9
004012AA  |.  8807          |mov byte ptr ds:[edi],al
004012AC  |.  46            |inc esi                                ;  fornixcr.<ModuleEntryPoint>
004012AD  |.  47            |inc edi                                ;  fornixcr.<ModuleEntryPoint>
004012AE  |.  49            |dec ecx                                ;  fornixcr.<ModuleEntryPoint>
004012AF  |.  42            |inc edx                                ;  fornixcr.<ModuleEntryPoint>
004012B0  |.^ EB E8         \jmp short fornixcr.0040129A
004012B2  |>  C607 00       mov byte ptr ds:[edi],0x0
004012B5  \.  C3            retn
004012B6  /$  BE 88624000   mov esi,fornixcr.00406288
004012BB  |.  BF C0624000   mov edi,fornixcr.004062C0
004012C0  |.  BA 92624000   mov edx,fornixcr.00406292
004012C5  |.  56            push esi                                ;  fornixcr.<ModuleEntryPoint>
004012C6  |.  52            push edx                                ;  fornixcr.<ModuleEntryPoint>
004012C7  |.  EB 08         jmp short fornixcr.004012D1
004012C9  |>  8A06          /mov al,byte ptr ds:[esi]
004012CB  |.  34 09         |xor al,0x9
004012CD  |.  8802          |mov byte ptr ds:[edx],al
004012CF  |.  46            |inc esi                                ;  fornixcr.<ModuleEntryPoint>
004012D0  |.  42            |inc edx                                ;  fornixcr.<ModuleEntryPoint>
004012D1  |>  803E 00        cmp byte ptr ds:[esi],0x0
004012D4  |.^ 75 F3         \jnz short fornixcr.004012C9
004012D6  |.  5A            pop edx                                 ;  kernel32.7741FCC9
004012D7  |.  5E            pop esi                                 ;  kernel32.7741FCC9
004012D8  |>  803F 00       /cmp byte ptr ds:[edi],0x0
004012DB  |.  75 07         |jnz short fornixcr.004012E4
004012DD  |.  803A 00       |cmp byte ptr ds:[edx],0x0
004012E0  |.  75 02         |jnz short fornixcr.004012E4
004012E2  |.  EB 12         |jmp short fornixcr.004012F6
004012E4  |>  8A27          |mov ah,byte ptr ds:[edi]
004012E6  |.  8A02          |mov al,byte ptr ds:[edx]
004012E8  |.  38E0          |cmp al,ah
004012EA  |.  75 04         |jnz short fornixcr.004012F0
004012EC  |.  47            |inc edi                                ;  fornixcr.<ModuleEntryPoint>
004012ED  |.  42            |inc edx                                ;  fornixcr.<ModuleEntryPoint>
004012EE  |.^ EB E8         \jmp short fornixcr.004012D8
004012F0  |>  B8 00000000   mov eax,0x0
004012F5  |.  C3            retn
004012F6  |>  B8 01000000   mov eax,0x1
004012FB  \.  C3            retn
004012FC   .- FF25 00504000 jmp dword ptr ds:[<&kernel32.ExitProces>;  kernel32.ExitProcess
00401302   $- FF25 04504000 jmp dword ptr ds:[<&kernel32.FindResour>;  kernel32.FindResourceA
00401308   $- FF25 08504000 jmp dword ptr ds:[<&kernel32.GetModuleH>;  kernel32.GetModuleHandleA
0040130E   $- FF25 0C504000 jmp dword ptr ds:[<&kernel32.GetVolumeI>;  kernel32.GetVolumeInformationA
00401314   $- FF25 10504000 jmp dword ptr ds:[<&kernel32.GlobalAllo>;  kernel32.GlobalAlloc
0040131A   $- FF25 14504000 jmp dword ptr ds:[<&kernel32.LoadResour>;  kernel32.LoadResource
00401320   $- FF25 18504000 jmp dword ptr ds:[<&kernel32.LockResour>;  kernel32.LockResource
00401326   $- FF25 1C504000 jmp dword ptr ds:[<&kernel32.SizeofReso>;  kernel32.SizeofResource
0040132C   $- FF25 20504000 jmp dword ptr ds:[<&kernel32.lstrcatA>] ;  kernel32.lstrcatA
00401332   $- FF25 24504000 jmp dword ptr ds:[<&kernel32.lstrcpyA>] ;  kernel32.lstrcpyA
00401338   $- FF25 28504000 jmp dword ptr ds:[<&kernel32.lstrlenA>] ;  kernel32.lstrlenA
0040133E   $- FF25 6C504000 jmp dword ptr ds:[<&user32.DialogBoxPar>;  user32.DialogBoxParamA
00401344   $- FF25 68504000 jmp dword ptr ds:[<&user32.EndDialog>]  ;  user32.EndDialog
0040134A   $- FF25 64504000 jmp dword ptr ds:[<&user32.GetDlgItem>] ;  user32.GetDlgItem
00401350   $- FF25 60504000 jmp dword ptr ds:[<&user32.LoadIconA>]  ;  user32.LoadIconA
00401356   $- FF25 70504000 jmp dword ptr ds:[<&user32.MessageBoxA>>;  user32.MessageBoxA
0040135C   $- FF25 5C504000 jmp dword ptr ds:[<&user32.SendDlgItemM>;  user32.SendDlgItemMessageA
00401362   $- FF25 58504000 jmp dword ptr ds:[<&user32.SendMessageA>;  user32.SendMessageA
00401368   $- FF25 54504000 jmp dword ptr ds:[<&user32.SetDlgItemTe>;  user32.SetDlgItemTextA
0040136E   $- FF25 50504000 jmp dword ptr ds:[<&user32.SetFocus>]   ;  user32.SetFocus

后面还有一堆代码,看着没什么用先不管,只先看这些
从上面的代码很容易找到关键算法为:

0040120E  |.  E8 40000000   call fornixcr.00401253
00401213  |.  E8 6B000000   call fornixcr.00401283
00401218  |.  E8 99000000   call fornixcr.004012B6

这三个方法
1). 00401253 用户名前4位运算得到4位结果再补一个$
2). 00401283 用户名前4位运算得到4位结果再补一个\0,与上面合起来得到9位字符串 "IIII$9999" 其实是固定串,跟用户名没关系
3). 004012B6 注册码循环运算得到9位结果与上面9位对比 code[i] ^ 0x9 = "IIII$9999"[i]
可见注册码也是固定的,即: @@@@-0000
示例:
用户名:任意 (4位以上)
注册码:@@@@-0000 (9位以后可任意)

后记:
因为我电脑C盘没有重命名盘符,即为默认的"本地磁盘", 所以获取到的盘符结果为空, 这里用户名不管输入什么,结果都是@@@@-0000这个,相当于固定了,
但如果你们的C盘不叫"本地磁盘"那结果就可能跟用户有关了(盘符名称少于4位就有关), 下面是注册机:

#include <stdio.h>
#include <string.h>
#include <windows.h>

int main() {
	char user[51] = { 0 }, user1[51] = { 0 }, rlt[10] = { 0 };
	printf("用户名: ");
	fgets(user, sizeof(user), stdin);
	int i, j = 0, len = strlen(user) - 1;
	if (len <= 4) {
		printf("The name should be atleast 4 characters long");
		getchar();
		return 0;
	}
	
	char rootPath[] = "C:\\";
	
	// 定义缓冲区来存储卷标和文件系统名称
	char volumeName[MAX_PATH];
	char fileSystemName[MAX_PATH];
	
	// 定义变量来存储卷序列号、最大文件名组件长度和文件系统标志
	DWORD volumeSerialNumber;
	DWORD maximumComponentLength;
	DWORD fileSystemFlags;
	
	// 调用 GetVolumeInformationA 函数
	GetVolumeInformationA(rootPath, volumeName, MAX_PATH, &volumeSerialNumber, &maximumComponentLength, &fileSystemFlags, fileSystemName, MAX_PATH);
	sprintf(user1, "%s%s", volumeName, user);
	for (i = 0; i < 4; i++) {
		rlt[j++] = (((user1[i] ^ user[i]) & 0x5F) | 0x40) ^ 0x9;
	}
	rlt[j++] = 0x24;
	for (i = 0; i < 4; i++) {
		rlt[j++] = (((user1[i] ^ user[i]) & 0x3F) | 0x30) ^ 0x9;
	}
	for (i = 0; i < 9; i++) {
		rlt[i] ^= 0x9;
	} 
	printf("注册码: %s\r\n", rlt);
	getchar();
	return 0;
}

 
 
本节高手录制的视频,点击前往查看

 
 
 
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
OD界面布局

posted @ 2024-12-30 14:30  hankerstudio  阅读(57)  评论(0)    收藏  举报