16 KiB
16 KiB
寻找serial
长度9位，仅数字
比较 单位ascii==(index xor 2)(最后一位)
| index | (XOR) value | result | real result |
|---|---|---|---|
| 1 | 2 | 3 | 3 |
| 2 | 2 | 0 | 0 |
| 3 | 2 | 1 | 1 |
| 4 | 2 | 6 | 6 |
| 5 | 2 | 7 | 7 |
| 6 | 2 | 4 | 4 |
| 7 | 2 | 5 | 5 |
| 8 | 2 | 10 | 0 |
| 9 | 2 | 11 | 1 |
Serial结果: 301674501
详细信息：
00403620 | 55 | push ebp | CheckSerial
...
...
004036D9 | 8B45 E4 | mov eax,dword ptr ss:[ebp-1C] | [ebp-1C]:L"123456789"
004036DC | 50 | push eax |
004036DD | FF15 08104000 | call dword ptr ds:[<__vbaLenBstr>] |
004036E3 | 33C9 | xor ecx,ecx |
004036E5 | 83F8 09 | cmp eax,9 | 检查serial长度是否为9
004036E8 | 0F95C1 | setne cl |
004036EB | F7D9 | neg ecx |
004036ED | 8BF1 | mov esi,ecx | esi:__vbaStrMove
004036EF | 8D4D E4 | lea ecx,dword ptr ss:[ebp-1C] | [ebp-1C]:L"123456789"
004036F2 | FF15 C0104000 | call dword ptr ds:[<__vbaFreeStr>] |
004036F8 | 8D4D D4 | lea ecx,dword ptr ss:[ebp-2C] |
004036FB | FF15 C4104000 | call dword ptr ds:[<__vbaFreeObj>] |
00403701 | 66:3BF3 | cmp si,bx |
00403704 | 0F85 1A030000 | jne <bjcm20a.Fail> |
0040370A | 8B17 | mov edx,dword ptr ds:[edi] |
0040370C | 57 | push edi |
0040370D | FF92 08030000 | call dword ptr ds:[edx+308] |
00403713 | 50 | push eax |
00403714 | 8D45 D4 | lea eax,dword ptr ss:[ebp-2C] |
00403717 | 50 | push eax |
00403718 | FF15 2C104000 | call dword ptr ds:[<__vbaObjSet>] |
0040371E | 8BF0 | mov esi,eax | esi:__vbaStrMove
00403720 | 8D55 E4 | lea edx,dword ptr ss:[ebp-1C] | [ebp-1C]:L"123456789"
00403723 | 52 | push edx |
00403724 | 56 | push esi | esi:__vbaStrMove
00403725 | 8B0E | mov ecx,dword ptr ds:[esi] | esi:__vbaStrMove
00403727 | FF91 A0000000 | call dword ptr ds:[ecx+A0] |
0040372D | 3BC3 | cmp eax,ebx | ebx:rtcStrFromVar
0040372F | DBE2 | fnclex |
...
...
00403745 | 8B45 E4 | mov eax,dword ptr ss:[ebp-1C] | [ebp-1C]:L"123456789"
00403748 | 50 | push eax |
00403749 | FF15 08104000 | call dword ptr ds:[<__vbaLenBstr>] |
0040374F | 8BC8 | mov ecx,eax |
00403751 | FF15 50104000 | call dword ptr ds:[<__vbaI2I4>] |
00403757 | 8D4D E4 | lea ecx,dword ptr ss:[ebp-1C] | [ebp-1C]:L"123456789"
0040375A | 8985 14FFFFFF | mov dword ptr ss:[ebp-EC],eax |
00403760 | C745 E8 01000000 | mov dword ptr ss:[ebp-18],1 | index=1
00403767 | FF15 C0104000 | call dword ptr ds:[<__vbaFreeStr>] |
0040376D | 8D4D D4 | lea ecx,dword ptr ss:[ebp-2C] |
00403770 | FF15 C4104000 | call dword ptr ds:[<__vbaFreeObj>] |
00403776 | 8B35 AC104000 | mov esi,dword ptr ds:[<__vbaStrMove>] | esi:__vbaStrMove
0040377C | 66:8B8D 14FFFFFF | mov cx,word ptr ss:[ebp-EC] | Loop
00403783 | 66:394D E8 | cmp word ptr ss:[ebp-18],cx | 取出每一位进行检查
00403787 | 0F8F 17030000 | jg <bjcm20a.Success> |
0040378D | 8B17 | mov edx,dword ptr ds:[edi] |
...
...
0040381D | 51 | push ecx |
0040381E | 57 | push edi | edi:Index
0040381F | 52 | push edx | edx:Name
00403820 | 8945 C0 | mov dword ptr ss:[ebp-40],eax |
00403823 | 8945 B0 | mov dword ptr ss:[ebp-50],eax |
00403826 | FF15 44104000 | call dword ptr ds:[<Ordinal#631>] |
0040382C | 8BD0 | mov edx,eax |
0040382E | 8D4D D8 | lea ecx,dword ptr ss:[ebp-28] |
00403831 | FFD6 | call esi | 检查当前位是否是数字
00403833 | 50 | push eax | 通过循环检查整体
00403834 | FF15 1C104000 | call dword ptr ds:[<Ordinal#516>] |
0040383A | 8B4D E4 | mov ecx,dword ptr ss:[ebp-1C] | [ebp-1C]:L"123456789"
0040383D | 33DB | xor ebx,ebx | ebx:rtcStrFromVar
0040383F | 66:3D 3900 | cmp ax,39 | 39:'9'
00403843 | 8D45 C0 | lea eax,dword ptr ss:[ebp-40] |
00403846 | 50 | push eax |
00403847 | 57 | push edi |
00403848 | 0F9FC3 | setg bl |
0040384B | 51 | push ecx |
0040384C | F7DB | neg ebx | ebx:rtcStrFromVar
0040384E | FF15 44104000 | call dword ptr ds:[<Ordinal#631>] |
00403854 | 8BD0 | mov edx,eax |
00403856 | 8D4D E0 | lea ecx,dword ptr ss:[ebp-20] |
00403859 | FFD6 | call esi | esi:__vbaStrMove
0040385B | 50 | push eax |
0040385C | FF15 1C104000 | call dword ptr ds:[<Ordinal#516>] |
00403862 | 33D2 | xor edx,edx |
00403864 | 66:3D 3000 | cmp ax,30 | 30:'0'
00403868 | 0F9CC2 | setl dl |
0040386B | F7DA | neg edx |
0040386D | 8D45 D8 | lea eax,dword ptr ss:[ebp-28] |
00403870 | 23DA | and ebx,edx | ebx:rtcStrFromVar
00403872 | 8D4D DC | lea ecx,dword ptr ss:[ebp-24] | [ebp-24]:L" 49"
00403875 | 50 | push eax |
00403876 | 8D55 E0 | lea edx,dword ptr ss:[ebp-20] |
00403879 | 51 | push ecx |
0040387A | 8D45 E4 | lea eax,dword ptr ss:[ebp-1C] | [ebp-1C]:L"123456789"
...
...
004038A7 | 83C4 2C | add esp,2C |
004038AA | 66:85DB | test bx,bx |
004038AD | 0F85 6F010000 | jne <bjcm20a.Error2> | 如果包含非数字内容则Error2
004038B3 | 8B45 08 | mov eax,dword ptr ss:[ebp+8] | [ebp+08]:"tZ@"
...
...
004038F1 | 66:8B45 E8 | mov ax,word ptr ss:[ebp-18] |
004038F5 | 8B1D 74104000 | mov ebx,dword ptr ds:[<Ordinal#536>] | ebx:rtcStrFromVar
004038FB | 66:35 0200 | xor ax,2 | index xor 2
004038FF | 8D4D A0 | lea ecx,dword ptr ss:[ebp-60] |
00403902 | 0F80 A4020000 | jo bjcm20a.403BAC |
00403908 | 51 | push ecx |
00403909 | 66:8945 A8 | mov word ptr ss:[ebp-58],ax |
0040390D | C745 A0 02000000 | mov dword ptr ss:[ebp-60],2 |
00403914 | FFD3 | call ebx | ebx:rtcStrFromVar
00403916 | 8BD0 | mov edx,eax |
00403918 | 8D4D D8 | lea ecx,dword ptr ss:[ebp-28] |
0040391B | FFD6 | call esi | esi:__vbaStrMove
0040391D | 8B45 E4 | mov eax,dword ptr ss:[ebp-1C] | [ebp-1C]:L"123456789"
00403920 | 8D55 C0 | lea edx,dword ptr ss:[ebp-40] |
00403923 | 52 | push edx |
00403924 | 57 | push edi |
00403925 | 50 | push eax |
00403926 | C745 C8 01000000 | mov dword ptr ss:[ebp-38],1 |
0040392D | C745 C0 02000000 | mov dword ptr ss:[ebp-40],2 |
00403934 | FF15 44104000 | call dword ptr ds:[<Ordinal#631>] |
0040393A | 8BD0 | mov edx,eax |
0040393C | 8D4D E0 | lea ecx,dword ptr ss:[ebp-20] |
0040393F | FFD6 | call esi | esi:__vbaStrMove
00403941 | 50 | push eax |
00403942 | FF15 1C104000 | call dword ptr ds:[<Ordinal#516>] |
00403948 | 8D4D B0 | lea ecx,dword ptr ss:[ebp-50] |
0040394B | 66:8945 B8 | mov word ptr ss:[ebp-48],ax |
0040394F | 51 | push ecx |
00403950 | C745 B0 02000000 | mov dword ptr ss:[ebp-50],2 |
00403957 | FFD3 | call ebx | ebx:rtcStrFromVar
00403959 | 8BD0 | mov edx,eax |
0040395B | 8D4D DC | lea ecx,dword ptr ss:[ebp-24] | [ebp-24]:L" 49"
0040395E | FFD6 | call esi | esi:__vbaStrMove
00403960 | 50 | push eax |
00403961 | FF15 84104000 | call dword ptr ds:[<__vbaR8Str>] |
00403967 | DC25 D8104000 | fsub qword ptr ds:[4010D8] | 减去48(实际意义类似"1"->1)
0040396D | 8D55 90 | lea edx,dword ptr ss:[ebp-70] |
00403970 | 6A 01 | push 1 |
00403972 | 52 | push edx |
00403973 | C785 30FFFFFF 058000 | mov dword ptr ss:[ebp-D0],8005 |
0040397D | DD9D 38FFFFFF | fstp qword ptr ss:[ebp-C8] |
00403983 | DFE0 | fnstsw ax |
00403985 | A8 0D | test al,D |
00403987 | 0F85 1A020000 | jne bjcm20a.403BA7 |
0040398D | 8B45 D8 | mov eax,dword ptr ss:[ebp-28] |
00403990 | C745 D8 00000000 | mov dword ptr ss:[ebp-28],0 |
00403997 | 8945 98 | mov dword ptr ss:[ebp-68],eax | [ebp-68]:L" 3"
0040399A | 8D45 80 | lea eax,dword ptr ss:[ebp-80] |
0040399D | 50 | push eax |
0040399E | C745 90 08000000 | mov dword ptr ss:[ebp-70],8 |
004039A5 | FF15 B0104000 | call dword ptr ds:[<Ordinal#619>] |
004039AB | 8D8D 30FFFFFF | lea ecx,dword ptr ss:[ebp-D0] |
004039B1 | 8D55 80 | lea edx,dword ptr ss:[ebp-80] |
004039B4 | 51 | push ecx | (int) serial[index]
004039B5 | 52 | push edx | index Xor 2的结果取最后一位
004039B6 | FF15 A0104000 | call dword ptr ds:[<__vbaVarTstNe>] | 比较
004039BC | 8BF8 | mov edi,eax |
004039BE | 8D45 D8 | lea eax,dword ptr ss:[ebp-28] |
004039C1 | 8D4D DC | lea ecx,dword ptr ss:[ebp-24] | [ebp-24]:L" 49"
004039C4 | 50 | push eax |
004039C5 | 8D55 E0 | lea edx,dword ptr ss:[ebp-20] |
004039C8 | 51 | push ecx |
004039C9 | 8D45 E4 | lea eax,dword ptr ss:[ebp-1C] | [ebp-1C]:L"123456789"
004039CC | 52 | push edx |
004039CD | 50 | push eax |
004039CE | 6A 04 | push 4 |
004039D0 | FF15 90104000 | call dword ptr ds:[<__vbaFreeStrList>] |
004039D6 | 83C4 14 | add esp,14 |
004039D9 | 8D4D D4 | lea ecx,dword ptr ss:[ebp-2C] |
004039DC | FF15 C4104000 | call dword ptr ds:[<__vbaFreeObj>] |
004039E2 | 8D4D 80 | lea ecx,dword ptr ss:[ebp-80] |
004039E5 | 8D55 90 | lea edx,dword ptr ss:[ebp-70] |
004039E8 | 51 | push ecx |
004039E9 | 8D45 A0 | lea eax,dword ptr ss:[ebp-60] |
004039EC | 52 | push edx |
004039ED | 8D4D B0 | lea ecx,dword ptr ss:[ebp-50] |
004039F0 | 50 | push eax |
004039F1 | 8D55 C0 | lea edx,dword ptr ss:[ebp-40] |
004039F4 | 51 | push ecx |
004039F5 | 52 | push edx |
004039F6 | 6A 05 | push 5 |
004039F8 | FF15 0C104000 | call dword ptr ds:[<__vbaFreeVarList>] |
004039FE | 83C4 18 | add esp,18 |
00403A01 | 66:85FF | test di,di |
00403A04 | 75 1C | jne <bjcm20a.Error2> |
00403A06 | 8B7D 08 | mov edi,dword ptr ss:[ebp+8] | [ebp+08]:"tZ@"
00403A09 | B8 01000000 | mov eax,1 |
00403A0E | 66:0345 E8 | add ax,word ptr ss:[ebp-18] |
00403A12 | 0F80 94010000 | jo bjcm20a.403BAC |
00403A18 | 8945 E8 | mov dword ptr ss:[ebp-18],eax |
00403A1B | 33DB | xor ebx,ebx | ebx:rtcStrFromVar
00403A1D | E9 5AFDFFFF | jmp bjcm20a.40377C | Next Loop
00403A22 | 33DB | xor ebx,ebx | ebx:rtcStrFromVar
00403A24 | 8B35 A4104000 | mov esi,dword ptr ds:[<__vbaVarDup>] | esi:__vbaStrMove
...FAIL
...
00403AA2 | EB 7E | jmp bjcm20a.403B22 |
00403AA4 | 8B35 A4104000 | mov esi,dword ptr ds:[<__vbaVarDup>] | esi:__vbaStrMove
...SUCCESS
...
00403B22 | 6A 04 | push 4 |
...
...