首页
论坛
课程
招聘
[原创]AD Stream Recorder 3.8.0简单分析
2008-8-28 12:20 3998

[原创]AD Stream Recorder 3.8.0简单分析

2008-8-28 12:20
3998
【破文标题】AD Stream Recorder 3.8.0简单分析
【破文作者】tianxj
【作者邮箱】[email]tianxj_2007@126.com[/email]
【作者主页】WwW.ChiNaPYG.CoM
【破解工具】PEiD,OD
【破解平台】D-Windows XP sp2
【软件名称】AD Stream Recorder 3.8.0
【软件大小】1221KB
【软件类别】国外软件/音频处理  
【软件授权】共享版
【软件语言】英文
【运行环境】Win9x/Me/NT/2000/XP/2003
【原版下载】自己找一下
【保护方式】注册码
【软件简介】是一款声音录制软件,它能录制internet流媒体、Windows媒体播放器播放的电影和音乐、WinAmp、RealPlayer以及麦克风、音频输入、CD音乐等音源。录制和监视过程中用实时的图形显示信号,使你可以录制高质量的音频。
【破解声明】我是一只小菜鸟,偶得一点心得,愿与大家分享:)
--------------------------------------------------------------
【破解内容】
--------------------------------------------------------------
**************************************************************
一、运行程序,进行注册,输入错误的注册信息进行检测,有提示信息
"Incorrect Code!"
**************************************************************
二、用PEiD对adsrecorder.exe查壳,为 Borland Delphi 6.0 - 7.0
**************************************************************
三、运行OD,打开adsrecorder.exe,右键—超级字串参考—查找ASCII.
发现"Incorrect Code!"
==============================================================
00488B9C  /.  55            PUSH EBP
00488B9D  |.  8BEC          MOV EBP,ESP
00488B9F  |.  33C9          XOR ECX,ECX
00488BA1  |.  51            PUSH ECX
00488BA2  |.  51            PUSH ECX
00488BA3  |.  51            PUSH ECX
00488BA4  |.  51            PUSH ECX
00488BA5  |.  51            PUSH ECX
00488BA6  |.  51            PUSH ECX
00488BA7  |.  51            PUSH ECX
00488BA8  |.  53            PUSH EBX
00488BA9  |.  56            PUSH ESI
00488BAA  |.  57            PUSH EDI
00488BAB  |.  8945 FC       MOV DWORD PTR SS:[EBP-4],EAX
00488BAE  |.  33C0          XOR EAX,EAX
00488BB0  |.  55            PUSH EBP
00488BB1  |.  68 F68C4800   PUSH adsrecor.00488CF6
00488BB6  |.  64:FF30       PUSH DWORD PTR FS:[EAX]
00488BB9  |.  64:8920       MOV DWORD PTR FS:[EAX],ESP
00488BBC  |.  68 C8000000   PUSH 0C8                                 ; /Timeout = 200. ms
00488BC1  |.  E8 5E4BF8FF   CALL <JMP.&kernel32.Sleep>               ; \Sleep
00488BC6  |.  C745 F8 32000>MOV DWORD PTR SS:[EBP-8],32
00488BCD  |.  BF 3C734A00   MOV EDI,adsrecor.004A733C                ;  ASCII 04,"1297"
00488BD2  |>  8D55 F0       /LEA EDX,DWORD PTR SS:[EBP-10]
00488BD5  |.  8B45 FC       |MOV EAX,DWORD PTR SS:[EBP-4]
00488BD8  |.  8B80 14030000 |MOV EAX,DWORD PTR DS:[EAX+314]
00488BDE  |.  E8 89A7FBFF   |CALL adsrecor.0044336C
00488BE3  |.  8B45 F0       |MOV EAX,DWORD PTR SS:[EBP-10]           ;  //左边注册框内的试练码
00488BE6  |.  50            |PUSH EAX
00488BE7  |.  8D45 EC       |LEA EAX,DWORD PTR SS:[EBP-14]
00488BEA  |.  8BD7          |MOV EDX,EDI
00488BEC  |.  E8 83BCF7FF   |CALL adsrecor.00404874
00488BF1  |.  8B55 EC       |MOV EDX,DWORD PTR SS:[EBP-14]           ;  //左边注册框内的真码
00488BF4  |.  58            |POP EAX                                 ;  //左边注册框内的试练码
00488BF5  |.  E8 22BEF7FF   |CALL adsrecor.00404A1C                  ;  //比较CALL
00488BFA  |.  0F85 92000000 |JNZ adsrecor.00488C92                   ;  //不等则跳
00488C00  |.  BE 32000000   |MOV ESI,32
00488C05  |.  BB 38744A00   |MOV EBX,adsrecor.004A7438               ;  \n1157717132\n1275215397\n1566343884\n2565740578\n2662106601\n2691296134\n2891286439\n2976152334\n3129671956\n3215798652\n3310760636\n3408623238\n3613335510\n3613792109\n3682429757\n4137188610\n4342271231\n4576195302\n4794974223\n4866392884\n5488323045 ..
00488C0A  |>  8D55 E8       |/LEA EDX,DWORD PTR SS:[EBP-18]
00488C0D  |.  8B45 FC       ||MOV EAX,DWORD PTR SS:[EBP-4]
00488C10  |.  8B80 18030000 ||MOV EAX,DWORD PTR DS:[EAX+318]
00488C16  |.  E8 51A7FBFF   ||CALL adsrecor.0044336C
00488C1B  |.  8B45 E8       ||MOV EAX,DWORD PTR SS:[EBP-18]          ;  //右边注册框内的试练码
00488C1E  |.  50            ||PUSH EAX
00488C1F  |.  8D45 E4       ||LEA EAX,DWORD PTR SS:[EBP-1C]
00488C22  |.  8BD3          ||MOV EDX,EBX
00488C24  |.  E8 4BBCF7FF   ||CALL adsrecor.00404874
00488C29  |.  8B55 E4       ||MOV EDX,DWORD PTR SS:[EBP-1C]          ;  //右边注册框内的真码
00488C2C  |.  58            ||POP EAX                                ;  //右边注册框内的试练码
00488C2D  |.  E8 EABDF7FF   ||CALL adsrecor.00404A1C                 ;  //比较CALL
00488C32  |.  75 54         ||JNZ SHORT adsrecor.00488C88            ;  //不等则跳
00488C34  |.  A1 F87F4A00   ||MOV EAX,DWORD PTR DS:[4A7FF8]
00488C39  |.  C600 01       ||MOV BYTE PTR DS:[EAX],1
00488C3C  |.  A1 1C824A00   ||MOV EAX,DWORD PTR DS:[4A821C]
00488C41  |.  C700 F6750100 ||MOV DWORD PTR DS:[EAX],175F6
00488C47  |.  8D45 F4       ||LEA EAX,DWORD PTR SS:[EBP-C]
00488C4A  |.  50            ||PUSH EAX                               ; /pHandle
00488C4B  |.  68 06000200   ||PUSH 20006                             ; |Access = KEY_WRITE
00488C50  |.  6A 00         ||PUSH 0                                 ; |Reserved = 0
00488C52  |.  68 048D4800   ||PUSH adsrecor.00488D04                 ; |software\adrosoft\ad sound recorder
00488C57  |.  68 01000080   ||PUSH 80000001                          ; |hKey = HKEY_CURRENT_USER
00488C5C  |.  E8 A3D9F7FF   ||CALL <JMP.&advapi32.RegOpenKeyExA>     ; \RegOpenKeyExA
00488C61  |.  85C0          ||TEST EAX,EAX
00488C63  |.  75 63         ||JNZ SHORT adsrecor.00488CC8
00488C65  |.  6A 04         ||PUSH 4                                 ; /BufSize = 4
00488C67  |.  A1 1C824A00   ||MOV EAX,DWORD PTR DS:[4A821C]          ; |
00488C6C  |.  50            ||PUSH EAX                               ; |Buffer => adsrecor.004FDDE0
00488C6D  |.  6A 04         ||PUSH 4                                 ; |ValueType = REG_DWORD
00488C6F  |.  6A 00         ||PUSH 0                                 ; |Reserved = 0
00488C71  |.  68 288D4800   ||PUSH adsrecor.00488D28                 ; |control1
00488C76  |.  8B45 F4       ||MOV EAX,DWORD PTR SS:[EBP-C]           ; |
00488C79  |.  50            ||PUSH EAX                               ; |hKey
00488C7A  |.  E8 95D9F7FF   ||CALL <JMP.&advapi32.RegSetValueExA>    ; \RegSetValueExA
00488C7F  |.  8B45 F4       ||MOV EAX,DWORD PTR SS:[EBP-C]
00488C82  |.  50            ||PUSH EAX                               ; /hKey
00488C83  |.  E8 74D9F7FF   ||CALL <JMP.&advapi32.RegCloseKey>       ; \RegCloseKey
00488C88  |>  83C3 0B       ||ADD EBX,0B
00488C8B  |.  4E            ||DEC ESI
00488C8C  |.^ 0F85 78FFFFFF |\JNZ adsrecor.00488C0A                  ;  //循环
00488C92  |>  83C7 05       |ADD EDI,5
00488C95  |.  FF4D F8       |DEC DWORD PTR SS:[EBP-8]
00488C98  |.^ 0F85 34FFFFFF \JNZ adsrecor.00488BD2                   ;  //循环
00488C9E  |.  A1 F87F4A00   MOV EAX,DWORD PTR DS:[4A7FF8]
00488CA3  |.  8038 00       CMP BYTE PTR DS:[EAX],0
00488CA6  |.  75 0C         JNZ SHORT adsrecor.00488CB4
00488CA8  |.  B8 3C8D4800   MOV EAX,adsrecor.00488D3C                ;  incorrect code!
00488CAD  |.  E8 CE05FAFF   CALL adsrecor.00429280
00488CB2  |.  EB 14         JMP SHORT adsrecor.00488CC8
00488CB4  |>  B8 548D4800   MOV EAX,adsrecor.00488D54                ;  thank you for using our product!\nyou have registered ad sound recorder!
00488CB9  |.  E8 C205FAFF   CALL adsrecor.00429280
00488CBE  |.  A1 C8F14F00   MOV EAX,DWORD PTR DS:[4FF1C8]
00488CC3  |.  E8 AC6CFDFF   CALL adsrecor.0045F974
00488CC8  |>  33C0          XOR EAX,EAX
00488CCA  |.  5A            POP EDX
00488CCB  |.  59            POP ECX
00488CCC  |.  59            POP ECX
00488CCD  |.  64:8910       MOV DWORD PTR FS:[EAX],EDX
00488CD0  |.  68 FD8C4800   PUSH adsrecor.00488CFD
00488CD5  |>  8D45 E4       LEA EAX,DWORD PTR SS:[EBP-1C]
00488CD8  |.  E8 33B9F7FF   CALL adsrecor.00404610
00488CDD  |.  8D45 E8       LEA EAX,DWORD PTR SS:[EBP-18]
00488CE0  |.  E8 2BB9F7FF   CALL adsrecor.00404610
00488CE5  |.  8D45 EC       LEA EAX,DWORD PTR SS:[EBP-14]
00488CE8  |.  E8 23B9F7FF   CALL adsrecor.00404610
00488CED  |.  8D45 F0       LEA EAX,DWORD PTR SS:[EBP-10]
00488CF0  |.  E8 1BB9F7FF   CALL adsrecor.00404610
00488CF5  \.  C3            RETN
00488CF6   .^ E9 95B2F7FF   JMP adsrecor.00403F90
00488CFB   .^ EB D8         JMP SHORT adsrecor.00488CD5
00488CFD   .  5F            POP EDI
00488CFE   .  5E            POP ESI
00488CFF   .  5B            POP EBX
00488D00   .  8BE5          MOV ESP,EBP
00488D02   .  5D            POP EBP
00488D03   .  C3            RETN
==============================================================
左边注册框内的真码表
004A733C  04 31 32 39 37 04 31 33 39 37 04 31 34 36 31 04  129713971461
004A734C  31 35 35 36 04 31 36 31 32 04 32 34 30 37 04 32  1556161224072
004A735C  34 33 34 04 32 35 30 33 04 32 39 37 36 04 33 31  4342503297631
004A736C  35 36 04 33 33 34 37 04 33 34 38 37 04 33 36 30  5633473487360
004A737C  31 04 33 39 33 30 04 34 31 30 35 04 34 31 31 38  1393041054118
004A738C  04 34 33 35 36 04 34 33 36 33 04 34 34 30 31 04  435643634401
004A739C  34 35 34 33 04 34 35 35 38 04 34 38 35 32 04 34  4543455848524
004A73AC  39 38 32 04 34 39 39 33 04 35 31 38 36 04 35 33  9824993518653
004A73BC  37 37 04 35 36 35 34 04 35 36 39 31 04 35 37 39  7756545691579
004A73CC  37 04 35 38 39 37 04 35 39 37 31 04 36 31 33 30  7589759716130
004A73DC  04 36 33 31 37 04 36 33 32 33 04 36 33 38 31 04  631763236381
004A73EC  36 35 35 36 04 36 36 39 37 04 36 37 35 30 04 37  6556669767507
004A73FC  33 38 33 04 37 36 30 39 04 37 37 31 35 04 37 38  3837609771578
004A740C  34 36 04 37 39 32 39 04 38 31 36 30 04 38 38 36  4679298160886
004A741C  37 04 38 39 38 35 04 39 32 38 37 04 39 33 37 37  7898592879377
004A742C  04 39 37 34 30 04 39 39 38 32 8B C0 0A 31 31 35  97409982嬂.115
==============================================================
右边注册框内的真码表
004A7438  0A 31 31 35 37 37 31 37 31 33 32 0A 31 32 37 35  .1157717132.1275
004A7448  32 31 35 33 39 37 0A 31 35 36 36 33 34 33 38 38  215397.156634388
004A7458  34 0A 32 35 36 35 37 34 30 35 37 38 0A 32 36 36  4.2565740578.266
004A7468  32 31 30 36 36 30 31 0A 32 36 39 31 32 39 36 31  2106601.26912961
004A7478  33 34 0A 32 38 39 31 32 38 36 34 33 39 0A 32 39  34.2891286439.29
004A7488  37 36 31 35 32 33 33 34 0A 33 31 32 39 36 37 31  76152334.3129671
004A7498  39 35 36 0A 33 32 31 35 37 39 38 36 35 32 0A 33  956.3215798652.3
004A74A8  33 31 30 37 36 30 36 33 36 0A 33 34 30 38 36 32  310760636.340862
004A74B8  33 32 33 38 0A 33 36 31 33 33 33 35 35 31 30 0A  3238.3613335510.
004A74C8  33 36 31 33 37 39 32 31 30 39 0A 33 36 38 32 34  3613792109.36824
004A74D8  32 39 37 35 37 0A 34 31 33 37 31 38 38 36 31 30  29757.4137188610
004A74E8  0A 34 33 34 32 32 37 31 32 33 31 0A 34 35 37 36  .4342271231.4576
004A74F8  31 39 35 33 30 32 0A 34 37 39 34 39 37 34 32 32  195302.479497422
004A7508  33 0A 34 38 36 36 33 39 32 38 38 34 0A 35 34 38  3.4866392884.548
004A7518  38 33 32 33 30 34 35 0A 35 35 37 36 36 34 39 35  8323045.55766495
004A7528  33 31 0A 35 37 30 35 39 31 34 39 38 36 0A 35 37  31.5705914986.57
004A7538  34 32 37 39 33 36 33 38 0A 35 38 34 33 32 39 36  42793638.5843296
004A7548  32 38 30 0A 35 39 31 36 38 35 34 36 36 36 0A 35  280.5916854666.5
004A7558  39 32 38 37 37 37 37 38 32 0A 36 32 33 39 37 33  928777782.623973
004A7568  33 39 35 31 0A 36 33 35 34 34 39 33 30 36 32 0A  3951.6354493062.
004A7578  36 34 34 37 33 34 38 37 38 35 0A 36 34 37 30 36  6447348785.64706
004A7588  34 39 36 38 35 0A 36 38 34 33 30 38 36 31 36 39  49685.6843086169
004A7598  0A 37 31 33 37 39 38 32 30 35 30 0A 37 34 30 38  .7137982050.7408
004A75A8  36 38 39 35 31 33 0A 37 35 39 30 31 30 30 38 33  689513.759010083
004A75B8  31 0A 37 37 31 32 33 30 32 37 31 32 0A 37 38 30  1.7712302712.780
004A75C8  33 36 35 39 34 35 34 0A 37 38 33 38 33 39 34 33  3659454.78383943
004A75D8  30 38 0A 37 38 37 33 32 30 33 34 30 36 0A 38 31  08.7873203406.81
004A75E8  30 30 36 38 34 34 30 39 0A 38 35 35 32 30 38 31  00684409.8552081
004A75F8  30 39 37 0A 38 35 37 35 31 32 33 34 33 38 0A 38  097.8575123438.8
004A7608  36 39 32 39 37 33 32 38 38 0A 38 37 32 38 37 30  692973288.872870
004A7618  36 31 32 36 0A 39 32 31 31 31 32 33 33 34 38 0A  6126.9211123348.
004A7628  39 33 37 34 31 30 39 34 30 36 0A 39 35 30 37 33  9374109406.95073
004A7638  36 32 39 39 31 0A 39 36 33 33 37 36 39 31 39 36  62991.9633769196
004A7648  0A 39 37 35 35 30 36 36 35 34 34 0A 39 39 33 32  .9755066544.9932
004A7658  35 37 39 33 39 38 8B C0 5A 00 00 00 00 00 00 01  579398嬂Z......

**************************************************************  
【破解总结】
只要输入的注册码与左边注册框内的真码表和右边注册框内的真码表里的注册码相符即可注册成功
--------------------------------------------------------------
【注册信息】
一个可用注册码:1297-1157717132
--------------------------------------------------------------
感谢飘云老大、猫老大、Nisy老大以及很多前辈们的学习教程以及所有帮助过我的论坛兄弟姐妹们!谢谢
--------------------------------------------------------------
【版权声明】破文是学习的手记,兴趣是成功的源泉;本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!

第五届安全开发者峰会(SDC 2021)议题征集正式开启!

收藏
点赞0
打赏
分享
最新回复 (1)
雪    币: 34676
活跃值: 活跃值 (151719)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
linhanshi 活跃值 2008-8-28 12:24
2
0
support.
游客
登录 | 注册 方可回帖
返回