cdr38key.asm

破解很多程序的序列号算法程序

        invoke SendDlgItemMessage, hWnd, IDC_CDRWIN, BM_GETCHECK, 0, 0
        or eax, eax
        je is_DAO_1
        mov edi, 2
        jmp generate_checksum
is_DAO_1:
        mov edi, 1

; == Generate Checksum calculated from Name/Company
; == xxxxxxxx-xxxxxxxx-xxxxxxxx-XXXXXXXX

generate_checksum:
            push edi
            push offset szName
            call Checksum_1
            add esp, 4*2
            mov esi, eax
            push edi
            push offset szEmail
            call Checksum_1
            add esp, 4*2
            mov ecx, eax
            mov edx, eax
            and ecx, 0FF0000h
            shr edx, 10h
            or ecx, edx
            mov edx, eax
            and edx, 0FF00h
            shl eax, 10h
            or edx, eax
            xor eax, eax
            shr ecx, 8
            shl edx, 8
            or ecx, edx
            xor ecx, esi       ; ecx = xxxxxxxx-xxxxxxxx-xxxxxxxx-XXXXXXXX
            mov dword ptr [License_Part_4], ecx
            mov edi, ecx       ; keep License_Part_4 in edi for some time

; == Check if Blacklisted (compare License_Part_4 with a list of known blacklisted ones)
            push offset [License_Part_4]
; == Check if CDRWin or DAO Radiobutton
            invoke SendDlgItemMessage, hWnd, IDC_CDRWIN, BM_GETCHECK, 0, 0
            or eax, eax
            je is_DAO_2
            call CDRWin_Blacklisted_Routine
            jmp done_blacklistcheck
is_DAO_2:
            call DAO_Blacklisted_Routine
done_blacklistcheck:
            add esp, 4
            or ax, ax
            je not_blacklisted
            invoke SetDlgItemText, hWnd, IDC_UNLOCKKEY, addr lpError2
            invoke SetDlgItemText, hWnd, IDC_CHECKKEY, addr lpError2
            jmp endof_keyengine

not_blacklisted:
; == Generate Version/Expiration Info
; == xxxxxxxx-xxxxxxxx-xxxxXXXX-xxxxxxxx
            mov ecx, edi
            shr ecx, 10h
            xor cx, Expiration_Word	; xor cx, xxxxxxxx-xxxxxxxx-xxxxXXXX-xxxxxxxx
            mov word ptr [License_Part_3], cx

; == Checksum Check, occurs when program is started (fails = piracy message)
; == xxxxxxxx-xxxxxxxx-XXXXxxxx-xxxxxxxx
            push 0                          ; little fix for stack problem
            mov eax, edi
            push 0
            lea ecx, [esp+4]
            push 4
            add eax, 64h
            push ecx
            push offset Checksum_Table_3
            mov [esp+10h], eax
            call Checksum_32Bit_Routine
            add esp, 14h
            shr eax, 10h
            xor edx, edx
            mov word ptr [License_Part_3+2], ax ; xxxxxxxx-xxxxxxxx-XXXXxxxx-xxxxxxxxx


; == Hidden Check 1:
; == XXXXxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx
            mov eax, edi
            add eax, 40h
            mov edx, eax
            mov esi, eax
            shr edx, 19h
            shl esi, 7
            or edx, esi
            shr eax, 0Dh
            add edx, eax
            mov word ptr [License_Part_1+2], dx

; == Hidden Check 2: 
; == xxxxxxxx-xxxxXXXX-xxxxxxxx-xxxxxxxx
            xor edx, edx
            xor eax, eax
            mov ecx, edi
hidden2_1:
            test cl, 1
            jz hidden2_2
            add edx, ecx
hidden2_2:
            add edx, eax
            shr ecx, 1
            inc eax
            cmp eax, 20h
            jl hidden2_1
            mov word ptr [License_Part_2], dx

            invoke SendDlgItemMessage, hWnd, IDC_RANDOMIZE, BM_GETCHECK, 0, 0
            or eax, eax
            jne dont_randomize      ; don't use randome if user wants that


; == Hidden Check 3:
; == NOT YET USED! -- V3.8A 12/27/99, V3.8A 03/20/00, V3.8B July 00
; == Therefore use (very pseudo) pseudo random words for:
; == xxxxXXXX-XXXXxxxx-xxxxxxxx-xxxxxxxx
            invoke GetTickCount
            mov edi, eax
            imul edx, edi, 01343f123h
            mov word ptr [License_Part_1], dx
            imul edx, edi, 0c01439ach
            shr edx, 16
            mov word ptr [License_Part_2+2], dx
dont_randomize:

; == Generate Check Codes
            mov esi, offset [License_Part_1]
            mov ecx, offset [Check_Part_1]
            mov edi, [esi]
            mov eax, [esi+4]
            mov edx, edi
            xor edx, eax
            mov [ecx+4], edx
            mov edx, [esi+8]
            mov ebx, edx
            xor ebx, eax
            mov [ecx+8], ebx
            mov eax, [esi+0Ch]
            mov ebx, eax
            xor ebx, edx
            mov [ecx+0Ch], ebx
            xor eax, edi
            mov [ecx], eax

; == Display Codes
            xor edi, edi
            mov esi, offset [License_Part_1]
display_codes:
            push dword ptr [esi+0Ch]
            push dword ptr [esi+8]
            push dword ptr [esi+4]
            push dword ptr [esi]
            push offset lpCode
            push offset BigBuffer
            call dword ptr [wsprintfa]
            add esp, 6*4
            or edi, edi
            jne display_codes_2
            invoke SetDlgItemText, hWnd, IDC_UNLOCKKEY, addr BigBuffer
            inc edi
            mov esi, offset [Check_Part_1]
            jmp display_codes
display_codes_2:
            invoke SetDlgItemText, hWnd, IDC_CHECKKEY, addr BigBuffer

            mov Valid_Data, 1
        .ENDIF
    .ENDIF
endof_keyengine:
    popa
    ret
cdrwin_keyengine endp

save_dat_routine proc hWnd:HWND
    pusha
    cmp Valid_Data, 0
    jne save_dat
    invoke MessageBox, hWnd, addr lpError7, addr lpCaption, MB_ICONEXCLAMATION
    jmp end_save

save_dat:
    lea esi, Empty_Dat
    lea edi, DatFileBuffer
    mov ecx, SIZEOFDAT
    rep movsb

    invoke GetDlgItemText, hWnd, IDC_NAME, addr DatFileBuffer+460, MAXSIZE
    invoke GetDlgItemText, hWnd, IDC_EMAIL, addr DatFileBuffer+524, MAXSIZE

    lea ebx, License_Part_4
    lea ecx, DatFileBuffer+828
    mov eax, [ebx]
    mov [ecx], eax
    mov eax, [ebx-4]
    mov [ecx+4], eax
    mov eax, [ebx-8]
    mov [ecx+8], eax
    mov eax, [ebx-12]
    mov [ecx+12], eax

    invoke GetLocalTime, addr st_
    lea eax, DatFileBuffer+852
    mov cx, st_.wDay
    mov dx, st_.wMonth
    mov word ptr [eax], cx
    mov cx, st_.wYear
    mov word ptr [eax+2], dx
    mov dx, st_.wDayOfWeek
    mov word ptr [eax+4], cx
    mov word ptr [eax+6], dx

    push 0
    push 03f4h
    push offset DatFileBuffer+0ch
    push offset Checksum_Table_3
    call Checksum_32Bit_Routine
    add esp, 10h
    mov dword ptr DatFileBuffer+08h, eax
    mov ecx, SIZEOFDAT
    xor eax, eax
    lea edx, DatFileBuffer
@Encrypt:
    mov bl, byte ptr [eax+edx]
    add bl, al
    mov [eax+edx], bl
    inc eax
    loop @Encrypt 

    invoke RtlZeroMemory, addr ofn, sizeof ofn
    mov ofn.lStructSize, sizeof ofn
    m2m ofn.hWndOwner, hWnd
    m2m ofn.hInstance, hInstance
    mov ofn.lpstrFilter, offset szFileFilter
    invoke RtlZeroMemory, addr szFileNameBuffer, FILESIZE
    mov ofn.lpstrFile, offset szFileNameBuffer
    mov ofn.nFilterIndex, 2
    mov ofn.nMaxFile, FILESIZE
    mov ofn.Flags, OFN_CREATEPROMPT or \
                   OFN_LONGNAMES or OFN_EXPLORER or OFN_HIDEREADONLY
    mov ofn.lpstrTitle, offset szFileSaveTitle
    invoke GetSaveFileName, addr ofn
    .IF eax == TRUE
        invoke CreateFile, ofn.lpstrFile,
                           GENERIC_WRITE,
                           0, NULL,
                           CREATE_ALWAYS,
                           FILE_ATTRIBUTE_NORMAL,
                           NULL
    .ELSE
        jmp end_save
    .ENDIF
    push eax
    invoke WriteFile, eax, addr DatFileBuffer, SIZEOFDAT, addr lpNumberOfBytesRead,NULL
    pop eax
    invoke CloseHandle, eax
    invoke MessageBox, hWnd, addr lpSaved, addr lpCaption, MB_OK

end_save:
    popa
    ret
save_dat_routine endp

dat_routine proc hWnd:HWND

; == open dialog and read dat file
    pusha
    invoke RtlZeroMemory, addr ofn, sizeof ofn
    mov ofn.lStructSize, sizeof ofn
    m2m ofn.hWndOwner, hWnd
    m2m ofn.hInstance, hInstance
    mov ofn.lpstrFilter, offset szFileFilter
    invoke RtlZeroMemory, addr szFileNameBuffer, FILESIZE
    mov ofn.lpstrFile, offset szFileNameBuffer
    mov ofn.nFilterIndex, 2
    mov ofn.nMaxFile, FILESIZE
    mov ofn.Flags, OFN_FILEMUSTEXIST or OFN_PATHMUSTEXIST or \
                   OFN_LONGNAMES or OFN_EXPLORER or OFN_HIDEREADONLY
    mov ofn.lpstrTitle, offset szFileOpenTitle
    invoke GetOpenFileName, addr ofn
    .IF eax == TRUE
        invoke CreateFile, ofn.lpstrFile,
                           GENERIC_READ,
                           0, NULL,
                           OPEN_EXISTING,
                           FILE_ATTRIBUTE_NORMAL,
                           NULL
    .ELSE
        invoke MessageBox, hWnd, addr lpError3, addr lpCaption, MB_ICONEXCLAMATION
        jmp end_dat
    .ENDIF
    push eax
    invoke ReadFile, eax, addr DatFileBuffer, SIZEOFDAT, addr lpNumberOfBytesRead,NULL
    pop eax
    invoke CloseHandle, eax

; == decrypt cdrwin.dat file
    mov ecx, SIZEOFDAT
    xor eax, eax
    lea edx, DatFileBuffer
Decrypt_Dat:
    mov bl, byte ptr [eax+edx]
    sub bl, al
    mov [eax+edx], bl
    inc eax
    loop Decrypt_Dat    

; == check if cdrwin.dat ok
    push 0
    push 03f4h
    push offset DatFileBuffer+0ch
    push offset Checksum_Table_3
    call Checksum_32Bit_Routine
    add esp, 10h
    mov ecx, dword ptr DatFileBuffer+08h      ; checksum inside datfile
    .IF eax != ecx
        invoke MessageBox, hWnd, addr lpError4, addr lpCaption, MB_ICONEXCLAMATION
        jmp end_dat
    .ENDIF
    
; == do various checks if key is 100%
    push offset [DatFileBuffer+828]
    call CDRWin_Blacklisted_Routine
    add esp, 4
    or ax, ax
    je @2check
    invoke MessageBox, hWnd, addr lpError2, addr lpCaption, MB_ICONWARNING
    jmp end_dat

@2check:
    mov edi, 2
    push edi
    push offset DatFileBuffer+460
    call Checksum_1
    add esp, 4*2
    mov esi, eax
    push edi
    push offset DatFileBuffer+524
    call Checksum_1
    add esp, 4*2
    mov ecx, eax
    mov edx, eax
    and ecx, 0FF0000h
    shr edx, 10h
    or ecx, edx
    mov edx, eax
    and edx, 0FF00h
    shl eax, 10h
    or edx, eax
    xor eax, eax
    shr ecx, 8
    shl edx, 8
    or ecx, edx
    xor ecx, esi       
    mov edi, ecx
    cmp dword ptr DatFileBuffer+828, edi
    je @3check
    invoke MessageBox, hWnd, addr lpError6, addr lpCaption, MB_YESNO
    .IF eax == IDNO
        jmp end_dat 
    .ELSE
        mov dword ptr DatFileBuffer+828, edi
        mov Got_Fixed, 1
   .ENDIF
@3check:
    push 0                          ; little fix for stack problem
    mov eax, dword ptr DatFileBuffer+828
    push 0
    lea ecx, [esp+4]
    push 4
    add eax, 64h
    push ecx
    push offset Checksum_Table_3
    mov [esp+10h], eax
    call Checksum_32Bit_Routine
    add esp, 14h
    shr eax, 10h
    xor edx, edx
    mov edi, eax
    cmp word ptr DatFileBuffer+834, di
    je @4check
    cmp Got_Fixed, 1
    je @3fix
    invoke MessageBox, hWnd, addr lpError6, addr lpCaption, MB_YESNO
    .IF eax == IDNO
        jmp end_dat 
    .ELSE
    @3fix:
        mov word ptr DatFileBuffer+834, di
        mov Got_Fixed, 1
   .ENDIF
@4check:
    mov eax, dword ptr DatFileBuffer+828
    add eax, 40h
    mov edx, eax
    mov esi, eax
    shr edx, 19h
    shl esi, 7
    or edx, esi
    shr eax, 0Dh
    add edx, eax
    mov edi, edx
    cmp word ptr DatFileBuffer+842, di
    je @5check
    cmp Got_Fixed, 1
    je @4fix
    invoke MessageBox, hWnd, addr lpError6, addr lpCaption, MB_YESNO
    .IF eax == IDNO
        jmp end_dat 
    .ELSE
    @4fix:
        mov word ptr DatFileBuffer+842, di
        mov Got_Fixed, 1
   .ENDIF
@5check:
    xor edx, edx
    xor eax, eax
    mov ecx, dword ptr DatFileBuffer+828
@5check_1:
    test cl, 1
    jz @5check_2
    add edx, ecx
@5check_2:
    add edx, eax
    shr ecx, 1
    inc eax
    cmp eax, 20h
    jl @5check_1
    mov edi, edx
    cmp word ptr DatFileBuffer+836, di
    je @6check
    cmp Got_Fixed, 1
    je @5fix
    invoke MessageBox, hWnd, addr lpError6, addr lpCaption, MB_YESNO
    .IF eax == IDNO
        jmp end_dat 
    .ELSE
    @5fix:
        mov word ptr DatFileBuffer+836, di
        mov Got_Fixed, 1
   .ENDIF
@6check:
@donecheck: