cdr38key.asm

破解很多程序的序列号算法程序

    cmp Got_Fixed, 1
    jne no_fixing
    
; == fix dat and save back
    push 0
    push 03f4h
    push offset DatFileBuffer+0ch
    push offset Checksum_Table_3
    call Checksum_32Bit_Routine
    add esp, 10h
    mov dword ptr DatFileBuffer+08h, eax
    mov ecx, SIZEOFDAT
    xor eax, eax
    lea edx, DatFileBuffer
Encrypt_Dat:
    mov bl, byte ptr [eax+edx]
    add bl, al
    mov [eax+edx], bl
    inc eax
    loop Encrypt_Dat    
    invoke CreateFile, ofn.lpstrFile,
                       GENERIC_WRITE,
                       0, NULL,
                       OPEN_EXISTING,
                       FILE_ATTRIBUTE_NORMAL,
                       NULL
    push eax
    invoke WriteFile, eax, addr DatFileBuffer, SIZEOFDAT, addr lpNumberOfBytesRead,NULL
    pop eax
    invoke CloseHandle, eax
    mov ecx, SIZEOFDAT
    xor eax, eax
    lea edx, DatFileBuffer
@Fix:
    mov bl, byte ptr [eax+edx]
    sub bl, al
    mov [eax+edx], bl
    inc eax
    loop @Fix    

    mov Got_Fixed, 0

no_fixing:
; == fetch Name and Company
    invoke SetDlgItemText, hWnd, IDC_NAME, addr DatFileBuffer+460
    invoke SetDlgItemText, hWnd, IDC_EMAIL, addr DatFileBuffer+524

; == display expiration range 
    mov eax, dword ptr DatFileBuffer+832
    mov esi, dword ptr DatFileBuffer+828
    shr esi, 010h
    xor esi, eax
    and esi, 0ffffh
    add esi, Base_Year*12-Base_Counter+Base_Month
    mov eax, esi
    mov ecx, 12
    xor edx, edx
    div ecx
    or edx, edx
    jne not_end_of_da_year
    dec eax
    invoke SetDlgItemInt, hWnd, IDC_YEARSTART, eax, FALSE    
    invoke SetDlgItemInt, hWnd, IDC_MONTHSTART, 12, FALSE
    jmp finish_fetch_date 
not_end_of_da_year:
    mov edi, edx
    invoke SetDlgItemInt, hWnd, IDC_YEARSTART, eax, FALSE    
    invoke SetDlgItemInt, hWnd, IDC_MONTHSTART, edi, FALSE
finish_fetch_date:    

; == fetch Unlock Key and generate Check Key
    lea ebx, License_Part_4
    lea ecx, DatFileBuffer+828
    mov eax, [ecx]
    mov [ebx], eax
    mov eax, [ecx+4]
    mov [ebx-4], eax
    mov eax, [ecx+8]
    mov [ebx-8], eax
    mov eax, [ecx+12]
    mov [ebx-12], eax

    mov esi, offset [License_Part_1]
    mov ecx, offset [Check_Part_1]
    mov edi, [esi]
    mov eax, [esi+4]
    mov edx, edi
    xor edx, eax
    mov [ecx+4], edx
    mov edx, [esi+8]
    mov ebx, edx
    xor ebx, eax
    mov [ecx+8], ebx
    mov eax, [esi+0Ch]
    mov ebx, eax
    xor ebx, edx
    mov [ecx+0Ch], ebx
    xor eax, edi
    mov [ecx], eax

; == display code (must be at the end, otherwise overwrite through EN_CHANGE)
    xor edi, edi
    mov esi, offset [License_Part_1]
display_codes_again:
    push dword ptr [esi+0Ch]
    push dword ptr [esi+8]
    push dword ptr [esi+4]
    push dword ptr [esi]
    push offset lpCode
    push offset BigBuffer
    call dword ptr [wsprintfa]
    add esp, 6*4
    or edi, edi
    jne display_codes_2_again
    invoke SetDlgItemText, hWnd, IDC_UNLOCKKEY, addr BigBuffer
    inc edi
    mov esi, offset [Check_Part_1]
    jmp display_codes_again
display_codes_2_again:
    invoke SetDlgItemText, hWnd, IDC_CHECKKEY, addr BigBuffer


end_dat:
    popa
    ret
dat_routine endp

; == The following routines are directly ripped from CDRWin

Checksum_1 proc near
arg_0 = dword ptr  4
arg_4 = dword ptr  8
    mov eax, [esp+arg_4]
    push esi
    dec eax
    jz short loc_0_4203A6
    dec eax
    jz short loc_0_42039F
    xor eax, eax
    pop esi
    retn
loc_0_42039F:
    mov esi, offset Checksum_Table_1
    jmp short loc_0_4203AB
loc_0_4203A6:
    mov esi, offset Checksum_Table_2
loc_0_4203AB:
    mov edx, [esp+4+arg_0]
    push edi
    mov edi, edx
    or ecx, 0FFFFFFFFh
    xor eax, eax
    push 0
    repne scasb
    not ecx
    dec ecx
    push ecx
    push edx
    push esi
    call Checksum_32Bit_Routine
    add esp, 10h
    pop edi
    pop esi
    retn
Checksum_1 endp

Checksum_32Bit_Routine proc near
arg_0 = dword ptr 4
arg_4 = dword ptr 8
arg_8 = dword ptr 0Ch
arg_C = dword ptr 10h
    mov eax, [esp+arg_C]
    mov edx, [esp+arg_4]
    push edi
    mov edi, [esp+4+arg_8]
    test di, di
    jz short loc_0_43FDB0
    push ebx
    push ebp
    push esi
    mov esi, [esp+10h+arg_0]
    and edi, 0FFFFh
loc_0_43FD7F:
    xor ecx, ecx
    mov ebp, eax
    mov cl, [edx]
    inc edx
    mov ebx, ecx
    xor ebx, eax
    and ebx, 0Fh
    shr ebp, 4
    mov eax, [esi+ebx*4]
    xor eax, ebp
    shr ecx, 4
    mov ebx, eax
    and ecx, 0Fh
    and ebx, 0Fh
    xor ecx, ebx
    shr eax, 4
    mov ecx, [esi+ecx*4]
    xor eax, ecx
    dec edi
    jnz short loc_0_43FD7F
    pop esi
    pop ebp
    pop ebx
loc_0_43FDB0:
    pop edi
    retn
Checksum_32Bit_Routine endp

; ripped from CDRWin V3.8A 12/27/99, still up-to-date with DAO V3.8B July
CDRWin_Blacklisted_Routine proc near
var_250 = dword ptr -250h
var_24C = dword ptr -24Ch
var_248 = dword ptr -248h
var_244 = dword ptr -244h
var_240 = dword ptr -240h
var_23C = dword ptr -23Ch
var_238 = dword ptr -238h
var_234 = dword ptr -234h
var_230 = dword ptr -230h
var_22C = dword ptr -22Ch
var_228 = dword ptr -228h
var_224 = dword ptr -224h
var_220 = dword ptr -220h
var_21C = dword ptr -21Ch
var_218 = dword ptr -218h
var_214 = dword ptr -214h
var_210 = dword ptr -210h
var_20C = dword ptr -20Ch
var_208 = dword ptr -208h
var_204 = dword ptr -204h
var_200 = dword ptr -200h
var_1FC = dword ptr -1FCh
var_1F8 = dword ptr -1F8h
var_1F4 = dword ptr -1F4h
var_1F0 = dword ptr -1F0h
var_1EC = dword ptr -1ECh
var_1E8 = dword ptr -1E8h
var_1E4 = dword ptr -1E4h
var_1E0 = dword ptr -1E0h
var_1DC = dword ptr -1DCh
var_1D8 = dword ptr -1D8h
var_1D4 = dword ptr -1D4h
var_1D0 = dword ptr -1D0h
var_1CC = dword ptr -1CCh
var_1C8 = dword ptr -1C8h
var_1C4 = dword ptr -1C4h
var_1C0 = dword ptr -1C0h
var_1BC = dword ptr -1BCh
var_1B8 = dword ptr -1B8h
var_1B4 = dword ptr -1B4h
var_1B0 = dword ptr -1B0h
var_1AC = dword ptr -1ACh
var_1A8 = dword ptr -1A8h
var_1A4 = dword ptr -1A4h
var_1A0 = dword ptr -1A0h
var_19C = dword ptr -19Ch
var_198 = dword ptr -198h
var_194 = dword ptr -194h
var_190 = dword ptr -190h
var_18C = dword ptr -18Ch
var_188 = dword ptr -188h
var_184 = dword ptr -184h
var_180 = dword ptr -180h
var_17C = dword ptr -17Ch
var_178 = dword ptr -178h
var_174 = dword ptr -174h
var_170 = dword ptr -170h
var_16C = dword ptr -16Ch
var_168 = dword ptr -168h
var_164 = dword ptr -164h
var_160 = dword ptr -160h
var_15C = dword ptr -15Ch
var_158 = dword ptr -158h
var_154 = dword ptr -154h
var_150 = dword ptr -150h
var_14C = dword ptr -14Ch
var_148 = dword ptr -148h
var_144 = dword ptr -144h
var_140 = dword ptr -140h
var_13C = dword ptr -13Ch
var_138 = dword ptr -138h
var_134 = dword ptr -134h
var_130 = dword ptr -130h
var_12C = dword ptr -12Ch
var_128 = dword ptr -128h
var_124 = dword ptr -124h
var_120 = dword ptr -120h
var_11C = dword ptr -11Ch
var_118 = dword ptr -118h
var_114 = dword ptr -114h
var_110 = dword ptr -110h
var_10C = dword ptr -10Ch
var_108 = dword ptr -108h
var_104 = dword ptr -104h
var_100 = dword ptr -100h
var_FC = dword ptr -0FCh
var_F8 = dword ptr -0F8h
var_F4 = dword ptr -0F4h
var_F0 = dword ptr -0F0h
var_EC = dword ptr -0ECh
var_E8 = dword ptr -0E8h
var_E4 = dword ptr -0E4h
var_E0 = dword ptr -0E0h
var_DC = dword ptr -0DCh
var_D8 = dword ptr -0D8h
var_D4 = dword ptr -0D4h
var_D0 = dword ptr -0D0h
var_CC = dword ptr -0CCh
var_C8 = dword ptr -0C8h
var_C4 = dword ptr -0C4h
var_C0 = dword ptr -0C0h
var_BC = dword ptr -0BCh
var_B8 = dword ptr -0B8h
var_B4 = dword ptr -0B4h
var_B0 = dword ptr -0B0h
var_AC = dword ptr -0ACh
var_A8 = dword ptr -0A8h
var_A4 = dword ptr -0A4h
var_A0 = dword ptr -0A0h
var_9C = dword ptr -9Ch
var_98 = dword ptr -98h
var_94 = dword ptr -94h
var_90 = dword ptr -90h
var_8C = dword ptr -8Ch
var_88 = dword ptr -88h
var_84 = dword ptr -84h
var_80 = dword ptr -80h
var_7C = dword ptr -7Ch
var_78 = dword ptr -78h
var_74 = dword ptr -74h
var_70 = dword ptr -70h
var_6C = dword ptr -6Ch
var_68 = dword ptr -68h
var_64 = dword ptr -64h
var_60 = dword ptr -60h
var_5C = dword ptr -5Ch
var_58 = dword ptr -58h
var_54 = dword ptr -54h
var_50 = dword ptr -50h
var_4C = dword ptr -4Ch
var_48 = dword ptr -48h
var_44 = dword ptr -44h
var_40 = dword ptr -40h
var_3C = dword ptr -3Ch
var_38 = dword ptr -38h
var_34 = dword ptr -34h
var_30 = dword ptr -30h
var_2C = dword ptr -2Ch
var_28 = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr  4
    sub esp, 250h
    push ebx
    mov ecx, 8574D6DAh
    mov eax, 52FAEF70h
    push esi
    push edi
    mov [esp+25Ch+var_248], 0A7ECB4BCh
    mov [esp+25Ch+var_244], 4F53C64Ch
    mov [esp+25Ch+var_240], 40BB4C25h
    mov [esp+25Ch+var_23C], 15B85CC9h
    mov [esp+25Ch+var_238], 60CF10ADh
    mov [esp+25Ch+var_234], 0C40DF385h
    mov [esp+25Ch+var_230], 3FBF9B41h
    mov [esp+25Ch+var_22C], 0C74BB7D7h
    mov [esp+25Ch+var_228], 0C1E43D51h
    mov [esp+25Ch+var_224], 345B3B7Eh
    mov [esp+25Ch+var_220], 717CDBC6h
    mov [esp+25Ch+var_21C], 4CF3D66Eh
    mov [esp+25Ch+var_218], 0FD1A3279h
    mov [esp+25Ch+var_214], 68D236F3h
    mov [esp+25Ch+var_210], 7D4BE720h
    mov [esp+25Ch+var_20C], 9C309CC1h
    mov [esp+25Ch+var_208], 659E52F8h
    mov [esp+25Ch+var_204], 0B42FED5Eh
    mov [esp+25Ch+var_200], 0E21BADD5h
    mov [esp+25Ch+var_1FC], 3E89D2B9h
    mov [esp+25Ch+var_1F8], 6D712456h
    mov [esp+25Ch+var_1F4], 0E1CF582Bh
    mov [esp+25Ch+var_1F0], 2B46EDEDh
    mov [esp+25Ch+var_1EC], 3285CC23h
    mov [esp+25Ch+var_1E8], 0F4465C0Eh
    mov [esp+25Ch+var_1E4], 31B3668Eh
    mov [esp+25Ch+var_1E0], 43799AFAh
    mov [esp+25Ch+var_1DC], 0F74F1CC8h
    mov [esp+25Ch+var_1D8], 0A194ED65h
    mov [esp+25Ch+var_1D4], 85468981h
    mov [esp+25Ch+var_1D0], 0DFFCA902h
    mov [esp+25Ch+var_1CC], 275590D1h
    mov [esp+25Ch+var_1C8], 37645E8Ah
    mov [esp+25Ch+var_1C4], 0D3AACB15h
    mov [esp+25Ch+var_1C0], 8672DEDBh
    mov [esp+25Ch+var_1BC], 0BD973BE0h
    mov [esp+25Ch+var_1B8], 278A0A4h
    mov [esp+25Ch+var_1B4], 0E911813Eh
    mov [esp+25Ch+var_1B0], 65DBAA75h
    mov [esp+25Ch+var_1AC], 49C93F5Eh
    mov [esp+25Ch+var_1A8], 784FFB86h
    mov [esp+25Ch+var_1A4], 0BE3D7B75h
    mov [esp+25Ch+var_1A0], ecx
    mov [esp+25Ch+var_19C], eax
    mov [esp+25Ch+var_198], 0FF695CF2h
    mov [esp+25Ch+var_194], 5425BDFCh
    mov [esp+25Ch+var_190], 0C964FD3Fh
    mov [esp+25Ch+var_18C], 0C3C307EFh
    mov [esp+25Ch+var_188], 99D948C7h
    mov [esp+25Ch+var_184], 0E65323AAh
    mov [esp+25Ch+var_180], 773F84B8h
    mov [esp+25Ch+var_17C], 0A79DF75Fh
    mov [esp+25Ch+var_178], 712A0DC8h
    mov [esp+25Ch+var_174], 0D84B09C1h
    mov [esp+25Ch+var_170], 0F7152AD8h
    mov [esp+25Ch+var_16C], 5F9355FEh
    mov [esp+25Ch+var_168], 0CF9B73B0h
    mov [esp+25Ch+var_164], 5EC34700h
    mov [esp+25Ch+var_160], 95D1B737h
    mov [esp+25Ch+var_15C], 0D590AA84h
    mov [esp+25Ch+var_158], 153F6E04h
    mov [esp+25Ch+var_154], 74797D39h
    mov [esp+25Ch+var_150], 213A82D2h
    mov [esp+25Ch+var_14C], 368A30EFh
    mov [esp+25Ch+var_148], 984244BBh
    mov [esp+25Ch+var_144], 782FA2Eh
    mov [esp+25Ch+var_140], 49934854h
    mov [esp+25Ch+var_13C], 0CB3552BAh
    mov [esp+25Ch+var_138], 44C23803h
    mov [esp+25Ch+var_134], 0E4524969h
    mov [esp+25Ch+var_130], 273D5E9Ah
    mov [esp+25Ch+var_12C], 0ED700070h
    mov [esp+25Ch+var_128], 55111A62h
    mov [esp+25Ch+var_124], 7D298F42h
    mov [esp+25Ch+var_120], 4F6D9D02h
    mov [esp+25Ch+var_11C], 92C9C7AAh
    mov esi, [esp+25Ch+arg_0]
    mov [esp+25Ch+var_30], ecx
    mov [esp+25Ch+var_2C], eax