riscmirc.asm

破解很多程序的序列号算法程序

; tasm riscmirc
; tlink /t riscmirc

.MODEL TINY
.CODE
.386
ORG 100h

start:  jmp main

;_______________________________________________________________

    intro       db 10,13, 'Mirc 5.x ** kEYGEN #2 bY R!SC ** [e-mail] **'
                db 10,13, 'Please enter more than 5 letters',10,13,10,13
                db 10,13, 'eNTER yOUR nAME : ', '$'

    input       db 26h, 0
    input2      db  26h dup(0)
    
    code        db 10,13, 'yOUR rEGCODE iS : '
    regcode     db 14 dup(20h)
    regend      db 10,13, '$'
    tempreg     db  20 dup (0)
    tempregend  db 0
    
    itshere     db "its here-->"
    
        reg1        dd  0       ; yah, contains part 1 of the reg code
        reg2        dd  0       ; yah, contains part 2...
                                ; but they need converting to decimal ASCii

    finished    db  "<-- in hex, just gotta convert it! (byte by byte)"
    
    noname      db 10,13,10,13 ,'Name is not a valid length!!', 10,13, '$'
    count       db  0
    Essential   dw 0Bh,06h,11h,0Ch,0Ch,0Eh,05h,0Ch,10h,0Ah,0Bh,06h,0Eh,0Eh,04h,0Bh
                dw 06h,0Eh,0Eh,04h,0Bh,09h,0Ch,0Bh,0Ah,08h,0Ah,0Ah,10h,08h,04h,06h,0Ah
                dw 0Ch,10h,08h,0Ah,04h,10h
    hiya        dw  0
   
;_______________________________________________________________

main:
        
        mov     ah, 9           ; print title
        lea     dx, intro       ; dx with offset ov text
        int     21h
        lea     dx, input
        mov     ah, 0ah
        int     21h
        
        cmp     byte ptr [input+1], 38
        jge     badname                 ; more than 37 chars
        cmp     byte ptr [input+1], 5   ; less than 5?
        jge     go
        
badname:      
        lea     dx, noname
        mov     ah, 9 
        int     21h
        mov     ax, 4C00h   ; Exit 
        int     21h


go:
 
start_conversion_of_name:

;        int 03
        xor     eax,eax
        mov     byte ptr [count],03     ; start with letter 4?
        lea     dx,Essential
        mov     word ptr [hiya], dx     ; get a pointer to magic array
        lea     si, input2              ; name in si
        add     si,03                   ; letter 4?
        
reg_loop_1:     
        movzx   ebx, byte ptr [si]      ; move char into ebx
        xor     ecx,ecx
        mov     di, [hiya]              ; get our magic array pointer
        movzx   ecx, word ptr [di]      ; move a number from it into ecx
        imul    ebx, ecx                ; multiply char with magic number
        add     eax,ebx                 ; add result to reg1
        add     word ptr [hiya],02      ; make pointer point to next magic number
        inc     byte ptr [count]        ; inc our letter counter
        inc     si                      ; point to next char
        push    eax                     ; store reg1
        mov     al, byte ptr [input+1]  ; get name length
        cmp     byte ptr [count], al    ; check it
        pop     eax                     ; restore our reg1
        jne     reg_loop_1              ; if count & length are not equal, loop
        mov     [reg1], eax             ; i doubt there will be a name with more than 26h chars in it
                                        ; as my buffer is only 20h!!!
        
done_first_half:

        xor     eax,eax                 ; do it all again
        mov     byte ptr [count],03     ; how i long for 32bit addressing in 16bit code...
        lea     dx,Essential            ; and a few more registers would be nice
        mov     word ptr [hiya], dx     ; golly, i wish i had a decent computer
        lea     si, input2
        add     si,03
        
reg_loop_2:     
        movzx   ebx, byte ptr [si]
        movzx   ecx, byte ptr [si-1]
        imul    ebx, ecx
        xor     ecx,ecx
        mov     di, [hiya]
        movzx   ecx, word ptr [di]
        imul    ebx, ecx
        add     eax,ebx
        add     word ptr [hiya],02
        inc     byte ptr [count]
        inc     si
        push    eax
        mov     al, byte ptr [input+1]
        cmp     byte ptr [count], al
        pop     eax
        jne     reg_loop_2
        mov     [reg2], eax
        mov     ebx, eax
        mov     eax, [reg1]
        
 ;      int 03       ; in softice, type in 'bpint 03'
                    ; then compile & run this code, when softice pops up
                    ; the reg code is eax-ebx
                    ; yah, do ? eax, then ? ebx
                    ; then you have the code...
        
        
;fix the numbers

 
convert_eax_ebx:

        lea si, tempregend-1    ; temp storing place, starting from the end
        mov     eax, [reg2]     ; start with reg2, and we calculate it backwords
        mov     ecx, 0ah        ; divisor (10)
        xor     edx, edx
l11:
        div ecx                 ; divide eax by 10
        add dl, 30h             ; remainder is last decimal digit, left in edx
        mov [si],dl             ; save it
        dec si                  
        xor edx,edx             ; clear remainder
        test    eax,eax         ; check we still have a number to work with
        jne l11
        mov byte ptr [si],'-'   ; stick in the divider between our numbers
        dec si
        
        mov     eax, [reg1]     ; just have to convert reg1 now...
l12:
        div ecx
        add dl, 30h
        mov [si],dl
        dec si
        xor edx,edx
        test    eax,eax
        jne l12
conversion_done:        
        inc si                  ; point to first digit..
        lea di, regcode         ; where to copy it to
copy_number:
        movsb                   ; copy it, byte by byte
        cmp    byte ptr [si],0  ; see if we have finished
        jne copy_number         ; if not, loop

        mov     ah, 9           ; print code
        lea     dx, code        ; dx with offset ov text
        int     21h

        mov     ax, 4C00h       ; All Done And Exit 
        int     21h


  end    start