hru4.dpr

用来查看被EncryptPE V2.2007.12.01加过东东的授权信息 来自unpack.cn的shoooo大侠。 写这东西的主要目的有4个 1. 好玩 2. 熟悉一下delphi 3.

program hru4;

uses
  Windows,Messages,commdlg,SysUtils;

type
  PUserRecord = ^TUserRecord;
  TUserRecord = record
    Bz: Byte;
    ValueSize: Integer;
    ValueBuf: Pointer;
    PassSize: Integer;
    PassBuf: Pointer;
  end;

var
  ofn:  OPENFILENAME;
  fnm:  string;
  md:   integer;
  fs:   integer;
  ep:   integer;
  bzd:  integer;
  nfo:  string;
  key:  string;
  hru:  string;

  HInt: Integer = High(Integer);
  RegisterHandle: HWND;

procedure GetRegisterHandle;
var
  TempStr: string;
  i: Integer;
  hFileMap: Cardinal;
  TempP: ^Cardinal;
begin
  RegisterHandle := 0;
  TempStr := GetModuleName(HInstance);
  i := Pos('\', TempStr);
  while i > 0 do
  begin
    TempStr := Copy(TempStr, 1, i - 1) + '/' + Copy(TempStr, i + 1, Length(TempStr) - i);
    i := Pos('\', TempStr);
  end;
  TempStr := TempStr + '/' + IntToHex(GetCurrentProcessID, 8);
  hFileMap := OpenFileMapping(FILE_MAP_WRITE, False, PChar(TempStr));
  if hFileMap > 0 then
  begin
    TempP := MapViewOfFile(hFileMap, FILE_MAP_WRITE, 0, 0, 0);
    if TempP <> nil then
    begin
      RegisterHandle := TempP^;
      UnmapViewOfFile(TempP);
    end;
    CloseHandle(hFileMap);
  end;
end;  

function StringDecrypt(SourceString: string; Password: string = ''; HFlag: Boolean = True): string;
var
  P: TUserRecord;
  i, MessageResult: Integer;
begin
  Result := '';
  if (SourceString = '') or not IsWindow(RegisterHandle) then
    Exit;
  if HFlag then
    P.Bz := 111
  else
    P.Bz := 121;
  P.ValueSize := Length(SourceString);
  P.ValueBuf := @SourceString[1];
  P.PassSize := Length(Password);
  if P.PassSize > 0 then
    P.PassBuf := @Password[1]
  else
    P.PassBuf := nil;
  for i := 1 to 100 do
  begin
    MessageResult := SendMessage(RegisterHandle, WM_USER, HInt, Integer(@P));
    if MessageResult = 1 then
    begin
      {try
        SetLength(Result, P.ValueSize);
        CopyMemory(@Result[1], P.ValueBuf, P.ValueSize);
      except
        Result := '';
      end;}
      Result := PChar(P.ValueBuf);
      Break;
    end;
  end;
end;  

begin
  SetLength(fnm, MAX_PATH);
  ZeroMemory(pchar(fnm), 0);
  ofn.lStructSize := sizeof(OPENFILENAME);
  ofn.hWndOwner := 0;
  ofn.lpstrFilter := 'EXE Files'+#0+'*.EXE'+#0#0;
  ofn.lpstrFile := pchar(fnm);
  ofn.nFilterIndex := 1;
  ofn.nMaxFile := MAX_PATH;
  ofn.lpstrTitle := 'who are you IV by shoooo[CUG]';
  ofn.Flags := OFN_EXPLORER or OFN_FILEMUSTEXIST;

  if not GetOpenFileName(ofn) then
    ExitProcess(0);

  md := integer(LoadLibraryEx(pchar(fnm), 0, DONT_RESOLVE_DLL_REFERENCES));
  if md = 0 then
    ExitProcess(0);

  fs := pinteger(md+$3c)^;
  ep := pinteger(md+fs+$28)^;

  if ep = 0 then
    ExitProcess(0);

  if (lstrcmpi(pchar(md+ep+$200), 'V220071201.EPE') <> 0) then
    ExitProcess(0);

  fs := md + ep + $220;
  fs := pinteger(fs)^ + pinteger(fs+4)^ + fs + 9;
  if ( (pinteger(fs)^ and $08) = 8) then
    bzd := 1
  else
    bzd := 0;
  fs := fs + 4;
  fs := pinteger(fs)^ + pinteger(fs+4)^ + fs + 8;

  ep := lstrlen(pchar(fs));
  SetLength(nfo, ep);
  CopyMemory(pchar(nfo), Pointer(fs), ep);

  GetRegisterHandle();
  key := 'B96BD9AA7ADA94'+#$8B#$08#$8B#$50#$04#$83#$C0#$09#$01#$D0#$01#$C8#$50#$FF#$D3#$6A;
  if bzd = 1 then
    key := key + 'B';
  hru := StringDecrypt(nfo, key, TRUE);

  nfo := '硬件:' + Copy(hru, 1, 24) + #13#10 + '注册:' + Copy(hru, 25, Length(hru));
  MessageBox(0, pchar(nfo), '信息', $40);

end.