unit2.pas

投名状脱机登录DELPHI源代码。在D7、windows2003上测试通过可用。

  mov     eax, [esp+$18]
  dec     eax
  mov     [esp+$18], eax
  jnz     @FOUR
  pop     edi
  pop     esi
  pop     ebp
  pop     ebx
  pop     ecx

  jmp @GoEnd
@Begin:
  mov     edx, [esp+$4]
  push    esi
  mov     esi, [esp+$C]
  mov     ecx, $20
  and     esi, $1F
  mov     eax, edx
  sub     ecx, esi
  shr     eax, cl
  mov     ecx, esi
  pop     esi
  shl     edx, cl
  or      eax, edx
  retn
@GoEnd:
  nop
end;

procedure MakePass;
var
  s:string;
begin
  s:='ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp';
  asm
    pushad
    mov     esi,$10
    lea     edx, LoginPackage.Packed_Pass
    lea     edi,Key
    push    $80
    push    edx
    lea     ecx,Key                   //KEY
  end;
  CreateMiMaPacked;
  asm
    add     esp,$8
    popad
  end;
end;

procedure CreateMiMaPacked;
asm
  sub     esp, $8
  mov     eax, [esp+$10]                                      // 取参数80
  push    ebp
  cdq
  and     edx, $7
  mov     [esp+$4], ecx
  add     eax, edx
  sar     eax, $3                                             // 右移3位
  shl     eax, $3                                             // 左移3位
  test    eax, eax
  jle     @ONE
  cdq
  and     edx, $7
  xor     ebp, ebp
  add     eax, edx
  sar     eax, $3
  test    eax, eax
  mov     [esp+$8], eax
  jle     @ONE
  push    ebx
  push    esi
  push    edi
  jmp     @TWO
@FOUR:
  mov     ecx, [esp+$10]                                      // 密码KEY地址
@TWO:
  mov     eax, [esp+$1C]                                      // 密码地址
  mov     edi, [ecx+$10]
  lea     ebx, [ecx+$1C]
  mov     dword ptr [esp+$20], $0C
  mov     esi, [eax+ebp*$8]
  mov     edx, [eax+ebp*$8+$4]
  add     esi, edi
  mov     edi, [ecx+$14]
  add     edi, edx
@THREE:
  mov     eax, edi
  push    edi
  xor     eax, esi
  push    eax
  call    @Begin
  mov     esi, [ebx-$4]
  add     esi, eax
  xor     edi, esi
  push    esi
  push    edi
  call    @Begin
  mov     edx, [ebx]
  add     esp, $10
  add     eax, edx
  add     ebx, $8
  mov     edi, eax
  mov     eax, [esp+$20]
  dec     eax
  mov     [esp+$20], eax
  jnz     @THREE
  mov     eax, [esp+$1C]
  inc     ebp
  mov     [eax+ebp*$8-$8], esi
  mov     [eax+ebp*$8-$4], edi
  cmp     ebp, [esp+$14]
  jl      @FOUR
  pop     edi
  pop     esi
  pop     ebx
@ONE:
  pop     ebp
  add     esp, $8

  jmp @GoEnd
@Begin:
  mov     edx, [esp+$4]
  push    esi
  mov     esi, [esp+$C]
  mov     ecx, $20
  and     esi, $1F
  mov     eax, edx
  sub     ecx, esi
  shr     eax, cl
  mov     ecx, esi
  pop     esi
  shl     edx, cl
  or      eax, edx
  retn
@GoEnd:
  nop
end;

////////////////////////////////
/////以下函数生成密钥表/////////
////////////////////////////////
procedure MakeTable;
var
  bufTable:array [0..1024] of Char;
begin
  bufTable:='';
  asm
    pushad
    lea ecx,[bufTable+$08]
  end;
  CreateCipherTable;
  asm
    popad
  end;
  CopyMemory(@RecvCipherTable[0],@bufTable[0],528);
  CopyMemory(@RecvCipherTable[528],@bufTable[8],528);
  CopyMemory(@SendCipherTable[0],@RecvCipherTable[0],1055);
  CopyMemory(@SendmCipherTable[0],@RecvCipherTable[0],1055);
end;

procedure CreateCipherTable;
begin
  asm
    push    ebp
    mov     ebp, esp
    push    ecx
    push    esi
    mov     al, $1F
    push    edi
    mov     edi, ecx
    mov     [ebp-$4], al
    xor     edx, edx
@THREE:
    mov     [edx+edi], al
    mov     eax, [ebp-$4]
    and     eax, $0FF
    mov     ecx, eax
    shl     ecx, $5
    and     ecx, $800000FF
    jns     @ONE
    dec     ecx
    or      ecx, $FFFFFF00
    inc     ecx
@ONE:
    add     ecx, $0FD
    imul    ecx, eax
    add     ecx, $7
    mov     eax, ecx
    and     eax, $800000FF
    jns     @TWO
    dec     eax
    or      eax, $FFFFFF00
    inc     eax
@TWO:
    inc     edx
    mov     [ebp-$4], al
    cmp     edx, $100
    jl      @THREE
    mov     dl, $3F
    xor     esi, esi
@FOUR:
    mov     al, dl
    mov     cl, $7A
    imul    cl
    sub     al, $31
    mov     [edi+esi+$100], dl
    imul    dl
    sub     al, $1B
    inc     esi
    cmp     esi, $100
    mov     dl, al
    jl      @FOUR
    mov     eax, edi
    pop     edi
    pop     esi
    mov     esp, ebp
    pop     ebp
  end;
end;
////////////////////////////////
/////以上函数生成密钥表/////////
////////////////////////////////


procedure Encrypt(var buf;nLen:integer);
var
  s:string;
begin
  s:='eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee';
  SendCipherTable:='';
  CopyMemory(@SendCipherTable[0],@SendmCipherTable[0],1055);
  asm
    pushad
    push    $1
    mov     esi, nLen
    push    esi                                             //  取加数据长度
    mov     edx, buf                                        //  取加密字符串地址
    lea     ecx, SendCipherTable                                //  取密钥表地址
    push    edx                                             //  取数据存放地址
  end;
  EnOrDecryptData;
  asm
    add esp,$c
    popad
  end;
end;

procedure Decrypt(var buf;nLen:integer);
var
  s:string;
begin
  s:='ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd';
  asm
    pushad
    push    $1
    push    nLen                                          // 取加密数据长度
    lea     ecx, RecvCipherTable                              // 取密钥表地址
    push    buf                                           // 取数据存放地址
  end;
  EnOrDecryptData;
  asm
    add esp,$c
    popad
  end;
end;

procedure EnOrDecryptData;
begin
  asm
    push    ebp
    mov     ebp, esp
    sub     esp, $8
    mov     edx, [ecx+$4]
    mov     eax, [ecx]                       // 取密码表第一个双字，ECX为密钥表首地址
    mov     [ebp-$8], edx
    mov     edx, [ebp+$C]
    push    esi
    xor     esi, esi                         // 要加密的数据偏移量清0
    test    edx, edx
    mov     [ebp-$4], eax
    jle     @ONE
    push    ebx
    push    edi
    mov     edi, [ebp+$8]
@THREE:
    mov     eax, [ecx]                       // 取密码表第一个双字，ECX为密钥表首地址
    mov     bl, [esi+edi]                    // 取字符串一个字节（EDI为首地址，ESI为偏移量）
    mov     al, [eax+ecx+$8]                  // 取第一个密钥（位置＝密码表第一个双字＋密码表首地址＋8）
    xor     bl, al                           // 一次加密
    mov     [esi+edi], bl                    // 送回这个值到当前字符所在的字符串位置
    mov     al, bl                           // 把这个加密后的字符暂时保存
    mov     ebx, [ecx+$4]                     // 取密钥表第二个双字，位置相对于当前密钥表的首地址的第二个双字
    mov     bl, [ebx+ecx+$108]                // 取第二个密钥（位置＝密码表第二个双字＋密码表首地址＋108）
    xor     bl, al                           // 二次加密
    mov     [esi+edi], bl                    // 放回原位
    mov     ebx, [ecx]                       // 给当前密钥表第一个双字+1
    inc     ebx                              // /
    mov     eax, ebx                         // /
    mov     [ecx], ebx                       // /
    cmp     eax, $100                         // 比较密钥表第一个双字是否大于100(十进制256)
    jl      @TWO                              // 小于继续
    mov     ebx, [ecx+$4]                     // 大于对第一个双字清0，并对第二个双字＋1
    mov     dword ptr [ecx], $0
    inc     ebx
    mov     eax, ebx
    mov     [ecx+$4], ebx
    cmp     eax, $100
    jl      @TWO
    mov     dword ptr [ecx+$4], $0
@TWO:
    inc     esi                              // 给字符串偏移指针＋1
    cmp     esi, edx                         // 是否加密完
    jl      @THREE                           // 没有就继续
    pop     edi
    pop     ebx
@ONE:
    mov     al, [ebp+$10]                     // 函数第三个参数：1
    pop     esi
    test    al, al
    jnz     @FOUR
    mov     edx, [ebp-$4]
    mov     eax, [ebp-$8]
    mov     [ecx], edx
    mov     [ecx+$4], eax
@FOUR:
    mov     esp, ebp
    pop     ebp
  end;
end;

initialization

  DllHandle:=LoadLibrary('msvcrt.dll');
  if DllHandle<>0 then
  begin
    @Rand:=GetProcAddress(DllHandle,'rand');
    @SRand:=GetProcAddress(DllHandle,'srand');
  end;

end.