这同样有壳 去壳过程没技术含量~
不知道是作者太那啥还是所用的编译器太那啥~看下面一段代码…
004431FC |> /A1 34584400 /mov eax, dword ptr [445834]
00443201 |. |8B13 |mov edx, dword ptr [ebx]
00443203 |. |0FB64410 FF |movzx eax, byte ptr [eax+edx-1] ; NameList~
00443208 |. |8D55 F8 |lea edx, dword ptr [ebp-8]
0044320B |. |E8 4844FCFF |call 00407658 ; %d
00443210 |. |8B55 F8 |mov edx, dword ptr [ebp-8]
00443213 |. |B8 38584400 |mov eax, 00445838
00443218 |. |E8 0706FCFF |call 00403824
0044321D |. |8B03 |mov eax, dword ptr [ebx] ; [ebx]
0044321F |. |A3 44584400 |mov dword ptr [445844], eax
00443224 |. |A1 38584400 |mov eax, dword ptr [445838]
00443229 |. |E8 5A44FCFF |call 00407688
0044322E |. |F72D 44584400 |imul dword ptr [445844] ; 115D*[ebx]?
00443234 |. |A3 4C584400 |mov dword ptr [44584C], eax
00443239 |. |6B03 13 |imul eax, dword ptr [ebx], 13 ; eax== [ebx]*0x13
0044323C |. |8906 |mov dword ptr [esi], eax
0044323E |. |8B06 |mov eax, dword ptr [esi]
00443240 |. |03C0 |add eax, eax ; eax*2
00443242 |. |83C0 03 |add eax, 3 ; +3
00443245 |. |8906 |mov dword ptr [esi], eax
00443247 |. |A1 4C584400 |mov eax, dword ptr [44584C]
0044324C |. |F72E |imul dword ptr [esi] ; 115D*~
0044324E |. |A3 50584400 |mov dword ptr [445850], eax
00443253 |. |A1 50584400 |mov eax, dword ptr [445850]
00443258 |. |F72E |imul dword ptr [esi] ; *~
0044325A |. |0105 40584400 |add dword ptr [445840], eax ; 0x53++++
00443260 |. |FF03 |inc dword ptr [ebx] ; ++
00443262 |> |A1 34584400 mov eax, dword ptr [445834]
00443267 |. |E8 E007FCFF |call 00403A4C
0044326C |. |3B03 |cmp eax, dword ptr [ebx]
0044326E |.^\7D 8C \jge short 004431FC
一点精简 效率性都没有…=.=
一组可用Key:
KeyOne:
13028-31x23e93-z14d20
KeyTwo:
ShadowKong
464411239-Oc3k
DownMe:KeyGen
关于这个CM 作者排除了几个Name Dasm翻几下就能知道~
还有CM那里限制了只能输入0xF个Name字符~