160 - 40 DaNiEl-RJ.1

环境
Windows xp sp3

工具
1.exeinfo PE
2.ollydbg

查壳
无壳Delphi程序

测试：
按照说明点到这个注册窗口。

OD载入搜字符串，直接可以定位到这里

0042D4A8  /.  55            push ebp
0042D4A9  |.  8BEC          mov ebp,esp
0042D4AB  |.  33C9          xor ecx,ecx
0042D4AD  |.  51            push ecx
0042D4AE  |.  51            push ecx
0042D4AF  |.  51            push ecx
0042D4B0  |.  51            push ecx
0042D4B1  |.  53            push ebx
0042D4B2  |.  56            push esi
0042D4B3  |.  57            push edi
0042D4B4  |.  8BF0          mov esi,eax
0042D4B6  |.  33C0          xor eax,eax
0042D4B8  |.  55            push ebp
0042D4B9  |.  68 B2D54200   push DaNiEl-R.0042D5B2
0042D4BE  |.  64:FF30       push dword ptr fs:[eax]
0042D4C1  |.  64:8920       mov dword ptr fs:[eax],esp
0042D4C4  |.  8D55 F8       lea edx,[local.2]
0042D4C7  |.  8B86 DC010000 mov eax,dword ptr ds:[esi+0x1DC]
0042D4CD  |.  E8 8EC9FEFF   call DaNiEl-R.00419E60                   ;  读入name
0042D4D2  |.  837D F8 00    cmp [local.2],0x0
0042D4D6  |.  74 14         je XDaNiEl-R.0042D4EC
0042D4D8  |.  8D55 F4       lea edx,[local.3]
0042D4DB  |.  8B86 E0010000 mov eax,dword ptr ds:[esi+0x1E0]
0042D4E1  |.  E8 7AC9FEFF   call DaNiEl-R.00419E60                   ;  读入serial
0042D4E6  |.  837D F4 00    cmp [local.3],0x0
0042D4EA  |.  75 0F         jnz XDaNiEl-R.0042D4FB
0042D4EC  |>  B8 C8D54200   mov eax,DaNiEl-R.0042D5C8                ;  ASCII "One of the fields is empty!"
0042D4F1  |.  E8 02FCFFFF   call DaNiEl-R.0042D0F8
0042D4F6  |.  E9 8C000000   jmp DaNiEl-R.0042D587
0042D4FB  |>  BB 01000000   mov ebx,0x1
0042D500  |.  8D55 F8       lea edx,[local.2]
0042D503  |.  8B86 DC010000 mov eax,dword ptr ds:[esi+0x1DC]
0042D509  |.  E8 52C9FEFF   call DaNiEl-R.00419E60
0042D50E  |.  8B45 F8       mov eax,[local.2]
0042D511  |.  E8 AA62FDFF   call DaNiEl-R.004037C0
0042D516  |.  8BF8          mov edi,eax
0042D518  |.  8D45 FC       lea eax,[local.1]
0042D51B  |.  E8 2460FDFF   call DaNiEl-R.00403544
0042D520  |.  3BFB          cmp edi,ebx
0042D522  |.  7C 32         jl XDaNiEl-R.0042D556
0042D524  |>  8D55 F8       /lea edx,[local.2]
0042D527  |.  8B86 DC010000 |mov eax,dword ptr ds:[esi+0x1DC]
0042D52D  |.  E8 2EC9FEFF   |call DaNiEl-R.00419E60                  ;  读入name
0042D532  |.  8B45 F8       |mov eax,[local.2]
0042D535  |.  33D2          |xor edx,edx
0042D537  |.  8A5418 FF     |mov dl,byte ptr ds:[eax+ebx-0x1]
0042D53B  |.  83C2 05       |add edx,0x5                             ;  对name上每一个位加上5
0042D53E  |.  8D45 F0       |lea eax,[local.4]
0042D541  |.  E8 A261FDFF   |call DaNiEl-R.004036E8
0042D546  |.  8B55 F0       |mov edx,[local.4]
0042D549  |.  8D45 FC       |lea eax,[local.1]                       ;  结果存到这里
0042D54C  |.  E8 7762FDFF   |call DaNiEl-R.004037C8
0042D551  |.  43            |inc ebx
0042D552  |.  3BFB          |cmp edi,ebx
0042D554  |.^ 7D CE         \jge XDaNiEl-R.0042D524
0042D556  |>  8D55 F8       lea edx,[local.2]
0042D559  |.  8B86 E0010000 mov eax,dword ptr ds:[esi+0x1E0]
0042D55F  |.  E8 FCC8FEFF   call DaNiEl-R.00419E60
0042D564  |.  8B45 F8       mov eax,[local.2]                        ;  输入的serial
0042D567  |.  8B55 FC       mov edx,[local.1]                        ;  name + 5  的结果
0042D56A  |.  E8 6163FDFF   call DaNiEl-R.004038D0                   ;  判断是否相同而已
0042D56F  |.  75 0C         jnz XDaNiEl-R.0042D57D
0042D571  |.  B8 ECD54200   mov eax,DaNiEl-R.0042D5EC                ;  ASCII "Congratz cracker! hehehe"
0042D576  |.  E8 7DFBFFFF   call DaNiEl-R.0042D0F8
0042D57B  |.  EB 0A         jmp XDaNiEl-R.0042D587
0042D57D  |>  B8 10D64200   mov eax,DaNiEl-R.0042D610                ;  ASCII "No no no! :( Try again!"
0042D582  |.  E8 71FBFFFF   call DaNiEl-R.0042D0F8
0042D587  |>  33C0          xor eax,eax
0042D589  |.  5A            pop edx
0042D58A  |.  59            pop ecx
0042D58B  |.  59            pop ecx
0042D58C  |.  64:8910       mov dword ptr fs:[eax],edx
0042D58F  |.  68 B9D54200   push DaNiEl-R.0042D5B9
0042D594  |>  8D45 F0       lea eax,[local.4]
0042D597  |.  E8 A85FFDFF   call DaNiEl-R.00403544
0042D59C  |.  8D45 F4       lea eax,[local.3]
0042D59F  |.  BA 02000000   mov edx,0x2
0042D5A4  |.  E8 BF5FFDFF   call DaNiEl-R.00403568
0042D5A9  |.  8D45 FC       lea eax,[local.1]
0042D5AC  |.  E8 935FFDFF   call DaNiEl-R.00403544
0042D5B1  \.  C3            retn