|
|
Eagle的破文：(重写)FlashGet1.65的算号器
, b) O, C9 J% U& L' d
) K) X. ?2 }( v1 h: k) W再次声明：本破文曾发表于www.chinadfcg.com' p: n1 b4 M9 T
声明：上次写完1.60A的算号器，LeNgHost告诉我，FlashGet会在一段时间后验证第四段KEY，所以现在针对最新的FlashGet重写了算号破文。谢谢大家的支持。其实，这个算号器算出来的号还不是正版的。只能用一段时间，因为最后的几段的算法我没有时间去找了。
, ~7 q7 k0 P" p) B$ O$ ^
# }: h/ W7 i# Z: e: M* W% ~+ t【破解作者】 Eagle
4 B: G, }& t! S【作者邮箱】 eagle_twenty@163.com
* d: E. u& Z7 a$ m8 ^! C【使用工具】 OllyDbg1.098 ]- _. j% K$ p
【破解平台】 WinXP9 n, s7 \. i: V& [' l& ~- J9 N
【软件名称】 FlashGet1.65
; B+ _3 h$ F; O7 V( u( E+ r【加壳方式】 无壳
h. \. G3 C- u: t$ ?5 x" F【破解声明】 1 O( p2 h; p# m' w+ `5 U& D
--------------------------------------------------------------------------------
4 _0 Z" o& g" Y/ f3 A& u【破解内容】
# m% j5 d, n4 Y) Z! Q, s7 o: l3 j: e
2 A! D0 w3 m# ^1 L/ c7 }安装FlashGet1.60A并运行，输入完注册码的时候，它会提示重新启动软件来检测是否注册成功，同时用RegMoniter监视到FlashGet1.60A写入注册表项RegPass, RegName等。用PEID侦壳：无。
/ Y0 `+ i5 x* [/ u; @
" q) u% D* a( N1 Z0 N1.用OD加载FlashGet1.60A，查找参考字符串，在涉及RegPass的地方下断，运行* Z; ~2 n" c5 ]% F# X- X
2.程序第一次即中断在此，从上下文来看，这段代码有大量的跳转，有很大可能是注册码验证代码
4 Y; g& h; R/ P7 l6 O% w0041DCE6 |. 68 98E55200 PUSH flashget.0052E598 ; ASCII "RegPass"
+ P& o& V8 a% m6 g0041DCEB |. 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]: m5 a$ f3 o! W/ O. p
0041DCEF |. 68 A0C15200 PUSH flashget.0052C1A0 ; ASCII "General"
4 O% [& z. b1 W0041DCF4 |. 51 PUSH ECX6 f. c* r1 \ J6 B8 v
0041DCF5 |. 8BCD MOV ECX,EBP: h: R, Z& s+ ?5 t4 |) v
;这个CALL将从注册表中读入注册码: M' `7 O5 v% Y D7 k* b
0041DCF7 |. E8 54C70C00 CALL flashget.004EA450; A" ^9 @9 j8 _
# q3 E/ x, B6 S4 X; ~" @2 j+ r
3 m% t2 t; w5 ^8 i% D* p+ R分析下面一段代码，可以发现每个条件跳转都跳向flashget.0041DE7B，可以那儿就是验证失败后的跳转方向8 s- @. t2 M7 O, `* i9 F. I0 ?
……. m, V: P( i) _4 |0 p
0041DD27 |. 0F84 4E010000 JE flashget.0041DE7B8 s& ^3 j* Q3 ?1 W+ j) y
……1 H1 l6 m0 ~# [8 Y9 d2 B" n! S8 L
0041DD35 |. 0F84 40010000 JE flashget.0041DE7B% x) J; s1 P+ C: b
……" \; r" T% U2 r) h o" Y( H: g
0041DD4F |. 0F8E 26010000 JLE flashget.0041DE7B/ y( {( I. S: F l: u& s
……$ k0 @& w1 g5 {8 J% e4 _
0041DD63 |. 0F8C 12010000 JL flashget.0041DE7B
: Z, C; ~' T- ^4 _! ]6 j8 {……
% [" g1 |3 D' e! k1 ]; X0041DD77 |. 0F8C FE000000 JL flashget.0041DE7B* \, m; `; F$ z' |+ d7 b y: X
……
& t* v2 D2 |6 V9 ^6 G7 h9 C;下面这个CALL是计算KEY的长度的，要求的KEY的长度为0x2C，也就是44位! Q. ?$ y [7 y( ?3 U" {6 X
0041DD86 |. E8 F4200B00 CALL flashget.004CFE7F8 ~' n* p! w1 |7 P! C
0041DD8B |. 8B55 00 MOV EDX,DWORD PTR SS:[EBP]
! A5 `, g, Q6 m, p+ ?0041DD8E |. 8B42 F8 MOV EAX,DWORD PTR DS:[EDX-8]
; C" C2 z0 E9 @/ L7 U0041DD91 |. 83F8 2C CMP EAX,2C) r+ w- i. N# S, D+ ?. U* l
0041DD94 |. 0F85 E1000000 JNZ flashget.0041DE7B- ] v$ s/ G# r
: @& D m# f. I3 r;下面是验证注册码的类型的，fgc-和fgf-两种KEY的验证算法是一的，
/ r, R8 K* t4 _$ C;但用来对KEY进行解密的密钥是不一样的，我们可以看到密钥类型的标志是存入DWORD PTR SS:[ESP+10]3 z5 a$ T T& g' W7 b
;这次破解我们用的是fgf-的类型的密钥
+ p; s/ a. O1 K8 \0041DD9A |. 68 B0E55200 PUSH flashget.0052E5B0 ; ASCII "fgc-"5 O0 _7 S9 I. G% U+ y! I
0041DD9F |. 8BCD MOV ECX,EBP
( l$ M; g4 d' H8 _0041DDA1 |. E8 401D0B00 CALL flashget.004CFAE6: X0 {( Q! m( ^! Z J: y
0041DDA6 |. 85C0 TEST EAX,EAX% O+ s6 o! I9 A) |1 p/ K
0041DDA8 |. 75 06 JNZ SHORT flashget.0041DDB0# A; `( W. T- J, P: M! `
0041DDAA |. 895C24 10 MOV DWORD PTR SS:[ESP+10],EBX
6 T8 Y; t- S9 g0041DDAE |. EB 18 JMP SHORT flashget.0041DDC8 v: P4 j" j. ]
0041DDB0 |> 68 A8E55200 PUSH flashget.0052E5A8 ; ASCII "fgf-"3 Q9 t# w6 C0 u: [
0041DDB5 |. 8BCD MOV ECX,EBP
) W/ {9 j6 D$ O' p* e& [. O0041DDB7 |. E8 2A1D0B00 CALL flashget.004CFAE6
% ?' d5 L/ S$ w0041DDBC |. 85C0 TEST EAX,EAX
* v. s3 E* d1 S" |+ v0041DDBE |. 0F85 B7000000 JNZ flashget.0041DE7B$ @: u7 e$ ?- w9 X& w! a
0041DDC4 |. 894424 10 MOV DWORD PTR SS:[ESP+10],EAX
# g; h; {( i A8 d* R/ a2 E- x
9 H0 P/ Y0 _ D+ ?: P: l' Q0 S' y8 i" x
;下面是对KEY的验证算法
* j/ Z# Y6 ]% o6 U( i/ H @# E0041DDC8 |> 6A 2C PUSH 2C
5 t; q8 B& B6 O0 V0041DDCA |. 8BCD MOV ECX,EBP
( I5 Y: f1 N, T! N# b# J- ~! n, W; w6 r+ A0041DDCC |. E8 7A680B00 CALL flashget.004D464B
6 J4 H! |' g' o. q9 {( d" p0041DDD1 |. 8BF8 MOV EDI,EAX
! N7 L6 ?1 [. f/ n- l- O6 w0041DDD3 |. 33C9 XOR ECX,ECX1 q# ^0 A- {5 `% j0 q2 r9 U# C8 y
0041DDD5 |. 83C7 04 ADD EDI,4
6 Y" {/ P7 S* l6 Z2 c0 S3 c0041DDD8 |. 33F6 XOR ESI,ESI) }: [! q& X' p
% ~5 F$ J: D& L, E
2 [4 ?5 l% R1 t2 H# z+ A
分析下面一个循环，我们把每一段KEY的四们定义成ABCD，则有
L* v+ V5 l4 j# e% p5 o& ?0041DDDA |> 8B07 /MOV EAX,DWORD PTR DS:[EDI] X3 L1 r3 y* E! H( t* i% y
0041DDDC |. 8BD6 |MOV EDX,ESI: _7 n/ p0 ~% b9 n
0041DDDE |. 83C7 04 |ADD EDI,4& t8 Z: z, {( `3 r% z- q" I
0041DDE1 |. 83EA 00 |SUB EDX,0 ; Switch (cases 0..2)# |/ V8 v y% ~# M3 T& A
0041DDE4 |. 894424 1C |MOV DWORD PTR SS:[ESP+1C],EAX
$ J9 {- U. H- `" Y, O# [0041DDE8 |. 74 26 |JE SHORT flashget.0041DE10
2 c3 E/ Z4 h7 L7 s0041DDEA |. 4A |DEC EDX2 p- L& I# n* {7 Q2 m
0041DDEB |. 74 17 |JE SHORT flashget.0041DE04- M0 ~4 i) M' `# g% l
0041DDED |. 4A |DEC EDX) G+ V: k* i+ Q9 D# f j
0041DDEE |. 75 38 |JNZ SHORT flashget.0041DE28
) }* g/ L% ]8 q6 N1 e! V
5 V$ U9 t4 Q6 L* l) k2 e0041DDF0 |. 0FBE4C24 1E |MOVSX ECX,BYTE PTR SS:[ESP+1E] ; Case 2 of switch 0041DDE1# k5 ~' u& {$ H7 g6 g
0041DDF5 |. 0FBED4 |MOVSX EDX,AH1 }: U6 @4 b0 h2 ]6 ^- X: A1 }# @
0041DDF8 |. 0FAFCA |IMUL ECX,EDX1 N2 X2 M/ |$ Z$ k' P( i y
0041DDFB |. 0FBE5424 1F |MOVSX EDX,BYTE PTR SS:[ESP+1F]8 M1 z+ I# ]" _( A6 ]
0041DE00 |. 03CA |ADD ECX,EDX; R; D( G0 `( ?
0041DE02 |. EB 1F |JMP SHORT flashget.0041DE239 R5 r! ?. u* D9 k! z
;ECX = B * C + D
; K3 _0 D& @5 E* K5 z2 |3 ~2 K
y$ s/ ?9 c, h( ~1 e" Y6 ? Z
! T6 J# w* d& R2 d, m0041DE04 |> 0FBE4C24 1E |MOVSX ECX,BYTE PTR SS:[ESP+1E] ; Case 1 of switch 0041DDE1
. A0 q/ [/ F9 X0041DE09 |. 0FBED4 |MOVSX EDX,AH1 h, n# o A7 _5 b3 ~7 x
0041DE0C |. 23CA |AND ECX,EDX
- c& t8 } i/ J) `0041DE0E |. EB 0B |JMP SHORT flashget.0041DE1B
) c! i; y- ?7 c' O;ECX = C AND B+ [9 M+ G8 c, k: z6 I( K
& \% J# w/ y7 a2 K& r5 e( p
6 p+ F# M0 \% `( z d, T0041DE10 |> 8A4C24 1E |MOV CL,BYTE PTR SS:[ESP+1E] ; Case 0 of switch 0041DDE1
1 M" s5 s0 D* s2 s0041DE14 |. 8AD4 |MOV DL,AH6 k% |& M M" N" k, M% w
0041DE16 |. 33CA |XOR ECX,EDX
9 A0 o) k6 f1 R- F! ^- a5 x0041DE18 |. 83E1 7F |AND ECX,7F h$ n( x0 L9 W: A
;ECX = C XOR B，不要被后面的那个AND ECX,7F迷惑了，它只不过是用来把高位屏蔽的/ d8 J& H8 `& k) W' i" u6 |( U
; y; X- G/ p: M5 y( p+ g3 }
. e1 w* S1 z4 @% `/ J+ k8 u: R0041DE1B |> 0FBE5424 1F |MOVSX EDX,BYTE PTR SS:[ESP+1F]8 r. p, j8 q+ _1 T. X' j5 g1 k
0041DE20 |. 0FAFCA |IMUL ECX,EDX6 y/ ^& G% n% _- N5 t
;ECX = ECX * D
]: x0 V& h& A
4 q9 v; p" O1 h% `
/ ~+ y2 m' @3 U- P0041DE23 |> 0FBEC0 |MOVSX EAX,AL
% I0 ?# H) \% Z2 W; U1 q5 P0041DE26 |. 03C8 |ADD ECX,EAX7 p4 t" ]. J) J8 K
;ECX = ECX + A
' i' u' G# O9 c1 M R! Y; f9 m;处理后那些跳转，可以得到
- w! Q7 S+ F, a6 h' Q;Case 0:ECX = (C XOR B) * D + A3 [& N: S5 G+ |) C6 J$ Y3 J
;Case 1:ECX = (C AND B) * D + A2 g! R3 S; }. v* F- e% X
;Case 2:ECX = B * C + D + A
4 _) c7 M, Y+ _1 z2 m" x4 c6 u* j( j
7 }" R: w4 M. Z" ] s. n& q( }9 w0 M9 r
( G. ^6 T; |" J: A( o
;下面是用验证密钥来对算得的ECX值进行验证，我们来看它的密钥获取方法
; ?+ f1 Y' |( h) j7 d% @;密钥存放在DS:[52C72B]起始的一段空间，为kevinhyx12345，9 ?* R+ ^9 t) N
;如果KEY的第一段为fgf-，运算所用到的密钥是顺序从这个字符串中读取的，
- o3 O1 g! z4 B* v z, c7 ^9 b;如果KEY的第一段是fgc-，运算所用到的密钥是顺序在Case 2的时候会从DS:[52C72B]中读取，即密钥的第四位: i% r, L7 _3 X# j8 A C T
0041DE28 |> 8B4424 10 |MOV EAX,DWORD PTR SS:[ESP+10] ; Default case of switch 0041DDE1
: Z4 A7 [0 b/ S; n) T; {0041DE2C |. 85C0 |TEST EAX,EAX+ s, h: k- A' v
0041DE2E |. 74 0C |JE SHORT flashget.0041DE3C3 A9 k2 [0 L7 t& l
0041DE30 |. 0FBE1D 2BC7520>|MOVSX EBX,BYTE PTR DS:[52C72B]
; ~# v: Y/ E; R5 [0041DE37 |. 83FE 02 |CMP ESI,2
# j) c u( A6 G L+ y0041DE3A |. 74 07 |JE SHORT flashget.0041DE43
* O5 F9 R; n1 R- J3 P7 [* V0041DE3C |> 0FBE9E 28C7520>|MOVSX EBX,BYTE PTR DS:[ESI+52C728]2 X5 j7 c" v2 n$ d* c/ L
. p+ ]/ _ T+ z, g( u, i: u;对于运算结果的验证也很简单，只是用密钥的ASC码来除ECX中的值，余数在EDX中。# g# C/ `( w, k. x2 z# v
0041DE43 |> 8BC1 |MOV EAX,ECX
: O6 N G% w, E: t: X; j0041DE45 |. 33D2 |XOR EDX,EDX* b: H! t0 r+ ~' q! Y& O5 f$ a* C
0041DE47 |. F7F3 |DIV EBX
' c0 _6 I# H- A! X: }
# h$ o/ K. M( P+ L, J
2 ~$ o' ~$ W+ `& o" r' K
: r, X( Z1 S+ r5 N& i;以上是对指定段的KEY的验证运算，下面是对结果的判断2 j2 w2 j9 `* ^3 R1 b( [% E
0041DE49 |. 8BC6 |MOV EAX,ESI; K$ m( I8 _0 D |$ `
0041DE4B |. 83E8 00 |SUB EAX,0 ; Switch (cases 0..2)
9 {$ B e0 j6 _- }+ ]: |5 `& H3 B0041DE4E |. 74 13 |JE SHORT flashget.0041DE63
0 A- y+ x3 M3 h0041DE50 |. 48 |DEC EAX1 E! p. |, V; e0 m5 k5 |. z- R, K
0041DE51 |. 74 09 |JE SHORT flashget.0041DE5C$ n5 G" s& u, E' ?: a2 n
0041DE53 |. 48 |DEC EAX
2 Q) C& p; m2 [0 a0 X3 c6 U7 y. Q0041DE54 |. 75 11 |JNZ SHORT flashget.0041DE67+ L# X- s1 ~: V: a! D! K
6 n; ^/ d9 q9 s, [+ u3 l
;余数是否为0" U9 P+ e, z+ r% y0 R7 m, Q
0041DE56 |. 85D2 |TEST EDX,EDX ; Case 2 of switch 0041DE4B0 _8 E) [4 n- Z' h5 ] l
0041DE58 |. 75 18 |JNZ SHORT flashget.0041DE72
T! p+ |0 ?0 H: A( g1 p0041DE5A |. EB 0B |JMP SHORT flashget.0041DE67% a+ V* G6 z o H2 Q
! e3 r# z- y& v H1 a/ p$ @
;余数是否为8" n# X$ e1 v7 Z' r
0041DE5C |> 83FA 08 |CMP EDX,8 ; Case 1 of switch 0041DE4B
: g5 g. s* A( k; f/ t# E9 e/ f, S! ]0041DE5F |. 75 11 |JNZ SHORT flashget.0041DE72% z6 R* R% g$ i6 q3 F6 @ F' [
0041DE61 |. EB 04 |JMP SHORT flashget.0041DE67* Z7 u# j. h K) T0 Z- t! c
* s" F2 \' y* A- l;余数是否为0
8 P& l' K b4 d1 R0041DE63 |> 85D2 |TEST EDX,EDX ; Case 0 of switch 0041DE4B* M& D3 P: H. N; }: `
0041DE65 |. 75 0B |JNZ SHORT flashget.0041DE72$ j" U4 ~6 E3 A* g. T# e
) h# ]# `. Y; N# B" f7 ]6 z+ i
0041DE67 |> 46 |INC ESI ; Default case of switch 0041DE4B# Z- n: {! L: z. ?: ?# R" X1 r
0041DE68 |. 83FE 03 |CMP ESI,3
' v$ S: n3 [ u4 V0041DE6B |. 7D 23 |JGE SHORT flashget.0041DE90
2 Y& ?; J1 p+ o$ w8 {& z; T' F. u0041DE6D |.^E9 68FFFFFF \JMP flashget.0041DDDA# A. \* w! R, Z$ N5 h: b+ X
/ A- d- g. A6 W7 M# M1 l, l所以这三段的KEY的验证算法是：
2 E9 t' o2 n% `0 o+ v5 S# ^! k' hCase 0(B XOR C) * D + A) MOD X = 0，这儿X是'k'+ ^- l' @+ G3 O
Case 1(B AND C) * D + A) MOD X = 0，这儿X是'e'
5 t; z, o! c2 a6 ZCase 2B * C + D + A) MOD X = 0，对于fgf-类的KEY，这儿X是'v'；对于fgc-类的KEY，这儿X是'i'
4 s5 M7 E& v7 w4 w$ V( L" d3 b) B* k7 _, a2 x a0 R2 ^6 q( L% f
LeNgHost告诉我，FlashGet会在一段时间后验证第四段KEY，于是我就在程序正常运行后在那段已经读入内存的KEY上下了内存断点，并在RegPass也下了断点。出去逛完一个下午后……中断成功了……
3 t' j5 v0 H6 U6 ^* ^0042514C |. 8B48 10 MOV ECX,DWORD PTR DS:[EAX+10]% S7 P# E( D& r, x. Z# Q' I, Z
0042514F |. 83C0 10 ADD EAX,10
. F/ x/ G6 S/ R% Y/ ~/ c5 d6 v% N00425152 |. 894C24 08 MOV DWORD PTR SS:[ESP+8],ECX3 w: x* V; S! b# ]9 M% Z
00425156 |. 6A FF PUSH -1& c4 H( ]6 Z* B6 E1 G7 d, B8 a/ W
00425158 |. 0FBE4424 0E MOVSX EAX,BYTE PTR SS:[ESP+E]
# I- S" @7 N' y( r0042515D |. 0FBED5 MOVSX EDX,CH* F! A0 a/ n! \! O9 _
00425160 |. 0BC2 OR EAX,EDX- f2 l/ Z2 Y3 o$ H! w
00425162 |. 0FBE5424 0F MOVSX EDX,BYTE PTR SS:[ESP+F]
5 B5 {) ]0 ~% P! O4 h00425167 |. 0FAFC2 IMUL EAX,EDX7 c7 N1 i% f- T' ~% K
0042516A |. 0FBEC9 MOVSX ECX,CL7 ]# C8 G" f" S; y# {/ B7 Q; Y6 D
0042516D |. 03C1 ADD EAX,ECX& e" [: f) h j% q7 J- }8 E
;跟踪分析得EAX = (B OR C) * D + A
5 G; X9 h0 h- d% T* z: L' a# |3 y" K9 k9 t. o# \! _" i. b
0042516F |. 33D2 XOR EDX,EDX' e' S1 k3 N! G, P5 p% n s# P
& m& |; G/ u8 _: L; Q;验证用的密钥直接来自DS:[52C72B]，哈哈，就是'i'3 E( g. b5 v* P- S
00425171 |. 0FBE0D 2BC7520>MOVSX ECX,BYTE PTR DS:[52C72B], \# t3 k# X2 A
00425178 |. F7F1 DIV ECX
( b" C0 M+ h) C- i0042517A |. 8BCE MOV ECX,ESI
/ |1 ~- C v8 p4 a
. z [9 E1 [. V+ K8 \: K;判断余数是否为0% @# A4 Q! n. U; }! `
0042517C |. 85D2 TEST EDX,EDX
: e% j+ G" ^0 O" F! p+ a6 `: n# Z: c: V/ K0042517E |. 74 1E JE SHORT flashget.0042519E$ R( |7 c$ l$ f+ G- {
+ {. q- ~1 Y! w# F& b所以这一段的算法是((B OR C) * D + A) MOD X = 0，这儿X是'i'! u- F" X5 f5 t5 K7 ]
# f2 x3 h# ?5 E [/ k8 g/ R7 X" Q
; S* @3 `& N c& O/ w0 o只要KEY能符合这四个条件就可以了。我用VB做出了对应的算号器代码：
, w c6 h! D/ u Randomize
5 O) Z& R8 f% u Dim intEbx As Integer
, t6 u6 l) V% G" m$ F5 n0 u& z Dim i As Integer, j As Integer, k As Integer, intChar As Integer- h- s9 a+ U, J7 Q
Dim strCode As String7 \( c2 J5 ?# n' H
7 d5 A# ]( E7 N' s3 U2 p
If fgf Then
' A5 o: n( g( Y3 s" } strCode = "fgf-"4 S: P5 s9 M* {0 G, t0 f3 W6 t+ J
intEbx = 118
b" F0 z* V8 n2 O& y8 \ Else* k* X8 k0 X6 A; }8 g
strCode = "fgc-"
" @* e" I% C% F4 |2 G/ i7 Y8 s: w intEbx = 105
$ y) e8 m9 ]" y End If
9 C6 ?. L- Y* {
; ?2 ]7 V6 y; J4 I+ K- `/ V Do3 s2 d) y% F0 p1 B$ D7 d* F
intChar = 97 + Int(Rnd() * 25)2 b p" {. m! K- q" Q7 K0 z8 t3 u
For i = 48 To 57! j! A5 t/ n, t+ ]' ` u
For j = 48 To 57
, L$ ]3 Q2 @% p+ }( G For k = 48 To 57
. d6 ^+ W9 X0 h) z) O! ^: j( } If (((i Xor j) And 127) * k + intChar) Mod 107 = 0 Then
3 \) Y( ^; k5 K strCode = strCode & Chr(intChar) & Chr(i) & Chr(j) & Chr(k)/ o( T' Q7 u6 X0 t
Exit Do
; K3 t: c* a& \! t1 q+ w) t End If" w5 }- t# V0 t$ S" E u; h
Next k0 T$ a+ c* A5 \9 O9 M" t& Z
Next j
, C- Q7 u7 v# r Next i
2 m5 u8 k7 Q" s/ a4 F; ~+ { Loop0 R7 J0 l; Q3 A' c1 l( O; `
% Q5 a1 b% q7 |9 [' j& Z Do
0 S0 _$ `( x/ M6 ?" w' ~ intChar = 97 + Int(Rnd() * 25)
) c& T( Q; P3 L3 g d1 Q For i = 48 To 57
+ k2 A9 \0 b# A For j = 48 To 57* A. P( l- z" H$ p
For k = 48 To 57
' _4 m' u6 D, G% P4 D/ g2 \; ]; w If ((i And j) * k + intChar) Mod 101 = 8 Then/ e4 B' v/ W' J
strCode = strCode & Chr(intChar) & Chr(i) & Chr(j) & Chr(k)
1 |* G( k9 p/ o; p- Y( k Exit Do: C8 I9 e0 d3 |3 ]( n+ M6 s7 Q
End If
0 n7 H! ?( I: ^ Next k
* C$ ^: g( S- z. u Next j, N7 w7 [4 T* K* }, f6 D; x1 s
Next i( B4 s+ c3 y& m: G+ ~6 ]/ R- l+ |
Loop
# D% ~/ ~5 Y+ N, ]# Y
4 `! E7 Z! K! l0 ` d6 C Do: Y3 {/ W7 U4 F
intChar = 97 + Int(Rnd() * 25)
' `7 r0 \, ?2 h& N) S1 ^ For i = 48 To 57
7 h/ [) a* W8 {5 D/ f For j = 48 To 57
. {" Z. V; g, v For k = 48 To 57: q, ?5 Q4 m; |! b5 C
If (i * j + k + intChar) Mod intEbx = 0 Then* u9 ?# @# f7 a% ]! W1 {/ I
strCode = strCode & Chr(intChar) & Chr(i) & Chr(j) & Chr(k)! ?6 o' B& k5 H; R* Q& h* m" p. _
Exit Do- K# `9 T9 S' s+ H c/ v- P
End If
& S( g% }2 l, v) G( y3 j Next k
% M4 u2 E2 `+ d# @ O Next j) d; W! Q: E3 i. S @" A
Next i
* c% t* b9 F3 ?; W7 h6 q2 s3 H- m# Q Loop; P. e3 D- R& L" q9 I9 \/ W6 ~
5 t( i& \/ ^2 ~/ c Do; O0 R# D7 s3 E/ {2 a
intChar = 97 + Int(Rnd() * 25)
9 Z4 b _6 v; }' v( ^ For i = 48 To 57: y* n/ C2 l, ^1 f1 W' @
For j = 48 To 57
( Z5 Y H8 w/ ^4 o d4 O, s+ a For k = 48 To 57
0 Q5 K1 H' O5 K1 Y- T9 o6 c6 V If ((i Or j) * k + intChar) Mod 105 = 0 Then
; z' I- q U, T* z @! J strCode = strCode & Chr(intChar) & Chr(i) & Chr(j) & Chr(k)
; b q1 t; e6 s Exit Do
. z* O5 y$ w* [1 l; c End If% b( j& I& p( O* h8 t6 E' C4 e
Next k
& i$ T6 D) ^! U% c' q( l0 _ Next j
. b; P: Q& W3 |+ S Next i4 W7 O5 E4 U% a
Loop. q% W# ]0 u2 v5 H5 Z0 A
' B7 n% r9 k E; O4 B0 s2 a( L
! ~9 @! I( I- K- h6 | '后面的24位随机生成。: a8 G; z$ {( v: x: \& ~% E
For i = 1 To 6
( A t9 i- `5 B+ j intChar = 97 + Int(Rnd() * 25)
; [/ m4 u) f7 n' N5 S strCode = strCode & Chr(intChar)
8 C" R# t0 S' u, c6 Z+ X For j = 1 To 35 f4 i0 C+ L+ ^% y( U) l
intChar = 48 + Int(Rnd() * 9)
0 s/ G& w' V9 @) G7 z6 b8 V strCode = strCode & Chr(intChar)! M$ Z2 N3 D$ Q1 M2 ^% z7 y/ H
Next j) J2 s, Q! z) y) ~
Next i
" i8 F. f7 [9 g- I3 F
1 M6 I1 y- \, j" r7 z) h2 N9 U/ @$ R* g+ E
最后字符串strCode就是所要求的KEY |
|
/1 
IP卡
狗仔卡
发表于 2004-11-1 13:35:00
QQ好友和群
QQ空间
腾讯微博
腾讯朋友
收藏
分享
顶
踩
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
抢沙发
千斤顶
显身卡