"Yenilsen de yensen de, taraftarin seninle. Iyi gunde, kotu gunde, seninle birlikte."

Unlock bolumune “1907” girelim. [bpx hmemcpy] -> [F8]

0167:00647F0E MOV EAX,[EBP-0C]                     <- buradayiz
0167:00647F11 CALL 006A46A8                        <- ??
0167:00647F16 MOV ECX,EAX
0167:00647F18 XOR CL,01
...
0167:00647F55 CALL 0040989C
0167:00647F5A CMP DWORD PTR [EBP-10],00
0167:00647F5E JZ 00648035
0167:00647F64 PUSH 30
0167:00647F66 PUSH 00648074
0167:00647F6B PUSH 00648080
0167:00647F70 PUSH 00
0167:00647F72 CALL USER32!MessageBoxA              <- hata

647F11’de iken [d eax] -> 1907. Bu nedenle 647F11’deki cagriyi incelemek gerekecek. [bpx 647F11] -> [F8]

...
0167:006A46DA MOV EAX,[EBP-04]                     <- 1907
0167:006A46DD CALL 00409D84                        <- Hex’e cevir
0167:006A46E2 MOV [EBP-10],EAX                     <- eax=773h
0167:006A46E5 MOV [EBP-0C],EDX                     <- edx=0

Girdigimiz sayi FFFFFFFFh den buyuk olmadigi icin edx degeri 0 olarak dondu. [F10] ->

...
0167:006A4713 MOV EAX,[EBP-10]                     <- 773
0167:006A4716 MOV EDX,[EBP-0C]                     <- 0
0167:006A4719 CALL 00407279                        <- ??
0167:006A471E CMP EDX,00
0167:006A4721 JNZ 006A472C                         <- kotu cocuk
0167:006A4723 CMP EAX,00036D6E                     <- ??
0167:006A4728 JNZ 006A472C                         <- kotu cocuk
0167:006A472A MOV BL,01                            <- iyi cocuk
0167:006A472C TEST BL,BL
0167:006A472E JZ 006A4754

6A4719’daki cagri sonucu edx 0 ve eax 36D6Eh olmasi gerekiyor. [bpx 6A4719] -> [F8]

0167:0040727F MOV EBX,[ESP+14]                     <- ebx=C6CACh durumunda
...                                                <- eax=773
0167:004072EC DIV EBX                              <- eax=0 ve edx=773 oldu
0167:004072EE XCHG EAX,EDX                         <- edx=0 ve eax=773 oldu
0167:004072EF XOR EDX,EDX                          <- edx=0
0167:004072F1 JMP 004072E5

773h sayisinin C6CACh sayisina bolumunden cikan sonuclar eax ve edx registerlerine aktarildi. Bolum=0 ve kalan=773h oldu. Daha sonra eax ve edx registerleri XCHG ile degerlerini birbirleri ile degistirdiler. 6A4723’e gore eax degerimiz 36D6E olmali. O zaman bu sarti saglayan seriallerin uymasi gereken kural su;

Mod (Serial, C6CACh) = 36D6Eh <- serialin C6CAC ye bolumunden kalan deger 36D6E olmali. En basit sekilde sallama seriali 36D6Eh = 224622 olarak girebiliriz.

...
0167:006A4721 JNZ 006A472C
0167:006A4723 CMP EAX,00036D6E                     <- bu testi gectik
0167:006A4728 JNZ 006A472C
0167:006A472A MOV BL,01
0167:006A472C TEST BL,BL
0167:006A472E JZ 006A4754
0167:006A4730 PUSH 00
0167:006A4732 PUSH 000C6CAC
0167:006A4737 MOV EAX,[EBP-10]                     <- eax=36D6Eh
0167:006A473A MOV EDX,[EBP-0C]                     <- edx=0
0167:006A473D CALL 00407186                        <- ??
0167:006A4742 CMP EDX,00
0167:006A4745 JNZ 006A4750
0167:006A4747 CMP EAX,000003E8                     <- eax=3E8h olmali
0167:006A474C JAE 006A4754
0167:006A474E JMP 006A4752
0167:006A4750 JGE 006A4754
0167:006A4752 XOR EBX,EBX
0167:006A4754 CMP DWORD PTR [EBP-0C],00
0167:006A4758 JNZ 006A4761
0167:006A475A CMP DWORD PTR [EBP-10],4815CF2A      <- black-list basliyor
0167:006A4761 JZ 006A483A
0167:006A4767 CMP DWORD PTR [EBP-0C],0D
0167:006A476B JNZ 006A4774
0167:006A476D CMP DWORD PTR [EBP-10],FE7DDBE2

Sallama serialin saglamasi gereken bir sart daha ortaya cikti. Ayrica, butun bunlardan sonra, black-list’deki degerlerden de farkli olmasi gerekiyor. [bpx 6A473D] -> [F8]

...
0167:0040718C MOV EBX,[ESP+14]                     <- ebx=C6CACh durumunda
...                                                <- eax=36D6Eh
0167:004071F8 DIV EBX                              <- eax=0, edx=36D6Eh
0167:004071FA XOR EDX,EDX
0167:004071FC JMP 004071F1

Yukaridaki algoritma ile hemen hemen ayni. Yeni denklemimiz su sekilde,

3E8 * C6CAC + ????? = Serial

????? olan degeri yukaridaki aciklamalardan anlamis olmaniz gerekmektedir.
 

Bir programı kullanarak para kazanıyorsanız, programı satın alın.