"... 2.1 mt kanat acikligina sahip bir kusun iskeleti sadece 113 gr agirligindadir. Disleri olmadigi ve bu nedenle de cene kemikleri ve bunlarla baglantili kaslarin sayisi az oldugu icin kuslarin kafasi hafiftir. Dislerin gorevi olan ogutme ve karistirma isinin buyuk kismini yapan taslik epeyce agirdir. Ancak agirlik merkezi, kanatlarin olusturdugu kaldirma merkezinin altinda olacak bicimde, govdenin arka tarafina oldukca iyi bir bicimde yerlestirilmistir."

“amois”, “1907” -> [bpx hmemcpy] -> [F12] -> [F10] ->

...
00415689 MOV EAX,[ESI+000000A0]                 <- “amois”
0041568F CALL 00404708                          <- eax=5 <- uzunluk
00415694 TEST EAX,EAX                           <- user name bos mu ?
00415696 JLE 004156B4
00415698 MOV EAX,[ESI+000000A4]                 <- “1907”
0041569E CALL 00404708                          <- eax=4 oldu <- uzunluk
004156A3 CMP EAX,[ESI+00000098]                 <- serial 9 basamak mi ?
004156A9 JNZ 004156B4                           <- kotu cocuk
004156AB MOV EAX,ESI
004156AD CALL 00414CF8

Sallama serial “987654321” -> [bpx 4156AD] ->

...
0048A808 MOV EDX,[ESI+000000A0]                 <- “amois”
0048A80E MOV EAX,0048A858                       <- “SOCKShell”
0048A813 CALL 00412318                          <- ?
0048A818 MOV EAX,[EBP-04]                       <- “*”
0048A81B MOV EDX,[ESI+000000A4]                 <- “987654321”
0048A821 CALL 0040484C                          <- ?
0048A826 SETZ AL                                <- ?

[bpx 48A813] ->

00412350 MOV EAX,[EBP-08]                       <- “amois”
00412353 CALL 00404708                          <- eax=5 <- uzunluk
00412358 MOV ESI,EAX                            <- esi=5
0041235A CMP ESI,06                             <- en az 6 karakter olmali
0041235D JL 00412562

User name “amois_fb” -> [F10]

0041239E MOV EDX,[EBP-10]
004123A1 MOV ECX,[EBP-04]                       <- “SOCKShell”
004123A4 DEC EDX
004123A5 TEST ECX,ECX
004123A7 JZ 004123AE
004123A9 CMP EDX,[ECX-04]
004123AC JB 004123B3
004123AE CALL 004035FC
004123B3 INC EDX
004123B4 MOVZX EDX,BYTE PTR [EDX+ECX-01]        <- S O C K S h e l l
004123B9 ADD EBX,EBX
004123BB XOR EDX,EBX
004123BD MOV EBX,EDX
004123BF INC DWORD PTR [EBP-10]                 <- sayaci artir
004123C2 DEC EAX
004123C3 JNZ 0041239E                           <- Karakter kaldi mi ?

Buradaki dongu sonucunda ebx=6A70h oldu. -> [F10] ->

004123C3 JNZ 0041239E
004123C5 MOV EAX,ESI                            <- eax = 8 <- user name uzunluk
004123C7 MOV ECX,00000005
004123CC CDQ
004123CD IDIV ECX                               <- 8/5 -> eax = 1, edx = 3
004123CF MOV EDI,EAX                            <- edi = 1
004123D1 MOV [EBP-10],ESI                       <- [ebp-10] = 8
004123D4 IMUL EAX,EDI,05                        <- 1*5 = 5
004123D7 JNO 004123DE
004123D9 CALL 00403604
004123DE SUB ESI,EAX                            <- 8 – 5 = 3
004123E0 JNO 004123E7
004123E2 CALL 00403604
004123E7 MOV EAX,00000001                       <- eax = 1
004123EC MOV EDX,[EBP-08]                       <- “amois_fb”
004123EF DEC EAX                                <- eax = 0
004123F0 TEST EDX,EDX
004123F2 JZ 004123F9
004123F4 CMP EAX,[EDX-04]                       <- [edx-04] = 8 <- user name uzunluk
004123F7 JB 004123FE
004123F9 CALL 004035FC
004123FE INC EAX                                <- eax = 1
004123FF MOVZX EAX,BYTE PTR [EAX+EDX-01]        <- “a” <- user name ilk digit
00412404 PUSH EAX                               <- 61
00412405 MOV EAX,EBX                            <- eax = 6A70h
00412407 POP EDX                                <- 61
00412408 MOV ECX,EDX                            <- 61
0041240A CDQ
0041240B IDIV ECX                               <- 6A70/61 -> edx=58h
0041240D MOV EAX,EDX                            <- eax = 58h
0041240F LEA EDX,[EBP-1C]
00412412 CALL 00408BEC
00412417 CMP ESI,[EBP-10]                       <- esi = 3, [ebp-10] = 8
0041241A JGE 00412464
0041241C MOV EAX,[EBP-10]                       <- eax = 8
0041241F MOV EDX,[EBP-08]                       <- “amois_fb”
00412422 DEC EAX                                <- eax = 7
00412423 TEST EDX,EDX
00412425 JZ 0041242C
00412427 CMP EAX,[EDX-04]                       <- [edx-04] = 8 <- user name uzunluk
0041242A JB 00412431
0041242C CALL 004035FC
00412431 INC EAX                                <- eax = 8
00412432 MOVZX EAX,BYTE PTR [EAX+EDX-01]        <- amois_fb
00412437 PUSH EAX
00412438 MOV EAX,EBX
0041243A POP EDX
0041243B MOV ECX,EDX
0041243D CDQ
0041243E IDIV ECX
00412440 MOV EAX,EDX                            <- 4 E 4E 6C 35
00412442 LEA EDX,[EBP-20]
00412445 CALL 00408BEC
0041244A MOV EDX,[EBP-20]
0041244D LEA EAX,[EBP-1C]
00412450 CALL 00404710
00412455 SUB [EBP-10],EDI                       <- edi = 1 <- user name uzunluk azalt
00412458 JNO 0041245F
0041245A CALL 00403604
0041245F CMP ESI,[EBP-10]                       <- esi = 3 ile kontrol
00412462 JL 0041241C
00412464 LEA EDX,[EBP-10]

Bu bolumu toparlayalim. 4123FF’de eax her zaman user name’in ilk digitine esit oluyor. 4123DE’de esi’ye atanan deger user name uzunluguna bagli olarak degistigi icin, 412432’de eax’e atanan digitler de degisken oluyor. “amois_fb” icin 4123DE’de esi=3 oldu ve 412432’de eax’e 5 kez deger atandi. Eger, user name “amois_fenerbahce” olsaydi,

004123C5 MOV EAX,ESI                            <- eax = 16 <- user name uzunluk
004123C7 MOV ECX,00000005
004123CC CDQ
004123CD IDIV ECX                               <- 16/5 -> eax = 3, edx = 1
004123CF MOV EDI,EAX                            <- edi = 3
004123D1 MOV [EBP-10],ESI                       <- [ebp-10] = 16
004123D4 IMUL EAX,EDI,05                        <- 3*5 = 15
004123D7 JNO 004123DE
004123D9 CALL 00403604
004123DE SUB ESI,EAX                            <- 16 - 15 = 1
 

Buna gore, 412455’de user name uzunlugundan her seferinde edi = 3 kadar azaltma yapilarak 41245F’de esi = 1 ile kontrol edilecek. Kontrol islemi 5 kez yapilacak ve bu deger sabit. Cunku, edi’nin aldigi deger, user name uzunlugunun 5’e bolumunun tam kismi. Ve her seferinde user name’den bu tam kisim cikarildigi icin, dongu sayisi 5 oluyor.

16-3=13, 13-3=10, 10-3=7, 7-3=4, 4-3=1 -> toplam 5 kez

412432’de eax’e toplam 5 kez deger atanacakti -> amois_fenerbahce

Atanan digitlerinin konumlarinin edi=3 kadar azaltilarak bulunduguna dikkat edin.

“amois_fb” icin dongu sonucunda olusan degeri 412467’de “884147810853” olarak gorebiliyoruz. Bu deger nasil olustu ? 41240B ve 412440’da eax’in aldigi degerlere dikkat edelim. Sirasiyla -> 58h 4h Eh 4Eh 6Ch 35h -> 88 4 14 78 108 53

...
00412464 LEA EDX,[EBP-10]
00412467 MOV EAX,[EBP-1C]                       <- 884147810853
0041246A CALL 00405774                          <- Hex. cevir
0041246F MOV [EBP-18],EAX                       <- DB50F225
00412472 MOV [EBP-14],EDX                       <- CD

884147810853 sayisinin Hex. karsiligi CDDB50F225. eax’de tasma meydana geldigi icin sagdan 9.uncu digitten itibaren edx deger aldi.

...
004124EB MOV EAX,[EBP-18]                       <- DB50F225
004124EE MOV EDX,[EBP-14]                       <- CD
004124F1 CALL 004056AC                          <- ?

ilk turda 4124F1’deki cagri sonucu eax=D degerini aldi.

...
00412513 MOV EDX,004125F8                       <-“zyxw1vu2ts3rq4po5nm6lk7ji8hg9fed???”
00412518 DEC EAX
00412519 TEST EDX,EDX
0041251B JZ 00412522
0041251D CMP EAX,[EDX-04]
00412520 JB 00412527
00412522 CALL 004035FC
00412527 INC EAX                                <- eax = D + 1 = E
00412528 MOV AL,[EAX+EDX-01]                    <- tablodan 14.uncu elamani al = “4”

...
00412533 MOV EAX,[EBP-18]                       <- eax = DB50F225
00412536 MOV EDX,[EBP-14]                       <- edx = CD
00412539 CALL 004055AC
0041253E JNO 00412545
00412540 CALL 00403604
00412545 MOV [EBP-18],EAX                       <- eax = E1B1DB08
00412548 MOV [EBP-14],EDX                       <- edx = 5

00412556 CMP DWORD PTR [EBP-10],09              <- serial tamamlandi mi ?
0041255A JLE 0041249D                           <- dongu

41249D ile 41255A arasindaki dongu sonucunda serial olusuyor. Cozulmesi gereken 4124F1 ve 412539’daki cagrilar kaldi. 412513’deki tablo uzunlugumuz 35 ve 412527’de eax’in alabilecegi max. deger tablo uzunluguna esit olacagindan, 412522’deki cagri 0 ile 34 arasinda bir sayi uretmek zorunda. Birazcik inceledigimizde gorecegiz gibi MOD 35 islemi yapiyor. 412540’daki cagri ise MOD 35 islemi sonucunda bolum ve kalanlari belirliyor. Ve bu degerler azalarak dongu icerisinde kullaniliyor.
Serial formatini dongu icerisinde kolayca gorebilirsiniz -> XXXX-XXXX

KeyGen kodunu VB’de veriyorum. MOD 35 rutinini kendiniz yazacaksiniz. VB, buyuk sayilar icin MOD isleminde “Overflow” hatasi veriyor :(

tablo = "zyxw1vu2ts3rq4po5nm6lk7ji8hg9fed???"   ; sabit deger
sabit = "SOCKShell"                             ; sabit deger
isim = "amois_fb"

ebx = 0
For i = 1 To Len(sabit)
edx = Asc(Mid(sabit, i, 1))                     ; S O C K S h e l l
ebx = ebx + ebx
edx = edx Xor ebx
ebx = edx
Next i
bolum_1 = ebx                                   ; bolum_1 = 6A70h

isim_uz = Len(isim)                             ; 8
harf_konum = Int(isim_uz / 5)                   ; 1 <- sondan basa dogru 1 ilerle
ilk_harf = Asc(Mid(isim, 1, 1))                 ; “a”
serial = CStr(bolum_1 Mod ilk_harf)             ; “88”

For j = 1 To 5                                  ; toplam 5 kez ve sabit
harf = Asc(Mid(isim, isim_uz, 1))               ; bf_sioma
deger = CStr(bolum_1 Mod harf)                  ; 4 14 78 108 53
serial = serial + deger                         ; 884 88414 8841478 ...
isim_uz = isim_uz - harf_konum                  ; user name 1 azalt
Next j

serial = CDec(serial)                           ; 884147810853

For k = 1 To 8                                  ; 8 digit bulunacak
Call mod35(serial, kalan)                       ; MOD 35 hesapla
kalan = kalan + 1                               ; D + 1 = E
sonuc = sonuc + Mid(tablo, kalan, 1)            ; “4”
If k = 4 Then sonuc = sonuc + "-"               ; 4.uncu digitten sonra “-“ koy
Next k
 

Bir programı kullanarak para kazanıyorsanız, programı satın alın.