POWERCOM MODBUS工具

浪客剑心 s_blin@126.com 2007.10.22 004F30CA . 8B45 FC mov eax, dword ptr [ebp-4] 004F30CD . 8B08 mov ecx, dword ptr [eax] 004F30CF . FF51 1C call dword ptr [ecx+1C] 004F30D2 . 8B45 EC mov eax, dword ptr [ebp-14] ; 存放正确的key.dat数据地址 004F30D5 . B9 0A000000 mov ecx, 0A 004F30DA . BA 01000000 mov edx, 1 004F30DF . E8 701BF1FF call 00404C54 004F30E4 . 33C0 xor eax, eax 004F30E6 . 5A pop edx 004F30E7 . 59 pop ecx 004F3274 |. 33D2 xor edx, edx 004F3276 |. 8910 mov dword ptr [eax], edx 004F3278 |. 8BC3 mov eax, ebx 004F327A |. E8 B9FEFFFF call 004F3138 ; 判断注册码 004F327F |. 84C0 test al, al ; 正确则跳,改为JMP 004F3281 |. 0F85 B3000000 jnz 004F333A 004F3287 |. 8B0D 2C704F00 mov ecx, dword ptr [4F702C] ; PowerSCT.004F8BBC 004F328D |. 8B09 mov ecx, dword ptr [ecx] 004F328F |. B2 01 mov dl, 1 004F29F8 . /7C 2A jl short 004F2A24 004F29FA . |46 inc esi 004F29FB . |33FF xor edi, edi 004F29FD > |8D55 D4 lea edx, dword ptr [ebp-2C] ; 算法开始 004F2A00 . |8B45 F8 mov eax, dword ptr [ebp-8] 004F2A03 . |8B08 mov ecx, dword ptr [eax] 004F2A05 . |FF51 1C call dword ptr [ecx+1C] 004F2A08 . |8B45 D4 mov eax, dword ptr [ebp-2C] 004F2A0B . |0FB64438 FF movzx eax, byte ptr [eax+edi-1] 004F2A10 . |8B55 EC mov edx, dword ptr [ebp-14] 004F2A13 . |0FB612 movzx edx, byte ptr [edx] 004F2A16 . |8D1452 lea edx, dword ptr [edx+edx*2] 004F2A19 . |03DA add ebx, edx 004F2A1B . |2BD8 sub ebx, eax 004F2A1D . |83C3 07 add ebx, 7 004F2A20 . |47 inc edi 004F2A21 . |4E dec esi 004F2A22 .^|75 D9 jnz short 004F29FD 004F2A24 > \8D55 D0 lea edx, dword ptr [ebp-30] 004F2A27 . 8B45 FC mov eax, dword ptr [ebp-4] 004F2A2A . 8B80 34030000 mov eax, dword ptr [eax+334] 004F2A30 . E8 F7B6F5FF call 0044E12C 004F2A35 . 8B45 D0 mov eax, dword ptr [ebp-30] ; 以上截取前12位 004F2A38 . E8 B71FF1FF call 004049F4 ; 机器码数 004F2A3D . 8BD3 mov edx, ebx 004F2A3F . C1E2 08 shl edx, 8 004F2A42 . 2BD0 sub edx, eax 004F2A44 . 8BDA mov ebx, edx 004F2A46 . 8BC3 mov eax, ebx 004F2A48 . F7D0 not eax 004F2A4A . 99 cdq 004F2A4B . 33C2 xor eax, edx 004F2A4D . 2BC2 sub eax, edx 004F2A4F . 8BD8 mov ebx, eax 004F2A51 . 8BC3 mov eax, ebx 004F2A53 . F7EB imul ebx 004F2A55 . 99 cdq 004F2A56 . 33C2 xor eax, edx 004F2A58 . 2BC2 sub eax, edx 004F2A5A . 8BD8 mov ebx, eax 004F2A5C . 8D4D E8 lea ecx, dword ptr [ebp-18] 004F2A5F . BA 0A000000 mov edx, 0A 004F2A64 . 8BC3 mov eax, ebx 004F2A66 . E8 A968F1FF call 00409314 004F2A6B . 8B45 E8 mov eax, dword ptr [ebp-18] 004F2A6E . 8B55 F0 mov edx, dword ptr [ebp-10] ; 比较注册码 004F2A71 . E8 CA20F1FF call 00404B40 004F2A76 . 74 14 je short 004F2A8C ; 相等则跳 004F2A78 . 8B45 F8 mov eax, dword ptr [ebp-8] 004F2A7B . E8 840EF1FF call 00403904 004F2A80 . A1 40325100 mov eax, dword ptr [513240] 004F2A85 . E8 8282F7FF call 0046AD0C 004F2FEB |. BB 01000000 mov ebx, 1 004F2FF0 |> 8D4D F4 /lea ecx, dword ptr [ebp-C] 004F2FF3 |. 8B45 FC |mov eax, dword ptr [ebp-4] 004F2FF6 0FB64418 FF movzx eax, byte ptr [eax+ebx-1] ; 异常 004F2FFB |. BA 02000000 |mov edx, 2 004F3000 |. E8 0F63F1FF |call 00409314 004F3005 |. 8B55 F4 |mov edx, dword ptr [ebp-C] 004F3008 |. 8D46 04 |lea eax, dword ptr [esi+4] 004F300B |. E8 EC19F1FF |call 004049FC 004F3010 |. 43 |inc ebx 004F3011 |. 83FB 07 |cmp ebx, 7 004F3014 |.^ 75 DA \jnz short 004F2FF0