QuickCHM v2.01�ƽ�� 㷨�� -pc6��Ѷ

��λ�ã��ҳ��ƽ�� QuickCHM v2.01�ƽ�� 㷨��

QuickCHM v2.01�ƽ�� 㷨�� ʱ�䣺2004/10/15 0:55:00��Դ��վ��ߣ����Ҫ��(0)

��˵��CHM��
��ص�ַhttp://www.skycn.com/download.phpid=6785&url=http://jshttp.skycn.net/down/qchm_setup.exe
�ƽ⹤�ߣ�TRW2000

��̣�
�жϺ�F10��⣺
===============================================================
:004F2432 33C9 xor ecx, ecx
:004F2434 B201 mov dl, 01
:004F2436 A198864E00 mov eax, dword ptr [004E8698]
:004F243B E8AC63FFFF call 004E87EC
:004F2440 8BD8 mov ebx, eax
:004F2442 8B55FC mov edx, dword ptr [ebp-04]
:004F2445 8BC3 mov eax, ebx
:004F2447 E89464FFFF call 004E88E0
:004F244C C6434400 mov [ebx+44], 00

* Possible StringData Ref from Code Obj ->"F0E1"<----------------ע��Щ��ַ��Ժ��м��
|
:004F2450 BA70254F00 mov edx, 004F2570<-------------ȡ��ַ�(EDXΪ��F0E1��)
:004F2455 8BC3 mov eax, ebx
:004F2457 E82864FFFF call 004E8884
:004F245C 8BC3 mov eax, ebx
:004F245E E81967FFFF call 004E8B7C<-----------------��㷨��(��)
:004F2463 837B3400 cmp dword ptr [ebx+34], 00000000<----�ж�ע��Ƿ��
:004F2467 0F84CB000000 je 004F2538
:004F246D 8B4334 mov eax, dword ptr [ebx+34]<---��ע��
:004F2470 8B55F8 mov edx, dword ptr [ebp-08]<---�ٵ�ע��
:004F2473 E83429F1FF call 00404DAC<-----------------�ڴ�CALL��Ƚ�
:004F2478 0F85BA000000 jne 004F2538<------------------��ע��ɹ�
:004F247E B201 mov dl, 01

��
============================================================
:004E8B7C 55 push ebp
:004E8B7D 8BEC mov ebp, esp
:004E8B7F 6A00 push 00000000
:004E8B81 53 push ebx
................
................
:004E8BB5 53 push ebx
:004E8BB6 8D45FC lea eax, dword ptr [ebp-04]
:004E8BB9 50 push eax
:004E8BBA 8B4E40 mov ecx, dword ptr [esi+40]
:004E8BBD 8B5630 mov edx, dword ptr [esi+30]
:004E8BC0 8BC6 mov eax, esi
:004E8BC2 E875FDFFFF call 004E893C<-----------------��
:004E8BC7 8B55FC mov edx, dword ptr [ebp-04]

��
==============================================================
:004E893C 55 push ebp
:004E893D 8BEC mov ebp, esp
:004E893F 83C4C4 add esp, FFFFFFC4
:004E8942 53 push ebx
:004E8943 56 push esi
...............
...............
:004E899E 33F6 xor esi, esi
:004E89A0 807D0C00 cmp byte ptr [ebp+0C], 00
:004E89A4 0F849B000000 je 004E8A45
:004E89AA BF64000000 mov edi, 00000064<-------------EDI��ֵ64(��ע��ĵ�һλ)
:004E89AF 8D45F0 lea eax, dword ptr [ebp-10]
:004E89B2 50 push eax
:004E89B3 897DDC mov dword ptr [ebp-24], edi
:004E89B6 C645E000 mov [ebp-20], 00
:004E89BA 8D55DC lea edx, dword ptr [ebp-24]
:004E89BD 33C9 xor ecx, ecx

* Possible StringData Ref from Code Obj ->"%1.2x"
|
:004E89BF B8688B4E00 mov eax, 004E8B68
:004E89C4 E8CB17F2FF call 0040A194
:004E89C9 8B45FC mov eax, dword ptr [ebp-04]
:004E89CC E897C2F1FF call 00404C68
:004E89D1 85C0 test eax, eax
:004E89D3 0F8E2F010000 jle 004E8B08
:004E89D9 8945E4 mov dword ptr [ebp-1C], eax
:004E89DC C745EC01000000 mov [ebp-14], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E8A3E(C)
|
:004E89E3 8B45FC mov eax, dword ptr [ebp-04]<-----------ȡע��
:004E89E6 8B55EC mov edx, dword ptr [ebp-14]
:004E89E9 0FB64410FF movzx eax, byte ptr [eax+edx-01]<------ȡһλע��
:004E89EE 03C7 add eax, edi<--------------------------��EDI��
:004E89F0 B9FF000000 mov ecx, 000000FF<---------------------ECX��ֵFF
:004E89F5 99 cdq
:004E89F6 F7F9 idiv ecx<------------------------------��FF
:004E89F8 8BDA mov ebx, edx<--------------------------��EBX(��ֵΪX)
:004E89FA 3B75F4 cmp esi, dword ptr [ebp-0C]<-----------�Ƚ�ESI�Ƿ��ڵ��4([ebp-0c]==4(��ַ��4λ��ӵ�һλ��)
:004E89FD 7D03 jge 004E8A02
:004E89FF 46 inc esi
:004E8A00 EB05 jmp 004E8A07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E89FD(C)
|
:004E8A02 BE01000000 mov esi, 00000001<----------------------ESI��ڵ��4��¸�ֵΪ1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E8A00(U)
|
:004E8A07 8B45F8 mov eax, dword ptr [ebp-08]<------------ȡҪ��ַ�(F0E1)
:004E8A0A 0FB64430FF movzx eax, byte ptr [eax+esi-01]<-------ȡ��һλ(��ΪY)
:004E8A0F 33D8 xor ebx, eax<---------------------------ֵX��һλ��ַ�Y��(��Ϊһλע��)
:004E8A11 8D45D8 lea eax, dword ptr [ebp-28]
:004E8A14 50 push eax
:004E8A15 895DDC mov dword ptr [ebp-24], ebx
:004E8A18 C645E000 mov [ebp-20], 00
:004E8A1C 8D55DC lea edx, dword ptr [ebp-24]
:004E8A1F 33C9 xor ecx, ecx

* Possible StringData Ref from Code Obj ->"%1.2x"
|
:004E8A21 B8688B4E00 mov eax, 004E8B68
:004E8A26 E86917F2FF call 0040A194
:004E8A2B 8B55D8 mov edx, dword ptr [ebp-28]
:004E8A2E 8D45F0 lea eax, dword ptr [ebp-10]
:004E8A31 E83AC2F1FF call 00404C70
:004E8A36 8BFB mov edi, ebx
:004E8A38 FF45EC inc [ebp-14]<------��ַ��+1
:004E8A3B FF4DE4 dec [ebp-1C]<------ע��ȼ��-1
:004E8A3E 75A3 jne 004E89E3<------�ж��û�У�û��
:004E8A40 E9C3000000 jmp 004E8B08

================================================================
�㷨�ܽ᣺
1��ע��ǰ��λΪ64��
2��λΪ��ÿλע��+ǰ��λע��ֵ mod FF ��ַ�(��F0E1��һ��ȡһλ��ѭ��ȡ)��ֵ��
3��ע��붼Ϊ��д��ĸ��

ע��master
ע��룺6497C879DC0446

��TC2.0ע��Դ�룺
main()
{
short c[20],x1,x2;
int i,j,m;
char a[20],b[4]={"F0E1"};
c[0]=0x64;
clrscr();
printf("===============================\n");
printf(" This Is QC Keygen \n");
printf(" made by master[FCG] \n");
printf("===============================\n");
printf("\nPlease Input Your name: ");
gets(a);
j=strlen(a);
for (i=0;i c[i+1]=((a[i]+c[i])%0xff)^b[i%4];
printf("Your Code Is: ");
for (i=0;i {
x1=c[i]/16;
x2=c[i]%16;
if (x1<10) x1=x1+48;
else x1=x1+55;
if (x2<10) x2=x2+48;
else x2=x2+55;
printf("%c%c",x1,x2);
}
}