Chapter 8 - How is the registration code made up?
What you should understand is that all the software authors are like what you imagine and hope, no one is willing to use the software by others in the debugger, you can find the correct registration code ... if that is What is it?
The way we are looking for software registration code is targeted. It must be guaranteed that the software is using clearly, in which we only need to find a place, a D directive will become. Since there is a clear code, it is not difficult to guess the corresponding non-code comparison ... Non-code comparison is more likely to understand, that is, the software compares two registration code different, not to calculate the correct After the registration code, it is compared to the user input. It may be compared with the corresponding bit per calculated and the corresponding bits in the ingredition, one but finds the difference from the user, and prompts an error, etc.
In this software, we can actually find its corresponding registration code, but there is a bit of miserable, a one-sized plan ... but if people don't give you a face, one but calculate a certain number of incorrect If you jump, what do you do? Therefore, the national wants to get rich, and the tree is fundamental ... Ng! So in this software, we only analyze its algorithms, and the registrar is the only way (if you want to write the registrar) ...
You have to understand that even if we can find the registration code of the software that uses the clear code, the reason is just because it is clearly compared, so we don't have a happy place, we really have to do it, not to find one Registration code ... Of course, if you have just started, it is still very helpful to you. Our Crack's ultimate goal is to analyze it, engage in its registration algorithm and write the registration machine, so that successful CRACK has a software, successful mood is difficult to express! Just like you have a constipation, you have ruling it out, ^ _ ^, huh, this metaphor, although vulgar, but you can imagine, carefully analyze a software, and finally put it on the algorithm to understand, that kind I feel ... I am convinced that one day you can experience you, even waiting for you.
I believe that you have seen the article about the software registration algorithm for the highly prawn before, and also believe that you have tried to track the movement of a software, although the next result is not very satisfied.
In fact, analyze a software registration algorithm, including some technological things and necessary experience, it is difficult to imagine a person who has not been mastered by a conjunction, how to analyze a single scene .. Hey, even the use of the use of the debugger is not difficult, but that doesn't mean you can analyze a software, see Call, chasing such a move, is not an experience, this chapter I try to Give you an appropriate analysis method.
I believe everyone is not accompanying the ability to use the debugger alone and understand the ability to understand most of the assembly instructions. It is enough! Let's start...
It officially started today's topic, I will come to two examples, I believe that these two examples have enough expression skills, at most, the ability to sell fritters in our house is much more, ...
Ok, first, we still invite our old friends. Here, this, even the authors of Chinazip v7.0 said that I am the most sincere apology in my heart! I believe I use this old version of China compression Will not bring you an economical trouble ...
Through the explanation of the two chapters in front, we have made this software substantially to understand, and also chase its corresponding registration code. And our purpose is to analyze its registration algorithm, and write the registration machine! The registration algorithm of this software is actually more simple (and there is bug) to use it to be an example, which can explain the situation ... Ok, we started, we already know how to calculate the correct The key CALL of the registration code is 004F4DDE, and we use TRW2000 to analyze it! (Given the current TRW2000 in most tutorials, and this is the debugger that most rookie will use, this debugging Make specific explanations)
Start CHINAZIP, help - registration (so I said that this software is ideal for writing the tutorial, and still register after registration) Enter the registration name Suunb [CCG], registration code 19870219. See the CTRL N exhaled TRW2000, the next BPX 004F4DDE, F5 returns.
Then press OK, huh, huh, was stopped by TRW2000. Through the analysis of the two chapters before, we used this CALL that learned 004f4dde to calculate the correct registration code, so we press F8 to follow up! The algorithm of the registration code will bear in this call, which gives it to the analysis, and we can figure out how the software's registration code is generated. But what should I analyze? This is a serious problem. I don't know what you think, anyway, I can't find the north, what are my important? Besides, there is so many calls in it, I have to catch it in one place?
Oh, this is what I said. In fact, it is not terrible. As long as you are compiling is not a problem, it will be. First of all, you can first execute the Call of this calculated registration code from the head to the end, in understanding that probably jump and some of some of the Calls, HEHE ~~ You can perform a CALL to see the change of each register (If the value in the register changes, the color will change) If the value of a register changes after the CALL is over, we can see what type it contains. If the memory address is used to look at the D instruction, if Take a look at the number of digits you enter the registration name or registration code. If you can eliminate a large part of the Call, because there are many CALL roles only put the registration name or registration code into memory. A address or get the number of bits of the registration name (registration code) or a ASCII code for a certain bit of the registration code. We don't have to be relentant. It is also recommended that you use ollydbg. Many information can be seen after executing a directive, I will then say, press F8 to pursue the CALL first, then go once ... I give the anti-appointment code after the pursuit, and give notes , Corresponding analysis looks back ...
0167: 004F4FAC PUSH EBP <- F8 first instructions
0167: 004f4fad MOV EBP, ESP
0167: 004F4FAF Push Byte 00
0167: 004f4fb1 push byte 00
0167: 004f4fb3 push byte 00
0167: 004f4fb5 push byte 00
0167: 004f4fb7 push byte 00
0167: 004f4fb9 push byte 00
0167: 004f4fbb push byte 00
0167: 004f4fbd Push EBX0167: 004F4fbe Push ESI
0167: 004F4fbf Push EDI
0167: 004F4FC0 MOV [EBP-08], ECX
0167: 004F4FC3 MOV [EBP-04], EDX
0167: 004F4FC6 MOV EAX, [EBP-04]
0167: 004F4FC9 Call 004041C0
0167: 004f4fce xor Eax, EAX
0167: 004f4fd0 Push EBP
0167: 004f4fd1 push dword 004f5097
0167: 004f4fd6 push dword [fs: eax]
0167: 004F4FD9 MOV [fs: eax], ESP
0167: 004f4fdc xor ESI, ESI
0167: 004f4fde lea eax, [EBP-0C]
0167: 004F4FE1 MOV EDX, [EBP-04]
0167: 004F4FE4 Call 00403E24 <- This Call is used to get registration names entered by the user
0167: 004F4FE9 MOV EAX, [EBP-0C] <- EAX register with the address of the registered name
0167: 004F4FEC call 0040400C <- This CALL is used to get the number of bits of the registration name entered by the user, and put it in EAX
0167: 004f4ff1 MOV EDI, EAX <- Load the number of bits of the registration name into the EDI
0167: 004F4FF3 Test EDI, EDI <- Testing EDI
0167: 004F4FF5 JNG 004F5051 <- If the value in EDI is 0, it will jump.
0167: 004F4FF7 MOV EBX, 01 <- EBX set 1 for later operations
0167: 004F4FFC MOV EAX, [EBP-0C] <- EBP-0C is installed in the registered memory address, which is paid in Eax
0167: 004F4FFF MOV AL, [EAX EBX-01] <- EAX This is the memory address of the registered name, plus the value in EBX to reduce 01, used to obtain the corresponding bit of the registration code For example, when we executed here, the EBX is loaded into 01, and then the value obtained after the 01 is actually EAX itself, so it can get the first character in the registration name, and execute it When you jump back, EBX will add 1, so you can get the next character ...
0167: 004f5003 Call 004f4f60 <- This Call is very important, will explain how we know it is very important.
0167: 004F5008 Test Al, Al <- Here we will find a test operation, the object is Al, and the Al is just raised in the registered name before the CALL, so we can determine the above CALL will Do some hands and feet, we will follow ...
0167: 004F500A JZ 004f5031 <- If 0 is loaded into 004F5031 if the Al is installed, the value in Al is changed by the CALL at 004F5003.
0167: 004F500C LEA EAX, [EBP-18]
0167: 004F500F MOV EDX, [EBP-0C] <- EBP-0C is installed in the registered memory address, which is loaded into the EDX
0167: 004F5012 MOV DL, [EDX EBX-01] <- That is the same as the instructions at 004F4FFF, get the current participating computing in the registration code
0167: 004F5016 Call 00403f34 <- not important!!
0167: 004F501B MOV EAX, [EBP-18]
0167: 004f501e lea edx, [EBP-14]
0167: 004F5021 Call 004088ac <- Not important !! 0167: 004f5026 MOV EDX, [EBP-14]
0167: 004f5029 Lea Eax, [EBP-10]
0167: 004F502C Call 00404014 <- This Call also is more important, the action is such that if the current participating characters are calculated after calculation of the front 004f5003, Al will be placed in a non-0 value) Then the jump at 004F500A will lose its role, and the CALL will save the current changing characters to 00d3b3c4 (memory) !! will be detailed later
0167: 004F5031 CMP EBX, Byte 01 <- Use this at this time to reduce the value of EBX 1
0167f5040 <- If it is zero, it means that the first character in the registration name is jumped to 004F5040.
0167: 004f5036 MOV EAX, [EBP-0C] <- EBP-0C is installed in the registered memory address, which loads the registered memory address into EAX
0167: 004f5039 Movzx Eax, Byte [EAX EBX-02] <- Used to get the previous character
0167: 004F503E JMP Short 004f5046 <- unconditional jump to 004F5046
0167: 004F5040 MOV EAX, [EBP-0C] <- EBP-0C is installed in the registered memory address
0167: 004f5043 MOVZX EAX, Byte [EAX] <- Get the first character of the registered name
0167: 004F5046 LEA ESI, [ESI EAX * 4 A8] <- !!! This instruction is the key, will be explained later !!! This instruction first gets the ASCII code of the character of this round, then Multiplying 6, then add A8 (ie, the number of decimers 168, huh, it can be understood) and add this character to the value of the value of the characters and the value of the previous character!
0167: 004F504D Inc EBX <- EBX plus 1, used to get the next character of the registration code
0167: 004F504E Dec EDI <- EDI minus 1, EDI is installed in the number of registration code
0167: 004f404f JNZ 004F4FFC <- Do not jump to the 004f4ffc at 004F4FFC to calculate the next character ... Since full participation.
0167: 004f5051 Lea EDX, [EBP-1C] <- put the address of the second half of the registration code into the EDX, pass it to the following CALL
0167: 004F5054 MOV EAX, ESI <- Direct the value of the second half of the previously calculated registration code into EAX
0167: 004F5056 Call 00408C70 <- Convert the value of the second half of the previously calculated registration code to decimal, and loaded into EBP-1C
0167: 004F505B MOV ECX, [EBP-1C] <- EPB-1C is installed in the second half of the registration code
0167: 004F505E Lea Eax, [EBP-0C]
0167: 004F5061 MOV EDX, [EBP-10] <- EBP-10 is installed in the first half of the registration code
0167: 004F5064 Call 00404058 <- This CALL is used to consolidate the front and rear partial registration code, and the merged registration code will save the EBP-0C
0167: 004F5069 MOV EAX, [EBP-08]
0167: 004F506C MOV EDX, [EBP-0C]
0167: 004f506f call 00403de00167: 004f5074 xor Eax, EAX
0167: 004F5076 POP EDX
0167: 004F5077 POP ECX
0167: 004F5078 POP ECX
0167: 004F5079 MOV [fs: eax], EDX
0167: 004F507C Push DWORD 004F509E
0167: 004f5081 Lea Eax, [EBP-1C]
0167: 004F5084 MOV EDX, 05
0167: 004F5089 Call 00403dB0
0167: 004f508E Lea Eax, [EBP-04]
0167: 004F5091 Call 00403D8C
Oh, is it good to understand the code after I added a note? You may ask, how do you know what CALL is doing? Don't I say the method? We will probably, look at each other, then look at each Call's role ... Do you think that the above comments can I write after I have passed? You have a few times, you will have a probably ...
What are you thinking now? Everyone: Standing and talking, no back pain ... I halo ~~
Oh, I try to say something carefully:
In fact, it is very understandable. We chase in, then look at those Calls, some of whom have a slight experience, know if it is used to get registered names or length ... After we followed it again. .. followed by 004f4ff3, it will find that it will be compared to the number of bits of the registered name, see if the user enters the registration name ... (that is, if the number of registered names in the EDI is not more than 0, ie Just jump away, I will talk about this BUG after a while. After the 004F4FFC, we will find that the software will get the registered memory address. Next, one instruction will be known to get registration. The characters in the name, hey, see this instruction, look down now, find which instruction below will jump back to 004F4FFC ... Oh, we will find the goal at 004f504f, good Now we know those instructions between 004f4FFC to 004f504f to calculate each character in the registration name ...
Oh, that is, the software starts from 004F4FFC first get the nth character in the registered name, and then makes a series of operations, then subtract the number of bits of the previously come to the registration name when the 004f504e is executed. Whether it is 0, not 0, then jump to the 004f4ffc, then the N 1 bit of the registered name is calculated. The purpose of this move is to see if the registered name is calculated. If it is not 0, it will not be calculated, huh, very simple, and EDI is the number of registered names. After one, it will be reduced. After done, the registered names have also participated in the operation ...
Ok, let's see the specific algorithm section:
The jump at 004F4FF5, if you enter the registration name, it will not jump away ... This is input to Suunb [CCG], it will continue to 004F4FF7, which initializes EBX. .. Pay 1, then load the memory address of the registered name in EBP-0C in the 004f4ffc, then the 004f4FFF is used to obtain the first character of the registered name, and put it into it Al. Imagine that EAX is installed in the registered memory address, starting from this address, 10 memory cells are the registration name of our entered S u n b [c g] Oh, do you understand? The memory address installed in EAX is the first address of the registered name in memory. When the first execution is here, 1, EAX EBX-01 is the first address of the registered name, that is, S. Wait until the jump instructions at 004F504F jumps back, there is an INC instruction at 004f504D to add 1 at 004f504d, which will get the second character u after the registration name when executed here, 嘿嘿, Will add 1 to EBX before you come, understand? Total You can understand the value in EBX as the number of characters in the registration name, that is, EBX is 1 is the first bit (s) of the registered name. If EBX is 2 is the registered name 2 bits (U). Then, after 004F5003, there will be a call waiting for us, huh, this CALL is more important, a part of the registration code is decided by it, it is not difficult to find it, because 004f5003 will have a jump, and the AL will be tested before the jump is jumped. Hey, and the AL is loaded before the CALL is the character of the current participating operation ... and you will find it with the debugger. Modifications to Al, huh, this CALL will do some processing, and the result of the processing directly affects the process of the back part, so for it, we must follow ... It is best to send two people. The road is defensive, and looking for a specialized back to its tail ...
We will follow it later, but now you should first understand the software substantially algorithm. Ok, I will say that there will be a jump after the AL is tested at 004F5008, that is, if the value of the installed in Al is 0, jump to 004F5031, you can understand the character for this Call. In order to make some operations, if the requirements are met, Al will be set 0 or 1, and after the test is used to determine if the current character meets the requirements. If you meet, you jump or don't match it ...
Continue, because the first character I entered is S, and S just the calculation of the Call at 004F5003, I have not jumped, I will continue to press F10 to perform single-step execution ... The next 004f500c, 004f500f, 004f5012 These three instructions are the same as the norm of the nth character of the registration code before, you can see it ... and the following instructions from 004F5016 to 004F5029 are not good. If you are curious about the two CALLs, you can go in. I don't have any substantive things ... and this Call at 004F502C is very important, huh, huh, what is its role? I still remember the call that I just said, it will make Al, it will change the Al, and the jump instruction below will jump according to the value of Al, that is, if Al is 0, jump to 004F5031 At the point, just skip this Call at 004F502C ... and the first character I entered is S, just in line with the requirements of 004F5003, so I didn't jump, so I executed here, you can chase Going in, it is not complicated, just put the current participating characters into the 00D3B3C4 of the memory (if the characters currently participating in the operation are not passed at 004F5003, you will not execute it here, huh, I understand, this Call is used to collect all the characters in the registration name that meet the 004F5003 Call requirements) Hohoho ~~ (please imitate Zhou Xingxing's laughter ...) Now we have understood half ... Ok, we continue .. .
Whether you jump from 004f500a to 004F5031, it is also a step by step, knowing, no matter where the current calculation is not in line with the CALL requirements at 004F5003, in the registration name. Will do it here ... What is the instruction to do? Is it a corresponding number of characters participating in the registration name in EBX? CMP EBX, BYTE 01 is minus 1 with EBX. The use of the instruction is to look at the first character in the registration name. If you jump to 004F5040, do you continue .. We first see 004F5040, when executed here, the EBP-0C is actually the memory address of the registered name (it has been said before the front), and the instructions at 004F5043 later The purpose is to get the first character of the registered name ... Ok, let's turn back to see 004f5036, if the character currently participating in the calculation is not the first character in the registration name, it will not jump, and execute it The memory address of the registered name in EBP-0C is also put in EAX, and the Eax, Byte [EBX EBX-02] at 004F5039 is, huh, it is very well understood, EAX EBX-01 is The memory address of the characters currently participating in the calculation, and the Eax EBX-02 here is the character of the previous character, understand?
We went to the instructions at 004F5046, this is also very important, its role is to calculate the second half of the registration code!
I believe that you can understand it, it means that when executed here, the first character in Eax is in the registration code, or the previous character of the current participating characters (Note: Character In the memory or register, it is represented by the ASCII code. If S is displayed in EAX to 00000053, the S of the ASCII code is 53, the decimal 83) ... We first executed here, ESI The value of 0 (ie 00000000) EAX * 4 A8 is to multiply the ASCII code that currently participate in the characters of the operations 4, and then use A8 (that is, the number of decimers 168, all the way?) And use this and ESI added, I have said, the value in the ESI is 0 when I execute it here, and when the second execution is here, the ESI is the first character of the registered name. ASCII code multiply by 4 and then plus all the way ... You will ask you why know it is the second half of the calculation code? Guess !! Of course, we can see that at 004F5054, the program will load the results of the previous calculations in Eax, and then the next side is a call, hey, the light day is too clear, this is too obvious. We will find it out that it will know that its role is to convert hexadecimal numbers into decimal ... and load the conversion into the memory address in the EDX, we will see EDX before Call. The value is loaded from 004F5051, ie EBP-1C, huh, after Call, you will see D EBP-1C, you will see the second half of your registration code ...
The post program will load a memory address EBP-0C in ECX at 004f505E, and the action is a function of passing the parameters at 004F505E (its role is the CALL of the passing parameters. The value will be stored in the 004f5061 after the value in EAX is used), and what is the EBP-10 installed in EDX? We will know that its address is 00d3b3c4 with D EBP-10 instructions. Hey, is your smell sensitive? If you are not sensitive, then I will say it again, and I still remember the Call at the 004f502c? Its role is to collect characters required by the Call at 004F5003 ...
Hey, do you understand it?
The registration algorithm of this software is this: first get the number of registration code, see if it is more than 0, not more than 0, jump to 004F5051 ... Ok, we entered Suunb [ccg] this registration name, at this time The number of registration codes is 10, so we will not jump, then we will come to 004F4FFF. When you execute it here, the first character S of the registration name will be loaded into the Al, the second time. Loading the second character (ie) in the registration name into the Al, its role is to load the characters currently participating in the operation into Al, then it is a call, this Call will perform the characters currently participating. Calculate ... there will be a jump, see if the Al is installed is 0, if you jump to 004f5031, if it is not a non-zero, you will meet the requirements, then it will be executed to 004F502C The Call here will store the 00D3B3C4 of the memory ... and there will be a comparison at 004F5031. The role is to see the first character in the registration name. If you jump to 004F5040 At this point, the first character of the registration name is located in EAX to participate in the calculation at 004F5046. If the current participating operation is not the first character of the registration name, then it will get the character in front of the characters currently participating in the calculation when executing the 004f5039, and it is incomplete to the 004F5046 to participate in the operation after loading EAX. To understanding? That is to say, the first character you entered will participate twice, and the last character will not participate in the calculation (think about it, if the character currently participating in the characters are the first character in the registration name, it will Participate in the calculation, if it is the second, take the front side, that is, the first one will participate once, take the second time, take the second, to the fourth time ... When the last character comes to here, the character will be taken to participate in the operation, and after this, the loop is over, so the last one will not be calculated), etc.), all characters in the registration name have participated in the operation, At 004F5056, the calculation result at the front 004f5046 is converted to a decimal ... and then in the CALL of the 004F5064, it is required to meet the CALL of 004F5003 at 004F5003 at 004F5003. The characters are merged together, this result, 嘿嘿, is the real registration code! That is, the real registration code is composed of the following:
All the character of the CALL required at 004F5003 in the registration name of the registration name ((ASCII code * 4 168) * 2 in the registration name (except the first and last one All characters) * 4 168 and
Now we also know how the registration code is made. We must write a registration machine, you must understand the CALL of 004F5003, so we can filter characters in the registration name ...
Ok, let's come again:
Ctrl N exhaled TRW2000, under the BPX 004F5003, F5 exit point determined to follow F8 followed by F8, huh, this is nothing to say, see what I gave it:
0167: 004F4F60 PUSH EBP
0167: 004F4F61 MOV EBP, ESP
0167: 004F4F63 PUSH ECX
0167: 004F4F64 Push EBX
0167: 004F4F65 Push ESI
0167: 004F4F66 MOV [EBP-01], Al <- put characters into memory EBP-01
0167: 004F4F69 MOV BYTE [EBP-03], 02 <- EBP-03 loading 020167: 004f4f6d MOV BYTE [EBP-02], 01 <- EBP-02 loading 01
0167: 004F4F71 MOV CL, [EBP-01] <- Put the character of the operation into the CL
0167: 004F4F74 DEC ECX <- CL minus 1
0167: 004F4F75 SUB CL, 02 <- Cl to reduce 2
0167: 004F4F78 JC 004F4FA4 <- If you carry, you jump, you don't have to worry, usually you will not jump away.
0167: 004f4f7a incc ECX <- ECX plus 1, that is, CL plus 1
0167: 004F4f7b MOV BL, 02 <- BL load 02
0167: 004f4f7d xor Eax, EAX <- EAX Different or calculation, will be set to EAX 0
0167: 004F4f7f MOV Al, [EBP-01] <- Al loaded into the character of the operation
0167: 004F4F82 XOR EDX, EDX <- EDX set 0
0167: 004F4F84 MOV DL, BL <- Pay the value in the BL to DL
0167: 004F4F86 MOV ESI, EDX <- Pay for ESI
0167: 004f4f88 xor Edx, EDX <- EDX set 0
0167: 004F4F8A DIV ESI <- ASCII code to be used in Eax's participating characters to remove the value of the current ESI
0167: 004F4F8C Test EDX, EDX <- Test EDX, EDX is installed in the rest of the number
0167: 004f4f8e jnz 004f4f93 <- not 0 Jump to 004F4F93
0167: 004f4f90 inc Byte [EBP-03] <- EBP-03 value plus 1
0167: 004F4F93 CMP BYTE [EBP-03], 02 <- Diming 02 with the value at EBP-03
0167: 004F4F97 JNA 004F4F9f <- Do not jump to 004F4F9F
0167: 004F4F99 MOV BYTE [EBP-02], 00 <- EBP-02 loading 00
0167: 004F4F9D JMP Short 004f4fa4 <- unconditionally jumped to 004F4FA4
0167: 004f4f9f inco <- EBX plus 1
0167: 004F4FA0 DEC CL <- Cl minus 1
0167: 004F4FA2 JNZ 004F4F7D <- Do not jump to 004F4F7D again
0167: 004F4FA4 MOV Al, [EBP-02] <- Return the value at EBP-02 into Al
0167: 004F4FA7 POP ESI
0167: 004F4FA8 POP EBX
0167: 004f4fa9 pop ECX
0167: 004F4FAA POP EBP
I don't know what you can't see, I will give you a clear explanation, which is this very like this:
First get this character's ASCII code, then subtract 2, and turn the BL value 02 ... then use Eax to reduce the 2 ASCII code divided by the value in the BL installed in the ESI, then look Whether the remainder of the EDX is 0, if 0, add the value of EBP-03, you should know that the EBP-03 is fixed when it is initialized, and if it is added 1, it is greater than 2, so after this, you will not jump away at 004f4f97. If you don't jump, at 004f4f99, EBP-02 will be loaded into 00, then there is no conditional jump to 004f4fa4, where there will be EBP there The value of -02, that is, 00 mounts Al, understand it ... But if the remainder in the EDX is not 0, then take away at 004F4F8E, when it is 004F4F93 due to EBP-03 Yes 02, so the conditions will be established, so that the 004f4f9f can be jumped to continue executing procedures ... and after the 004f4f9f, EBX (ie BL) will be plus 1, and the Cl is subtracted from 1, if If CL is not 0, then jump to 004f4f7d, then again, until CL becomes zero ... The above process can be said in Delphi:
(The variable S is installed in the current participating computing characters, the Code variable is used to collect characters that meet the requirements, the declaration of the variable I did not write)
N: = ORD (S);
For i: = 2 to n-1 do
Begin
Modz: = (N-I) MOD I;
IF MODZ = 0 THEN BREAK;
END;
IF MODZ <> 0 THEN
Code: = CODE S;
Oh, this has played the same role as the previous assembly code.
Let me write a function, which can be used to get all the requirements in the registration code:
Function getKeychar (Name: string): string;
VAR
I, ASC, SH, MODZ: Integer;
String;
Begin
For i: = 1 to Length (name) DO
Begin
ASC: = ORD (Name);
For sh: = 2 to ASC-1 DO
Begin
MODZ: = (ASC-SH) mod sh;
IF MODZ = 0 THEN BREAK;
END;
IF MODZ <> 0 THEN
Code: = CODE NAME;
END;
Result: = Code;
END;
You can use this:
VAR
S1, S2: STRING;
Begin
S1: = edit1.text; // Edit1 is used to enter the registration name;
S2: = getKeyChar (S1); // This time S2 is the character that meets all the requirements in the registration name;
END;
Hey, is you very important to know what characters can meet the requirements? Hey, in fact, CHINAZIP can tell us, you only need to complete all the available characters when entering the registered name, and then look at the first half of the registration code with D instructions, you can know Of course, you can also write a program to try it yourself. If you use Delphi, you can use the functions you give above ... tell you, in all ASCII characters, only the following meets:
CGIosyaegkmq5 =%) ; /
If you don't believe, you can try it, the characters in the correct registration code can only be these few ... Hey, it seems to respect our CCG.
Ok, I have been nonsense, put the complete registrar. This is not difficult. As long as the calculation of the second half of the registration code is OK: You can declare the following functions in Delphi, Can be used directly:
Function getKey: String;
VAR
N: String;
I, SH, CI: Integer;
Si: integer;
ASC, MODZ: Integer;
Begin
I: = length (name);
IF i = 0 THEN Result: = 'Please enter the registration name ...'
Else
Begin
For sh: = 1 to i do
Begin
ASC: = ORD (Name [sh]);
For ci: = 2 to ASC-1 DO
Begin
Modz: = (ASC-CI) MOD CI;
IF MODZ = 0 THEN BREAK;
END;
IF MODZ <> 0 THEN N: = N Name [sh]
END;
Si: = ORD (Name [1]) * 4 168;
For sh: = 1 to i-1 DO
Begin
Si: = Si ORD (Name [SH]) * 4 168;
END;
N: = Uppercase (N INTOSTR (SI));
Result: = n;
END;
END;
Finally, if you pay attention, you will find that the number of bits of the registered name will be tested at the 004F4FF3 at the beginning. Slightly a little experience, I will find that if the program finds that the number of registered names is 0, it will jump directly to the failure, and this software is not! What is the 004F5051? Halo ~~ If you have to get the second half of the registration code, huh, let's take a look at 00d3b3c4, you will see a pile of 0, what are you thinking now? Since we don't enter the registration name, it is impossible to have the first half of the registration code, and then there will be Calls to merge the registration code before and after you will restart the software. The registration name is not filled, and the registration code is filled with 0 registration Take a look at ... hoho ~~ (please still imitate Zhou Xingxing's laughter) This careless author, causing this reason very simple, the software does not judge whether the statist is empty and the software is initialized The INTEGER variable used to calculate the second half of the registration code payment is 0, otherwise the memory at 00d3b3c4 should be empty .. (It is difficult to connect 0 without losing if you can register?)
So, CRACK is not a bad thing. You can tell the author at this time, but not only pay a friend but also, you will get a free registration code ... (I don't know if there is any White hat cracker? 嘿嘿, ccc just can also be the first half of the registration code ~~) I hope you understand that the simple and bug software for this registration algorithm (usually indicates that its author has nothing experience ^ _ ^), We should not be happy to provide its registration machine, if you can help your author improve the algorithm or remove the BUG, what is it not a good thing? After all, there are two words above the software, do you bear to bear? ? ?
I don't know if China's compression registration analysis you read, I personally think that I am more detailed (almost every directive added annotations and then three later) but if you still look If you don't understand, please be sure to believe that my article is not good, don't give up, buddy ~~! Ok, let me give you another example ... By telling you to tell you another more common The registration code calculation method, the result of the operation is converted with characters in a table, that is, the password table ^ _ ^
Originally, I want to use the Internet Express FlashGet, but I have already posted the latest version 1.40 version of the article & the registration machine. When I just, the netizen is not behind the back and stickers. I want to help him look at the voice interface. 2.0 This software, Down is about to look at it, huh, I found that this is what I want, the registration code calculation is used to use the password table and it is not difficult ... HEHE ~~ Later HMily brother saw it Nor is another post, you also write a registration machine and break, you can refer to it, hey, hmily and the couple are people, so I am not afraid of him ...
let us start...
First comply with this software, it will automatically generate machine code, in my side is XN2URKEUMWPNV5XZ.
This chapter, I will use the debugger ollydbg to explain, it is really easy to use ... we start:
I don't know if you like ollydbg's way of break, the general knowledge doesn't like it, from that more API first (word is small), then say, even if you still use HMemcpy, unless you can't make or in 2K / Under XP, I don't even go to the API. I often want to break up three or four times. We are more tired. We will first ask the temporary actor TRW2000 out of the game (to pause your MP3), lower bpx hmemcpy After confirming, the pmodule returned to 0040432F, we will start from here. Director: "STOP! Forward", "Hey, continue your MP3, please open ollydbg
We use ollydbg to load, in the disassembly code (ie in the top left in the top left), press Ctrl g, enter 0040432F, and then come here. We probably look at it. If you have experience, you will easily see this place is it (this luck is better, you can find the software calculated registration code. ^ _ ^)
Ok, let's press F2, then press F9 to run the program. After entering China CRACKING Group Suunb after the Registry, press OK will be disconnected by ollydbg, and go to the run. I posted the anti-assembly code:
0040432F |. 8D4C24 10 Lea ECX, DWORD PTR SS: [ESP 10]
00404333 |. 6a 05 Push 5
00404335 |. 51 Push ECX
00404336 |. 68 E8030000 Push 3e8
0040433b |. 8BCE MOV ECX, ESI
0040433d |. E8 10050000 Call
00404342 |. 8bc8 MOV ECX, EAX
00404344 |. E8 7D060000 Call
00404349 |. 8D5424 18 Lea EDX, DWORD PTR SS: [ESP 18]
0040434d |. 6a 05 Push 5
0040434f |. 52 Push EDX
00404350 |. 68 E9030000 Push 3e900404355 |. 8BCE MOV ECX, ESI
00404357 |. E8 F6040000 Call
0040435C |. 8bc8 MOV ECX, EAX
0040435E |. E8 63060000 Call
00404363 |. 8D4424 20 Lea Eax, DWORD PTR SS: [ESP 20]
00404367 |. 6a 05 push 5
00404369 |. 50 push eax
0040436A |. 68 EA030000 Push 3ea
0040436f |. 8bce Mov ECX, ESI
00404371 |. E8 DC040000 Call
00404376 |. 8BC8 MOV ECX, EAX
00404378 |. E8 49060000 Call
0040437D |. 8D4C24 28 Lea ECX, DWORD PTR SS: [ESP 28]
00404381 |. 6A 05 Push 5
00404383 |. 51 Push ECX
00404384 |. 68 EB030000 PUSH 3EB
00404389 |. 8BCE MOV ECX, ESI
0040438B |. E8 C2040000 Call
00404390 | 8BC8 MOV ECX, EAX
00404392 |. E8 2F060000 Call
00404397 |. 8b7c24 68 MOV EDI, DWORD PTR SS: [ESP 68]
0040439b |. 33DB XOR EBX, EBX
0040439d |. 33c9 xor ECX, ECX
0040439f |. 8D04BF LEA EAX, DWORD PTR DS: [EDI EDI * 4]
004043A2 |. 8D0480 Lea Eax, DWORD PTR DS: [EAX EAX * 4]
004043A5 |. 8D3480 Lea ESI, DWORD PTR DS: [EAX EAX * 4] <- These you don't need to manage, because they can't help us
004043A8 |. C1E6 02 SHL ESI, 2 <- The value of ESI after execution is 5dc, and the decimal number of 1500
004043ab |> 0fbe440c 50 / Movsx Eax, Byte Ptr SS: [ESP ECX 50] <- ESP ECX 50 is the address in the machine code (the first execution here ECX is 0, the machine is the machine) The first place of the code, the second time, ECX will add 1, get the second ...)
004043B0 |. 03C6 | Add Eax, ESI <- added with ESI, that is, add 1500
004043b2 |. BD 3E000000 | MOV EBP, 3e <- EBP set 3E, and decimal number 62
004043b7 |. 99 | CDQ <- expansion ...
004043B8 |. F7FD | IDIV EBP <- The first OR 3 or 3 or 4 bits of the machine code in EAX are removed from 1500 and 62
004043BA |. 0fbe440c 54 | Movsx Eax, Byte PTR SS: [ESP ECX 54] <- ESP ECX 54 Getting the 5th place from the machine code (also in the ESP ECX 50 in the ESP ECX 50 is the first Is the bit? The first execution of the ECX is 0, the result is the 5th place of the machine code, the second time, ECX will add 1, get the 6th ...) 004043BF |. 03c6 | add EAX, ESI <- Database & Sql Blog Articles
004043C1 |. 8A92 E4704000 | MOV DL, BYTE PTR DS: [EDX 4070E4] <- Important places! At this time, the first OR 2 or 3 or 4-bit machine code plus 1500 in the EDX After the remainder of 62, what is the 4070E4? If we can see D 004070E4 in TRW2000, in OLLYDBG, we can press CTRL G to enter the corresponding memory address at the bottom left corner, so that you can see it. We will find that starting from 4070E4, a string of characters, which is 0123456789abcdefghijklmnopqrStuvwxyzabcdefghijklmnopQrstuvwxyz. Oh, what do you mean? 4070E4 refers to 0, which is the registration code corresponding to the current machine code in the memory address of the remainder of the EDX. (If the remainder is 5, then starting from 4070E4, the fifth character is the 5 characters.) The instruction will be loaded into the DL in DL after execution.
004043C7 |. 88540C 30 | MOV BYTE PTR SS: [ESP ECX 30], DL <- Loads the registration code corresponding to the first OR 3 OR 4 of the machine code into ESP ECX 30
004043cb |. 99 | CDQ <- 5 or 6 or 7 or 8-bit machine code expansion obtained in front
004043cc |. F7FD | IDIV EBP <- Also divided by 62
004043ce | MOV Al, Byte Ptr DS: [EDX 4070E4] <- That is the same as 004043C1, don't say more, it is to get the corresponding registration code of the current machine code
004043D4 |. 88440C 38 | MOV BYTE PTR SS: [ESP ECX 38], Al <- loaded into ESP ECX 38
004043d8 |. 0fbe440c 58 | Movsx Eax, Byte Ptr SS: [ESP ECX 58] <- Get the 9th OR 11 or 12 of the machine code
004043DD |. 03C6 | Add Eax, ESI <- added with 1500
004043df |. 99 | CDQ <- expansion ....
004043E0 |. F7FD | IDIV EBP <- divided by 62
004043E2 |. 0fbe440c 5c | Movsx Eax, Byte PTR SS: [ESP ECX 5C] <- Get the 13th OR 15 or 15 or 16 of the machine code
004043E7 |. 03C6 | Add Eax, ESI <- Add 1500
004043E9 |. 8A92 E4704000 | MOV DL, BYTE PTR DS: [EDX 4070E4] <- Northern OR 10 or 11 or 12-bit registration code
004043EF |. 88540C 40 | MOV BYTE PTR SS: [ESP ECX 40], DL <- Mount ESP ECX 40 004043F3 |. 99 | CDQ <- Extension
004043F4 |. F7FD | IDIV EBP <- divided by 62
004043F6 |. 41 | Inc ECX <- ECX plus 1
004043f7 |. 83f9 04 | CMP ECX, 4 <- See if ECX is 4 (the front is a calculation of four, the first calculation of the first, 5th, 9th, 13th, the second time 2, 6 10, 14 ...)
004043fa |. 8A82 E4704000 | MOV Al, Byte PTR DS: [EDX 4070E4] <- Get the registration code corresponding to the front of the 13th OR 14 or 15 or 16-bit machine code
00404400 |. 88440C 47 | MOV BYTE PTR SS: [ESP ECX 47], Al <- loaded into ESP ECX 47
00404404 |. ^ 7C A5 / JL short liaocach.004043ab <- ECX less than 4, come back from the beginning (until the 16-bit machine code calculates)
00404406 |. 8b35 AC524000 MOV ESI, DWORD PTR DS: [<& msvcrt.atoi>]; msvcrt.atoi
0040440C |. 8D4C24 10 LEA ECX, DWORD PTR SS: [ESP 10]
00404410 |. 51 Push ECX; / S
0040411 |. 885c24 38 MOV BYTE PTR SS: [ESP 38], BL; |
00404415 |. 885c24 40 MOV BYTE PTR SS: [ESP 40], BL; |
00404419 |. 885c24 48 MOV BYTE PTR SS: [ESP 48], BL; |
0040441D |. 885C24 50 MOV BYTE PTR SS: [ESP 50], BL; |
00404421 |. FFD6 Call ESI; / ATOI
00404423 |. 83C4 04 Add ESP, 4
00404426 |. 83f8 01 CMP EAX, 1
00404429 |. 75 3c jnz short liaocach.00404467
0040442b |. 8D5424 18 Lea EDX, DWORD PTR SS: [ESP 18]
0040442f |. 52 Push EDX
00404430 |. FFD6 Call ESI
00404432 |. 83C4 04 Add ESP, 4
00404435 |. 83F8 01 CMP EAX, 1
00404438 |. 75 2D jnz short liaocach.00404467
0040443A |. 8D4424 20 Lea Eax, DWORD PTR SS: [ESP 20]
0040443e |. 50 push eax
0040443f |. FFD6 Call ESI
00404441 |. 83C4 04 Add ESP, 4
00404444 |. 83f8 01 CMP EAX, 1
00404447 |. 75 1e jnz short liaocach.00404467
00404449 |. 8D4C24 28 Lea ECX, DWORD PTR SS: [ESP 28]
0040444d |. 51 Push ECX
0040444E |. FFD6 Call ESI
00404450 |. 83C4 04 Add ESP, 4
00404453 |. 83f8 01 CMP Eax, 100404456 |. 75 0f jnz short liaocach.00404467
00404458 |. 5F POP EDI
00404459 |. 5E POP ESI
0040445A |. 5D POP EBP
0040445b |. B8 Feffffff Mov Eax, -2
00404460 |. 5B POP EBX
00404461 | 83C4 54 Add ESP, 54
00404464 |. C2 0400 RETN 4
00404467 |> 8d7424 30 Lea ESI, DWORD PTR SS: [ESP 30] <- The first 4 digits of the correct registration code is loaded into ESI, hey, we can see the correct registration. The first 4, in TRW2000 or Softice, you can use D ESP 30 to view anything in OllyDBG, you can reverse assembly area in the upper left, in the middle of the lower left memory area, in TRW2000 After the D command, press Alt Upside button to turn a few, you can see all registration code (they don't have a little bit, 0063F5E0-0063F5E3 is the first 4 digits, 0063f5e8-0063f5eb is 5-8, 0063f5f0-0063f5f3 It is 9-12 bits, 0063f5f8-0063f5fb is the last 4 digits, and the memory address of the registration code you entered: 0063F5C0-0063F5C3 is the first 4 digits, 0063f5c8-0063f5cb is 5-8 bits, 0063f5d0-0063f5d3 is 9-12 bits, 0063f5d8-0063f5db is the last 4 digits, the address stored in the machine code is 0063F6000-0063F60F)
0040446B |. 8D4424 10 Lea Eax, DWORD PTR SS: [ESP 10] <- The first 4 digits of the registration code you entered is loaded in EAX
0040446F |> 8A10 / MOV DL, BYTE PTR DS: [EAX] <- Get the first or third bits of your registration code (the value in Eax is here, then add 2, then execute here The time you get is the third place)
00404471 | 8aca | MOV CL, DL <- Incoming in CL
00404473 |. 3A16 | CMP DL, BYTE PTR DS: [ESI] <- Comparison with the first or third bit of the correct registration code (the value in the ESI will change with the value in EAX)
00404475 |. 75 1C | jnz short liaocach.00404493 <- 不 相 就 就 就
00404477 |. 3acb | CMP CL, BL <- Cl to BL comparison, the value of the BL is 00000000 (which is empty), what is the use of this instruction? In fact, it is very simple, every 4 registration code I will follow an empty value, that is, if you can see 1234 in memory. That is a null value, understand it, wait until the top 4 is tested, and the CL will be loaded. That is 00000000 , You can jump in the back.
00404479 |. 74 14 | JE Short liaocach.0040448f <- If the value in Cl is zero (ie 4 digits have been all compared), just jump
0040447B |. 8A50 01 | MOV DL, BYTE PTR DS: [EAX 1] <- EAX 1 will be the second or fourth bit of the registration code you entered (depending on the value of Eax)
0040447E |. 8aca | MOV CL, DL <- Incoming CL
00404480 |. 3A56 01 | CMP DL, BYTE PTR DS: [ESI 1] <- Comparison with the correct registration code (ESI's value) 00404483 | 75 0E | Jnz short liaocach.00404493 <- 不 相 就 就 就
00404485 |. 83c0 02 | Add Eax, 2 <- Eax plus 2, then jump to 0040446F again, then get the third place of the registration code you entered
00404488 |. 83C6 02 | Add ESI, 2 <- 同
0040448B |. 3acb | CMP CL, BL <- Compare the CL again is empty
0040448d |. ^ 75 E0 / JNZ Short liaocach.0040446f <- If you jump to 0040446F, you will continue to compare 1,3 in the top 4 bits.
0040448F |> 33c0 xor Eax, EAX <- 1-4 bits will be jumped here after completion
00404491 |. EB 05 JMP Short Liaocach.00404498
00404493 |> 1BC0 SBB EAX, EAX
00404495 |. 83D8 FF SBB EAX, -1
00404498 |> 3BC3 CMP EAX, EBX
0040449A |. 0F85 ab000000 jnz liaocach.0040454b
004044A0 |. 8d7424 38 Lea ESI, DWORD PTR SS: [ESP 38] <- Musal the 5-8-bit memory address of the correct registration code in ESI as the above.
004044A4 |. 8D4424 18 Lea Eax, DWORD PTR SS: [ESP 18] <- 5-8-bit memory address of the registration code you entered into EAX
004044A8 |> 8A10 / MOV DL, BYTE PTR DS: [EAX] <- Get the 5th OR 7 of the registration code you entered (truth, I believe you have already understood)
004044AA |. 8aca | MOV CL, DL <- loaded into CL
004044ac |. 3A16 | CMP DL, BYTE PTR DS: [ESI] <- Compare with the correct registration code
004044AE |. 75 1C | jnz short liaocach.004044cc <- 不 相 就 就 走
004044B0 |. 3acb | CMP CL, BL <- Did you look at 5-8 bits all over comparison with 00000000 in BL?
004044B2 |. 74 14 | Je Short liaocach.004044c8 <- Yes jumping away
004044B4 |. 8A50 01 | MOV DL, BYTE PTR DS: [EAX 1] <- Get the 6th OR 8 of the registration code you entered
004044B7 |. 8aca | MOV CL, DL <- loaded into CL
004044B9 |. 3A56 01 | CMP DL, BYTE PTR DS: [ESI 1] <- Comparison with the correct registration code
004044BC |. 75 0e | jnz short liaocach.004044cc <- 不 正 就
004044BE |. 83c0 02 | Add eax, 2 <- Eax plus 2, this purpose is to believe that you already know
004044C1 |. 83C6 02 | Add ESI, 2 <- ESI also plus 2
004044C4 |. 3acb | CMP CL, BL <- Compare whether CL is empty
004044C6 |. ^ 75 E0 / JNZ Short Liaocach.004044A8 <- Don't jump back and come back 004044C8 |> 33c0 xor Eax, EAX <- 5-8 all compared, full jump here
004044ca |. EB 05 JMP Short LiAocach.004044d1
004044cc |> 1BC0 SBB EAX, EAX
004044ce |. 83D8 FF SBB EAX, -1
004044d1 |> 3BC3 CMP EAX, EBX
004044d3 |. 75 76 JNZ Short LiAocach.0040454B
004044d5 |. 8d7424 40 Lea ESI, DWORD PTR SS: [ESP 40] <- loads the correct registration code 9-12 bits of memory address into ESI
004044d9 |. 8D4424 20 Lea Eax, DWORD PTR SS: [ESP 20] <- you entered
004044dd |> 8A10 / MOV DL, BYTE PTR DS: [EAX] <- get the 9th OR 11 of the registration code you entered
004044DF |. 8aca | MOV CL, DL <- loaded into CL
004044E1 |. 3A16 | CMP DL, BYTE PTR DS: [ESI] <- Compare with the correct registration code 9th OR 11
004044E3 |. 75 1C | jnz short liaocach.00404501 <- Do not jump around
004044E5 |. 3acb | CMP CL, BL <- See if CL is empty, that is, see if 9-12 is all completed
004044E7 |. 74 14 | Je short liaocach.004044fd <- Yes jump
004044E9 |. 8A50 01 | MOV DL, BYTE PTR DS: [EAX 1] 004044ec |. 8aca | MOV CL, DL <- loaded into CL 004044EE |. 3A56 01 | CMP DL, BYTE PTR DS: [ESI 1] <- Comparison with the first or 12 of the correct registration code 004044f1 |. 75 0e | jnz short liaocach.00404501 <- 不 相 就 就 004044F3 |. 83c0 02 | Add Eax, 2 <- EAX plus 2 004044F6 |. 83C6 02 | Add ESI, 2 <- ESI plus 2 004044f9 |. 3acb | CMP CL, BL <- See if it is complete 004044fb |. ^ 75 E0 / jnz short liaocach.004044dd <- Nothing to jump back and come back 004044fd |> 33c0 xor Eax, Eax <- 9-12 bits will be jumped here after completing 004044ff |. EB 05 JMP Short Liaocach.00404506 00404501 |> 1BC0 SBB EAX, EAX 00404503 |. 83D8 FF SBB EAX, -1 00404506 |> 3BC3 CMP EAX, EBX 00404508 |. 75 41 JNZ Short Liaocach.0040454B 0040450a |. 8d7424 48 Lea ESI, DWORD PTR SS: [ESP 48] <- 嘿, I have said three times, you must understand it, so I will leave this last section to you. Here to 00404530, I believe you guess it (everyone: despise you!) 0040450E |. 8D4424 28 Lea Eax, DWORD PTR SS: [ESP 28] 00404512 |> 8A10 / MOV DL, BYTE PTR DS: [EAX] 00404514 |. 8aca | MOV CL, DL 00404516 |. 3A16 | CMP DL, BYTE PTR DS: [ESI] 00404518 |. 75 1C | jnz short liaocach.00404536 0040451A |. 3acb | CMP CL, BL 0040451c |. 74 14 | Je Short Liaocach.00404532 0040451E |. 8A50 01 | MOV DL, BYTE PTR DS: [EAX 1] 00404521 |. 8aca | MOV CL, DL 00404523 |. 3A56 01 | CMP DL, BYTE PTR DS: [ESI 1] 00404526 |. 75 0e | jnz short liaocach.00404536 00404528 |. 83c0 02 | Add Eax, 2 0040452b |. 83c6 02 | Add ESI, 2 0040452e |. 3acb | CMP CL, BL 00404530 |. ^ 75 E0 / Jnz Short Liaocach.00404512 00404532 |> 33c0 xor Eax, EAX <- all came here later 00404534 |. EB 05 JMP Short LiAocach.0040453B 00404536 |> 1BC0 SBB EAX, EAX 00404538 |. 83D8 FF SBB EAX, -1 0040453b |> 3BC3 CMP EAX, EBX 0040453d |. 75 0c jnz short liaocach.0040454b 0040453f |. 8bc7 MOV EAX, EDI 00404541 |. 5F POP EDI 00404542 |. 5e POP ESI 00404543 |. 5D POP EBP 00404544 |. 5B POP EBX 00404545 |. 83C4 54 Add ESP, 54 00404548 |. C2 0400 RETN 4 My annotation is written, ^ _ ^, I will probably tell you about: The software registration code is calculated, the ASCII code of each character in the machine code plus 1500 removes the corresponding character of 62 in the password table, is the corresponding registration code. For example, the machine code here is XN2URKEUMWPNV5XZ and X's ASCII code 78 (decimal 120) 78 5DC value of 654 (ie 1620) then use 1620 to divide more than 26 8, ok, we From the "Password Table" 0123456789ABCDefghijklmnopqrstuvwxyzabcdefghijklmnopqrStuvwxyz, it will go to 8 characters, 嘿嘿, this is the corresponding registration code. Ok, I give Delphi's registration machine (I still write it as a function): Function Keygen (name: string): String; VAR String [16]; P: string; Key: String; I, n, z: integer; Begin P: = '0123456789Abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz'; IF Length <16 THEN Result: = 'Machine code must be 16 ...' Else Begin S: = Name; For i: = 1 to 16 dobegin N: = ORD (S); N: = n 1500; Z: = n mod 62; Z: = z 1; Key: = KEY P [Z]; END; Result: = KEY; END; END; Oh, this chapter is the last chapter, and now I'm finished .... Take a kiss ~~
