Cracking an English Learning System

An English software has powerful functions, including listening, speaking, reading, and words. Software Protection is also very powerful, is composed of serial number machine code activation code online network verification.

The serial number is composed of 16 digits, the machine code is composed of hardware information, and the activation code is composed of 9 digits. Network Authentication is performed through WebService authentication. Fortunately, the software is written by. net, most of which Code Not encrypted. Only important code is obfuscated using tools. The idea is to use the. NET anti-encoding tool reflector to view the code structure. After a look, I finally found the relevant encryption function. His serial number Algorithm : Private int checkcode () although the code is obfuscated, the main part of the code can be clearly viewed. The algorithm is basically: int [] code = new int [16]; For (INT I = 0; I <code. length; I) { Code [I] = 0; } Int num = getformatednumeric (); If (Num> = 0 & num <= 3) { Code [3] = 2; Code [11] = 6; } Else if (Num> 3 & num <= 6) { Code [3] = 5; Code [11] = 2; } Else { Code [3] = 7; Code [11] = 4; } Code [14] = getformatednumeric (); Code [10] = getformatednumeric (); Code [6] = getformatednumeric (); Code [7] = getformatednumeric (); Code [12] = getformatednumeric (); Code [13] = getformatednumeric (); Code [0] = (code [14] * Code [10] * Code [6]) 3) % 10; Code [1] = (code [10] (code [13] * Code [14]) 8) % 10; Code [2] = (code [14] Code [6] Code [12]) * 3) 2) % 10; Code [4] = (code [7] * Code [6]) Code [10]) * 6) 7) % 10; Code [5] = (code [14] (code [10] * Code [13]) 3) % 10; Code [8] = (code [7] (code [12] * Code [6]) * 4) % 10; Code [9] = (code [10] Code [13] Code [7]) * 2) 3) % 10; Code [15] = (code [7] Code [14]) * 4) % 10; The activation code algorithm is more complex. The activation code is calculated based on the serial number and machine code. The final cracking algorithm is: Public String getcode (string regstr, string mcode) { Int [] numarray3 = new int [(strings. Len (strings. Trim (regstr)-1) 1]; Int num3 = strings. Len (strings. Trim (regstr)-1; For (INT num2 = 0; num2 <= num3; num2) { Numarray3 [num2] = conversions. tointeger (strings. mid (strings. Trim (regstr), num2 1, 1 )); } Int [] numarray2 = new int [(strings. Len (strings. Trim (mcode)-1) 1]; Int num4 = strings. Len (strings. Trim (mcode)-1; For (INT num2 = 0; num2 <= num4; num2) { Numarray2 [num2] = conversions. tointeger (strings. mid (strings. Trim (mcode), num2 1, 1 )); } Int [] numarray4 = new int [8]; Numarray4 [0] = (numarray2 [0] numarray2 [1]) (numarray3 [4] * 3) % 10 ); Numarray4 [1] = (numarray2 [2] * numarray3 [15]) numarray3 [14]) % 10 ); Numarray4 [2] = (numarray2 [3] * numarray3 [9]) (numarray3 [7] * 3) % 10 ); Numarray4 [3] = (numarray2 [2] numarray2 [7]) (numarray3 [12] * numarray3 [13]) % 10 ); Numarray4 [4] = (numarray2 [5] * numarray2 [8]) (numarray3 [6] * numarray3 [11]) % 10 ); Numarray4 [5] = (numarray2 [3] numarray3 [8]) (numarray3 [5] * 3) % 10 ); Numarray4 [6] = (numarray2 [4] (numarray3 [0] * numarray3 [1]) numarray3 [10]) % 10 ); Numarray4 [7] = (numarray2 [6] * numarray3 [2]) numarray3 [3]) % 10 ); String STR = string. empty; Foreach (int I in numarray4) { STR = I. tostring (); } Return STR; } So I wrote a registration machine, as shown below:
Then use ildasm and ilasm to generate the code again, and remove some code for network verification. The cracking is complete.