Simple TxtEdit 4.5.2 Registration Algorithm

[Break text title] Simple TxtEdit 4.5.2 Registration Algorithm
[Author] XXNB
[Author's mailbox] supports PYG
[Author Home Page] http://free.ys168.com /? Binbinbin7456
[Cracking tool] OD
[Cracking platform] XP SP2
[Software name] TxtEdit 4.5.2
[Software size] 924KB
[Original download] http://www.onlinedown.net/soft/23539.htm
[Protection method] Name + code
[Software Overview] The text editor has the spelling check function!
Software language: English
Software category: foreign software/shared edition/editing software
Running Environment: Win9x/Me/NT/2000/XP/2003
Time added: 9:22:12
Downloads: 901
[Cracking statement] Learn From heroes !!! Learning only!
------------------------------------------------------------------------
[Cracking process]
------------------------------------------------------------------------

1. Use the powerful tool of delphi, dede. We can easily find the button breakpoint. "Find the key breakpoint, half done"

We entered the following information: regname: binbin.
RegNO: 123456789
After my analysis, the entered registration code must be greater than "10000000 ". For details, refer to the code analysis below.

004E7080 $ Content $ nbsp; 55 push ebp
004E7081. 8BEC mov ebp, esp
004E7083. B9 04000000 mov ecx, 4
004E7088> 6A 00 push 0
004E708A. 6A 00 push 0
004E708C. 49 dec ecx
004E708D. ^ 75 F9 jnz short 004E7088
004E708F. 51 push ecx
004E7090. 53 push ebx
004E7091. 56 push esi
004E7092. 57 push edi
004E7093. 8945 FC mov dword ptr [ebp-4], eax
004E7096. 33C0 xor eax, eax
004E7098. 55 push ebp
004E7099. 68 A8724E00 push 004E72A8
004E709E. 64: FF30 push dword ptr fs: [eax]
004E70A1. 64: 8920 mov dword ptr fs: [eax], esp
004E70A4. C745 F0 00000> mov dword ptr [ebp-10], 0
004E70AB. C745 F4 00000> mov dword ptr [ebp-C], 0
004E70B2. 8D55 EC lea edx, dword ptr [ebp-14]
004E70B5. 8B45 FC mov eax, dword ptr [ebp-4]
004E70B8. 8B80 28030000 mov eax, dword ptr [eax + 328]
004E70BE. E8 DD80F8FF call 0046F1A0
004E70C3. 8B45 EC mov eax, dword ptr [ebp-14]; the user name appears in binbin
004E70C6. E8 69D7F1FF call 00404834; count
004E70CB. 8BD8 mov ebx, eax
004E70CD. 4B dec ebx
004E70CE. 85DB test ebx, ebx
004E70D0. 7E 34 jle short 004E7106
004E70D2. BE 01000000 mov esi, 1
004E70D7> 8D55 E8 lea edx, dword ptr [ebp-18]
004E70DA. 8B45 FC mov eax, dword ptr [ebp-4]
004E70DD. 8B80 28030000 mov eax, dword ptr [eax + 328]
004E70E3. E8 B880F8FF call 0046F1A0
004E70E8. 8B45 E8 mov eax, dword ptr [ebp-18]; User Name
004E70EB. 8A4430 FF mov al, byte ptr [eax + esi-1]; get user names one by one
004E70EF. 25 FF000000 and eax, 0FF; get ascii code value
004E70F4. 33D2 xor edx, edx
004E70F6. 0345 F0 add eax, dword ptr [ebp-10]; add one result
004E70F9. 1355 F4 adc edx, dword ptr [ebp-C]
004E70FC 8945 F0 mov dword ptr [ebp-10], eax; storage results
004E70FF. 8955 F4 mov dword ptr [ebp-C], edx
004E7102. 46 inc esi
004E7103. 4B dec ebx
004E7104. ^ 75 D1 jnz short 004E70D7; accumulate the username ascii code value, which is stored in the ebp-10. Note: remove the last part.

One digit, that is, the last digit is not accumulated.
004E7106> 33C0 xor eax, eax; 204 (516) Remove the accumulate value of the last digit
004E7108. 55 push ebp
004E7109. 68 7F714E00 push 004E717F
004E710E & n