Vista之家 >> Vista应用技巧 >> Vista"暴力算号器"关键代码部分的分析

Vista"暴力算号器"关键代码部分的分析

作者:Vista之家来源:Vista之家日期:2007-3-19 3:02:30
这三天传播的所谓修改slmgr.vbs达到"算号"目的的Windows Vista"暴力算号器",我对其关键代码进行了分析.分析发现,此段代码仅仅是从Windows 序列号所允许的全部25个字母(实际应该是24个,这里面错误地多出了一个"L")中随机选取5组各5个字符组成一个字符串,再以此调用Vista的授权服务进行验证.根本就无法算出序列号,只是进行一种穷举破解而已.

相关关键代码分析:
运行slmgr带-ipk generate参数,则到此处

Private Sub InstallProductKey(strProductKey)
Dim objService, objProduct '定义授权服务对象
Dim lRet, strDescription, strOutput '定义返回值
Dim random(24) '定义一个25元素的数组
Dim x
Dim y
Dim Group
Dim FoundKey

Dim z
Dim a '定义环境变量和临时变量
Randomize '初始化随机数种子
FoundKey = False '初始化FoundKey变量

MsgBox "Click to begin generating a Key" '显示消息框

For Each objService in g_objWMIService.InstancesOf(ServiceClass) '尝试每种服务(Retail、KMS、OEM)

For Each objProduct in g_objWMIService.InstancesOf(ProductClass) '尝试每个产品(Vista的各种版本)
While FoundKey = False '当没有找到key时,循环

On Error Resume Next '忽略错误

strProductKey = ""

random(0) = "B"
random(1) = "C"
random(2) = "D"
random(3) = "F"
random(4) = "G"
random(5) = "H"
random(6) = "J"
random(7) = "K"
random(8) = "L"
random(9) = "M"
random(10) = "P"
random(11) = "Q"
random(12) = "R"
random(13) = "T"
random(14) = "V"
random(15) = "W"
random(16) = "X"
random(17)= "Y"
random(18)= "2"
random(19)= "3"
random(20)= "4"
random(21)= "6"
random(22)= "7"
random(23)= "8"
random(24)= "9"

'定义可用的25个字符
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))

strProductKey = strProductKey & "-"

strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))

strProductKey = strProductKey & "-"

strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))

strProductKey = strProductKey & "-"

strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))

strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))

strProductKey = strProductKey & "-"

strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd()))
strProductKey = strProductKey & random(int(25 *Rnd())) '生成一个形式为"xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"的字符串,其中x为random()数组中的元素

objService.InstallProductKey(strProductKey) '对授权服务安装上述字符串"序列号"

strDescription = objProduct.Description '得到产品描述

If IsKmsServer(strDescription) Then '如果是KMS?
' Set the KMS version in the registry
lRet = SetRegistryStr(HKEY_LOCAL_MACHINE, SLKeyPath, "KeyManagementServiceVersion", objService.Version) '此处不明,应为将密钥管理服务版本设为与本机版本一致
If (lRet = 0) Then '若设置失败
'QuitWithError CStr(Hex(lRet))
msgbox strProductKey
strOutput = Replace(GetResource("L_MsgInstalledPKey"), "%PKEY%", strProductKey)
LineOut strOutput
FoundKey = True '找到key,操作完成
End If
Else '如果不是kms?
lRet = DeleteRegistryValue(HKEY_LOCAL_MACHINE, SLKeyPath, "KeyManagementServiceVersion") '删除注册表密钥管理信息
If (lRet = 0 And lRet = 2 And lRet = 5) Then '若失败,则
'QuitWithError CStr(Hex(lRet))
msgbox strProductKey
strOutput = Replace(GetResource("L_MsgInstalledPKey"), "%PKEY%", strProductKey)
LineOut strOutput
FoundKey = True '找到key,操作完成
End If
End If
WEND
Next
'QuitIfError()
Next
End Sub

这个脚本利用Vista的密匙服务在安装Product Key成功时会打开注册表下某键值的特点,反复随机生成序列号字符反复验证,当修改/删除那个键值失败时,就判定该key合法.其实这样完全是大海捞针,碰运气,有些人几个小时就能碰中,有些人几个月都碰不中一个.我已经用这个脚本算了6小时,完全没有结果.
(责任编辑: Cary)
上一篇：惠普dv2208tx在vist下分区方法
下一篇：双系统卸载Win Vista系统攻略