PowerTCP Dart.Telnet for.net 4.4.10 (2019年版)试用期限（30天）研究

以下代码可以得到试用期的license，当中包括开始试用的日期

  private static string uE880(Type type, string uE00D, Stream SuE00D)
        {
            BinaryFormatter binaryFormatter = new BinaryFormatter();
            object[] array = binaryFormatter.Deserialize(SuE00D) as object[];
            if (!(array[1] is Hashtable))
            {
                return null;
            }
            Hashtable hashtable = array[1] as Hashtable;
            
            foreach (object obj in hashtable.Keys)
            {
                string text = (string)obj;
                return hashtable[text] as string;

            }
            return null;
        }
        static void Main(string[] args)
        {
           

            Telnet telnet = new Telnet();
            Type type = telnet.GetType();
            Assembly entryAssembly = Assembly.GetEntryAssembly();
            FileInfo fileInfo = new FileInfo(entryAssembly.Location);
            List<Stream> list = new List<Stream>();
            foreach(string text in entryAssembly.GetManifestResourceNames())
            {
                if (text.EndsWith(".licenses", StringComparison.OrdinalIgnoreCase))
                {
                    list.Add(entryAssembly.GetManifestResourceStream(text));
                }
            }
            foreach (Stream uE00D in list)
            {
                string name = fileInfo.Name;
                string text = uE880(type, fileInfo.Name, uE00D);
                if (text != null)
                {
                    
                }
            }


          

        }

断点在hashtable 上，可以看见你的license,我的是这样：
TRIAL-lbkSPEhDSUSQZzThs3Nu0MfatabYskJy-2020/10/12 19:48:20

这段代码时照猫画虎从他程序中提取出来的。

然后就是下面的代码：

private static void \uF5C5\uE0D8\uE8D3\uF5DA\uE5CE\uE886(Type \uE010, bool \uE010, string \uE010)
		{
			StringBuilder stringBuilder = new StringBuilder();
			if (LicenseManager.\uE8A8\uE75B\uF0D2\uE00B\uF1CE\uE225 == null)
			{
				if (LicenseManager.CurrentContext.GetType().ReflectedType != null && LicenseManager.CurrentContext.GetType().ReflectedType.Name.Equals("licenseinterophelper", StringComparison.OrdinalIgnoreCase))
				{
					stringBuilder.Append("License.Set(String licenseKey) must be called before using this product. A free 30-day trial license key is available at http://dart.com/trial or a developer license can be purchased at " + LicenseManager.\uE032\uEDBB\uE846\uE14F\uF2EF\uF8AA + ".");
				}
				else
				{
					stringBuilder.Append("No license found. Please add the line \"" + LicenseManager.\uF5C5\uE0D8\uE8D3\uF5DA\uE5CE\uE888(\uE010) + "\" to the top level project's licenses.licx file and recompile. Refer to the 'Licensing and Trial Operation' topic of the help documentation for further assistance.");
				}
				stringBuilder.Append("\n\nFor more information contact Dart at [email protected], [email protected] or 315.790.5456.");
				LicenseManager.Message(stringBuilder.ToString(), TraceLevel.Error, true);
				throw new DartLicenseException(stringBuilder.ToString());
			}
			if (LicenseManager.\uE8A8\uE75B\uF0D2\uE00B\uF1CE\uE225.StartsWith("TRIAL"))
			{
				TimeSpan timeSpan = \uE200\uED2C\uF8F2\uF298\uF85D\uE25D.\uF8B4\uF851\uE488\uE34D\uE95A\uF7D5(LicenseManager.\uE8A8\uE75B\uF0D2\uE00B\uF1CE\uE225).AddDays(30.0).Subtract(DateTime.Now);
				if (timeSpan.TotalDays < 0.0 || timeSpan.TotalDays > 30.0)
				{
					stringBuilder.AppendLine(LicenseManager.\uE032\uEDBB\uE846\uE14F\uF2EF\uF8AC + "Your free 30-day trial license has expired.");
					stringBuilder.AppendLine();
					stringBuilder.Append(LicenseManager.\uE032\uEDBB\uE846\uE14F\uF2EF\uF8AB);
					LicenseManager.Message(stringBuilder.ToString(), TraceLevel.Error, true);
					throw new LicenseException(\uE010, null, stringBuilder.ToString());
				}
				stringBuilder.Append(LicenseManager.\uE032\uEDBB\uE846\uE14F\uF2EF\uF8AC);
				stringBuilder.Append(string.Format("Your free 30-day trial license has {0} day(s) remaining.", ((int)timeSpan.TotalDays).ToString("D")));
				LicenseManager.Message(stringBuilder.ToString(), TraceLevel.Warning, false);
			}
			else
			{
				\uE200\uED2C\uF8F2\uF298\uF85D\uE25A uE200_uED2C_uF8F2_uF298_uF85D_uE25A = new \uE200\uED2C\uF8F2\uF298\uF85D\uE25A(LicenseManager.\uE8A8\uE75B\uF0D2\uE00B\uF1CE\uE225);
				if (\uE010 && !uE200_uED2C_uF8F2_uF298_uF85D_uE25A.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3DB())
				{
					Assembly entryAssembly = Assembly.GetEntryAssembly();
					if (entryAssembly != null)
					{
						FileInfo fileInfo = new FileInfo(LicenseManager.\uF5C5\uE0D8\uE8D3\uF5DA\uE5CE\uE88B(entryAssembly));
						if (LicenseManager.CurrentContext.GetType().ReflectedType != null && LicenseManager.CurrentContext.GetType().ReflectedType.Name.Equals("licenseinterophelper", StringComparison.OrdinalIgnoreCase))
						{
							stringBuilder.Append("License.Set(String licenseKey) must be called before using this product. A free 30-day trial license key is available at http://dart.com/trial or a developer license can be purchased at " + LicenseManager.\uE032\uEDBB\uE846\uE14F\uF2EF\uF8AA + ".");
						}
						else
						{
							stringBuilder.Append("The project creating " + fileInfo.Name + " does not contain a licenses.licx with an entry for " + LicenseManager.\uF5C5\uE0D8\uE8D3\uF5DA\uE5CE\uE889());
							stringBuilder.Append(". Please add the line \"" + LicenseManager.\uF5C5\uE0D8\uE8D3\uF5DA\uE5CE\uE888(\uE010) + "\" to that project's licenses.licx file. ");
							stringBuilder.Append("If this is not possible, an Extended Distribution License is required to distribute " + LicenseManager.\uF5C5\uE0D8\uE8D3\uF5DA\uE5CE\uE889());
							stringBuilder.Append(" with " + \uE010 + ".");
							stringBuilder.Append("\n\nFor more information contact Dart at [email protected], [email protected] or 315.790.5456.");
						}
					}
					else
					{
						stringBuilder.Append("The developer license found in ");
						stringBuilder.Append(\uE010);
						stringBuilder.Append(" is not an Extended Distribution License, which is required to distribute ");
						stringBuilder.Append(LicenseManager.\uF5C5\uE0D8\uE8D3\uF5DA\uE5CE\uE889());
						stringBuilder.Append(" with your developed interface (API).");
						stringBuilder.Append("\n\nFor more information contact Dart at [email protected], [email protected] or 315.790.5456.");
					}
					if (!LicenseManager.\uF5C5\uE0D8\uE8D3\uF5DA\uE5CE\uE885())
					{
						throw new LicensePluginException(stringBuilder.ToString());
					}
					LicenseManager.Message(stringBuilder.ToString(), TraceLevel.Info, false);
				}
			}
			LicenseManager.\uF5C5\uE0D8\uE8D3\uF5DA\uE5CE\uE887();
			LicenseManager.\uE8A8\uE75B\uF0D2\uE00B\uF1CE\uE226 = DateTime.Now.Ticks;
		}

你懂得。。。

这段代码时在判断你的注册码，LicenseManager.\uE8A8\uE75B\uF0D2\uE00B\uF1CE\uE225就是存储注册码的信息。
编辑下IL（方法有很多），或者跳到下段看他如何判断正确注册码的，应该不是太难吧。。

继续往下研究：
首先，这个license存在你的编译好的文件中，基本属于明文，随便一个16进制编辑器可改（查找TRIAL就出来了）
按照上面的源码，首先这个license不能是null,如果是trail开头，那么是试用的，编辑下license，让它不是TRIAL开头，方便继续往下跟

protected string[] \uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E1(string \uE017)
	{
		string[] array = \uE017.Split(new char[]
		{
			'-'
		});
		if (array.Length < 4)
		{
			StringBuilder stringBuilder = new StringBuilder();
			for (int i = 0; i < array.Length; i++)
			{
				stringBuilder.Append("Part [");
				stringBuilder.Append(i);
				stringBuilder.Append("] :");
				stringBuilder.AppendLine(array[i]);
			}
			string arg = stringBuilder.ToString();
			throw new LicenseFormatException(string.Format("The product license key is not long enough.\r\n Product License: {0}\r\n{1}", \uE017, arg));
		}
		this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE120 = array[0];
		this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE121 = array[1];
		this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE122 = this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E3(this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE121, 0);
		this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE123 = this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E3(this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE121, 1);
		this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE124 = array[2];
		this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE125 = array[3];
		return array;
	}

到这里，可看出，注册码用“-”分开，4段，存储在ue120到ue125中，中间122和123是她的版本号。
试用的license不符合标准 那么正确的注册码应该是：
xxxx-4.4.xxxx-xxx-xxx
继续

protected virtual string[] \uEBB3\uEF9A\uF874\uF2B4\uEF84\uF5C4(string \uE065)
	{
		string[] result = this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E1(\uE065);
		string text = LicenseManager.\uF5C5\uE0D8\uE8D3\uF5DA\uE5CE\uE88C();
		if (!this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE120.StartsWith(text, StringComparison.OrdinalIgnoreCase))
		{
			throw new LicenseVerificationException(string.Concat(new string[]
			{
				"The product license is for another product.(",
				this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE120,
				" vs. ",
				text,
				")"
			}));
		}
		Version version = Assembly.GetExecutingAssembly().GetName().Version;
		if (version.Major != 1 && version.Minor != 0)
		{
			if (version.Major == this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE122)
			{
				if (version.Minor == this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE123)
				{
					goto IL_B7;
				}
			}
			throw new LicenseVerificationException("The product license is for another version of the product.");
		}
		IL_B7:
		if (this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE125 != this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E4())
		{
			throw new LicenseVerificationException("The product license is invalid.");
		}
		return result;
	}

到这里，下面这条算的第一个信息，我得出的text值是3080固定的

	string text = LicenseManager.\uF5C5\uE0D8\uE8D3\uF5DA\uE5CE\uE88C();
	if (!this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE120.StartsWith(text,......

这段就是版本号的判断

if (version.Major != 1 && version.Minor != 0)
		{
			if (version.Major == this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE122)
			{
				if (version.Minor == this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE123)
				{
					goto IL_B7;
				}
			}
			throw new LicenseVerificationException("The product license is for another version of the product.");
		}

注册码应该是3080-4.4.xxxx-xxx-xxx

继续

IL_B7:
		if (this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE125 != this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E4())
		{
			throw new LicenseVerificationException("The product license is invalid.");
		}

这个函数比较注册码的最后一段，如果正确，就OK了。
关键算法就在this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E4()中。利用2,3段信息得出一个计算值。

我算出来的值是534787
将注册码改成3080-4.4.xxxx-xxx-534787，程序正常运行。

接下来是他的算法，跟进this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E4()

protected string \uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E4()
	{
		string s = this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E2(); //开头3段 3080-xxx-xxx
		byte[] bytes = Encoding.ASCII.GetBytes(s);
		return this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E5(bytes);
	}


	//用到的函数
private string \uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E2()
	{
		return string.Concat(new string[]
		{
			this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE120,
			"-",
			this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE121,
			"-",
			this.\uE22A\uEC8B\uE356\uED03\uEEA8\uE124
		});
	}
	
protected string \uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E5(byte[] \uE019)
	{
		byte[] array = new byte[\uE019.Length];
		ulong[] array2 = new ulong[256];
		ulong uE01B = (ulong)-1356639362;
		this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E6(array2);
		for (ulong num = 0UL; num < \uE200\uED2C\uF8F2\uF298\uF85D\uE25A.\uE22A\uEC8B\uE356\uED03\uEEA8\uE127; num += 1UL)
		{
			this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E7(uE01B, \uE019, array, array2);
			array.CopyTo(\uE019, 0);
		}
		string text = "";
		for (int i = 0; i < \uE200\uED2C\uF8F2\uF298\uF85D\uE25A.\uE22A\uEC8B\uE356\uED03\uEEA8\uE126; i++)
		{
			text += this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E8(array[i] % 16);
			text += this.\uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E8(array[i] / 16);
		}
		
	private void \uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E6(ulong[] \uE01A)
	{
		for (ulong num = 0UL; num < 256UL; num += 1UL)
		{
			ulong num2 = num;
			for (ulong num3 = 0UL; num3 < 8UL; num3 += 1UL)
			{
				if (num2 % 2UL == 1UL)
				{
					num2 = ((ulong)-306674912 ^ num2 >> 1);
				}
				else
				{
					num2 >>= 1;
				}
			}
			\uE01A[(int)(checked((IntPtr)num))] = num2;
		}
	}
	private ulong \uE725\uE0D1\uEF9F\uEC7B\uE9D3\uE3E7(ulong \uE01B, byte[] \uE01B, byte[] \uE01B, ulong[] \uE01B)
	{
		ulong num = \uE01B ^ (ulong)-1;
		uint num2 = 0U;
		while ((ulong)num2 < (ulong)((long)\uE01B.Length))
		{
			num = (\uE01B[(int)(checked((IntPtr)((num ^ unchecked((ulong)\uE01B[(int)((UIntPtr)num2)])) % 256UL)))] ^ num >> 8);
			\uE01B[(int)(checked((IntPtr)(unchecked((long)\uE01B.Length - (long)((ulong)num2) - 1L))))] = (byte)(num % 256UL);
			num2 += 1U;
		}
		return num ^ (ulong)-1;
	}

把\uxxx改下就注册机了