Serial number calculation of mIRC ver. 5.51 32-bit
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

                                    by  Renegade


The basis for every key-generator is, of course, to figure out exactly
how a program calculates the key.To find the right place in the code is
sometimes quite a lot of work, disassembling, debugging etc.
Let's give a look to the calculation of mIRC 5.51


"Sorry, your registration name and number don't match..." that's what mIRC
will tell you after entering a wrong serial.Either through a bpx or a 
string reference we'll get to this piece of code:


:00436E5B 6878070000              push 00000778
:00436E60 E8973AFDFF              call 0040A8FC
:00436E65 50                      push eax
:00436E66 6A00                    push 00000000

* Possible Reference to String Resource ID=01913: "Sorry, your registration 
name and number don't match!"

Scrolling up, before any type of mex, successful or not, will be displayed,
the work begins here:

* Reference To: USER32.SendDlgItemMessageA, Ord:0000h
                                  |
:00436D6B E8382D0900              Call 004C9AA8
:00436D70 682F834D00              push 004D832F
:00436D75 68487F4D00              push 004D7F48
:00436D7A E87DCF0500              call 00493CFC
:00436D7F 85C0                    test eax, eax
:00436D81 0F849B000000            je 00436E22

Making a dump of the values that are pushed, you'll see that 4D7F48 contains
the entered username, and 4D832F the serial number you entered.After the call
at 00436D7A registers are compared, followed by a conditional jump.So let's
examine this call:


:00493CFC 55                      push ebp
:00493CFD 8BEC                    mov ebp, esp
:00493CFF 53                      push ebx  
:00493D00 56                      push esi
:00493D01 57                      push edi
:00493D02 8B750C                  mov esi, dword ptr [ebp+0C]
:00493D05 8B5D08                  mov ebx, dword ptr [ebp+08]
:00493D08 53                      push ebx
:00493D09 E89E910200              call 004BCEAC
:00493D0E 59                      pop ecx
:00493D0F 83F805                  cmp eax, 00000005
:00493D12 7304                    jnb 00493D18
:00493D14 33C0                    xor eax, eax

In ebx we'll find our registration name again and from the compare at
00493D0F we can conclude that the name has to be at least 5 characters long.

After some lines we have another call with a compare:

:00493D1A E8FDFEFFFF              call 00493C1C

Trace the call, we'll land at:

:00493C1C 55                      push ebp
:00493C1D 8BEC                    mov ebp, esp
:00493C1F 83C4F4                  add esp, FFFFFFF4
:00493C22 53                      push ebx
:00493C23 56                      push esi
:00493C24 57                      push edi
:00493C25 8B750C                  mov esi, dword ptr [ebp+0C]
:00493C28 6A2D                    push 0000002D

Push 0000002D: that's just a simple "-".So a "-" has to be included in our
serial, maybe the whole serial is made of two different parts.

:00493C35 85DB                    test ebx, ebx
:00493C37 7507                    jne 00493C40

The compare..."-" must be in the serial.


The real calculation starts here:


:00493C78 BA03000000              mov edx, 00000003
:00493C7D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00493C80 83C103                  add ecx, 00000003
:00493C83 3B55F4                  cmp edx, dword ptr [ebp-0C]
:00493C86 7D1C                    jge 00493CA4


In ecx we have our name, then 00000003 is added to ecx


:00493C88 0FB631                  movzx esi, byte ptr [ecx]

ASCII characters from 3 on are moved to esi.


:00493C8B 0FAF348590244D00        imul esi, dword ptr [4*eax+004D2490]
:00493C93 03DE                    add ebx, esi
:00493C95 40                      inc eax


The actual calculation at 00493C8B.This means that esi will be multiplied
by the result of [ ].In the first loop esi will be multiplied by B, then 
with 6 and so on.Just make a dump of 004D2490 and you'll find these values.

The result of esi is then added to ebx and eax is incremented by 1.



:00493C9D 42                      inc edx
:00493C9E 41                      inc ecx
:00493C9F 3B55F4                  cmp edx, dword ptr [ebp-0C]
:00493CA2 7CE4                    jl 00493C88


EDX and ECX are incremented and due to the cmp the whole thing will be 
repeated until edx corresponds to the length of the name you entered.


:00493CAD 33C0                    xor eax, eax
:00493CAF 33DB                    xor ebx, ebx
:00493CB1 BA03000000              mov edx, 00000003
:00493CB6 8B4D08                  mov ecx, dword ptr [ebp+08]
:00493CB9 83C103                  add ecx, 00000003
:00493CBC 3B55F4                  cmp edx, dword ptr [ebp-0C]
:00493CBF 7D23                    jge 00493CE4


Then again the name is read from the 3 character on,


:00493CC1 0FB631                  movzx esi, byte ptr [ecx]


the ASCII values of it are copied into esi


:00493CC4 0FB679FF                movzx edi, byte ptr [ecx-01]


now the ASCII characters from the 2 char. on are copied into edi



:00493CC8 0FAFF7                  imul esi, edi


esi is multiplied by edi and the result will be stored in esi.

:00493CCB 0FAF348590244D00        imul esi, dword ptr [4*eax+004D2490]

Again the same calculation we had above.


:00493CD3 03DE                    add ebx, esi

ESI is added to EBX.


:00493CD5 40                      inc eax
:00493CD6 83F826                  cmp eax, 00000026
:00493CD9 7E02                    jle 00493CDD
:00493CDB 33C0                    xor eax, eax
:00493CDD 42                      inc edx
:00493CDE 41                      inc ecx
:00493CDF 3B55F4                  cmp edx, dword ptr [ebp-0C]

EDX and ECX are incremented and the loop will be executed if EDX is smaller
than the length of the entered name.