; How to use this crap:
; calculate the last two bytes for a given number of loops of his main loops
; calculate them as: 35d8h+132h+number_of_looops
; read it off with break points..  in softice or something
; a correct serial is: PJ/7
; 25 loops is min. to make the last two bytes "typeable" but there is no values
; that first 25 loops.. 26 loops gives the PJ/7 serial

.model small
.stack 100h    ; Plenty stack space
.386           ; Who knows.. I might wanna use 386 code?

.data         
sentence  db 05,04    ; input from int21h/0ah
          db 0,0      ; Interate of these mother fuckers
          db 47,37h   ; Bytes consistent with 26 loops : 35d8h+132h+26d
          db 0dh      ; 0d terminated string - since read with int 21h/ah=0a
count     db 0        ; counter
finish    dw 0        ; place to store the current guess during iterations

.code
mov ax, @data         ; Make DS&ES point to the DATA
mov ds,ax
mov es,ax

xor dx,dx             ; dx=0

next:
lea bx, [sentence+2]  ; let bx point to the bytes we're checking for a fit
mov word ptr [bx],dx  ; reset the bytes for next attempt
inc word ptr [bx]     ; next two bytes
mov bx, word ptr [bx] ; fetch it
push bx               ; feed it to the call
call flaffer          ; try it!
pop dx                ; fetch attempt
test ax,ax            ; Did it work?
jnz next              ; no - try next

mov ax,4c00h          ; Breakpoint here - when it breaks DX=first two bytes
int 21h




flaffer:
lea si,sentence
mov cx,131h
call again
mov byte ptr [count],0
ret


again:
  PUSH    SI
  INC     CX
  LODSW
  XCHG    AX,BX
  LODSW
  ROL     BX,CL
  XOR     BX,AX
  XOR     BX,CX
  MOV     BP,[SI]
  LODSW
  MUL     BX
  MOV     [SI-04],AX
  POP     SI
  inc     byte ptr [count]
  cmp     byte ptr [count],26h ; patch number of loops here
  je      notagain
;  OR      AX,AX
  JNZ     again
;  ret
notagain:

ret

end

