（编者：这个 是tiantang朋友的作品，也希望大家能够将自己的作品与大家来分享）
我成功了。
打开cooolftp v1.2
填入注册名：tiantang
填入注册码：78787878
调出ICE
bpx hmemcpy
按F12至程序领空
----------------------------------------------------------
0137:00485C42 CALL 004316C8
0137:00485C47 MOV EAX,[EBP-0C]-------------中断后由这出来
0137:00485C4A CALL 00450FEC
0137:00485C4F TEST AL,AL
0137:00485C51 JZ 00485CDA
0137:00485C57 LEA EDX,[EBP-10]
0137:00485C5A MOV EAX,[EBP-04]
0137:00485C5D MOV EAX,[EAX+000002E4]
0137:00485C63 CALL 004316C8
0137:00485C68 MOV EDX,[EBP-10]
--------------------------------------------------------------
一直跑，走到
--------------------------------------------------------------
0137:00485CD8 JMP 00485CEF
0137:00485CDA PUSH 00
0137:00485CDC MOV CX,[00485D18]
0137:00485CE3 MOV DL,01
0137:00485CE5 MOV EAX,00485D6C
0137:00485CEA CALL 00455CA8
0137:00485CEF XOR EAX,EAX-----------在此出现错误信息
0137:00485CF1 POP EDX
0137:00485CF2 POP ECX
0137:00485CF3 POP ECX
------------------------------------------
往上看，进入错误信息之上的CALL 00455CA8
在里面怎么也找不到？
再往上看，进入中断后的第一个0137:00485C4A CALL 00450FEC
一直走到
0137:00451119 MOV EAX,[EBP-14]
0137:0045111C CALL 00408294
0137:00451121 MOV EDX,[EBP-28]---------在此处用D 命令 可见注册码
0137:00451124 POP EAX------------------在此处用D 命令 可见注册码
0137:00451125 CALL 00403EC0
0137:0045112A JNZ 00451132-------------将此处JNZ改成JZ软件成为任意注册版
0137:0045112C MOV BYTE PTR [EBP-05],01
0137:00451130 JMP 00451150
0137:00451132 INC DWORD PTR [EBP-18]
0137:00451135 CMP DWORD PTR [EBP-18],000001F4
---------------------------------------------------
F8进入上面的0137:00451125 CALL 00403EC0中，至
0137:00403EBD LEA EAX,[EAX+00]
0137:00403EC0 PUSH EBX
0137:00403EC1 PUSH ESI
0137:00403EC2 PUSH EDI
0137:00403EC3 MOV ESI,EAX
0137:00403EC5 MOV EDI,EDX
0137:00403EC7 CMP EAX,EDX----- 是在此处比较注册码吗？用D命令可见注册码!
0137:00403EC9 JZ 00403F5E
0137:00403ECF TEST ESI,ESI
0137:00403ED1 JZ 00403F3B
-------------------------------
可以改上面的0137:00403EC9 JZ 00403F5E中的JZ为任意注册版吗，为什么？
------------------------------------------
结果：
发现程序不断的用正确的注册码和输入的注册码对比，在
0137:00451121 MOV EDX,[EBP-28]
0137:00451124 POP EAX
处，每跳转循环一次便可不断的看到新的注册码，而且都能用
还有，我发现程序注册码和名字是分离的，就是只要注册码正确，名字可以任意输入。
我随便抄了几个
注册名：tiantang(也可任意)
注册码：RK30MX964C
注册码：QO45D6MIA6
注册码：ROF25W0AYL
|
******************************************************
GREATIS CORNERS 3.1 for Windows 95/98/NT
by Greatis Software
******************************************************
程式猎人
追踪：name:dahuilang
RN:0123456789
这个软件要求注册码一定为10位，如果不则无法点击注册按钮，所以输入10位。设bpx hm
emcpy。你将到达下面：
:00468EBA 8B45F8 mov eax, dword ptr [ebp-08]
:00468EBD 8A4418FF mov al, byte ptr [eax+ebx-01]
:00468EC1 04D0 add al, D0
:00468EC3 2C0A sub al, 0A
:00468EC5 7206 jb 00468ECD
:00468EC7 04F9 add al, F9
:00468EC9 2C1A sub al, 1A
:00468ECB 7303 jnb 00468ED0
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468EC5(C)
|
:00468ECD 43 inc ebx
:00468ECE EB0F jmp 00468EDF
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468ECB(C)
|
:00468ED0 8D45F8 lea eax, dword ptr [ebp-08]
:00468ED3 B901000000 mov ecx, 00000001
:00468ED8 8BD3 mov edx, ebx
:00468EDA E81DB2F9FF call 004040FC
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00468EB8(U), :00468ECE(U)
|
:00468EDF 8B45F8 mov eax, dword ptr [ebp-08]
:00468EE2 E8D1AFF9FF call 00403EB8
:00468EE7 3BD8 cmp ebx, eax
:00468EE9 7ECF jle 00468EBA
:00468EEB 8D45F8 lea eax, dword ptr [ebp-08]
:00468EEE E895B1F9FF call 00404088
:00468EF3 8D55F0 lea edx, dword ptr [ebp-10]
:00468EF6 B908000000 mov ecx, 00000008
:00468EFB E89C9AF9FF call 0040299C
:00468F00 8D45F0 lea eax, dword ptr [ebp-10]
:00468F03 E8DCFAFFFF call 004689E4
:00468F08 84C0 test al, al
:00468F0A 0F846E020000 je 0046917E
:00468F10 B201 mov dl, 01 *******
:00468F12 A13C734500 mov eax, dword ptr [0045733C]
:00468F17 E8CCE5FEFF call 004574E8
:00468F1C 8945EC mov dword ptr [ebp-14], eax
:00468F1F 33C0 xor eax, eax
:00468F21 55 push ebp
:00468F22 68DC904600 push 004690DC
:00468F27 64FF30 push dword ptr fs:[eax]
:00468F2A 648920 mov dword ptr fs:[eax], esp
:00468F2D BA02000080 mov edx, 80000002
:00468F32 8B45EC mov eax, dword ptr [ebp-14]
:00468F35 E846E6FEFF call 00457580
:00468F3A 8D55E0 lea edx, dword ptr [ebp-20]
:00468F3D B8DC914600 mov eax, 004691DC
:00468F42 E8B5F4FFFF call 004683FC
:00468F47 8B55E0 mov edx, dword ptr [ebp-20]
:00468F4A 8B45EC mov eax, dword ptr [ebp-14]
:00468F4D E83EEEFEFF call 00457D90
:00468F52 84C0 test al, al
:00468F54 0F84A6000000 je 00469000
:00468F5A 8D55E0 lea edx, dword ptr [ebp-20]
:00468F5D B8DC914600 mov eax, 004691DC
:00468F62 E895F4FFFF call 004683FC
:00468F67 8B55E0 mov edx, dword ptr [ebp-20]
:00468F6A 33C9 xor ecx, ecx
:00468F6C 8B45EC mov eax, dword ptr [ebp-14]
:00468F6F E868E7FEFF call 004576DC
:00468F74 84C0 test al, al
:00468F76 0F844A010000 je 004690C6
:00468F7C 33C0 xor eax, eax
:00468F7E 55 push ebp
大家看到这个是非常重要的。
:00468F10 B201 mov dl, 01
那么就进入上面那个call中
:004689E4 53 push ebx
:004689E5 56 push esi
:004689E6 57 push edi
:004689E7 83C4E8 add esp, FFFFFFE8
:004689EA 8BF0 mov esi, eax
:004689EC 8D3C24 lea edi, dword ptr [esp]
:004689EF A5 movsd
:004689F0 A5 movsd
:004689F1 33DB xor ebx, ebx
:004689F3 8D4C2408 lea ecx, dword ptr [esp+08]
:004689F7 8BC4 mov eax, esp
:004689F9 BA08000000 mov edx, 00000008
:004689FE E8C1FBFFFF call 004685C4
:00468A03 BE70170000 mov esi, 00001770
:00468A08 8B3D38354900 mov edi, dword ptr [00493538]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468A2A(C)
|
:00468A0E 8D542408 lea edx, dword ptr [esp+08]
:00468A12 8BC7 mov eax, edi
:00468A14 B910000000 mov ecx, 00000010
:00468A19 E8A6F4F9FF call 00407EC4
:00468A1E 84C0 test al, al
:00468A20 7404 je 00468A26
:00468A22 B301 mov bl, 01
:00468A24 EB06 jmp 00468A2C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468A20(C)
|
:00468A26 83C710 add edi, 00000010
:00468A29 4E dec esi
:00468A2A 75E2 jne 00468A0E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468A24(U)
|
:00468A2C 8BC3 mov eax, ebx
:00468A2E 83C418 add esp, 00000018
:00468A31 5F pop edi
:00468A32 5E pop esi
:00468A33 5B pop ebx
:00468A34 C3 ret
这个软件使用的是查看注册关键值来注册的，也就是说如果注册成功后，程序不再验证注
册码，而是查看注册值是否已经注册了。所以在上面就可以自己跳跃使bl=1。程序就注册成
功了。
经过分析，发现程序的注册点在下面的这个键值上，你只要这个键值不为空就可以注册了。
HKEY_CURRENT_USER\Software\Greatis\Corners\User\name
|