网站地址：http://www.programhunter.home.china.com/

编辑寄语：

我本人研究解密有一年有余，如何提高自己的解密水平呢？我一方面自己努力学习解密，另一方面从网上下载相关的文章来阅读以提高自己的解密水平。但是我每次上网查找解密文章都得花费我不少时间，这也意味着花了不少的money，所以我现在想为我们解密爱好者制作这个解密杂志。我给它启名为探索杂志。其用意相必大家一定知道了。

             Sea View Screen Saver-Ver 1.00.
                      程式猎人
简介：这个是一个关于海洋的屏保。
追踪：name：dahuilang
      RN:01234567
  这个屏保如果你没有注册，它将在执行时总是告诉你它没有注册，所以我必需将
它注册成功。但是这个软件实在是没有什么可以多说的，因为它的保护实在是太简单了。
* Reference To: user32.GetWindowTextA, Ord:0000h
                                  |
:00424869 E8DA1BFEFF              Call 00406448
:0042486E 8D55FC                  lea edx, dword ptr [ebp-04]  <-出来
:00424871 8D85F4FDFFFF            lea eax, dword ptr [ebp+FFFFFDF4]
:00424877 E8F02FFEFF              call 0040786C
:0042487C 68F4010000              push 000001F4
:00424881 8D85F4FDFFFF            lea eax, dword ptr [ebp+FFFFFDF4]
:00424887 50                      push eax
:00424888 6A06                    push 00000006
:0042488A 8B4508                  mov eax, dword ptr [ebp+08]
:0042488D 50                      push eax

* Reference To: user32.GetDlgItem, Ord:0000h
                                  |
:0042488E E8851BFEFF              Call 00406418
:00424893 50                      push eax

* Reference To: user32.GetWindowTextA, Ord:0000h
                                  |
:00424894 E8AF1BFEFF              Call 00406448
:00424899 8D55F8                  lea edx, dword ptr [ebp-08]
:0042489C 8D85F4FDFFFF            lea eax, dword ptr [ebp+FFFFFDF4]
:004248A2 E8C52FFEFF              call 0040786C
:004248A7 8B55F8                  mov edx, dword ptr [ebp-08]
:004248AA 8B45FC                  mov eax, dword ptr [ebp-04]
:004248AD E88AEFFFFF              call 0042383C
:004248B2 84C0                    test al, al
:004248B4 7448                    je 004248FE
  从上面出来后，到达这个je就是跳跃的关键地方，现在我进入call 0042383C中
，我想在这里一定有我想要得到的东西。
:0042383C 55                      push ebp
:0042383D 8BEC                    mov ebp, esp
:0042383F 83C4F0                  add esp, FFFFFFF0
:00423842 53                      push ebx
:00423843 33C9                    xor ecx, ecx
:00423845 894DF4                  mov dword ptr [ebp-0C], ecx
:00423848 894DF0                  mov dword ptr [ebp-10], ecx
:0042384B 8955F8                  mov dword ptr [ebp-08], edx
:0042384E 8945FC                  mov dword ptr [ebp-04], eax
:00423851 8B45FC                  mov eax, dword ptr [ebp-04]
:00423854 E8E703FEFF              call 00403C40
:00423859 8B45F8                  mov eax, dword ptr [ebp-08]
:0042385C E8DF03FEFF              call 00403C40
:00423861 33C0                    xor eax, eax
:00423863 55                      push ebp
:00423864 68BE384200              push 004238BE
:00423869 64FF30                  push dword ptr fs:[eax]
:0042386C 648920                  mov dword ptr fs:[eax], esp
:0042386F A120994200              mov eax, dword ptr [00429920]
:00423874 8B4874                  mov ecx, dword ptr [eax+74]

* Possible StringData Ref from Data Obj ->"l!A"
                                  |
:00423877 8B15F49A4200            mov edx, dword ptr [00429AF4]
:0042387D 8B12                    mov edx, dword ptr [edx]
:0042387F 8D45F0                  lea eax, dword ptr [ebp-10]
:00423882 E85102FEFF              call 00403AD8
:00423887 8B55F0                  mov edx, dword ptr [ebp-10]
:0042388A 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0042388D 8B45FC                  mov eax, dword ptr [ebp-04]
:00423890 E8AFFEFFFF              call 00423744

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042382E(C)
|
:00423895 8B45F4                  mov eax, dword ptr [ebp-0C]  real RN
:00423898 8B55F8                  mov edx, dword ptr [ebp-08]  fake RN
:0042389B E8FC02FEFF              call 00403B9C 
:004238A0 0F94C3                  sete bl
:004238A3 33C0                    xor eax, eax
  到达这里我们就可以看到自己的注册码了，所以说这个软件的保护是太弱了。好了
，game over!

                      ******************************
                      *      name:dahuilang        *
                      *      RN:60616F00           *
                      ******************************                      

返回

              GIF Movie GearTM 2.6 
简介：这个是一个动画制作软件。
追踪：name:jhw
      RN:01234567
  这个软件的追踪是我以前比较早的解密成果，现在使用WM来进行反汇编将它写出
来，以供大家参考。它的注册过程还是可以研究一下的。
:0042C32D 8D442478                lea eax, dword ptr [esp+78]  <-出来

* Possible Reference to Dialog: DialogID_0064 
                                  |
:0042C331 6A64                    push 00000064
:0042C333 50                      push eax

* Possible Reference to Dialog: DialogID_0091, CONTROL_ID:0450, ""
                                  |
:0042C334 6850040000              push 00000450
:0042C339 56                      push esi
:0042C33A FFD7                    call edi
:0042C33C 50                      push eax
:0042C33D FFD3                    call ebx
:0042C33F 8D4C2478                lea ecx, dword ptr [esp+78]
:0042C343 8D542414                lea edx, dword ptr [esp+14]
:0042C347 51                      push ecx
:0042C348 52                      push edx
:0042C349 E872FDFFFF              call 0042C0C0，
:0042C34E 83C408                  add esp, 00000008
:0042C351 85C0                    test eax, eax
:0042C353 0F84A6000000            je 0042C3FF   <-关键跳跃
:0042C359 8D442410                lea eax, dword ptr [esp+10]
   上面可以看出来，在上面那个关键的地方进行跳跃，所以我们不用多说就应当进
入那个call中。
进入后如下：
:0042C0C0 53                      push ebx
:0042C0C1 55                      push ebp
:0042C0C2 8B6C2410                mov ebp, dword ptr [esp+10]
:0042C0C6 56                      push esi
:0042C0C7 57                      push edi
:0042C0C8 807D006D                cmp byte ptr [ebp+00], 6D
:0042C0CC 0F85A0000000            jne 0042C172
:0042C0D2 807D0176                cmp byte ptr [ebp+01], 76
:0042C0D6 0F8596000000            jne 0042C172
:0042C0DC 807D0267                cmp byte ptr [ebp+02], 67
:0042C0E0 0F858C000000            jne 0042C172
:0042C0E6 807D0332                cmp byte ptr [ebp+03], 32
:0042C0EA 0F8582000000            jne 0042C172

* Possible Indirect StringData Ref from Data Obj ->"mvg21951736"
                                  |
:0042C0F0 BBA8624400              mov ebx, 004462A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C116(C)
|
:0042C0F5 8B13                    mov edx, dword ptr [ebx]
现在大家可以看到在那里有一个类似的注册码，mvg21951736它就是注册码吗？这个
不是注册码，它的作用是检查你输入的注册码是否等于这个值，如果等于它则认为你
是非法的注册码。这回大家知道它的用处是什么了。但是注册码的前四位是固定的，
分别为m v g 2如果输入的注册码不等于这个几个值就注册码失败了。
:0042C0F5 8B13                    mov edx, dword ptr [ebx]
:0042C0F7 83C9FF                  or ecx, FFFFFFFF
:0042C0FA 8BFA                    mov edi, edx
:0042C0FC 33C0                    xor eax, eax
:0042C0FE F2                      repnz
:0042C0FF AE                      scasb
:0042C100 F7D1                    not ecx
:0042C102 49                      dec ecx
:0042C103 8BFA                    mov edi, edx
:0042C105 8BF5                    mov esi, ebp
:0042C107 33C0                    xor eax, eax
:0042C109 F3                      repz
:0042C10A A6                      cmpsb
:0042C10B 7465                    je 0042C172
:0042C10D 83C304                  add ebx, 00000004
又经过上面的几次循环，它将比较几个已经认为非法的注册码。我们要得到真正的注
册码还要向下查找。现在设RN：mvg20000000
:0042C160 84D2                    test dl, dl
:0042C162 75DA                    jne 0042C13E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C13C(C)
|
:0042C164 3BF0                    cmp esi, eax      ***
:0042C166 750A                    jne 0042C172
:0042C168 5F                      pop edi
:0042C169 5E                      pop esi
:0042C16A 5D                      pop ebp
:0042C16B B801000000              mov eax, 00000001   ***
:0042C170 5B                      pop ebx
:0042C171 C3                      ret
 到达这里才是关键的比较地方了，看到那个使用eax等于1的命令没有，这个可是让
你注册成功的地方。在上面比较关键是那个cmp的命令将它跳跃到其它的地方了，现
在看一个那两个值esi=99D(H)=2461   eax=000，在这里我还要向大家说明的一点，
它比较的是你后四位的值，所以现在我可以得到相应的注册码了，RN：mvg20002461。
这个程式的追踪过程也就game over了。

                 *****************************
                 *      name:jhw             *
                 *      RN:mvg20002461       *
                 *****************************                           

返回

                        IP Tools v1.07
用W32DASM破解IP Tools v1.07（转载希望保持完整）
作者：丁丁虾 又名：DDXia [CCG]
IP Tools最新版本：1.07
文件大小：722KB
软件授权：共享软件
使用平台：Win95/98/2000/NT

软件简介：
　　集成了许多TCP/IP实用工具于一体，比如本地信息、连接信息、端口扫描、PING、
TRACE、WHOIS、FINGER、NSLOOKUP、Telnet客户端、 NETBIOS信息、IP监视器等等
http://www.newhua.com/down/ip-tools.exe
上 W32DASM！我掩护！把它载入W32DASM，Search Strings---也就是注册失败时，跳
出对话框中的羊肉串---->"Sorry, but Name or Registration "


* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048F771(C), :0048F78B(C), :0048F7C6(C), :0048F7EE(C)
|

* Possible StringData Ref from Code Obj ->"Sorry, but Name or Registration "
->"number is wrong !"
|
:0048F927 B884FA4800 mov eax, 0048FA84
:0048F92C E80F28FBFF call 00442140

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048F709(C), :0048F925(U)
|
:0048F931 33C0 xor eax, eax
:0048F933 5A pop edx
:0048F934 59 pop ecx
:0048F935 59 pop ecx
:0048F936 648910 mov dword ptr fs:[eax], edx

这回可不能按老方法啦！信息的上方可以看到如下四个地址:
:0048F771(C), :0048F78B(C), :0048F7C6(C), :0048F7EE(C)
瞧一瞧是什么的家伙！

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048F699(C)
|
:0048F6BB 51 push ecx
:0048F6BC 51 push ecx
:0048F6BD 51 push ecx
:0048F6BE 53 push ebx
:0048F6BF 56 push esi
:0048F6C0 57 push edi
:0048F6C1 8BD8 mov ebx, eax
:0048F6C3 8B3D1CCB4A00 mov edi, dword ptr [004ACB1C]
:0048F6C9 33C0 xor eax, eax
:0048F6CB 55 push ebp
:0048F6CC 685CF94800 push 0048F95C
:0048F6D1 64FF30 push dword ptr fs:[eax]
:0048F6D4 648920 mov dword ptr fs:[eax], esp
:0048F6D7 8B1524CA4A00 mov edx, dword ptr [004ACA24]
:0048F6DD 8B12 mov edx, dword ptr [edx]
:0048F6DF 8B07 mov eax, dword ptr [edi]
:0048F6E1 8B80F0010000 mov eax, dword ptr [eax+000001F0]
:0048F6E7 E8C82CF9FF call 004223B4
:0048F6EC 8B15CCC84A00 mov edx, dword ptr [004AC8CC]
:0048F6F2 8B12 mov edx, dword ptr [edx]
:0048F6F4 8B07 mov eax, dword ptr [edi]
:0048F6F6 8B80F4010000 mov eax, dword ptr [eax+000001F4]
:0048F6FC E8B32CF9FF call 004223B4
:0048F701 8B07 mov eax, dword ptr [edi]
:0048F703 E80812FAFF call 00430910
:0048F708 48 dec eax
:0048F709 0F8522020000 jne 0048F931
:0048F70F 8D55F8 lea edx, dword ptr [ebp-08]
:0048F712 8B07 mov eax, dword ptr [edi]
:0048F714 8BB0F0010000 mov esi, dword ptr [eax+000001F0]
:0048F71A 8BC6 mov eax, esi
:0048F71C E8632CF9FF call 00422384
:0048F721 8B45F8 mov eax, dword ptr [ebp-08]
:0048F724 8D55FC lea edx, dword ptr [ebp-04]
:0048F727 E8D87FF7FF call 00407704
:0048F72C 8B55FC mov edx, dword ptr [ebp-04]
:0048F72F 8BC6 mov eax, esi
:0048F731 E87E2CF9FF call 004223B4
:0048F736 8D55F8 lea edx, dword ptr [ebp-08]
:0048F739 8B07 mov eax, dword ptr [edi]
:0048F73B 8BB0F4010000 mov esi, dword ptr [eax+000001F4]
:0048F741 8BC6 mov eax, esi
:0048F743 E83C2CF9FF call 00422384
:0048F748 8B45F8 mov eax, dword ptr [ebp-08]
:0048F74B 8D55FC lea edx, dword ptr [ebp-04]
:0048F74E E8B17FF7FF call 00407704
:0048F753 8B55FC mov edx, dword ptr [ebp-04]
:0048F756 8BC6 mov eax, esi
:0048F758 E8572CF9FF call 004223B4
:0048F75D 8D55F8 lea edx, dword ptr [ebp-08]
:0048F760 8B07 mov eax, dword ptr [edi]
:0048F762 8B80F0010000 mov eax, dword ptr [eax+000001F0]
:0048F768 E8172CF9FF call 00422384
:0048F76D 837DF800 cmp dword ptr [ebp-08], 00000000
:0048F771 0F84B0010000 je 0048F927
^^^^^^^^^^^----->

:0048F777 8D55F4 lea edx, dword ptr [ebp-0C]
:0048F77A 8B07 mov eax, dword ptr [edi]
:0048F77C 8B80F4010000 mov eax, dword ptr [eax+000001F4]
:0048F782 E8FD2BF9FF call 00422384

:0048F787 837DF400 cmp dword ptr [ebp-0C], 00000000
:0048F78B 0F8496010000 je 0048F927
^^^^^^^^^^^----->

:0048F791 8D55F0 lea edx, dword ptr [ebp-10]
:0048F794 8B07 mov eax, dword ptr [edi]
:0048F796 8B80F0010000 mov eax, dword ptr [eax+000001F0]
:0048F79C E8E32BF9FF call 00422384
:0048F7A1 8B45F0 mov eax, dword ptr [ebp-10]
:0048F7A4 E80792FFFF call 004889B0
:0048F7A9 8BF0 mov esi, eax
:0048F7AB 8D55F0 lea edx, dword ptr [ebp-10]
:0048F7AE 8B07 mov eax, dword ptr [edi]
:0048F7B0 8B80F4010000 mov eax, dword ptr [eax+000001F4]
:0048F7B6 E8C92BF9FF call 00422384
:0048F7BB 8B45F0 mov eax, dword ptr [ebp-10]
:0048F7BE E87992FFFF call 00488A3C

:0048F7C3 663BF0 cmp si, ax
:0048F7C6 0F855B010000 jne 0048F927
^^^^^^^^^^^----->

:0048F7CC A148C94A00 mov eax, dword ptr [004AC948]
:0048F7D1 BAFF010000 mov edx, 000001FF
:0048F7D6 E8BD91FFFF call 00488998
:0048F7DB 8BF0 mov esi, eax
:0048F7DD A19CC84A00 mov eax, dword ptr [004AC89C]
:0048F7E2 BAFF010000 mov edx, 000001FF
:0048F7E7 E8AC91FFFF call 00488998

:0048F7EC 3BF0 cmp esi, eax
:0048F7EE 0F8533010000 jne 0048F927
^^^^^^^^^^^----->

:0048F7F4 8D55F8 lea edx, dword ptr [ebp-08]
:0048F7F7 8B07 mov eax, dword ptr [edi]
:0048F7F9 8B80F0010000 mov eax, dword ptr [eax+000001F0]
:0048F7FF E8802BF9FF call 00422384
:0048F804 8B55F8 mov edx, dword ptr [ebp-08]
:0048F807 A124CA4A00 mov eax, dword ptr [004ACA24]
:0048F80C E89744F7FF call 00403CA8
:0048F811 8D55F8 lea edx, dword ptr [ebp-08]
:0048F814 8B07 mov eax, dword ptr [edi]
:0048F816 8B80F4010000 mov eax, dword ptr [eax+000001F4]
:0048F81C E8632BF9FF call 00422384
:0048F821 8B55F8 mov edx, dword ptr [ebp-08]
:0048F824 A1CCC84A00 mov eax, dword ptr [004AC8CC]
:0048F829 E87A44F7FF call 00403CA8
:0048F82E 8BC3 mov eax, ebx
:0048F830 E877FAFFFF call 0048F2AC

以上的跳转都是没有交钱就有你好看的！
往下看，离它对你说“Thank You”很近了，加油哦^_^
怎么处理上面四个保镖就看你们的罗：） 问我！我功力比较低刚10点，只好
动粗啦，全部nop掉。爽.......哈...哈..哈.
* Possible StringData Ref from Code Obj ->"Thank You for registering"
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
----->好亲热的话语，我中听！
|
:0048F835 B874F94800 mov eax, 0048F974
:0048F83A E80129FBFF call 00442140
:0048F83F B201 mov dl, 01
:0048F841 A16C364300 mov eax, dword ptr [0043366C]
:0048F846 E8B53FFAFF call 00433800
:0048F84B 8BD8 mov ebx, eax
:0048F84D B101 mov cl, 01

来来，干一杯水、庆贺一下。刚刚想去解决一下温饱问题，一运行，到没有看见
Thank you 和 Sorry,反到看见了"Program was corrupted!!"没有搞错吧！居然
用过去时，明明是正在进行嘛！不管了，我可要去吃一点饼干罗! :))
(评语：这家伙连一点责任心都没有，唉，一代不如一代啦）