| EBPIG |
探索杂志 |
MHJDQ |
|
|
知识共享 资源共享
资料共享 | |
| 【制作成员】程式猎人 |
| 【发行时间】2000-9-27 |
| 【期刊号码】增刊十二 |
| 【网站地址】http://programhunter.com |
|
【编辑寄语】 |
{~._.~}
( Y )
()~*~()
(_)-(_) |
�这个增刊是面向解密初学者的，对于这个增刊，本人准备了已经破解成功的三个文章，希望大家可以先从给出的地址下载一个破解一下，看一看自己能否破解成功，如果不能的话，再来看一看我的破解，看一看你差在哪没有成功的。好了，这周的杂志我将向大家介绍很多的好东东啊，等第十三期杂志发到各位手中时你们就会发现有很多值你去……不说了，大家还是来研究一下这三个软件吧。 | |
| 【目 �� 录】 |
|
|
| &【破解心得】 |
下载地址：
CooolFTP v1.2 ftp://ftp1.mydown.com/home2/soft23/cooolftp.exe （查看破解过程）
SuperJPG V4.3 ftp://ftp1.mydown.com/home2/soft23/supjpg.zip （查看破解过程）
dfx V4.0 frp://ftp.21hh.net/dfx4_0100_w.exe （查看破解过程）
|
| 返回 |
CooolFTP v1.2
程式猎人
简介：具有自动开始与多线程传送功能的FTP客户端工具。以上功能意味着您可以更为轻松
地对ＦＴＰ服务器进行查看，并且当您选择下载时，多线程下载功能将被自动启用。它最多
支持同时六个线程同时下载，大大提高了下载速度。
软件开发 CooolSoft
版本 1.2
文件大小 665.98 KB
软件类型 Shareware
发布时间 2000-09-23
运行需要 Windows 9x, NT, or 2000
ftp://ftp1.mydown.com/home2/soft23/cooolftp.exe
追踪：name:programhunter
RN:01234567
这个软件的破解是一个相当简单的过程，如果你是一个初学者一定会很轻松的破解它。
:004353E7 89430C mov dword ptr [ebx+0C], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043538A(U), :004353C9(U)
|
:004353EA 8B03 mov eax, dword ptr [ebx]
:004353EC 83F80C cmp eax, 0000000C
:004353EF 751B jne 0043540C
:004353F1 8B5308 mov edx, dword ptr [ebx+08]
:004353F4 52 push edx
:004353F5 8B4B04 mov ecx, dword ptr [ebx+04]
:004353F8 8BD0 mov edx, eax
:004353FA 8BC6 mov eax, esi
:004353FC E8C7BEFFFF call 004312C8
:00435401 EB09 jmp 0043540C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435327(C)
|
:00435403 8BD3 mov edx, ebx
:00435405 8BC6 mov eax, esi
:00435407 E844D4FFFF call 00432850
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435352(C), :004353EF(C), :00435401(U)
|
:0043540C 5D pop ebp
:0043540D 5F pop edi
:0043540E 5E pop esi
:0043540F 5B pop ebx
:00435410 C3 ret
程序从这里进入出来，进入主程序中。向下追踪：
:00485C47 8B45F4 mov eax, dword ptr [ebp-0C]
:00485C4A E89DB3FCFF call 00450FEC
:00485C4F 84C0 test al, al
:00485C51 0F8483000000 je 00485CDA
:00485C57 8D55F0 lea edx, dword ptr [ebp-10]
:00485C5A 8B45FC mov eax, dword ptr [ebp-04]
:00485C5D 8B80E4020000 mov eax, dword ptr [eax+000002E4]
:00485C63 E860BAFAFF call 004316C8
:00485C68 8B55F0 mov edx, dword ptr [ebp-10]
:00485C6B A1EC924900 mov eax, dword ptr [004992EC]
:00485C70 8B00 mov eax, dword ptr [eax]
:00485C72 8B8084070000 mov eax, dword ptr [eax+00000784]
:00485C78 83C054 add eax, 00000054
:00485C7B E804DFF7FF call 00403B84
:00485C80 8D55EC lea edx, dword ptr [ebp-14]
:00485C83 8B45FC mov eax, dword ptr [ebp-04]
:00485C86 8B80D4020000 mov eax, dword ptr [eax+000002D4]
:00485C8C E837BAFAFF call 004316C8
:00485C91 8B55EC mov edx, dword ptr [ebp-14]
:00485C94 A1EC924900 mov eax, dword ptr [004992EC]
:00485C99 8B00 mov eax, dword ptr [eax]
:00485C9B 8B8084070000 mov eax, dword ptr [eax+00000784]
:00485CA1 83C058 add eax, 00000058
:00485CA4 E8DBDEF7FF call 00403B84
:00485CA9 A1EC924900 mov eax, dword ptr [004992EC]
:00485CAE 8B00 mov eax, dword ptr [eax]
:00485CB0 8B8084070000 mov eax, dword ptr [eax+00000784]
:00485CB6 E80D070100 call 004963C8
:00485CBB 6A00 push 00000000
:00485CBD 668B0D185D4800 mov cx, word ptr [00485D18]
:00485CC4 B202 mov dl, 02
:00485CC6 B8245D4800 mov eax, 00485D24
:00485CCB E8D8FFFCFF call 00455CA8
:00485CD0 8B45FC mov eax, dword ptr [ebp-04]
:00485CD3 E8346DFCFF call 0044CA0C
:00485CD8 EB15 jmp 00485CEF
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00485C51(C)
|
:00485CDA 6A00 push 00000000
:00485CDC 668B0D185D4800 mov cx, word ptr [00485D18]
:00485CE3 B201 mov dl, 01
:00485CE5 B86C5D4800 mov eax, 00485D6C
:00485CEA E8B9FFFCFF call 00455CA8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00485CD8(U)
|
:00485CEF 33C0 xor eax, eax
:00485CF1 5A pop edx
:00485CF2 59 pop ecx
:00485CF3 59 pop ecx
:00485CF4 648910 mov dword ptr fs:[eax], edx
:00485CF7 68115D4800 push 00485D11
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00485D0F(U)
|
:00485CFC 8D45EC lea eax, dword ptr [ebp-14]
:00485CFF BA03000000 mov edx, 00000003
:00485D04 E84BDEF7FF call 00403B54
:00485D09 C3 ret
看到上面那个典型的比较方式没有，进入call中，不用多说了。
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045113C(C)
|
:004510D7 6B55E80A imul edx, dword ptr [ebp-18], 0000000A
:004510DB 7105 jno 004510E2
:004510DD E8C61CFBFF call 00402DA8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004510DB(C)
|
:004510E2 0315F8A74900 add edx, dword ptr [0049A7F8]
:004510E8 7105 jno 004510EF
:004510EA E8B91CFBFF call 00402DA8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004510E8(C)
|
:004510EF B90A000000 mov ecx, 0000000A
:004510F4 8B45F0 mov eax, dword ptr [ebp-10]
:004510F7 E8C47AFBFF call 00408BC0
:004510FC 8D55EC lea edx, dword ptr [ebp-14]
:004510FF 8B45F0 mov eax, dword ptr [ebp-10]
:00451102 E8397CFBFF call 00408D40
:00451107 8D55DC lea edx, dword ptr [ebp-24]
:0045110A 8B45FC mov eax, dword ptr [ebp-04]
:0045110D E88271FBFF call 00408294
:00451112 8B45DC mov eax, dword ptr [ebp-24]
:00451115 50 push eax
:00451116 8D55D8 lea edx, dword ptr [ebp-28]
:00451119 8B45EC mov eax, dword ptr [ebp-14]
:0045111C E87371FBFF call 00408294
:00451121 8B55D8 mov edx, dword ptr [ebp-28] ******
:00451124 58 pop eax ******
:00451125 E8962DFBFF call 00403EC0
:0045112A 7506 jne 00451132
:0045112C C645FB01 mov [ebp-05], 01
:00451130 EB1E jmp 00451150
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045112A(C)
|
:00451132 FF45E8 inc [ebp-18]
:00451135 817DE8F4010000 cmp dword ptr [ebp-18], 000001F4 ***
:0045113C 7599 jne 004510D7
程序来到上面大家就可以看到注册码了。那么这个程序是使用什么方式来注册的呢？是使
用由name来计算得到RN的方式吗，大家这回汪没有想到吧，这个程序是使用1F4(H)个固定的
注册码来验证是否为注册码的方式，那么从那里可以看到呢？从***这里就可以得到。注册
码就在******这里可以得到的。
OK，追踪结束了。
|
| 返回 |
SuperJPG V4.3
程式猎人
简介：超级缩略图片创建工具,支持拖放操作，按字母排序,目录管理,拷贝,删除,重命名和
调整尺寸大小,还能进行格式转换，并且可以为你的图片库建立目录索引。支持 JPG, GIF,
TIF, BMP, PNG.
软件开发 Midnight Blue Software Inc.
版本 4.3
文件大小 1.31 MB
软件类型 Shareware
发布时间 2000-09-22
运行需要 Windows 95, 98, or NT
下载地址：ftp://ftp1.mydown.com/home2/soft23/supjpg.zip
追踪：name:programhunter
RN:888888-01234567
这个软件对于初学者来说有一定的难度，但是它不大的，你如果认真的去追踪，还是很容
易找到它的比较地方的。这个软件不是以明码出现的，但是也只是转换一下吧了。
现在开始追踪了。如下：
:00433243 E8B6590600 call 00498BFE
:00433248 6A32 push 00000032 <-出来
:0043324A 53 push ebx
:0043324B 56 push esi
:0043324C E8CA5B0600 call 00498E1B
:00433251 83C764 add edi, 00000064
:00433254 57 push edi
* Possible Reference to Dialog: DialogID_00AC, CONTROL_ID:0443, ""
|
:00433255 6843040000 push 00000443
:0043325A 56 push esi
:0043325B E89E590600 call 00498BFE
:00433260 6A06 push 00000006
:00433262 57 push edi
:00433263 56 push esi
:00433264 E8B25B0600 call 00498E1B
:00433269 5F pop edi
:0043326A 5E pop esi
:0043326B 5B pop ebx
:0043326C C20400 ret 0004
上面如果你设bpx hmemcpy将在call 00498BFE中断两次，所以这里是读取name和RN的地方
。
:004337D5 8D9424E0000000 lea edx, dword ptr [esp+000000E0] name
:004337DC 8D4C2410 lea ecx, dword ptr [esp+10] 888888
:004337E0 52 push edx
:004337E1 E830F00500 call 00492816
:004337E6 B306 mov bl, 06
:004337E8 8D4C2410 lea ecx, dword ptr [esp+10]
:004337EC 889C244C010000 mov byte ptr [esp+0000014C], bl
:004337F3 E83EF70500 call 00492F36
:004337F8 8B8424E4000000 mov eax, dword ptr [esp+000000E4]
:004337FF 8B8C24E0000000 mov ecx, dword ptr [esp+000000E0]
:00433806 50 push eax
:00433807 51 push ecx
:00433808 E8C3FAFFFF call 004332D0 ***
:0043380D 8B8C24E4000000 mov ecx, dword ptr [esp+000000E4]
:00433814 83C408 add esp, 00000008
:00433817 3BC8 cmp ecx, eax
:00433819 0F85A2000000 jne 004338C1
:0043381F 8B9424E4000000 mov edx, dword ptr [esp+000000E4]
:00433826 52 push edx
:00433827 E891760400 call 0047AEBD
:0043382C 83C404 add esp, 00000004
:0043382F 3D06120F00 cmp eax, 000F1206
:00433834 0F8487000000 je 004338C1
:0043383A 8B442410 mov eax, dword ptr [esp+10]
* Possible StringData Ref from Data Obj ->"ROMEO"
|
:0043383E 6838794E00 push 004E7938
:00433843 50 push eax
:00433844 E81F730400 call 0047AB68
:00433849 83C408 add esp, 00000008
:0043384C 85C0 test eax, eax
:0043384E 7471 je 004338C1
如果你能够来到这里，并且仔细这里的话，你就可以在这里得到注册码了。那么这里哪里
是重点呢？***这里就是重点的地方，如果你进入这里你可以看到程序通过name和前面的这
个888888来计算注册码的过程，可以它看到它的计算过程。
程序在从call出来后就用
:00433817 3BC8 cmp ecx, eax
:00433819 0F85A2000000 jne 004338C1
进入比较，其中ecx=0012d687(H)=01234567 eax=00f3c3af(H)=15975343
这样我们就得到注册码了。easy吧。下面是注册码的计算过程，可以研究一下的。
:004332D0 81EC00010000 sub esp, 00000100
:004332D6 B84D28D207 mov eax, 07D2284D
:004332DB 8D542400 lea edx, dword ptr [esp]
:004332DF 56 push esi
:004332E0 8BB42408010000 mov esi, dword ptr [esp+00000108]
:004332E7 803E00 cmp byte ptr [esi], 00
:004332EA 741A je 00433306
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433304(C)
|
:004332EC 8A0E mov cl, byte ptr [esi] <=name
:004332EE 80F961 cmp cl, 61
:004332F1 7C08 jl 004332FB
:004332F3 80F97A cmp cl, 7A
:004332F6 7F03 jg 004332FB
:004332F8 80E920 sub cl, 20
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004332F1(C), :004332F6(C)
|
:004332FB 880A mov byte ptr [edx], cl
:004332FD 8A4E01 mov cl, byte ptr [esi+01]
:00433300 42 inc edx
:00433301 46 inc esi
:00433302 84C9 test cl, cl
:00433304 75E6 jne 004332EC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004332EA(C)
|
:00433306 C60200 mov byte ptr [edx], 00
:00433309 8A4C2404 mov cl, byte ptr [esp+04]
:0043330D 84C9 test cl, cl
:0043330F 8D742404 lea esi, dword ptr [esp+04]
:00433313 744A je 0043335F
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043335D(C)
|
:00433315 80F920 cmp cl, 20
:00433318 743D je 00433357
:0043331A 80F92E cmp cl, 2E
:0043331D 7438 je 00433357
:0043331F 0FBEC9 movsx ecx, cl
:00433322 8D14C9 lea edx, dword ptr [ecx+8*ecx]
:00433325 8D1451 lea edx, dword ptr [ecx+2*edx]
:00433328 C1E207 shl edx, 07
:0043332B 03D1 add edx, ecx
:0043332D 8D1492 lea edx, dword ptr [edx+4*edx]
:00433330 8D0CD1 lea ecx, dword ptr [ecx+8*edx]
:00433333 8BD0 mov edx, eax
:00433335 C1E205 shl edx, 05
:00433338 03CA add ecx, edx
:0043333A 8BD0 mov edx, eax
:0043333C 81E2807F0000 and edx, 00007F80
:00433342 81E1FFFFFF00 and ecx, 00FFFFFF
:00433348 C1E209 shl edx, 09
:0043334B C1F80B sar eax, 0B
:0043334E 33CA xor ecx, edx
:00433350 25FF000000 and eax, 000000FF
:00433355 33C1 xor eax, ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433318(C), :0043331D(C)
|
:00433357 8A4E01 mov cl, byte ptr [esi+01]
:0043335A 46 inc esi
:0043335B 84C9 test cl, cl
:0043335D 75B6 jne 00433315
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433313(C)
|
:0043335F 8BB4240C010000 mov esi, dword ptr [esp+0000010C]
:00433366 8D542404 lea edx, dword ptr [esp+04]
:0043336A 803E00 cmp byte ptr [esi], 00
:0043336D 741A je 00433389
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433387(C)
|
:0043336F 8A0E mov cl, byte ptr [esi] <=888888
:00433371 80F961 cmp cl, 61
:00433374 7C08 jl 0043337E
:00433376 80F97A cmp cl, 7A
:00433379 7F03 jg 0043337E
:0043337B 80E920 sub cl, 20
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433374(C), :00433379(C)
|
:0043337E 880A mov byte ptr [edx], cl
:00433380 8A4E01 mov cl, byte ptr [esi+01]
:00433383 42 inc edx
:00433384 46 inc esi
:00433385 84C9 test cl, cl
:00433387 75E6 jne 0043336F
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043336D(C)
|
:00433389 C60200 mov byte ptr [edx], 00
:0043338C 8A4C2404 mov cl, byte ptr [esp+04]
:00433390 84C9 test cl, cl
:00433392 8D742404 lea esi, dword ptr [esp+04]
:00433396 7445 je 004333DD
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004333DB(C)
|
:00433398 80F920 cmp cl, 20
:0043339B 7438 je 004333D5
:0043339D 0FBEC9 movsx ecx, cl
:004333A0 8D14C9 lea edx, dword ptr [ecx+8*ecx]
:004333A3 8D1451 lea edx, dword ptr [ecx+2*edx]
:004333A6 C1E207 shl edx, 07
:004333A9 03D1 add edx, ecx
:004333AB 8D1492 lea edx, dword ptr [edx+4*edx]
:004333AE 8D0CD1 lea ecx, dword ptr [ecx+8*edx]
:004333B1 8BD0 mov edx, eax
:004333B3 C1E205 shl edx, 05
:004333B6 03CA add ecx, edx
:004333B8 8BD0 mov edx, eax
:004333BA 81E2807F0000 and edx, 00007F80
:004333C0 81E1FFFFFF00 and ecx, 00FFFFFF
:004333C6 C1E209 shl edx, 09
:004333C9 C1F80B sar eax, 0B
:004333CC 33CA xor ecx, edx
:004333CE 25FF000000 and eax, 000000FF
:004333D3 33C1 xor eax, ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043339B(C)
|
:004333D5 8A4E01 mov cl, byte ptr [esi+01]
:004333D8 46 inc esi
:004333D9 84C9 test cl, cl
:004333DB 75BB jne 00433398
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433396(C)
|
:004333DD 0D0000A000 or eax, 00A00000
:004333E2 5E pop esi
:004333E3 81C400010000 add esp, 00000100
:004333E9 C3 ret
上面的计算过程就是通过name和注册码的前面5位来计算得到的，再同后面的注册码进行
比较。这个就是这个软件的注册过程。
******************************
* name:programhunter *
* RN:888888-15975343 *
******************************
|
| 返回 |
dfx V4.0破解过程
程式猎人
简介：这个是一个winamp软件的插件，功能不太清楚。
下载地址：frp://ftp.21hh.net/dfx4_0100_w.exe
追踪：email:dahuilang@sohu.com
RN:01234567
在winamp中点击外观界面，再选择音效处理选项，点击里的dfx就程序就要求你注册了。
设bpx hmemcpy中断拦截程序。如下：
015F:03A3780C PUSH EDI
015F:03A3780D PUSH DWORD 80
015F:03A37812 PUSH EAX
015F:03A37813 PUSH DWORD CD
015F:03A37818 PUSH EBX
015F:03A37819 CALL ESI
015F:03A3781B TEST EAX,EAX <-出来 读取第一个值
015F:03A3781D JZ NEAR 03A379E7
015F:03A37823 LEA ECX,[ESP+18]
015F:03A37827 PUSH DWORD 80
015F:03A3782C PUSH ECX
015F:03A3782D PUSH DWORD D3
015F:03A37832 PUSH EBX
015F:03A37833 CALL ESI
015F:03A37835 MOV EDI,[03A4C0A4]
015F:03A3783B TEST EAX,EAX 读取第二个值
015F:03A3783D JNZ 03A3784E
015F:03A3783F LEA EDX,[ESP+18]
015F:03A37843 PUSH DWORD 03A50AC0
015F:03A37848 PUSH EDXz
015F:03A37849 CALL EDI
015F:03A3784B ADD ESP,BYTE +08
015F:03A3784E PUSH DWORD 7F02
015F:03A37853 PUSH BYTE +00
015F:03A37855 CALL `USER32!LoadCursorA`
015F:03A3785B MOV ESI,[03A4C168]
015F:03A37861 PUSH EAX
015F:03A37862 CALL ESI
015F:03A37864 LEA EAX,[ESP+14]
015F:03A37868 LEA ECX,[ESP+0518]
015F:03A3786F PUSH EAX
015F:03A37870 LEA EDX,[ESP+14]
015F:03A37874 PUSH ECX
015F:03A37875 LEA EAX,[ESP+0120]
015F:03A3787C PUSH EDX
015F:03A3787D LEA ECX,[ESP+18]
015F:03A37881 PUSH EAX
015F:03A37882 PUSH ECX
015F:03A37883 LEA EDX,[ESP+2C]
015F:03A37887 PUSH DWORD 03A51AD4
015F:03A3788C LEA EAX,[ESP+B0]
015F:03A37893 PUSH EDXw
015F:03A37894 PUSH EAX
015F:03A37895 CALL `DFXG11!?dfxpEnterSerialNumber@@YAHPAD0PAH10101@Z`
015F:03A3789A ADD ESP,BYTE +20
015F:03A3789D TEST EAX,EAX
015F:03A3789F JNZ NEAR 03A3793A 关键的跳跃地方，进入上面的call中。
015F:03A378A5 PUSH EAX
015F:03A378A6 CALL ESI
015F:03A378A8 MOV EAX,[03A51AD4]
015F:03A378AD CMP EAX,BYTE +05
015F:03A378B0 MOV EAX,[ESP+0C]
015F:03A378B4 JNZ 03A378F7
015F:03A378B6 TEST EAX,EAX
015F:03A378B8 JZ 03A378C3
015F:03A378BA LEA ECX,[ESP+0118]
015F:03A378C1 JMP SHORT 03A3792D
程序在上面就是一个关键的地方，进入call中查看。
015F:03A34DE0 MOV ECX,[ESP+24]
015F:03A34DE4 LEA EAX,[ESP+38]
015F:03A34DE8 PUSH EDX
015F:03A34DE9 PUSH EAX
015F:03A34DEA PUSH ECX
015F:03A34DEB CALL 03A35020
015F:03A34DF0 ADD ESP,BYTE +14
015F:03A34DF3 TEST EAX,EAX
015F:03A34DF5 JZ 03A34E04
015F:03A34DF7 POP EDI
015F:03A34DF8 POP ESI
015F:03A34DF9 POP EBP
015F:03A34DFA MOV EAX,01
015F:03A34DFF POP EBX
015F:03A34E00 ADD ESP,BYTE +08
015F:03A34E03 RET
015F:03A34E04 MOV EAX,[ESP+30]
015F:03A34E08 TEST EAX,EAX
015F:03A34E0A JNZ 03A34E46
015F:03A34E0C MOV DWORD [EDI],05
进入后将到达这里是关键的地方，不用多说再进入了。
015F:03A35020 PUSH EBX
015F:03A35021 MOV EBX,[ESP+18]
015F:03A35025 PUSH EBP
015F:03A35026 MOV EBP,[ESP+10]
015F:03A3502A PUSH ESI
015F:03A3502B MOV ESI,[ESP+10]
015F:03A3502F MOV DWORD [EBP+00],00
015F:03A35036 MOV DWORD [EBX],00
015F:03A3503C TEST ESI,ESI
015F:03A3503E JZ NEAR 03A351FA
015F:03A35044 PUSH ESI
015F:03A35045 CALL 03A40650
015F:03A3504A ADD ESP,BYTE +04
015F:03A3504D TEST EAX,EAX
015F:03A3504F JZ 03A3505A
015F:03A35051 POP ESI
015F:03A35052 POP EBP
015F:03A35053 MOV EAX,01
015F:03A35058 POP EBX
015F:03A35059 RET 015F:03A3505A PUSH EDI
015F:03A3505B MOV EDI,ESI
015F:03A3505D OR ECX,BYTE -01
015F:03A35060 XOR EAX,EAX
015F:03A35062 REPNE SCASB
015F:03A35064 NOT ECX
015F:03A35066 DEC ECX
015F:03A35067 POP EDI
015F:03A35068 CMP ECX,BYTE +08
015F:03A3506B JNZ 03A3507C
015F:03A3506D MOV EAX,[ESP+18]
015F:03A35071 MOV DWORD [EBX],01
015F:03A35077 MOV BYTE [EAX],30
015F:03A3507A JMP SHORT 03A3509A
015F:03A3507C CMP ECX,BYTE +09 *******
015F:03A3507F JNZ NEAR 03A351FA
015F:03A35085 MOV AL,[ESI]
015F:03A35087 MOV ECX,[ESP+18]
015F:03A3508B INC ESI
015F:03A3508C CMP AL,67 ***
015F:03A3508E MOV [ECX],AL
015F:03A35090 JZ 03A3509A
015F:03A35092 CMP AL,47
015F:03A35094 JNZ NEAR 03A351FA
015F:03A3509A PUSH BYTE +30
015F:03A3509C PUSH BYTE +4F
015F:03A3509E PUSH ESI
015F:03A3509F CALL 03A40610
015F:03A350A4 ADD ESP,BYTE +0C
015F:03A350A7 TEST EAX,EAX
015F:03A350A9 JZ 03A350B4
015F:03A350AB POP ESI
015F:03A350AC POP EBP
015F:03A350AD MOV EAX,01
015F:03A350B2 POP EBX
015F:03A350B3 RET
015F:03A350B4 PUSH BYTE +30
015F:03A350B6 PUSH BYTE +6F
015F:03A350B8 PUSH ESI
015F:03A350B9 CALL 03A40610
015F:03A350BE ADD ESP,BYTE +0C
015F:03A350C1 TEST EAX,EAX
015F:03A350C3 JZ 03A350CE
015F:03A350C5 POP ESI
015F:03A350C6 POP EBP
015F:03A350C7 MOV EAX,01
015F:03A350CC POP EBX
015F:03A350CD RET
015F:03A350CE PUSH BYTE +41
015F:03A350D0 PUSH BYTE +61
015F:03A350D2 PUSH ESI
015F:03A350D3 CALL 03A40610
015F:03A350D8 ADD ESP,BYTE +0C
015F:03A350DB TEST EAX,EAX
015F:03A350DD JZ 03A350E8
015F:03A350DF POP ESI
015F:03A350E0 POP EBP
015F:03A350E1 MOV EAX,01
015F:03A350E6 POP EBX
015F:03A350E7 RET
015F:03A350E8 PUSH BYTE +42
015F:03A350EA PUSH BYTE +62
015F:03A350EC PUSH ESI
015F:03A350ED CALL 03A40610
015F:03A350F2 ADD ESP,BYTE +0C
015F:03A350F5 TEST EAX,EAX
015F:03A350F7 JZ 03A35102
015F:03A350F9 POP ESI
015F:03A350FA POP EBP
015F:03A350FB MOV EAX,01
015F:03A35100 POP EBX
015F:03A35101 RET
015F:03A35102 PUSH BYTE +43
015F:03A35104 PUSH BYTE +63
015F:03A35106 PUSH ESI
015F:03A35107 CALL 03A40610
015F:03A3510C ADD ESP,BYTE +0C
015F:03A3510F TEST EAX,EAX
015F:03A35111 JZ 03A3511C
015F:03A35113 POP ESI
015F:03A35114 POP EBP
015F:03A35115 MOV EAX,01
015F:03A3511A POP EBX
015F:03A3511B RET
015F:03A3511C PUSH BYTE +44
015F:03A3511E PUSH BYTE +64
015F:03A35120 PUSH ESI
015F:03A35121 CALL 03A40610
015F:03A35126 ADD ESP,BYTE +0C
015F:03A35129 TEST EAX,EAX
015F:03A3512B JZ 03A35136
015F:03A3512D POP ESI
015F:03A3512E POP EBP
015F:03A3512F MOV EAX,01
015F:03A35134 POP EBX
015F:03A35135 RET
015F:03A35136 PUSH BYTE +45
015F:03A35138 PUSH BYTE +65
015F:03A3513A PUSH ESI
015F:03A3513B CALL 03A40610
015F:03A35140 ADD ESP,BYTE +0C
015F:03A35143 TEST EAX,EAX
015F:03A35145 JZ 03A35150
015F:03A35147 POP ESI
015F:03A35148 POP EBP
015F:03A35149 MOV EAX,01
015F:03A3514E POP EBX
015F:03A3514F RET
015F:03A35150 PUSH BYTE +46
015F:03A35152 PUSH BYTE +66
015F:03A35154 PUSH ESI
015F:03A35155 CALL 03A40610
015F:03A3515A ADD ESP,BYTE +0C
015F:03A3515D TEST EAX,EAX
015F:03A3515F JZ 03A3516A
015F:03A35161 POP ESI
015F:03A35162 POP EBP
015F:03A35163 MOV EAX,01
015F:03A35168 POP EBX
015F:03A35169 RET
015F:03A3516A LEA EDX,[ESP+14]
015F:03A3516E PUSH EDX
015F:03A3516F PUSH ESI
015F:03A35170 CALL 03A3DB80
015F:03A35175 ADD ESP,BYTE +08
015F:03A35178 TEST EAX,EAX
015F:03A3517A JZ 03A35185
015F:03A3517C POP ESI
015F:03A3517D POP EBP
015F:03A3517E MOV EAX,01
015F:03A35183 POP EBX
015F:03A35184 RET
015F:03A35185 MOV EAX,[ESP+14]
015F:03A35189 TEST EAX,EAX
015F:03A3518B JZ 03A351FA
015F:03A3518D MOV AL,[ESI]
015F:03A3518F CMP AL,41
015F:03A35191 JZ 03A351DE
015F:03A35193 MOV ECX,[03A50BD4]
015F:03A35199 CMP ECX,BYTE +0A
015F:03A3519C JNZ 03A351A8
015F:03A3519E CMP AL,36
015F:03A351A0 JZ 03A351DE
015F:03A351A2 POP ESI
015F:03A351A3 POP EBP
015F:03A351A4 XOR EAX,EAX
015F:03A351A6 POP EBX
015F:03A351A7 RET
015F:03A351A8 CMP ECX,BYTE +0B ***
015F:03A351AB JNZ 03A351B7 ***
015F:03A351AD CMP AL,37
015F:03A351AF JZ 03A351DE
015F:03A351B1 POP ESI
015F:03A351B2 POP EBP
015F:03A351B3 XOR EAX,EAX
015F:03A351B5 POP EBX
015F:03A351B6 RET
015F:03A351B7 CMP ECX,BYTE +0C
015F:03A351BA JNZ 03A351C6
015F:03A351BC CMP AL,38
015F:03A351BE JZ 03A351DE
015F:03A351C0 POP ESI
015F:03A351C1 POP EBP
015F:03A351C2 XOR EAX,EAX
015F:03A351C4 POP EBX
015F:03A351C5 RET
015F:03A351C6 CMP ECX,BYTE +0D
015F:03A351C9 JNZ 03A351D5
015F:03A351CB CMP AL,39
015F:03A351CD JZ 03A351DE
015F:03A351CF POP ESI
015F:03A351D0 POP EBP
015F:03A351D1 XOR EAX,EAX
015F:03A351D3 POP EBX
015F:03A351D4 RET
015F:03A351D5 CMP ECX,BYTE +0E
015F:03A351D8 JNZ 03A351DE
015F:03A351DA CMP AL,42
015F:03A351DC JNZ 03A351FA
015F:03A351DE MOV EAX,[ESP+1C]
015F:03A351E2 PUSH EAX
015F:03A351E3 PUSH DWORD 03A4E32C
015F:03A351E8 PUSH ESI
015F:03A351E9 CALL `MSVCRT!sscanf`
015F:03A351EF ADD ESP,BYTE +0C
015F:03A351F2 CMP EAX,BYTE +01
015F:03A351F5 JNZ 03A351FA
015F:03A351F7 MOV [EBP+00],EAX
015F:03A351FA POP ESI
015F:03A351FB POP EBP
015F:03A351FC XOR EAX,EAX
015F:03A351FE POP EBX
015F:03A351FF RET
现在就可以得到注册码了，在那里呢？首先来看
015F:03A3507C CMP ECX,BYTE +09 *******
015F:03A3507F JNZ NEAR 03A351FA
015F:03A35085 MOV AL,[ESI]
015F:03A35087 MOV ECX,[ESP+18]
015F:03A3508B INC ESI
015F:03A3508C CMP AL,67 ***
015F:03A3508E MOV [ECX],AL
015F:03A35090 JZ 03A3509A
015F:03A35092 CMP AL,47
015F:03A35094 JNZ NEAR 03A351FA
先比较你的注册码是否为9位，然后比较第一位是否G/g，如果是的话，将达到向下比较，
在上面的那么代码中，其中大部分是跳跃的。最后你将到达这里
015F:03A351A8 CMP ECX,BYTE +0B ***
015F:03A351AB JNZ 03A351B7 ***
015F:03A351AD CMP AL,37
015F:03A351AF JZ 03A351DE
比较第二位是否为7，如果是的话，将到达正确的地方。
游戏结束了。
注册码为：G7???????。
这里?将是任何一个数都可以的。如果你没有研究明白，还想研究的话，可以将下面的这
个注册表值删除就可以了。同时第二种注册方法也是将它改为3就可以了。
HKEY_LOCAL_MACHINE\Software\DFX\11\REGISTRATION\stat\(默认)这个值改为3，就可以注
册成功了，如果改为其它值就是注册不成功的。 |
| 返回 |
|
%【初学天地】 |
|
| 返回 |
|
O【问题答疑】 |
| |
| 返回 |
|
4【网站介绍】 |
| |
| |
| 返回 |
|
,【杂志信箱】 |
| 投稿信箱：discoveredit@china.com |
| 答疑信箱：discoveranswer@china.com |
| 斑竹信箱：programhunter@china.com |
| 返回 | |