加密狗技术网 加密狗破解 精美屏保暴力破解全过程

精美屏保暴力破解全过程

先用WD32ASM8.93超级中文版进行反汇编,然后查找,会看到: * Referenced by a (U)…

先用WD32ASM8.93超级中文版进行反汇编,然后查找,会看到:

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D097(C)
|
:0040D0AD 6A03                    push 00000003
:0040D0AF E82C67FFFF              call 004037E0
:0040D0B4 83C404                  add esp, 00000004
:0040D0B7 8945F8                  mov dword ptr [ebp-08], eax
:0040D0BA 837DF800                cmp dword ptr [ebp-08], 00000000
:0040D0BE 7414                    je 0040D0D4             //—–>修改74-75即jne->je
:0040D0C0 C70500FE410003000000    mov dword ptr [0041FE00], 00000003
:0040D0CA 6A01                    push 00000001
:0040D0CC E8A86EFFFF              call 00403F79
:0040D0D1 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D0BE(C)  //———->修改处,往上找。
|
:0040D0D4 833D00FE410000          cmp dword ptr [0041FE00], 00000000
:0040D0DB 7458                    je 0040D135      //—————修改74->75即jne->je
:0040D0DD C605B1DD410001          mov byte ptr [0041DDB1], 01
:0040D0E4 C605B2DD410001          mov byte ptr [0041DDB2], 01
:0040D0EB 833D00FE410001          cmp dword ptr [0041FE00], 00000001
:0040D0F2 7514                    jne 0040D108    //——————-修改74->75即jne->je

* Possible StringData Ref from Data Obj ->”TEMP registration OK”  //—–2条鱼!
                                  |
:0040D0F4 6834E54100              push 0041E534
:0040D0F9 6892000000              push 00000092
:0040D0FE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D101 51                      push ecx

* Reference To: USER32.SetDlgItemTextA, Ord:022Ch
                                  |
:0040D102 FF1514A24100            Call dword ptr [0041A214]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D0F2(C)      //————-修改的地方,往上找
|
:0040D108 833D00FE410002          cmp dword ptr [0041FE00], 00000002
:0040D10F 7514                    jne 0040D125     

* Possible StringData Ref from Data Obj ->”BASIC registration OK” //——-3条鱼!
                                  |
:0040D111 684CE54100              push 0041E54C
:0040D116 6892000000              push 00000092
:0040D11B 8B5508                  mov edx, dword ptr [ebp+08]
:0040D11E 52                      push edx

* Reference To: USER32.SetDlgItemTextA, Ord:022Ch
                                  |
:0040D11F FF1514A24100            Call dword ptr [0041A214]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D10F(C)
|
:0040D125 833D00FE410003          cmp dword ptr [0041FE00], 00000003  //—–>
:0040D12C 7D07                    jge 0040D135  //——> 比较大于则跳,所以改为小于7D->7E
:0040D12E 33C0                    xor eax, eax
:0040D130 E91B010000              jmp 0040D250

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D0DB(C), :0040D12C(C)
|
:0040D135 833D00FE410003          cmp dword ptr [0041FE00], 00000003
:0040D13C 7545                    jne 0040D183  //——–修改75-74即jne->je

* Possible StringData Ref from Data Obj ->”DELUXE registration OK”  //—–7条鱼!
                                  |
:0040D13E 6864E54100              push 0041E564
:0040D143 6892000000              push 00000092
:0040D148 8B4508                  mov eax, dword ptr [ebp+08]
:0040D14B 50                      push eax

* Reference To: USER32.SetDlgItemTextA, Ord:022Ch
                                  |
:0040D14C FF1514A24100            Call dword ptr [0041A214]
:0040D152 C605B1DD410001          mov byte ptr [0041DDB1], 01  //—-
:0040D159 C605B2DD410001          mov byte ptr [0041DDB2], 01  //—-
:0040D160 C605B3DD410001          mov byte ptr [0041DDB3], 01  //—-
:0040D167 C605B4DD410001          mov byte ptr [0041DDB4], 01  //—-
:0040D16E C605B5DD410001          mov byte ptr [0041DDB5], 01  //—-
:0040D175 C605B6DD410001          mov byte ptr [0041DDB6], 01  //—-
:0040D17C 33C0                    xor eax, eax
:0040D17E E9CD000000              jmp 0040D250

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D13C(C)  //————————-根据上面的值变化,也要修改。
|
:0040D183 6878104200              push 00421078
:0040D188 6892000000              push 00000092
:0040D18D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D190 51                      push ecx

* Reference To: USER32.SetDlgItemTextA, Ord:022Ch
                                  |
:0040D191 FF1514A24100            Call dword ptr [0041A214]
:0040D197 33C0                    xor eax, eax
:0040D199 E9B2000000              jmp 0040D250

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CFD1(C)

下面是参考dyiyd兄的提示写的:感谢dyiyd兄。

修改了上面的内容注册就是任意注册码了。而且是DELUXE,7条鱼!!!但是还有启动注册框NAG,下面来去掉他!

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404194(C)
|
:004041A0 833D00FE410000          cmp dword ptr [0041FE00], 00000000  //—-0041FE00是否为0
:004041A7 740E                    je 004041B7  //—–等于0就跳,玩完了。 74->75即je->jne
:004041A9 C605B1DD410001          mov byte ptr [0041DDB1], 01
:004041B0 C605B2DD410001          mov byte ptr [0041DDB2], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004041A7(C)
|
:004041B7 6A03                    push 00000003
:004041B9 E822F6FFFF              call 004037E0
:004041BE 83C404                  add esp, 00000004
:004041C1 85C0                    test eax, eax
:004041C3 7434                    je 004041F9  //——>eax=0就跳,玩完了。74->75即je->jne
:004041C5 C70500FE410003000000    mov dword ptr [0041FE00], 00000003  //—–使0041FE00=3
:004041CF C605B1DD410001          mov byte ptr [0041DDB1], 01
:004041D6 C605B2DD410001          mov byte ptr [0041DDB2], 01
:004041DD C605B3DD410001          mov byte ptr [0041DDB3], 01
:004041E4 C605B4DD410001          mov byte ptr [0041DDB4], 01
:004041EB C605B5DD410001          mov byte ptr [0041DDB5], 01
:004041F2 C605B6DD410001          mov byte ptr [0041DDB6], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404186(C), :004041C3(C)
|
:004041F9 833D00FE410000          cmp dword ptr [0041FE00], 00000000
:00404200 7410                    je 00404212
:00404202 837DFC00                cmp dword ptr [ebp-04], 00000000
:00404206 740A                    je 00404212
:00404208 6A01                    push 00000001
:0040420A E86AFDFFFF              call 00403F79

所以只要使0041FE00=3就可以了,所以我们可以这么修改。

本文来自网络,不代表加密狗技术网立场,转载请注明出处:http://www.crackgou.com/pojie/133.html

作者: admin

发表评论

您的电子邮箱地址不会被公开。

联系我们

联系我们

000-00000000

在线咨询: QQ交谈

邮箱: wolfree@qq.com

工作时间:8:00-23:00

关注微信
微信扫一扫关注我们

微信扫一扫关注我们

关注微博
返回顶部