<span class="pediy"><span class="pediy">
Teleport pro 1.29.1590
cracker：essorg
tools：trw2000pll
level：0
到注册界面，输入注册码随便打，出现 Incorrect release code 界面，
CTRL+N 进入 TRW2000
下hwnd 查该界面窗体句柄，再下bpmsg (hwnd) WM_COMMAND,X回到出错界面，点击确定，此时TRW中断进入
按N次F12和N次F8，得到以下内容
017F:0042690D 6A0A PUSH BYTE +0A
017F:0042690F 53 PUSH EBX
017F:00426910 50 PUSH EAX
017F:00426911 E85E690000 CALL 0042D274 〈----由输入注册码计算校验码1
017F:00426916 8B0DF8204800 MOV ECX,[004820F8]
017F:0042691C 83C40C ADD ESP,BYTE +0C
017F:0042691F 8945E8 MOV [EBP-18],EAX 〈----返回值放到[EBP-18]
017F:00426922 3899DB040000 CMP [ECX+04DB],BL
017F:00426928 0F8412020000 JZ NEAR 00426B40
017F:0042692E 3BC3 CMP EAX,EBX
017F:00426930 BE00DA4700 MOV ESI,0047DA00
017F:00426935 0F8406010000 JZ NEAR 00426A41
017F:0042693B FFB7D5000000 PUSH DWORD [EDI+D5]
017F:00426941 E896090000 CALL 004272DC 〈----由输入用户名计算校验码2
017F:00426946 3945E8 CMP [EBP-18],EAX 〈----比较校验码1和校验码2
017F:00426949 59 POP ECX
017F:0042694A 753A JNZ 00426986
由输入用户名计算校验码，经分析此段程序即可作为注册机程序，稍作修改：
〈----求用户名长度，长度必须不小于5才有效。
017F:004272DC 57 PUSH EDI
017F:004272DD 8B7C2408 MOV EDI,[ESP+08]
017F:004272E1 85FF TEST EDI,EDI
017F:004272E3 7409 JZ 004272EE
017F:004272E5 57 PUSH EDI
017F:004272E6 E855560000 CALL 0042C940
017F:004272EB 59 POP ECX
017F:004272EC EB02 JMP SHORT 004272F0
017F:004272EE 33C0 XOR EAX,EAX
017F:004272F0 83F805 CMP EAX,BYTE +05
017F:004272F3 7304 JNC 004272F9
017F:004272F5 33C0 XOR EAX,EAX
017F:004272F7 5F POP EDI
017F:004272F8 C3 RET
〈----注册码计算程序。
017F:004272F9 53 PUSH EBX
017F:004272FA 56 PUSH ESI
017F:004272FB BEA4E4FE5D MOV ESI,5DFEE4A4
017F:00427300 33DB XOR EBX,EBX
017F:00427302 85FF TEST EDI,EDI
017F:00427304 7409 JZ 0042730F
017F:00427306 57 PUSH EDI
017F:00427307 E834560000 CALL 0042C940 〈----计算用户名长度，返回给EAX。
017F:0042730C 59 POP ECX
017F:0042730D EB02 JMP SHORT 00427311
017F:0042730F 33C0 XOR EAX,EAX
017F:00427311 83C0FC ADD EAX,BYTE -04
017F:00427314 3BD8 CMP EBX,EAX
017F:00427316 730C JNC 00427324
017F:00427318 33343B XOR ESI,[EBX+EDI]
017F:0042731B F6C340 TEST BL,40
017F:0042731E 7401 JZ 00427321
017F:00427320 43 INC EBX
017F:00427321 43 INC EBX
017F:00427322 EBDE JMP SHORT 00427302
017F:00427324 8BC6 MOV EAX,ESI
017F:00427326 5E POP ESI
017F:00427327 5B POP EBX
017F:00427328 5F POP EDI
017F:00427329 C3 RET
总结：
keymake1.73制作内存注册机，中断42694A，75头，2字节，记录寄存器EAX，十进制
注册完成后在注册表中添加：
HKEY_CURRENT_USER\Software\Tennyson Maxwell\Teleport Pro\User\
Registration=0x40e2e4b2(1088611506)
因软件漏洞,此软件有一个万能注册码：0xffffffff(4294967295)
