anti-homeMade(2): 文件加密工具fedt V1.28 (2千字)
文件加密工具fedt V1.28crack by 6767
工具：只用WDASM就能搞定
说明：文件加密工具，效果未知
地址：ftp://211.100.8.153/download/142/10284_fedtw128.exe
先用upx解压，反编译，找出错信息：
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040955F(C)
|
:00409636 A154634900 mov eax, dword ptr [00496354]
:0040963B 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"错误信息！"
|
:0040963D B910E74800 mov ecx, 0048E710
* Possible StringData Ref from Data Obj ->"非法用户名或注册码！"
|
:00409642 BAFBE64800 mov edx, 0048E6FB
:00409647 8B00 mov eax, dword ptr [eax]
:00409649 E866D20600 call 004768B4
向上找出错的跳转：
:00409540 8D55EC lea edx, dword ptr [ebp-14] <-
:00409543 8D45F8 lea eax, dword ptr [ebp-08] <-
:00409546 E8C5D40600 call 00476A10
:0040954B 50 push eax ＜－出口值进栈
:0040954C FF4DD8 dec [ebp-28]
:0040954F 8D45EC lea eax, dword ptr [ebp-14]
:00409552 BA02000000 mov edx, 00000002
:00409557 E8E4D30600 call 00476940
:0040955C 59 pop ecx ＜－弹出FLAG
:0040955D 84C9 test cl, cl
:0040955F 0F84D1000000 je 00409636 ＜－为0则GAMEOVER
由于它根据你的机器生成一个与注册注册有关的ID号，正确的处理方法是暴掉 call 00476A10 的出口EAX值，使其等于1
* Referenced by a CALL at Addresses:
|:0040485B , :00409546
|
:00476A10 55 push ebp
:00476A11 8BEC mov ebp, esp
:00476A13 53 push ebx
:00476A14 8B00 mov eax, dword ptr [eax]
:00476A16 8B12 mov edx, dword ptr [edx]
:00476A18 E89F1EFFFF call 004688BC
:00476A1D 0F94C0 sete al ＜－共6字节空间，怎么改由你
:00476A20 83E001 and eax, 00000001 ＜－
:00476A23 5B pop ebx
:00476A24 5D pop ebp
:00476A25 C3 ret
可以作LOADER或内存补丁，解决大家面临的问题。
2分钟搞定，下面要怎样做取决于你自己，当然你也可以去注册:-）
