爆破《冰雨音画 ICE Player v1.80T》（VB） (2千字)
软件名称：冰雨音画 ICE Player v1.80T下载地址：ftp://ftp.cq.ilike.myrice.com/soft/soft_mediatools/ZMHC.zip
破解工具：TRW2000 1.23注册版
破解过程：先运行该软件8次，直至出现试用到期的画面，退出程序，运行TRW，再运行该软件，按ctrl-N，点确定，被拦，往上看－－＞
016F:00455A0C 68605F4200 PUSH DWORD 00425F60 d 42560会发现“lidez”字样
016F:00455A11 68485F4200 PUSH DWORD 00425F48 “zhouhbone”
016F:00455A16 68305F4200 PUSH DWORD 00425F30 “zhangyanc”
016F:00455A1B FF1578114000 CALL `MSVBVM60!rtcGetSetting` 读注册表HKEY_CURRENT_USER\Software\VB and VBA Program Settings\zhangyanc\zhouhbone下lidez的值，即运行次数
016F:00455A21 8BD0 MOV EDX,EAX
016F:00455A23 8D4DBC LEA ECX,[EBP-44]
016F:00455A26 FF15AC114000 CALL `MSVBVM60!__vbaStrMove`
016F:00455A2C 50 PUSH EAX
016F:00455A2D FF150C114000 CALL `MSVBVM60!__vbaI2Str` 变成数值
016F:00455A33 8B4D08 MOV ECX,[EBP+08]
016F:00455A36 668981A4000000 MOV [ECX+A4],AX 存入[ECX+A4]
016F:00455A3D 8D4DBC LEA ECX,[EBP-44]
016F:00455A40 FF15D4114000 CALL `MSVBVM60!__vbaFreeStr`
016F:00455A46 C745FC07000000 MOV DWORD [EBP-04],07
016F:00455A4D 8B5508 MOV EDX,[EBP+08]
016F:00455A50 668B82A4000000 MOV AX,[EDX+A4] 再取出来
016F:00455A57 66050100 ADD AX,01 加1
016F:00455A5B 0F80C1280000 JO NEAR 00458322
016F:00455A61 8B4D08 MOV ECX,[EBP+08]
016F:00455A64 668981A4000000 MOV [ECX+A4],AX
016F:00455A6B C745FC08000000 MOV DWORD [EBP-04],08
016F:00455A72 8B5508 MOV EDX,[EBP+08]
016F:00455A75 668B82A4000000 MOV AX,[EDX+A4]
016F:00455A7C 50 PUSH EAX
016F:00455A7D FF1504104000 CALL `MSVBVM60!__vbaStrI2`
016F:00455A83 8BD0 MOV EDX,EAX
016F:00455A85 8D4DBC LEA ECX,[EBP-44]
016F:00455A88 FF15AC114000 CALL `MSVBVM60!__vbaStrMove`
016F:00455A8E 50 PUSH EAX
016F:00455A8F 68605F4200 PUSH DWORD 00425F60
016F:00455A94 68485F4200 PUSH DWORD 00425F48
016F:00455A99 68305F4200 PUSH DWORD 00425F30
016F:00455A9E FF1508104000 CALL `MSVBVM60!rtcSaveSetting` 写回注册表
知道怎么爆破了吧？只要把455a57改为XOR EAX,EAX NOP NOP就好了，也就是查找66050100，改为31 C0 90 90即可。
