运行TRW2000，选TRnewTCB,运行CEW.EXE: (5千字)
运行TRW2000，选TRnewTCB,运行CEW.EXE:0167:004E40A1 CALL 004E40A6：按F8可以进入单步跟踪。
按照下面的代码下bpx指令，F5返回，拦截成功，你可以继续分析。我也是刚学破解，而且没有时间。你可以继续分析。
015F:004E7C58 MOV AX,0401 ;校验
015F:004E7C5C MOV CX,4F01
015F:004E7C60 MOV DH,01
015F:004E7C62 MOV DL,[EBP+00433DE9]
015F:004E7C68 CALL 004E7925
015F:004E7C6D MOV AX,0201 ；读盘
015F:004E7C71 MOV CX,4F32 ；C:4F H:1 R:32
015F:004E7C75 MOV DH,01
015F:004E7C77 MOV DL,[EBP+00433DE9] ;磁盘号
015F:004E7C7D CALL 004E7925
015F:004E7C82 MOV DL,[EBP+00433DE9]
015F:004E7C88 CALL 004E78FD
015F:004E7C8D MOV DL,[EBP+00433DE9]
015F:004E7C93 CALL 004E78FD
015F:004E7C98 MOV EBX,[EBP+00433DD7]
015F:004E7C9E CMP EBX,[EBP+00433DBF]
015F:004E7CA4 JZ 004E7CB7
015F:004E7CA6 CMP BYTE [EBP+00433DE9],01
015F:004E7CAD JNC 004E7CCE
015F:004E7CAF INC BYTE [EBP+00433DE9]
015F:004E7CB5 JMP SHORT 004E7C3E
015F:004E7CB7 PUSH EAX
015F:004E7CB8 LEA EDI,[EBP+00433BD7]
015F:004E7CBE LEA ECX,[EBP+00433CCA]
015F:004E7CC4 SUB ECX,EDI
015F:004E7CC6 DEC ECX
015F:004E7CC7 CLD
015F:004E7CC8 XOR AL,AL
015F:004E7CCA REP STOSB
015F:004E7CCC POP EAX
015F:004E7C58 MOV AX,0401
015F:004E7C5C MOV CX,4F01
015F:004E7C60 MOV DH,01
015F:004E7C62 MOV DL,[EBP+00433DE9]
015F:004E7C68 CALL 004E7925
015F:004E7C6D MOV AX,0201 ;读盘
015F:004E7C71 MOV CX,4F32
015F:004E7C75 MOV DH,01
015F:004E7C77 MOV DL,[EBP+00433DE9]
015F:004E7C7D CALL 004E7925
015F:004E7C82 MOV DL,[EBP+00433DE9]
015F:004E7C88 CALL 004E78FD
015F:004E7C8D MOV DL,[EBP+00433DE9]
015F:004E7C93 CALL 004E78FD
015F:004E7C98 MOV EBX,[EBP+00433DD7]
015F:004E7C9E CMP EBX,[EBP+00433DBF]
015F:004E7CA4 JZ 004E7CB7
015F:004E7CA6 CMP BYTE [EBP+00433DE9],01
015F:004E7CAD JNC 004E7CCE
015F:004E7CAF INC BYTE [EBP+00433DE9]
015F:004E7CB5 JMP SHORT 004E7C3E
015F:004E7CB7 PUSH EAX
015F:004E7CB8 LEA EDI,[EBP+00433BD7]
015F:004E7CBE LEA ECX,[EBP+00433CCA]
015F:004E7CC4 SUB ECX,EDI
015F:004E7CC6 DEC ECX
015F:004E7CC7 CLD
015F:004E7CC8 XOR AL,AL
015F:004E7CCA REP STOSB
015F:004E7CCC POP EAX
015F:004E7967 MOV ESI,03 ;读盘三次
015F:004E796C PUSH ESI
015F:004E796D PUSH EAX
015F:004E796E PUSH EBX
015F:004E796F PUSH ECX
015F:004E7970 PUSH EDX
015F:004E7971 CALL 004E752A
015F:004E7976 MOV [EBP+00433E50],EAX
015F:004E797C MOV [EBP+00433E4C],ECX
015F:004E7982 MOV [EBP+00433E48],EDX
015F:004E7988 MOV EBX,[EBP+00433A01]
015F:004E798E MOV [EBP+00433E44],EBX
015F:004E7994 SHR EBX,10
015F:004E7997 MOV [EBP+00433E56],BX
015F:004E799E MOV BL,13
015F:004E79A0 CALL 004E7756
015F:004E79A5 POP EDX
015F:004E79A6 POP ECX
015F:004E79A7 POP EBX
015F:004E79A8 POP EAX
015F:004E79A9 POP ESI
015F:004E79AA CMP AH,02 ；AH=2，读盘
015F:004E79AD JNZ 004E79C2
015F:004E79AF MOV EBX,[EBP+00433A05]
015F:004E79B5 CMP WORD [EBX],BYTE +00
015F:004E79B9 JNZ 004E79C2
015F:004E79BB OR ESI,ESI
015F:004E79BD JZ 004E79C2
015F:004E79BF DEC ESI
015F:004E79C0 JMP SHORT 004E796C
015F:004E79C2 CMP CX,4F32 ；磁道4F 扇区32H
015F:004E79C7 JNZ 004E79F1
015F:004E79C9 MOV EBX,[EBP+00433A05]
015F:004E79CF MOV ECX,0200
015F:004E79D4 CALL 004E7B24
015F:004E79D9 MOV [EBP+00433DBF],EAX
015F:004E79DF MOV EAX,[EBX+9B]
015F:004E79E5 XOR EAX,[EBX+0162]
015F:004E79EB XOR [EBP+00433DBB],EAX
015F:004E79F1 MOV EAX,[EBP+004339FD]
015F:004E79F7 CALL 004E761C
015F:004E7967 MOV ESI,03
015F:004E796C PUSH ESI
015F:004E796D PUSH EAX
015F:004E796E PUSH EBX
015F:004E796F PUSH ECX
015F:004E7970 PUSH EDX
015F:004E7971 CALL 004E752A
015F:004E7976 MOV [EBP+00433E50],EAX
015F:004E797C MOV [EBP+00433E4C],ECX
015F:004E7982 MOV [EBP+00433E48],EDX
015F:004E7988 MOV EBX,[EBP+00433A01]
015F:004E798E MOV [EBP+00433E44],EBX
015F:004E7994 SHR EBX,10
015F:004E7997 MOV [EBP+00433E56],BX
015F:004E799E MOV BL,13
015F:004E79A0 CALL 004E7756
015F:004E79A5 POP EDX
015F:004E79A6 POP ECX
015F:004E79A7 POP EBX
015F:004E79A8 POP EAX
015F:004E79A9 POP ESI
015F:004E79AA CMP AH,02
015F:004E79AD JNZ 004E79C2
015F:004E79AF MOV EBX,[EBP+00433A05]
015F:004E79B5 CMP WORD [EBX],BYTE +00
015F:004E79B9 JNZ 004E79C2
015F:004E79BB OR ESI,ESI
015F:004E79BD JZ 004E79C2
015F:004E79BF DEC ESI
015F:004E79C0 JMP SHORT 004E796C
015F:004E79C2 CMP CX,4F32
015F:004E79C7 JNZ 004E79F1
015F:004E79C9 MOV EBX,[EBP+00433A05]
015F:004E79CF MOV ECX,0200
015F:004E79D4 CALL 004E7B24
015F:004E79D9 MOV [EBP+00433DBF],EAX
015F:004E79DF MOV EAX,[EBX+9B]
015F:004E79E5 XOR EAX,[EBX+0162]
015F:004E79EB XOR [EBP+00433DBB],EAX
015F:004E79F1 MOV EAX,[EBP+004339FD]
015F:004E79F7 CALL 004E761C
