感谢click123！这是我重新写的：CuteFTP最新版V4.2.4 在线注册的破解-下篇 (13千字)
〓 CuteFTP最新版V4.2.4 在线注册的破解-下篇〓★(第二部分)爆破
6) 在HKCR\下再建个Rl\3 (为什么呢，用regmon查查便知), 随便输入字符串 "123456789".在4B72AA下断点，bpx 4B72AA,运行
cutftp32.exe，中断后接着走到：
:00490C29 FF15B4D25100 Call dword ptr [0051D2B4]
:00490C2F 50 push eax
* Reference To: KERNEL32.LockResource, Ord:01D5h
|
:00490C30 FF15B8D25100 Call dword ptr [0051D2B8]
:00490C36 8D8C2484080000 lea ecx, dword ptr [esp+00000884]--------------->ecx指向字符串“123456789”
:00490C3D 50 push eax
:00490C3E 51 push ecx
:00490C3F 8D94245C100000 lea edx, dword ptr [esp+0000105C]
:00490C46 56 push esi
:00490C47 52 push edx
:00490C48 E8C32E0100 call 004A3B10---------------|重要的CALL，进入-->
:00490C4D 83C410 add esp, 00000010
:00490C50 8D4C240C lea ecx, dword ptr [esp+0C]
:00490C54 8BF0 mov esi, eax------------------------------------┐
:00490C56 C784242C180000FFFFFFFF mov dword ptr [esp+0000182C], FFFFFFFF │
:00490C61 E88AB90400 call 004DC5F0 │eax=esi=1 就对了！
:00490C66 8B8C2424180000 mov ecx, dword ptr [esp+00001824] │
:00490C6D 8BC6 mov eax, esi------------------------------------┘
:00490C6F 5E pop esi
:00490C70 5B pop ebx
:00490C71 64890D00000000 mov dword ptr fs:[00000000], ecx
:00490C78 81C428180000 add esp, 00001828
:00490C7E C3 ret
* Referenced by a CALL at Address:
|:00490C48
|
* Possible Reference to String Resource ID=00255: "No entry for the current site found. Do you wish to create o"
|
:004A3B10 6AFF push FFFFFFFF
:004A3B12 682D6A5100 push 00516A2D
:004A3B17 64A100000000 mov eax, dword ptr fs:[00000000]
:004A3B1D 50 push eax
:004A3B1E 64892500000000 mov dword ptr fs:[00000000], esp
:004A3B25 81ECB0000000 sub esp, 000000B0
:004A3B2B 56 push esi
:004A3B2C 57 push edi
:004A3B2D 6A00 push 00000000
:004A3B2F 8D4C240C lea ecx, dword ptr [esp+0C]
:004A3B33 E8982A0100 call 004B65D0
:004A3B38 6A00 push 00000000
...............
* Possible Reference to String Resource ID=00008: "Toolbar changes will take effect after CuteFTP is restarted"
|
:004A3C1A B908000000 mov ecx, 00000008—————————————>置循环次数
:004A3C1F 8D7C2430 lea edi, dword ptr [esp+30]————————>指向一个不变的十六进制串 (值得研究)
:004A3C23 8D742470 lea esi, dword ptr [esp+70]————————>指向的十六进制串与输入字符串 "123456789"相关
:004A3C27 33C0 xor eax, eax
:004A3C29 F3 repz
:004A3C2A A7 cmpsd-------------------|DWORD值循环比较！
:004A3C2B 5F pop edi
:004A3C2C 5E pop esi
:004A3C2D 745E je 004A3C8D-------------------|在此一定得跳呵，这可是最后的机会了--->修改①★
:004A3C2F 8D4C2418 lea ecx, dword ptr [esp+18]
:004A3C33 C68424B800000005 mov byte ptr [esp+000000B8], 05
:004A3C3B E8402A0100 call 004B6680
7) 用Winhex把上面的第一处改为 745E-->EB5E.重新运行程序，CRC 报错 “CuteFTP consistency check failed...”
好！ 打开我们的利器W32dasm, 反汇编cutftp32.exe后，search 文本“check failed", 来到-->
* Possible Reference to Dialog: DialogID_0181
|
:0043BC50 6881010000 push 00000181
:0043BC55 6A00 push 00000000
:0043BC57 6A00 push 00000000
:0043BC59 8B481C mov ecx, dword ptr [eax+1C]
:0043BC5C 51 push ecx
* Reference To: USER32.RedrawWindow, Ord:01F1h
|
:0043BC5D FF1544D65100 Call dword ptr [0051D644]
:0043BC63 C7835006000001000000 mov dword ptr [ebx+00000650], 00000001
:0043BC6D E81E510500 call 00490D90—————————————>进入-------------------------------------->|
:0043BC72 85C0 test eax, eax—————————————>eax≠0，即可跳过CRC错误!! |
:0043BC74 756F jne 0043BCE5 |
:0043BC76 8D55EC lea edx, dword ptr [ebp-14] |
|
* Possible Reference to String Resource ID=00426: "CuteFTP consistency check failed. This means that you are pr" |
| |
:0043BC79 68AA010000 push 000001AA |
:0043BC7E 52 push edx |
:0043BC7F E8CC97FEFF call 00425450 |
:0043BC84 83C408 add esp, 00000008 |
:0043BC87 8B00 mov eax, dword ptr [eax] |
:0043BC89 6A00 push 00000000 |
|
* Possible Reference to String Resource ID=00016: "CuteFTP 4.0" |
| | |
:0043BC8B 6A10 push 00000010 |
:0043BC8D 50 push eax |
:0043BC8E C645FC2A mov [ebp-04], 2A |
:0043BC92 E8ECC70A00 call 004E8483—————————————> CRC 出错的CALL! |
|
---------------------------------------- |
|
* Referenced by a CALL at Addresses: |
|:0043BC6D , :004650FB |
| |
|
* Possible Reference to String Resource ID=00255: "No entry for the current site found. Do you wish to create o" |
: | |
:00490D90 6AFF push FFFFFFFF <------------------------------------------------------------------|
:00490D92 6831505100 push 00515031
:00490D97 64A100000000 mov eax, dword ptr fs:[00000000]
:00490D9D 50 push eax
:00490D9E 64892500000000 mov dword ptr fs:[00000000], esp
:00490DA5 81EC24010000 sub esp, 00000124
:00490DAB 8D4C2408 lea ecx, dword ptr [esp+08]
:00490DAF E863CA0400 call 004DD817
:00490DB4 8D442420 lea eax, dword ptr [esp+20]
* Possible Reference to String Resource ID=00260: "Rename folder"
|
:00490DB8 6804010000 push 00000104
:00490DBD 50 push eax
:00490DBE 6A00 push 00000000
:00490DC0 C784243801000000000000 mov dword ptr [esp+00000138], 00000000
* Reference To: KERNEL32.GetModuleFileNameA, Ord:0124h
|
:00490DCB FF1540D45100 Call dword ptr [0051D440]
:00490DD1 6A00 push 00000000
:00490DD3 8D4C2424 lea ecx, dword ptr [esp+24]
:00490DD7 6A40 push 00000040
:00490DD9 51 push ecx
:00490DDA 8D4C2414 lea ecx, dword ptr [esp+14]
:00490DDE E8E6CB0400 call 004DD9C9
:00490DE3 85C0 test eax, eax
:00490DE5 0F858E000000 jne 00490E79—————————>程序会跳到——->|
:00490DEB 8D542400 lea edx, dword ptr [esp] |
|
------------- |
|
* Referenced by a (U)nconditional or (C)onditional Jump at Address: |
|:00490DE5(C) |
| |
:00490E79 8D442418 lea eax, dword ptr [esp+18]<-----------------|
:00490E7D 8D4C2408 lea ecx, dword ptr [esp+08]
:00490E81 50 push eax
:00490E82 51 push ecx
:00490E83 E858FEFFFF call 00490CE0
:00490E88 83C408 add esp, 00000008
:00490E8B 8D4C2408 lea ecx, dword ptr [esp+08]
:00490E8F E850CD0400 call 004DDBE4
:00490E94 33C0 xor eax, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00490EA2(C)
|
:00490E96 8A4C0418 mov cl, byte ptr [esp+eax+18]
:00490E9A 84C9 test cl, cl------->cl 是验证CRC 出错与否的标志! !!!修改②★★
:00490E9C 7508 jne 00490EA6------------------------------->在这不要跳!
:00490E9E 40 inc eax
:00490E9F 83F808 cmp eax, 00000008-------------------------->循环8次
:00490EA2 7CF2 jl 00490E96
:00490EA4 EBA5 jmp 00490E4B------------------------------->|
|
* Referenced by a (U)nconditional or (C)onditional Jump at Address: |
|:00490E9C(C) |
| |
:00490EA6 8D4C2408 lea ecx, dword ptr [esp+08] |
:00490EAA C784242C010000FFFFFFFF mov dword ptr [esp+0000012C], FFFFFFFF |
:00490EB5 E852CA0400 call 004DD90C |
:00490EBA 8B8C2424010000 mov ecx, dword ptr [esp+00000124] |
:00490EC1 33C0 xor eax, eax |
:00490EC3 64890D00000000 mov dword ptr fs:[00000000], ecx |
:00490ECA 81C430010000 add esp, 00000130 |
:00490ED0 C3 ret |
|
--------------- |
* Referenced by a (U)nconditional or (C)onditional Jump at Address: |
|:00490EA4(U) |
| |
:00490E4B 8D4C2408 lea ecx, dword ptr [esp+08]<----------------|
:00490E4F C784242C010000FFFFFFFF mov dword ptr [esp+0000012C], FFFFFFFF
:00490E5A E8ADCA0400 call 004DD90C
:00490E5F B801000000 mov eax, 00000001---------------------------|这是我们想要的结果!
:00490E64 8B8C2424010000 mov ecx, dword ptr [esp+00000124]
:00490E6B 64890D00000000 mov dword ptr fs:[00000000], ecx
:00490E72 81C430010000 add esp, 00000130
:00490E78 C3 ret---------------------------------------->CRC OK了!返回吧。。。
-------------------
打开Winhex将上面的第二处 84C9 test cl, cl改为 30C9 xor cl,cl!
重新运行程序,CRC OK!
查看about窗口，UNVERIFIED 也不见了！！在线验证OK!
###########
最后整理：
注册文件为(粘贴并保存为reg注册表文件)
┄┄┄┄┄┄┄┄┄┄┄Cut Here┄┄┄┄┄┄┄┄┄┄┄
REGEDIT4
[HKEY_CLASSES_ROOT\Rl]
"1"="A2222222222222"
"3"="123456789"
[HKEY_LOCAL_MACHINE\Software\GlobalSCAPE Inc.\CuteFTP]
"RegUserName"="moonLite[BCG]"
┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
再打补丁两处：
修改① @offset A3C2D 745E-->EB5E
修改② @offset 90E9A 84C9-->30C9
##########
【后记】：虽然注册+爆破成功了，还有很多地方值得好好研究。例如：regmon看到的Key1是注册码部分，
那么Key2呢？(VERIFY？)。也难怪，这是个在线注册的软件。看一下它的注册帮助就知道了。
愿与朋友们交流！！
moonlite 于2001-10-12
