隐私保护神3.0暴破 (11千字)
破解者：tieji破解
破解工具：W32dasm黄金版, UltraEdit-32
作者主页:http://www.acesoft.net/china
说 明:您的电脑监视您在电脑上的一举一动，并把所有痕迹保存在硬 盘的隐蔽地方，包括：
所有您曾经去过的网站，网页，图片，小电影，音乐等等 隐私保护神正是专为保护
您的隐私而设计,只需鼠标一点，所有的痕迹将会彻底、安全的清除
是vb5,不想跟注册码,爆破算了
启动W32dasm黄金版,反汇编te.exe主程序,找到username字符串,有两处分别如下:
第一处:是注册的地方
:0041CBC6 FF15FC444400 Call dword ptr [004444FC]
:0041CBCC 8D45D4 lea eax, dword ptr [ebp-2C]
:0041CBCF 50 push eax
:0041CBD0 E8BBE60000 call 0042B290 <========此call为比较注册码
:0041CBD5 8D4DD4 lea ecx, dword ptr [ebp-2C]
:0041CBD8 668BF0 mov si, ax <========将比较结果ax传给si
是零注册不成功
* Reference To: MSVBVM50.__vbaFreeStr, Ord:0000h
|
:0041CBDB FF1530454400 Call dword ptr [00444530]
:0041CBE1 8D4DD0 lea ecx, dword ptr [ebp-30]
* Reference To: MSVBVM50.__vbaFreeObj, Ord:0000h
|
:0041CBE4 FF1534454400 Call dword ptr [00444534]
:0041CBEA 8D4DAC lea ecx, dword ptr [ebp-54]
:0041CBED 8D55BC lea edx, dword ptr [ebp-44]
:0041CBF0 51 push ecx
:0041CBF1 52 push edx
:0041CBF2 6A02 push 00000002
* Reference To: MSVBVM50.__vbaFreeVarList, Ord:0000h
|
:0041CBF4 FF15EC424400 Call dword ptr [004442EC]
:0041CBFA 83C40C add esp, 0000000C
:0041CBFD 663BF7 cmp si, di <========比较si与di
:0041CC00 0F8461030000 je 0041CF67 <========相等则跳,注册不成功,
此处不能跳,nop掉
:0041CC06 8B03 mov eax, dword ptr [ebx]
:0041CC08 53 push ebx
:0041CC09 FF9010030000 call dword ptr [eax+00000310]
:0041CC0F 8D4DD0 lea ecx, dword ptr [ebp-30]
:0041CC12 50 push eax
:0041CC13 51 push ecx
* Reference To: MSVBVM50.__vbaObjSet, Ord:0000h
|
:0041CC14 FF1560434400 Call dword ptr [00444360]
:0041CC1A 8BF0 mov esi, eax
:0041CC1C 8D45D8 lea eax, dword ptr [ebp-28]
:0041CC1F 50 push eax
:0041CC20 56 push esi
:0041CC21 8B16 mov edx, dword ptr [esi]
:0041CC23 FF92A0000000 call dword ptr [edx+000000A0]
:0041CC29 3BC7 cmp eax, edi
:0041CC2B 7D12 jge 0041CC3F
:0041CC2D 68A0000000 push 000000A0
* Possible StringData Ref from Code Obj ->"酦?檉??"
|
:0041CC32 6864924000 push 00409264
:0041CC37 56 push esi
:0041CC38 50 push eax
* Reference To: MSVBVM50.__vbaHresultCheckObj, Ord:0000h
|
:0041CC39 FF1528434400 Call dword ptr [00444328]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CC2B(C)
|
:0041CC3F 8B45D8 mov eax, dword ptr [ebp-28]
:0041CC42 8D4DBC lea ecx, dword ptr [ebp-44]
:0041CC45 8D55AC lea edx, dword ptr [ebp-54]
:0041CC48 51 push ecx
:0041CC49 52 push edx
:0041CC4A 897DD8 mov dword ptr [ebp-28], edi
:0041CC4D 8945C4 mov dword ptr [ebp-3C], eax
:0041CC50 C745BC08000000 mov [ebp-44], 00000008
* Reference To: MSVBVM50.rtcTrimVar, Ord:0208h
|
:0041CC57 FF158C434400 Call dword ptr [0044438C]
:0041CC5D 393DA8F04300 cmp dword ptr [0043F0A8], edi
:0041CC63 7510 jne 0041CC75
:0041CC65 68A8F04300 push 0043F0A8
:0041CC6A 6888284000 push 00402888
* Reference To: MSVBVM50.__vbaNew2, Ord:0000h
|
:0041CC6F FF1588444400 Call dword ptr [00444488]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CC63(C)
|
:0041CC75 8B35A8F04300 mov esi, dword ptr [0043F0A8]
:0041CC7B 8D459C lea eax, dword ptr [ebp-64]
:0041CC7E 8D4DAC lea ecx, dword ptr [ebp-54]
:0041CC81 50 push eax
:0041CC82 8B3E mov edi, dword ptr [esi]
:0041CC84 8D55D4 lea edx, dword ptr [ebp-2C]
:0041CC87 51 push ecx
:0041CC88 52 push edx
* Reference To: MSVBVM50.__vbaStrVarVal, Ord:0000h
|
:0041CC89 FF155C444400 Call dword ptr [0044445C]
:0041CC8F 50 push eax
* Possible StringData Ref from Code Obj ->"uusername" <=========第一处,向上看
|
:0041CC90 68689D4000 push 00409D68
===================================================================
第二处:是程序启动时判断注册码的地方,是关键,即判断注册码是否正确.
* Possible StringData Ref from Code Obj ->"uusername" <==========第二处,向下看
|
:0042FE33 68689D4000 push 00409D68
* Possible StringData Ref from Code Obj ->"ggeneral"
|
:0042FE38 68F0CA4000 push 0040CAF0
:0042FE3D 8B95E4FEFFFF mov edx, dword ptr [ebp+FFFFFEE4]
:0042FE43 8B02 mov eax, dword ptr [edx]
:0042FE45 8B8DE4FEFFFF mov ecx, dword ptr [ebp+FFFFFEE4]
:0042FE4B 51 push ecx
:0042FE4C FF502C call [eax+2C]
:0042FE4F 8985E0FEFFFF mov dword ptr [ebp+FFFFFEE0], eax
:0042FE55 83BDE0FEFFFF00 cmp dword ptr [ebp+FFFFFEE0], 00000000
:0042FE5C 7D23 jge 0042FE81
:0042FE5E 6A2C push 0000002C
:0042FE60 68AC9D4000 push 00409DAC
:0042FE65 8B95E4FEFFFF mov edx, dword ptr [ebp+FFFFFEE4]
:0042FE6B 52 push edx
:0042FE6C 8B85E0FEFFFF mov eax, dword ptr [ebp+FFFFFEE0]
:0042FE72 50 push eax
* Reference To: MSVBVM50.__vbaHresultCheckObj, Ord:0000h
|
:0042FE73 FF1528434400 Call dword ptr [00444328]
:0042FE79 8985B4FEFFFF mov dword ptr [ebp+FFFFFEB4], eax
:0042FE7F EB0A jmp 0042FE8B
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FE5C(C)
|
:0042FE81 C785B4FEFFFF00000000 mov dword ptr [ebp+FFFFFEB4], 00000000
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FE7F(U)
|
:0042FE8B 8B4DD0 mov ecx, dword ptr [ebp-30]
:0042FE8E 898DC0FEFFFF mov dword ptr [ebp+FFFFFEC0], ecx
:0042FE94 C745D000000000 mov [ebp-30], 00000000
:0042FE9B 8B95C0FEFFFF mov edx, dword ptr [ebp+FFFFFEC0]
:0042FEA1 8D4DD8 lea ecx, dword ptr [ebp-28]
* Reference To: MSVBVM50.__vbaStrMove, Ord:0000h
|
:0042FEA4 FF15FC444400 Call dword ptr [004444FC]
:0042FEAA C745FC04000000 mov [ebp-04], 00000004
:0042FEB1 833DA8F0430000 cmp dword ptr [0043F0A8], 00000000
:0042FEB8 751C jne 0042FED6
:0042FEBA 68A8F04300 push 0043F0A8
:0042FEBF 6888284000 push 00402888
* Reference To: MSVBVM50.__vbaNew2, Ord:0000h
|
:0042FEC4 FF1588444400 Call dword ptr [00444488]
:0042FECA C785B0FEFFFFA8F04300 mov dword ptr [ebp+FFFFFEB0], 0043F0A8
:0042FED4 EB0A jmp 0042FEE0
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FEB8(C)
|
:0042FED6 C785B0FEFFFFA8F04300 mov dword ptr [ebp+FFFFFEB0], 0043F0A8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FED4(U)
|
:0042FEE0 8B95B0FEFFFF mov edx, dword ptr [ebp+FFFFFEB0]
:0042FEE6 8B02 mov eax, dword ptr [edx]
:0042FEE8 8985E4FEFFFF mov dword ptr [ebp+FFFFFEE4], eax
:0042FEEE 8D4DD0 lea ecx, dword ptr [ebp-30]
:0042FEF1 51 push ecx
* Possible StringData Ref from Code Obj ->"rregcode"
|
:0042FEF2 68F89E4000 push 00409EF8
* Possible StringData Ref from Code Obj ->"ggeneral"
|
:0042FEF7 68F0CA4000 push 0040CAF0
:0042FEFC 8B95E4FEFFFF mov edx, dword ptr [ebp+FFFFFEE4]
:0042FF02 8B02 mov eax, dword ptr [edx]
:0042FF04 8B8DE4FEFFFF mov ecx, dword ptr [ebp+FFFFFEE4]
:0042FF0A 51 push ecx
:0042FF0B FF502C call [eax+2C]
:0042FF0E 8985E0FEFFFF mov dword ptr [ebp+FFFFFEE0], eax
:0042FF14 83BDE0FEFFFF00 cmp dword ptr [ebp+FFFFFEE0], 00000000
:0042FF1B 7D23 jge 0042FF40
:0042FF1D 6A2C push 0000002C
:0042FF1F 68AC9D4000 push 00409DAC
:0042FF24 8B95E4FEFFFF mov edx, dword ptr [ebp+FFFFFEE4]
:0042FF2A 52 push edx
:0042FF2B 8B85E0FEFFFF mov eax, dword ptr [ebp+FFFFFEE0]
:0042FF31 50 push eax
* Reference To: MSVBVM50.__vbaHresultCheckObj, Ord:0000h
|
:0042FF32 FF1528434400 Call dword ptr [00444328]
:0042FF38 8985ACFEFFFF mov dword ptr [ebp+FFFFFEAC], eax
:0042FF3E EB0A jmp 0042FF4A
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FF1B(C)
|
:0042FF40 C785ACFEFFFF00000000 mov dword ptr [ebp+FFFFFEAC], 00000000
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FF3E(U)
|
:0042FF4A 8B4DD0 mov ecx, dword ptr [ebp-30]
:0042FF4D 898DBCFEFFFF mov dword ptr [ebp+FFFFFEBC], ecx
:0042FF53 C745D000000000 mov [ebp-30], 00000000
:0042FF5A 8B95BCFEFFFF mov edx, dword ptr [ebp+FFFFFEBC]
:0042FF60 8D4DDC lea ecx, dword ptr [ebp-24]
* Reference To: MSVBVM50.__vbaStrMove, Ord:0000h
|
:0042FF63 FF15FC444400 Call dword ptr [004444FC]
:0042FF69 C745FC05000000 mov [ebp-04], 00000005
:0042FF70 8D55DC lea edx, dword ptr [ebp-24]
:0042FF73 52 push edx
:0042FF74 E817B3FFFF call 0042B290 <========此call为比较注册码
:0042FF79 0FBFC0 movsx eax, ax
:0042FF7C 85C0 test eax, eax <========测试eax是否为零
:0042FF7E 0F848F010000 je 00430113 <========eax为零注册失败
此处不能跳,nop掉
:0042FF84 C745FC06000000 mov [ebp-04], 00000006
:0042FF8B 833D50F1430000 cmp dword ptr [0043F150], 00000000
:0042FF92 751C jne 0042FFB0
:0042FF94 6850F14300 push 0043F150
:0042FF99 68F4554000 push 004055F4
* Reference To: MSVBVM50.__vbaNew2, Ord:0000h
|
:0042FF9E FF1588444400 Call dword ptr [00444488]
