去水印，我一直都很想搞定东东！ (47千字)
解密者:PeterChen组织:Free Cracking Group of China=[FCG]
对像:BCL Magellan Plugin Demo 4.2
功能:PDF to HTML Publishing Tool
保护:超级大水印与自制广告词。
破解工具:win32asm9.0
它是Acrobat 5.x正版加强功能插件，老外很早就有破解文件下载。
就是没有看到，老外最近也太水气了吧？这个非一般破解，应该拿出来交流一下才对!
没有办法，明天就要上班。就试一下自己动手，写一篇教程出来祝贺Last Day!
很久没有动手，分析它流程用一天时间。*_*
最明显提示:
--------------------------------------------------------------------------------
This page is not extracted in demo version.
--------------------------------------------------------------------------------
BCL
http://www.bcl-computers.com/
--------------------------------------------------------------------------------
最后完整搞定，就是听前恩师话耐心分析汇编流程内容:
* Possible Reference to String Resource ID=00049: "Processing Page %d of %d..."
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
:10004C4F 6A31 push 00000031
:10004C51 8D4DF0 lea ecx, dword ptr [ebp-10]
:10004C54 E874640500 call 1005B0CD
:10004C59 8B45EC mov eax, dword ptr [ebp-14]
:10004C5C 8B8E5C110000 mov ecx, dword ptr [esi+0000115C]
:10004C62 8B55F0 mov edx, dword ptr [ebp-10]
:10004C65 40 inc eax
:10004C66 41 inc ecx
:10004C67 51 push ecx
:10004C68 50 push eax
:10004C69 8D45E4 lea eax, dword ptr [ebp-1C]
:10004C6C 52 push edx
:10004C6D 50 push eax
:10004C6E E8A4140500 call 10056117
:10004C73 8B17 mov edx, dword ptr [edi]
:10004C75 83C410 add esp, 00000010
:10004C78 8D45E4 lea eax, dword ptr [ebp-1C]
:10004C7B 8BCF mov ecx, edi
:10004C7D 50 push eax
:10004C7E FF521C call [edx+1C]
:10004C81 51 push ecx
:10004C82 8D55E4 lea edx, dword ptr [ebp-1C]
:10004C85 8BCC mov ecx, esp
:10004C87 8965AC mov dword ptr [ebp-54], esp
:10004C8A 52 push edx
:10004C8B E8F25D0500 call 1005AA82
:10004C90 8B07 mov eax, dword ptr [edi]
:10004C92 8BCF mov ecx, edi
:10004C94 FF5038 call [eax+38]
:10004C97 8A4514 mov al, byte ptr [ebp+14]
:10004C9A 84C0 test al, al
:10004C9C 742B je 10004CC9
:10004C9E 8B8E5C110000 mov ecx, dword ptr [esi+0000115C]
:10004CA4 8B55EC mov edx, dword ptr [ebp-14]
:10004CA7 41 inc ecx
:10004CA8 8D4201 lea eax, dword ptr [edx+01]
:10004CAB 51 push ecx
:10004CAC 50 push eax
:10004CAD 8D45F0 lea eax, dword ptr [ebp-10]
* Possible StringData Ref from Data Obj ->"Page %d of %d - Magellan"
| ^^^^^^^^^^^^^^^^^^^^^^^^^^
:10004CB0 6824CD0710 push 1007CD24
:10004CB5 50 push eax
:10004CB6 E85C140500 call 10056117
:10004CBB 8B17 mov edx, dword ptr [edi]
:10004CBD 83C410 add esp, 00000010
:10004CC0 8D45F0 lea eax, dword ptr [ebp-10]
:10004CC3 8BCF mov ecx, edi
:10004CC5 50 push eax
:10004CC6 FF5210 call [edx+10]
以上内容是整理pdf to html进程！
_______________________________________________________________________________
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:10004C3A(C), :10004C9C(C)
|
:10004CC9 D98654110000 fld dword ptr [esi+00001154]
:10004CCF D80D04580610 fmul dword ptr [10065804]
:10004CD5 8B4DCC mov ecx, dword ptr [ebp-34]
:10004CD8 8B45EC mov eax, dword ptr [ebp-14]
-------------------------------------------------------------
:10004CDB 3BC1 cmp eax, ecx--->@ffset 4cdh抢着必死信心，试改之!^_^
:10004CDB 3BC0 cmp eax, eax--->Yeach！万岁，You Win!
-------------------------------------------------------------
:10004CDD D95DBC fstp dword ptr [ebp-44]--->这好像是浮点命令。
:10004CE0 0F84A9050000 je 1000528F---->☆ 所以不修改此处而>>>
:10004CE6 8A8678110000 mov al, byte ptr [esi+00001178]
:10004CEC 84C0 test al, al
:10004CEE 0F8466050000 je 1000525A
:10004CF4 8B8644110000 mov eax, dword ptr [esi+00001144]
:10004CFA 83F804 cmp eax, 00000004
:10004CFD 0F8457050000 je 1000525A
:10004D03 83F801 cmp eax, 00000001
:10004D06 752E jne 10004D36
:10004D08 8D9640100000 lea edx, dword ptr [esi+00001040]
:10004D0E 8D86400E0000 lea eax, dword ptr [esi+00000E40]
:10004D14 52 push edx
:10004D15 8D8E28080000 lea ecx, dword ptr [esi+00000828]
:10004D1B 50 push eax
:10004D1C 51 push ecx
:10004D1D 8D9568FEFFFF lea edx, dword ptr [ebp+FFFFFE68]
* Possible StringData Ref from Data Obj ->"%s%s%s"
|
:10004D23 6870C00710 push 1007C070
:10004D28 52 push edx
:10004D29 E80D3D0300 call 10038A3B
:10004D2E 83C414 add esp, 00000014
:10004D31 E996000000 jmp 10004DCC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10004D06(C)
|
:10004D36 83F802 cmp eax, 00000002
:10004D39 752B jne 10004D66
:10004D3B 8D8640100000 lea eax, dword ptr [esi+00001040]
:10004D41 8D8E400E0000 lea ecx, dword ptr [esi+00000E40]
:10004D47 50 push eax
:10004D48 8D962C090000 lea edx, dword ptr [esi+0000092C]
:10004D4E 51 push ecx
:10004D4F 52 push edx
:10004D50 8D8568FEFFFF lea eax, dword ptr [ebp+FFFFFE68]
* Possible StringData Ref from Data Obj ->"%s%s%s"
|
:10004D56 6870C00710 push 1007C070
:10004D5B 50 push eax
:10004D5C E8DA3C0300 call 10038A3B
:10004D61 83C414 add esp, 00000014
:10004D64 EB66 jmp 10004DCC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10004D39(C)
|
:10004D66 83F803 cmp eax, 00000003
:10004D69 7561 jne 10004DCC
:10004D6B 8DBE40100000 lea edi, dword ptr [esi+00001040]
:10004D71 8D9E400E0000 lea ebx, dword ptr [esi+00000E40]
:10004D77 57 push edi
:10004D78 8D8E28080000 lea ecx, dword ptr [esi+00000828]
:10004D7E 53 push ebx
:10004D7F 51 push ecx
:10004D80 8D9568FEFFFF lea edx, dword ptr [ebp+FFFFFE68]
* Possible StringData Ref from Data Obj ->"%s%s%s"
|
:10004D86 6870C00710 push 1007C070
:10004D8B 52 push edx
:10004D8C E8AA3C0300 call 10038A3B
:10004D91 57 push edi
:10004D92 8D862C090000 lea eax, dword ptr [esi+0000092C]
:10004D98 53 push ebx
:10004D99 50 push eax
:10004D9A 8D8D20F5FFFF lea ecx, dword ptr [ebp+FFFFF520]
* Possible StringData Ref from Data Obj ->"%s%s%s"
|
:10004DA0 6870C00710 push 1007C070
:10004DA5 51 push ecx
:10004DA6 E8903C0300 call 10038A3B
:10004DAB 8D9520F5FFFF lea edx, dword ptr [ebp+FFFFF520]
* Possible StringData Ref from Data Obj ->"aa"
|
:10004DB1 6820CD0710 push 1007CD20
:10004DB6 52 push edx
:10004DB7 E86C3C0300 call 10038A28
:10004DBC 8BD8 mov ebx, eax
:10004DBE 83C430 add esp, 00000030
:10004DC1 85DB test ebx, ebx
:10004DC3 895DC4 mov dword ptr [ebp-3C], ebx
:10004DC6 0F8443070000 je 1000550F
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:10004D31(U), :10004D64(U), :10004D69(C)
|
:10004DCC 8D8568FEFFFF lea eax, dword ptr [ebp+FFFFFE68]
* Possible StringData Ref from Data Obj ->"aa"
|
:10004DD2 6820CD0710 push 1007CD20
:10004DD7 50 push eax
:10004DD8 E84B3C0300 call 10038A28
:10004DDD 8BF8 mov edi, eax
:10004DDF 83C408 add esp, 00000008
:10004DE2 85FF test edi, edi
:10004DE4 0F8425070000 je 1000550F
* Possible StringData Ref from Data Obj ->"</BODY>
<STYLE TYPE="text/css">"
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
:10004DEA 68FCCC0710 push 1007CCFC 这里就是字体风格
* Possible StringData Ref from Data Obj ->"%s
"
|
:10004DEF 68F8CC0710 push 1007CCF8
:10004DF4 57 push edi
:10004DF5 E8C13B0300 call 100389BB
* Possible StringData Ref from Data Obj ->"<!-- /* page size information "
->"*/
" ^^^^^^^^^^^^^^^^^^^^^^^^
| 页面内容大小
:10004DFA 68D4CC0710 push 1007CCD4
* Possible StringData Ref from Data Obj ->"%s"
|
:10004DFF 6844B10710 push 1007B144
:10004E04 57 push edi
:10004E05 E8B13B0300 call 100389BB
:10004E0A 8B4DEC mov ecx, dword ptr [ebp-14]
:10004E0D 51 push ecx
* Possible StringData Ref from Data Obj ->".pg%d{"
|
:10004E0E 68CCCC0710 push 1007CCCC
:10004E13 57 push edi
:10004E14 E8A23B0300 call 100389BB
* Possible StringData Ref from Data Obj ->"absolute"
|
:10004E19 68C0CC0710 push 1007CCC0
* Possible StringData Ref from Data Obj ->"position:%s;"
|
:10004E1E 68B0CC0710 push 1007CCB0
:10004E23 57 push edi
:10004E24 E8923B0300 call 100389BB
:10004E29 8B9684110000 mov edx, dword ptr [esi+00001184]
:10004E2F 8B8E98110000 mov ecx, dword ptr [esi+00001198]
:10004E35 8B8680110000 mov eax, dword ptr [esi+00001180]
:10004E3B 03D1 add edx, ecx
:10004E3D 03C2 add eax, edx
:10004E3F 50 push eax
* Possible StringData Ref from Data Obj ->"top:%dpx
| ^^^^------->上边
:10004E40 68A4CC0710 push 1007CCA4
:10004E45 57 push edi
:10004E46 898680110000 mov dword ptr [esi+00001180], eax
:10004E4C E86A3B0300 call 100389BB
:10004E51 8B8688110000 mov eax, dword ptr [esi+00001188]
:10004E57 50 push eax
* Possible StringData Ref from Data Obj ->"left:%dpx;"
| ^^^^^^^^^---->左边
:10004E58 6898CC0710 push 1007CC98
:10004E5D 57 push edi
:10004E5E E8583B0300 call 100389BB
:10004E63 8B8E8C110000 mov ecx, dword ptr [esi+0000118C]
:10004E69 83C448 add esp, 00000048
:10004E6C 51 push ecx
* Possible StringData Ref from Data Obj ->"height:%dpx;"
| ^^^^^^---------->高度
:10004E6D 6888CC0710 push 1007CC88
:10004E72 57 push edi
:10004E73 E8433B0300 call 100389BB
:10004E78 8B9690110000 mov edx, dword ptr [esi+00001190]
:10004E7E 52 push edx
* Possible StringData Ref from Data Obj ->"width:%dpx;"
| ^^^^^------------->宽度
:10004E7F 687CCC0710 push 1007CC7C
:10004E84 57 push edi
:10004E85 E8313B0300 call 100389BB
* Possible StringData Ref from Data Obj ->"}
"
|
:10004E8A 6878CC0710 push 1007CC78
:10004E8F 57 push edi
:10004E90 E8263B0300 call 100389BB
* Possible StringData Ref from Data Obj ->"
"
|
:10004E95 6874CC0710 push 1007CC74
:10004E9A 57 push edi
:10004E9B E81B3B0300 call 100389BB
* Possible StringData Ref from Data Obj ->"/* text positioning information "
->"*/
" ^^^^^^^^^^^^^^^^^^^^^^^^^^
| 准备放上内容
:10004EA0 6850CC0710 push 1007CC50
:10004EA5 57 push edi
:10004EA6 E8103B0300 call 100389BB
:10004EAB D945BC fld dword ptr [ebp-44]
:10004EAE D80D00580610 fmul dword ptr [10065800]
:10004EB4 83C430 add esp, 00000030
:10004EB7 C745C800000000 mov [ebp-38], 00000000
:10004EBE E8C5430300 call 10039288
:10004EC3 D945BC fld dword ptr [ebp-44]
:10004EC6 D80DFC570610 fmul dword ptr [100657FC]
:10004ECC 8945B4 mov dword ptr [ebp-4C], eax
:10004ECF E8B4430300 call 10039288
:10004ED4 8945B8 mov dword ptr [ebp-48], eax
:10004ED7 C745E000000000 mov [ebp-20], 00000000
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10004F6C(C)
|
:10004EDE 8B45C8 mov eax, dword ptr [ebp-38]
:10004EE1 8B4DEC mov ecx, dword ptr [ebp-14]
:10004EE4 50 push eax
:10004EE5 51 push ecx
* Possible StringData Ref from Data Obj ->".ps%dp%d{"
|
:10004EE6 6844CC0710 push 1007CC44
:10004EEB 57 push edi
:10004EEC E8CA3A0300 call 100389BB
* Possible StringData Ref from Data Obj ->"absolute"
|
:10004EF1 68C0CC0710 push 1007CCC0
* Possible StringData Ref from Data Obj ->"position:%s;"
|
:10004EF6 68B0CC0710 push 1007CCB0
:10004EFB 57 push edi
:10004EFC E8BA3A0300 call 100389BB
:10004F01 8B868C110000 mov eax, dword ptr [esi+0000118C]
:10004F07 8B8E80110000 mov ecx, dword ptr [esi+00001180]
:10004F0D 99 cdq
:10004F0E 2BC2 sub eax, edx
:10004F10 8B55E0 mov edx, dword ptr [ebp-20]
:10004F13 D1F8 sar eax, 1
:10004F15 03C1 add eax, ecx
:10004F17 03C2 add eax, edx
:10004F19 50 push eax
* Possible StringData Ref from Data Obj ->"top:%dpx;"
|
:10004F1A 68A4CC0710 push 1007CCA4
:10004F1F 57 push edi
:10004F20 E8963A0300 call 100389BB
:10004F25 8B55B4 mov edx, dword ptr [ebp-4C]
:10004F28 52 push edx
