GETVBRES的注册破解 (6千字)
本不想写这个文章，一来因为现在好象好多前辈越来越保守，不愿意再多讲什么，我也不愿意在这种环境里多讲话，二来，RESTOOLS系列的工具编的实在不错，作者肯定花了不少心血，而且注册费也不是很贵，所以
发表破解有点不好意思。但我的关于破解方面的一点浅薄的知识大部分来源于看学论坛的各位前辈的无私奉
献，所以既然有人问起，就只好写上一写，为看学论坛出点小力，还请前辈高手指教
使用工具：trw2000(娃娃版，致谢），DEDE3.0，HIEW676
以下是dede反译出getvbres的部分代码：
0049AE05 64FF30 push dword ptr fs:[eax]
0049AE08 648920 mov fs:[eax], esp
0049AE0B BA02000080 mov edx, $80000002
0049AE10 8B45F8 mov eax, [ebp-$08]
* Reference to: registry.TRegistry.SetRootKey(TRegistry;Windows.HKEY);
|
0049AE13 E8749EFCFF call 00464C8C
0049AE18 B101 mov cl, $01
* Possible String Reference to: 'SOFTWARE\RESTOOLS\GetVBRes'
|
0049AE1A BA74AF4900 mov edx, $0049AF74
0049AE1F 8B45F8 mov eax, [ebp-$08]
* Reference to: registry.TRegistry.OpenKey(TRegistry;System.AnsiString;System.Boolean):System.Boolean;
|
0049AE22 E8A99FFCFF call 00464DD0
0049AE27 84C0 test al, al
0049AE29 0F84F4000000 jz 0049AF23
0049AE2F 8D45F4 lea eax, [ebp-$0C]
* Reference to: system.@LStrClr(String);
|
0049AE32 E80D8DF6FF call 00403B44
0049AE37 8D45F0 lea eax, [ebp-$10]
* Reference to: system.@LStrClr(String);
|
0049AE3A E8058DF6FF call 00403B44
* Possible String Reference to: 'reguser'
|
0049AE3F BA98AF4900 mov edx, $0049AF98
0049AE44 8B45F8 mov eax, [ebp-$08]
* Reference to: registry.TRegistry.ValueExists(TRegistry;System.AnsiString):System.Boolean;
|
0049AE47 E8B0A5FCFF call 004653FC
0049AE4C 84C0 test al, al
0049AE4E 7410 jz 0049AE60
0049AE50 8D4DF4 lea ecx, [ebp-$0C]
* Possible String Reference to: 'reguser'
|
0049AE53 BA98AF4900 mov edx, $0049AF98
0049AE58 8B45F8 mov eax, [ebp-$08]
* Reference to: registry.TRegistry.ReadString(TRegistry;System.AnsiString):System.AnsiString;
|
0049AE5B E8E0A3FCFF call 00465240
* Possible String Reference to: 'regcode'
|
0049AE60 BAA8AF4900 mov edx, $0049AFA8
0049AE65 8B45F8 mov eax, [ebp-$08]
* Reference to: registry.TRegistry.ValueExists(TRegistry;System.AnsiString):System.Boolean;
|
0049AE68 E88FA5FCFF call 004653FC
0049AE6D 84C0 test al, al
0049AE6F 7410 jz 0049AE81
0049AE71 8D4DF0 lea ecx, [ebp-$10]
* Possible String Reference to: 'regcode'
|
0049AE74 BAA8AF4900 mov edx, $0049AFA8
0049AE79 8B45F8 mov eax, [ebp-$08]
* Reference to: registry.TRegistry.ReadString(TRegistry;System.AnsiString):System.AnsiString;
|
0049AE7C E8BFA3FCFF call 00465240
0049AE81 8B45F0 mov eax, [ebp-$10]
* Reference to: system.@LStrLen:Integer;
| or: system.@DynArrayLength;
| or: system.DynArraySize(Pointer):Integer;
|
0049AE84 E83B8FF6FF call 00403DC4
0049AE89 83F828 cmp eax, +$28 判断长度
0049AE8C 0F8591000000 jnz 0049AF23
0049AE92 8B45F4 mov eax, [ebp-$0C]
* Reference to: system.@LStrLen:Integer;
| or: system.@DynArrayLength;
| or: system.DynArraySize(Pointer):Integer;
|
0049AE95 E82A8FF6FF call 00403DC4
0049AE9A 85C0 test eax, eax
0049AE9C 0F8E81000000 jle 0049AF23
0049AEA2 68368C0000 push $00008C36
0049AEA7 8D45EC lea eax, [ebp-$14]
0049AEAA 50 push eax
0049AEAB B985310000 mov ecx, $00003185
0049AEB0 BAD8030000 mov edx, $000003D8
0049AEB5 8B45F4 mov eax, [ebp-$0C]
|
0049AEB8 E847FBFFFF call 0049AA04
0049AEBD 8B55EC mov edx, [ebp-$14]
0049AEC0 8D45F4 lea eax, [ebp-$0C]
* Reference to: system.@LStrLAsg;
|
0049AEC3 E8148DF6FF call 00403BDC
0049AEC8 8D55E8 lea edx, [ebp-$18]
0049AECB 8B45F4 mov eax, [ebp-$0C]
|
0049AECE E8C1F9FFFF call 0049A894
0049AED3 8B45E8 mov eax, [ebp-$18]
0049AED6 8B55F0 mov edx, [ebp-$10]
* Reference to: system.@LStrCmp;------》这个函数是不是很好猜？
|
0049AED9 E8F68FF6FF call 00403ED4
0049AEDE 750C jnz 0049AEEC 判断是不是假码，不等就对了
0049AEE0 A1F0CA4A00 mov eax, dword ptr [$4ACAF0]
0049AEE5 8B00 mov eax, [eax]
* Reference to: forms.TApplication.Terminate(TApplication);相等就完蛋
|
0049AEE7 E85CFEFAFF call 0044AD48
0049AEEC 68368C0000 push $00008C36 从这里开始
0049AEF1 8D45E4 lea eax, [ebp-$1C]
0049AEF4 50 push eax
0049AEF5 B985310000 mov ecx, $00003185
0049AEFA BAD8030000 mov edx, $000003D8
0049AEFF 8B45F0 mov eax, [ebp-$10]
|
0049AF02 E8EDF8FFFF call 0049A7F4
0049AF07 8B55E4 mov edx, [ebp-$1C]
0049AF0A 8D45F0 lea eax, [ebp-$10]
* Reference to: system.@LStrLAsg;
|
0049AF0D E8CA8CF6FF call 00403BDC 到这里结束，算出真正的注册码(我很懒，
怕烦，只大概看了一下，好象和前面那个
假码有点关系，另算的20位码子）
0049AF12 8B45F0 mov eax, [ebp-$10]这里
0049AF15 8B55F0 mov edx, [ebp-$10]和这里就是真正要比较的东西
* Reference to: system.@LStrCmp;又看到熟面孔了
|
0049AF18 E8B78FF6FF call 00403ED4
0049AF1D 7504 jnz 0049AF23 不同就表示未注册
0049AF1F C645FF01 mov byte ptr [ebp-$01], $01相同就写上已注册标记
0049AF23 33C0 xor eax, eax
0049AF25 5A pop edx
0049AF26 59 pop ecx
0049AF27 59 pop ecx
0049AF28 648910 mov fs:[eax], edx
过程就是如此，很简单，我是用SMC解决这个问题的，具体怎么做，请参考精华III中mercury写的
大作，《SMC体会》一文，相信劳动得来的果实最香甜。谢谢看完。
hello!
