protection scheme (3千字)
这个玩意儿自己并未加壳，但是它会在运行时在windows的temp目录下生成一个临时文件，这个文件实际上是个已还原的DLL，然后它就用LoadLibraryA( )加载这个DLL，用这个DLL中的函数来检查日期和注册码。先要跳过它对SoftICE的检测：
1、用bpint 3设断点，看见它用SoftICE的BoundsChecker后门。这个是在EXE中进行的，可以直接patch，即把EBP的值改掉。
015F:0040582E MOV DWORD PTR [EBP-0168],4675446D
015F:00405838 MOV DWORD PTR [EBP-0148],04360C26
015F:00405842 MOV DWORD PTR [EBP-0164],00000000
015F:0040584C MOV DWORD PTR [EBP-04],00000000
015F:00405853 MOV [EBP-0164],EBP
015F:00405859 MOV EAX,[EBP-0148]
015F:0040585F XOR EAX,[EBP-0168]
015F:00405865 MOV EBP,EAX //改掉EBP的值即可
015F:00405867 MOV EAX,00000004
015F:0040586C INT 3
2、再用CreateFileA( )设断点，这下是在解出来的DLL中检测SoftICE，无法直接修改DLL文件。可以有两种策略，一是用process patcher，另外一种是等它在内存中解压出这个DLL后但是还未写入这个DLL之前将该DLL在内存中打补丁。
015F:10005BA3 PUSH EBX
015F:10005BA4 PUSH 00000080
015F:10005BA9 PUSH 03
015F:10005BAB PUSH EBX
015F:10005BAC PUSH 03
015F:10005BAE PUSH EBX
015F:10005BAF PUSH EAX
015F:10005BB0 CALL 10005C64
015F:10005BB5 POP ECX
015F:10005BB6 PUSH EAX
015F:10005BB7 CALL [KERNEL32!CreateFileA] //打开softICE
015F:10005BBD CMP EAX,-01
015F:10005BC0 JZ 10005BCB
015F:10005BC2 PUSH EAX
015F:10005BC3 CALL [KERNEL32!CloseHandle]
015F:10005BC9 JMP 10005BD6
015F:10005BCB CALL [KERNEL32!GetLastError]
015F:10005BD1 CMP EAX,02
015F:10005BD4 JZ 10005BDA
015F:10005BD6 MOV BYTE PTR [EBP-01],01 //Bad flag
015F:10005BDA MOV EAX,[ESI+04]
015F:10005BDD ADD ESI,04
015F:10005BE0 CMP EAX,EBX
015F:10005BE2 JNZ 10005BA3 //循环3次
015F:10005BE4 PUSH 1000D390
015F:10005BE9 CALL 10005C64
015F:10005BEE POP ECX
015F:10005BEF PUSH EAX
015F:10005BF0 CALL [KERNEL32!LoadLibraryA] //kernel32.dll
015F:10005BF6 MOV ESI,EAX
015F:10005BF8 CMP ESI,EBX
015F:10005BFA JZ 10005C24
015F:10005BFC PUSH 1000D37C
015F:10005C01 CALL 10005C64
015F:10005C06 POP ECX
015F:10005C07 PUSH EAX
015F:10005C08 PUSH ESI
015F:10005C09 CALL [KERNEL32!GetProcAddress]
015F:10005C0F CMP EAX,EBX
015F:10005C11 JZ 10005C1D
015F:10005C13 CALL EAX //调用IsDebugerPresent( )
015F:10005C15 TEST EAX,EAX
015F:10005C17 JZ 10005C1D
015F:10005C19 MOV BYTE PTR [EBP-01],01 //bad flag
015F:10005C1D PUSH ESI
015F:10005C1E CALL [KERNEL32!FreeLibrary]
015F:10005C24 CMP [EBP-01],BL
015F:10005C27 JZ 10005C5D //一定要跳
015F:10005C29 PUSH 00010010
015F:10005C2E PUSH EBX
015F:10005C2F PUSH EBX
015F:10005C30 PUSH EBX
015F:10005C31 PUSH EBX
015F:10005C32 PUSH EBX
015F:10005C33 PUSH EBX
015F:10005C34 PUSH EBX
015F:10005C35 PUSH EBX
015F:10005C36 PUSH EBX
015F:10005C37 PUSH 0F
015F:10005C39 CALL 100042B7 //导致非法操作的指令
015F:10005C3E ADD ESP,28
015F:10005C41 PUSH EAX
015F:10005C42 PUSH EBX
015F:10005C43 PUSH EBX
015F:10005C44 PUSH EBX
015F:10005C45 PUSH EBX
015F:10005C46 PUSH EBX
015F:10005C47 PUSH EBX
015F:10005C48 PUSH EBX
015F:10005C49 PUSH EBX
015F:10005C4A PUSH EBX
015F:10005C4B PUSH 03
015F:10005C4D CALL 100042B7
015F:10005C52 ADD ESP,28
015F:10005C55 PUSH EAX
015F:10005C56 PUSH EBX
015F:10005C57 CALL [USER32!MessageBoxA]
015F:10005C5D MOV AL,[EBP-01] //一定要返回0才行
015F:10005C60 POP ESI
015F:10005C61 POP EBX
015F:10005C62 LEAVE
015F:10005C63 RET
至于注册码，不懂点密码学是绝对搞不定的！
