邮件巡捕 V1.62 两步曲破解法！（献给 QHJ－我的朋友） (9千字)
邮件巡捕 V1.62 两步曲破解法！（献给 QHJ－我的朋友）DOWNLOAD FROM: http://www.crackbest.com/chcrack/crack/CrEmailSpiderEasy162C.zip
软件简介：定向邮件地址收集专家。从任一网址或搜索引擎开始搜索提取邮件地址。演示版限制，搜索结果不能保存。
破解工具：TRW2000 V1.03 and W32DASM V8.93
PaulYoung 热力奉献。
★E-mail:paulyoung@yeah.net★
★ 2001.3.23 ★
★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★
☆ 一、首选用W32DASM反汇编邮件巡捕 V1.62。在“串式字符串参考”找到“注册失败”。如下所示：
* Possible StringData Ref from Data Obj ->"注册成功! "
|
:0040991C 682C154300 push 0043152C
:00409921 E867860100 call 00421F8D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409916(C)
|
:00409926 833D08B1430001 cmp dword ptr [0043B108], 00000001
:0040992D 750E jne 0040993D
:0040992F 6A00 push 00000000
:00409931 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"Thanks for Register! Good Luck "
->"Everyday!"
|
:00409933 6800154300 push 00431500
:00409938 E850860100 call 00421F8D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040992D(C)
|
:0040993D 8B5500 mov edx, dword ptr [ebp+00]
:00409940 8BCD mov ecx, ebp
:00409942 FF92C4000000 call dword ptr [edx+000000C4] *********
:00409948 EB78 jmp 004099C2 *********
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040990D(C)
|
:0040994A BE01000000 mov esi, 00000001
:0040994F 3BC6 cmp eax, esi
:00409951 753A jne 0040998D
:00409953 A108B14300 mov eax, dword ptr [0043B108]
:00409958 85C0 test eax, eax
:0040995A 750E jne 0040996A
:0040995C 6A00 push 00000000
:0040995E 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"注册成功! "
|
:00409960 682C154300 push 0043152C
:00409965 E823860100 call 00421F8D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040995A(C)
|
:0040996A 393508B14300 cmp dword ptr [0043B108], esi
:00409970 750E jne 00409980
:00409972 6A00 push 00000000
:00409974 6A00 push 00000000
* Possible StringData Ref from Data Obj ->" Thanks for Register!
The Max "
->"Urls Spidered Every Time limit "
->"to 200000!
Good Luck Everyday!"
|
:00409976 68A0144300 push 004314A0
:0040997B E80D860100 call 00421F8D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409970(C)
|
:00409980 8B4500 mov eax, dword ptr [ebp+00]
:00409983 8BCD mov ecx, ebp
:00409985 FF90C4000000 call dword ptr [eax+000000C4] ***********
:0040998B EB35 jmp 004099C2 ***********
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409951(C)
|
* Possible Reference to Dialog: DialogID_0064
|
* Possible Reference to Dialog: DialogID_7801, CONTROL_ID:0064, ""
|
:0040998D 6A64 push 00000064
* Reference To: KERNEL32.Sleep, Ord:0296h
|
:0040998F FF1590814200 Call dword ptr [00428190]
:00409995 A108B14300 mov eax, dword ptr [0043B108]
:0040999A 85C0 test eax, eax //eax=1，即成功，否则就跳
:0040999C 750E jne 004099AC //可以在0040998F处设断，在此下 r fl z z 使其不出现“注册失败”提示，继续 比较，也可以不改，确定“注册失败”继续比较。
:0040999E 6A00 push 00000000
:004099A0 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"注册失败! "
|
:004099A2 6894144300 push 00431494
:004099A7 E8E1850100 call 00421F8D ***********
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040999C(C)
|
:004099AC 393508B14300 cmp dword ptr [0043B108], esi ***********
:004099B2 750E jne 004099C2 ***********
:004099B4 6A00 push 00000000
:004099B6 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"Please Check your Register Code "
->"
Or Contact us to Register!"
|
:004099B8 6858144300 push 00431458
:004099BD E8CB850100 call 00421F8D
★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★
（以下是重点）
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409948(U), :0040998B(U), :004099B2(C)
|
:004099C2 6A00 push 00000000
:004099C4 8BCD mov ecx, ebp
:004099C6 E8965B0100 call 0041F561
:004099CB 8BCD mov ecx, ebp
:004099CD E8B03E0100 call 0041D882
:004099D2 8D4C2414 lea ecx, dword ptr [esp+14]
:004099D6 C68424C000000005 mov byte ptr [esp+000000C0], 05
:004099DE E8C7100100 call 0041AAAA
:004099E3 8D4C2420 lea ecx, dword ptr [esp+20] ********* （装有效地址，下同）
:004099E7 C68424C000000004 mov byte ptr [esp+000000C0], 04
:004099EF E8B6100100 call 0041AAAA
:004099F4 8D4C241C lea ecx, dword ptr [esp+1C] *********
:004099F8 C68424C000000003 mov byte ptr [esp+000000C0], 03
:00409A00 E8A5100100 call 0041AAAA
:00409A05 8D4C2410 lea ecx, dword ptr [esp+10] **********
:00409A09 C68424C000000002 mov byte ptr [esp+000000C0], 02
:00409A11 E894100100 call 0041AAAA
:00409A16 8D4C2418 lea ecx, dword ptr [esp+18] **********
:00409A1A C68424C000000001 mov byte ptr [esp+000000C0], 01
:00409A22 E883100100 call 0041AAAA
:00409A27 8D4C2424 lea ecx, dword ptr [esp+24]
:00409A2B C68424C000000000 mov byte ptr [esp+000000C0], 00
:00409A33 E872100100 call 0041AAAA
:00409A38 8D8C2494000000 lea ecx, dword ptr [esp+00000094]
:00409A3F C78424C00000001D000000 mov dword ptr [esp+000000C0], 0000001D
:00409A4A E85B100100 call 0041AAAA
:00409A4F 8D8C2490000000 lea ecx, dword ptr [esp+00000090]
:00409A56 C68424C00000001C mov byte ptr [esp+000000C0], 1C
:00409A5E E847100100 call 0041AAAA
:00409A63 8D8C248C000000 lea ecx, dword ptr [esp+0000008C]
:00409A6A C68424C00000001B mov byte ptr [esp+000000C0], 1B
:00409A72 E833100100 call 0041AAAA
:00409A77 8D8C2488000000 lea ecx, dword ptr [esp+00000088]
:00409A7E C68424C00000001A mov byte ptr [esp+000000C0], 1A
:00409A86 E81F100100 call 0041AAAA
:00409A8B 8D8C2484000000 lea ecx, dword ptr [esp+00000084]
:00409A92 C68424C000000019 mov byte ptr [esp+000000C0], 19
:00409A9A E80B100100 call 0041AAAA
:00409A9F 8D8C2480000000 lea ecx, dword ptr [esp+00000080]
:00409AA6 C68424C000000018 mov byte ptr [esp+000000C0], 18
:00409AAE E8F70F0100 call 0041AAAA
:00409AB3 8D4C247C lea ecx, dword ptr [esp+7C]
:00409AB7 C68424C000000017 mov byte ptr [esp+000000C0], 17
:00409ABF E8E60F0100 call 0041AAAA
:00409AC4 8D4C2478 lea ecx, dword ptr [esp+78]
:00409AC8 C68424C000000016 mov byte ptr [esp+000000C0], 16
:00409AD0 E8D50F0100 call 0041AAAA
:00409AD5 C68424C000000015 mov byte ptr [esp+000000C0], 15
☆ 二、在TRW2000 下bpx 004099E3，d ecx 再用ALT+↓拖动可看到假的序列号和真的序列号，下面的lea ecx,×××也可 d ecx 看到。不过会看到两个类似的序列号，其中一个是真的，共有连在一起的24个古怪字符。
:004099E7 C68424C000000004 mov byte ptr [esp+000000C0], 04
:004099EF E8B6100100 call 0041AAAA
:004099F4 8D4C241C lea ecx, dword ptr [esp+1C] ********* 此处也可设断点
:004099F8 C68424C000000003 mov byte ptr [esp+000000C0], 03
:00409A00 E8A5100100 call 0041AAAA
:00409A05 8D4C2410 lea ecx, dword ptr [esp+10] ********** 同上
:00409A09 C68424C000000002 mov byte ptr [esp+000000C0], 02
:00409A11 E894100100 call 0041AAAA
:00409A16 8D4C2418 lea ecx, dword ptr [esp+18] ********** 同上
.
.
.
（注：**********为重点）
如我的注册码为：
用户名：PaulYoung
邮件地址：paulyoung@yeah.net
注册码：|],upRX]b9#P@239|!`Q<qYW
在注册框的三个框内分别依次填入
|],upRX]
b9#P@239
|!`Q<qYW
注册成功！！！！！！
★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★
仅以此文献给广大破解爱好者以及 QHJ 兄，须知“长江后浪推前浪，一代新人胜旧人”，不要老是讥笑我！！！！
★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★
常到看雪破解论坛走一走，不会解来也会“偷”！
★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★
