温柔一点，好吗？——暴破pt的另一种方法 (2千字)
温柔一点，好吗？——暴破pt的另一种方法目标：Performance Test v3.4 build 1000，以下简称pt。
工具：w32dasm8.93,trw1.22
运行pt，看about框，有'Evaluation version'字样。
用w32dasm反汇编pt.ext，找Evaluation version，找到如下
* Referenced by a CALL at Addresses:
|:004096D2 , :0040990D
|
:00408680 A148194400 mov eax, dword ptr [00441948]；若不为0就显示Evaluation version
:00408685 85C0 test eax, eax
:00408687 7527 jne 004086B0
:00408689 6840704300 push 00437040
* Possible StringData Ref from Data Obj ->"V3.4"
|
:0040868E 687C614200 push 0042617C
* Possible StringData Ref from Data Obj ->"PerformanceTest"
|
:00408693 68CC684200 push 004268CC
* Possible StringData Ref from Data Obj ->"%s %s"
|
:00408698 68D8944200 push 004294D8
:0040869D 6830184400 push 00441830
:004086A2 E8D9C30000 call 00414A80
:004086A7 83C414 add esp, 00000014
:004086AA B830184400 mov eax, 00441830
:004086AF C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408687(C)
|
* Possible StringData Ref from Data Obj ->"Evaluation version"
|
:004086B0 68C4944200 push 004294C4
现在只要找到程序中把[441948]置0的地方，我是这样做的，在w32dasm的Disassembler菜单中选Save Disassemble text file and create project file，保存结果为pt.alf。然后用写字板打开pt.alf，找481944，找到下面这一段
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E3FC(C)
|
:0040E40D 8BFE mov edi, esi
:0040E40F 83C9FF or ecx, FFFFFFFF
:0040E412 33C0 xor eax, eax
:0040E414 F2 repnz
:0040E415 AE scasb
:0040E416 F7D1 not ecx
:0040E418 49 dec ecx
:0040E419 83F903 cmp ecx, 00000003
:0040E41C 7244 jb 0040E462 ；把这一句改为 eb0f jmp 40e42d
^^^^ 就是注册版了。
:0040E41E 837B74FF cmp dword ptr [ebx+74], FFFFFFFF
:0040E422 753E jne 0040E462
:0040E424 80BB8000000037 cmp byte ptr [ebx+00000080], 37
:0040E42B 7535 jne 0040E462
:0040E42D C7054819440000000000 mov dword ptr [00441948], 0 ；在这里把[441948]置0。
^^^^^^
还有一点，程序启动时会先出现一个小窗口，等好长时间才能进入主窗口，好烦哪！
运行TRW，load pt.exe，下bpx sleep，找到下面（用w32dasm找sleep也一样）
0167:00409547 68DC050000 PUSH DWORD 05DC ；改为 6800000000 push dword 0
^^^^ 少睡点吧！
0167:0040954C FF1528314200 CALL `KERNEL32!Sleep`
