。先在这里贴上俺的破解方法。各位请扔砖头。 (2千字)
暴力破解WinRAR4.80b4。不知对否。TRW2000下bpm 473B04，看看改成01后会如何。
* Reference To: KERNEL32.GetLocalTime, Ord:0000h
|
:0042B713 E81CC80300 Call 00467F34
:0042B718 33C0 xor eax, eax
:0042B71A E8D9A0FEFF call 004157F8 <------- 进去看看。
:0042B71F A2043B4700 mov byte ptr [00473B04], al <----- 需要al=01，否则没有注册。
:0042B724 33C0 xor eax, eax
:0042B726 E9230D0000 jmp 0042C44E
* Referenced by a CALL at Addresses:
|:0042B71A , :00433D68 , :004346FB
|
:004157F8 55 push ebp
.
.
.
* Possible StringData Ref from Data Obj ->"rarreg.*"
|
:0041581C B82D9B4600 mov eax, 00469B2D
:00415821 E8683DFFFF call 0040958E
:00415826 84C0 test al, al
:00415828 7511 jne 0041583B
:0041582A 33C0 xor eax, eax <--------- 改为 mov al, 01 (33C0改为B001)
:0041582C 8B55A4 mov edx, dword ptr [ebp-5C]
:0041582F 64891500000000 mov dword ptr fs:[00000000], edx
:00415836 E970040000 jmp 00415CAB
.
.
.
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415836(U), :0041588C(U), :00415985(U), :004159CC(U), :00415B20(U)
|:00415BAF(U), :00415C16(U), :00415C8A(U)
|
:00415CAB 5F pop edi
:00415CAC 5E pop esi
:00415CAD 5B pop ebx
:00415CAE 8BE5 mov esp, ebp
:00415CB0 5D pop ebp
:00415CB1 C3 ret
还有一处，否则运行某些功能时还是会变为40 days trial copy的：
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004248A3(C)
|
:004248CB 803D043B470000 cmp byte ptr [00473B04], 00
:004248D2 7410 je 004248E4
:004248D4 803D0035470000 cmp byte ptr [00473500], 00
:004248DB 7507 jne 004248E4
:004248DD C605043B470000 mov byte ptr [00473B04], 00 <---- 需将01放入。
应该可以了。如若不行，请诸位告知，谢谢。
