《双星物语》单CD光盘版 (6千字)
* Reference To: KERNEL32.GetDriveTypeA, Ord:0104h|
:00408843 FF15FC304200 Call dword ptr [004230FC]
:00408849 83F805 cmp eax, 00000005 ;－> cmp eax,3
:0040884C 7565 jne 004088B3 ;如果改此处为 jz 004088b3
:0040884E 6A00 push 00000000 ;而不改上一句也是可以的，但是
:00408850 8D4C241C lea ecx, dword ptr [esp+1C] ;会读软驱，不知为何？
:00408854 6A00 push 00000000
:00408856 8D542424 lea edx, dword ptr [esp+24]
:0040885A 51 push ecx
:0040885B 52 push edx
:0040885C 6A00 push 00000000
:0040885E 8D842434020000 lea eax, dword ptr [esp+00000234]
:00408865 6804010000 push 00000104
:0040886A 8D4C2438 lea ecx, dword ptr [esp+38]
:0040886E 50 push eax
:0040886F 51 push ecx
:00408870 FFD5 call ebp
* Possible StringData Ref from Data Obj ->"ZWEI!!"
|
:00408872 BE3C894200 mov esi, 0042893C
:00408877 8D842420020000 lea eax, dword ptr [esp+00000220]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040889C(C)
|
:0040887E 8A10 mov dl, byte ptr [eax]
:00408880 8ACA mov cl, dl
:00408882 3A16 cmp dl, byte ptr [esi]
:00408884 751C jne 004088A2 ;-> jz 004088a2
:00408886 84C9 test cl, cl
:00408888 7414 je 0040889E
:0040888A 8A5001 mov dl, byte ptr [eax+01]
:0040888D 8ACA mov cl, dl
:0040888F 3A5601 cmp dl, byte ptr [esi+01]
:00408892 750E jne 004088A2 ;-> jz 004088a2 看来004088a2
:00408894 83C002 add eax, 00000002 ;是需光驱处
:00408897 83C602 add esi, 00000002
:0040889A 84C9 test cl, cl
:0040889C 75E0 jne 0040887E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408888(C)
|
:0040889E 33C0 xor eax, eax
:004088A0 EB05 jmp 004088A7
:004088A2 1BC0 sbb eax, eax
:004088A4 83D8FF sbb eax, FFFFFFFF
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004088A0(U)
|
:004088A7 85C0 test eax, eax
:004088A9 7508 jne 004088B3
:004088AB C744241401000000 mov [esp+14], 00000001
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040884C(C), :004088A9(C)
|
:004088B3 47 inc edi
:004088B4 83FF5C cmp edi, 0000005C
:004088B7 0F8C73FFFFFF jl 00408830
:004088BD 8B442414 mov eax, dword ptr [esp+14]
:004088C1 85C0 test eax, eax
:004088C3 7516 jne 004088DB
:004088C5 6A00 push 00000000
:004088C7 6834894200 push 00428934
:004088CC 6818894200 push 00428918
:004088D1 6A00 push 00000000
* Reference To: USER32.MessageBoxA, Ord:01BEh
|
:004088D3 FF15EC334200 Call dword ptr [004233EC]
:004088D9 EB58 jmp 00408933
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004088C3(C)
|
:004088DB 8B442410 mov eax, dword ptr [esp+10]
:004088DF 85C0 test eax, eax
:004088E1 7450 je 00408933
:004088E3 8B8424680A0000 mov eax, dword ptr [esp+00000A68]
:004088EA 83C9FF or ecx, FFFFFFFF
:004088ED 8D942424030000 lea edx, dword ptr [esp+00000324]
:004088F4 8B7808 mov edi, dword ptr [eax+08]
:004088F7 33C0 xor eax, eax
:004088F9 F2 repnz
:004088FA AE scasb
:004088FB F7D1 not ecx
:004088FD 2BF9 sub edi, ecx
:004088FF 8BC1 mov eax, ecx
:00408901 8BF7 mov esi, edi
:00408903 8BFA mov edi, edx
:00408905 8D942424030000 lea edx, dword ptr [esp+00000324]
:0040890C C1E902 shr ecx, 02
:0040890F F3 repz
:00408910 A5 movsd
:00408911 8BC8 mov ecx, eax
:00408913 A1E8F74200 mov eax, dword ptr [0042F7E8]
:00408918 83E103 and ecx, 00000003
:0040891B F3 repz
:0040891C A4 movsb
:0040891D 8D8C2424040000 lea ecx, dword ptr [esp+00000424]
:00408924 51 push ecx
:00408925 8B4808 mov ecx, dword ptr [eax+08]
:00408928 52 push edx
:00408929 6A00 push 00000000
:0040892B 51 push ecx
:0040892C FF542420 call [esp+20]
:00408930 83C410 add esp, 00000010
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004088D9(U), :004088E1(C)
|
:00408933 53 push ebx
* Reference To: KERNEL32.FreeLibrary, Ord:00B4h
|
:00408934 FF15BC304200 Call dword ptr [004230BC]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040880F(C)
|
:0040893A 8B15905E4300 mov edx, dword ptr [00435E90]
:00408940 8D842420010000 lea eax, dword ptr [esp+00000120]
:00408947 4A dec edx
:00408948 52 push edx
《双星物语》单CD光盘版
这是小弟第一次Crack，很幼稚吧！不过总算成功了。
但是我找不到在getdrivetypea后直接跳出光驱检测的方法，就是跳过光驱检测后的程序入口，请指教。
还有就是在:
00408849 83F805 cmp eax, 00000005 ;－> cmp eax,3
0040884C 7565 jne 004088B3
如果不改上一句，而改下一句，就会读软驱，但程序依然能运行，不知为何？
1，为何会读软驱？
2，为何程序依然会无需光驱？
