如何破解lockdown2000 v7.0.0.6(补) (4千字)
如何破解lockdown2000 v7.0.0.6(补)-----------------------------
雪椰
2001,01,03pm
Http://wocy.yeah.net(有本例中的补丁）
------------------------------
这个补丁的不完全不解，在我主页上，感觉不好。刚好今天有空，搞定它。
1,
软件用aspack加壳，先脱壳
2，
前面的7006补丁会出现连上服务器验证。失败后提示信息->
"LockDown 2000 has detected that you are running an unauthorized copy..."
(也可根据楼上那位根据 http://www.lockdown2000.com/order_now.html)
you will go to ...
-------------------------------------
* Possible StringData Ref from Code Obj ->"LockDown 2000 has detected that "
->"you are running an unauthorized "
->"copy.
Licenses are purchased "
->"on a per computer basis.
If you "
->"believe you are seeing this message "
->"in error or would like to purchase "
->"a license for this computer, please "
->"visit:
http://www.lockdown2000.com/
or "
->"call:
(800)422-5130 or (603)740-4590"
|
:004D739C B85C754D00 mov eax, 004D755C
:004D73A1 E83EF6F7FF call 004569E4
:004D73A6 C6059481610001 mov byte ptr [00618194], 01
:004D73AD 8B45FC mov eax, dword ptr [ebp-04]
:004D73B0 E8D351F7FF call 0044C588
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004D7356(C) -----------------》(c)
|
:004D73B5 E8F2C3F2FF call 004037AC
---------------------------------------------
Retrance (C) it to.....
:004D72C8 E883BDF2FF call 00403050
:004D72CD 84DB test bl, bl
:004D72CF 0F85EC000000 jne 004D73C1 ----------->point (1)
:004D72D5 803DA481610000 cmp byte ptr [006181A4], 00
:004D72DC 740D je 004D72EB
:004D72DE 803D08CB4D0000 cmp byte ptr [004DCB08], 00
:004D72E5 0F84D6000000 je 004D73C1 ----------->jmp exit point.
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004D72DC(C)
|
:004D72EB 803D08CB4D0000 cmp byte ptr [004DCB08], 00
:004D72F2 7510 jne 004D7304
:004D72F4 8B45FC mov eax, dword ptr [ebp-04]
:004D72F7 E8C4030000 call 004D76C0
:004D72FC 84C0 test al, al
:004D72FE 0F84BD000000 je 004D73C1
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004D72F2(C)
|
:004D7304 803D0CCB4D0000 cmp byte ptr [004DCB0C], 00
:004D730B 0F85B0000000 jne 004D73C1
:004D7311 C6050CCB4D0001 mov byte ptr [004DCB0C], 01
:004D7318 33C0 xor eax, eax
:004D731A 55 push ebp
:004D731B 683E734D00 push 004D733E
:004D7320 64FF30 push dword ptr fs:[eax]
:004D7323 648920 mov dword ptr fs:[eax], esp
:004D7326 8B45FC mov eax, dword ptr [ebp-04]
:004D7329 8B80D0050000 mov eax, dword ptr [eax+000005D0]
:004D732F E8B0C3FDFF call 004B36E4
:004D7334 33C0 xor eax, eax
:004D7336 5A pop edx
:004D7337 59 pop ecx
:004D7338 59 pop ecx
:004D7339 648910 mov dword ptr fs:[eax], edx
:004D733C EB7C jmp 004D73BA
:004D733E E9B9C1F2FF jmp 004034FC
:004D7343 8B45FC mov eax, dword ptr [ebp-04]
:004D7346 8B80D0050000 mov eax, dword ptr [eax+000005D0]
:004D734C 81B8A040000091010000 cmp dword ptr [eax+000040A0], 00000191
:004D7356 755D jne 004D73B5 ------->not equ ,jump (c)
----------------------------------------------------------------------------
3,Modify point (1) :jmp xxxxx(exit point)
0f 85 ec
e9 ed 00
4,还有下面几个点有校验
4d868c
4d8c2d
4d91ca
4d9769
同上
4d9cb3
4da1de
这两个不太一样
80 3d a4 81 61
e9 e7 00 00 00
5,all clear.
