破解心得之CDRWin 4.0A BETA篇（续） (24千字)
破解心得之CDRWin 4.0A BETA篇（续）
破解工具：W32DASM v8.93白金版汉化版、TRW2000 v1.23注册版
软件名称：CDRWin
发布公司：Golden Hawk Technology
最新版本：4.0A Beta
操作系统：Win9x/ME/NT4/2000
软件简介：CDRWin 是一套强力的特点极多的刻录软件，它可以：支持 AUDIO、CDROM (Mode1)、CDROM-XA (Mode2)、CD-I、混合型、多重扇区盘片；独有的
CUE SHEET 语言可以 100% 定制盘片的布局，避免其他刻录软件在不同 track 之间产生间隔的现象；强大的备份功能可以防止盘片上原有数据的损失；符合
ISO9660 磁盘控制标准；可以制作光盘启动盘；支持 Karaoke CD G 盘片（需要Sony CDW-900E, Panasonic 或
Yamaha 刻录机）；仅有的支持 Philips/Kodak/HP 家族刻录机 Disc-at-once 技术的软件；支持盘片的 UPC 码和
track 的 ISRC 码；支持“Kodak Disc Transporter”高速盘片复制技术。
但是我高兴的太早了，输入后的确注册成功，然而在退出软件重新运行时，弹出了一个窗口，大意是说我是通过非法手段注册的（气死我了，我的注册机已经写好了，看来我又要重新写了！55555……）。继续祭出我们的两大法宝TRW2000和W32DASM搞定它。
在上一节这么一段代码如下：
* Referenced by a CALL at Addresses:
|:004242D8 , :004243BE <==这里有两个调用该CALL的地址，其中:004243BE是上一节用过的，那么剩下的
|
就应该是启动时用到的
:004248B0 8B44240C
mov eax, dword ptr [esp+0C]
:004248B4 8B542404
mov edx, dword ptr [esp+04]
:004248B8 53
push ebx
:004248B9 55
push ebp
:004248BA 8B18
mov ebx, dword ptr [eax] <--ebx=54321
:004248BC 57
push edi
:004248BD 8BFA
mov edi, edx
:004248BF 83C9FF
or ecx, FFFFFFFF
:004248C2 33C0
xor eax, eax
:004248C4 F2
repnz
:004248C5 AE
scasb
:004248C6 F7D1
not ecx
:004248C8 49
dec ecx
:004248C9 83F906
cmp ecx, 00000006
<--检查name的长度是否大于等于6，
:004248CC 726B
jb 00424939
name的长度应该>=6
:004248CE 8B6C2414
mov ebp, dword ptr [esp+14]
:004248D2 83C9FF
or ecx, FFFFFFFF
:004248D5 8BFD
mov edi, ebp
:004248D7 F2
repnz
:004248D8 AE
scasb
:004248D9 F7D1
not ecx
:004248DB 49
dec ecx
:004248DC 83F906
cmp ecx, 00000006 <--检查company的长度是否大于等于6,
:004248DF 7258
jb 00424939
company的长度应该>=6
:004248E1 F7C3FFFF0000 test ebx,
0000FFFF
:004248E7 7450
je 00424939
:004248E9 F7C30000FFFF test ebx,
FFFF0000
:004248EF 7448
je 00424939
:004248F1 56
push esi
:004248F2 6A02
push 00000002
:004248F4 52
push edx
:004248F5 E846000000 call
00424940 <--按F8进入
:004248FA 6A02
push 00000002
:004248FC 55
push ebp
:004248FD 8BF0
mov esi, eax
:004248FF E83C000000 call
00424940 <--按F8进入
:00424904 8BC8
mov ecx, eax
:00424906 8BD0
mov edx, eax
:00424908 81E10000FF00 and ecx,
00FF0000
:0042490E 83C410
add esp, 00000010
:00424911 C1EA10
shr edx, 10
:00424914 0BCA
or ecx, edx
:00424916 8BD0
mov edx, eax
:00424918 81E200FF0000 and edx,
0000FF00
:0042491E C1E010
shl eax, 10
:00424921 0BD0
or edx, eax
:00424923 33C0
xor eax, eax
:00424925 C1E908
shr ecx, 08
:00424928 C1E208
shl edx, 08
:0042492B 0BCA
or ecx, edx
:0042492D 33CE
xor ecx, esi
:0042492F 5E
pop esi
:00424930 3BCB
cmp ecx, ebx
:00424932 5F
pop edi
:00424933 5D
pop ebp
:00424934 5B
pop ebx
:00424935 0F94C0
sete al
:00424938 C3
ret
因此用TRW2000载入它后设置断点BPX 004242D8，按F5继续执行，程序会被拦下，然后按F10单步执行。
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042416A(C)
|
:004242C9 6820DD4A00 push
004ADD20
:004242CE 68F0DB4A00 push
004ADBF0
:004242D3 68B0DB4A00 push
004ADBB0
:004242D8 E8D3050000 call
004248B0 <--程序会在这里被拦下，然后按F10单步执行
:004242DD 83C40C
add esp, 0000000C
:004242E0 85C0
test eax, eax
:004242E2 7510
jne 004242F4 <--会跳转
:004242E4 50
push eax
:004242E5 50
push eax
:004242E6 50
push eax
:004242E7 6836FFFFFF push
FFFFFF36
:004242EC E8AF370000 call
00427AA0
:004242F1 83C410
add esp, 00000010
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004242E2(C)
|
:004242F4 A124DD4A00 mov
eax, dword ptr [004ADD24]
:004242F9 56
push esi
:004242FA 8B3520DD4A00 mov esi,
dword ptr [004ADD20]
:00424300 C1EE10
shr esi, 10
:00424303 33F0
xor esi, eax
:00424305 81E6FFFF0000 and esi,
0000FFFF
:0042430B 8D46F1
lea eax, dword ptr [esi-0F]
:0042430E 3DBC040000 cmp
eax, 000004BC
:00424313 7E13
jle 00424328 <--会跳转
:00424315 6A00
push 00000000
:00424317 6A00
push 00000000
:00424319 6A00
push 00000000
:0042431B 6834FFFFFF push
FFFFFF34
:00424320 E87B370000 call
00427AA0
:00424325 83C410
add esp, 00000010
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424313(C)
|
:00424328 83C60F
add esi, 0000000F
:0042432B 81FEBC040000 cmp esi,
000004BC
:00424331 5E
pop esi
:00424332 7D13
jge 00424347 <--会跳转
:00424334 6A00
push 00000000
:00424336 6A00
push 00000000
:00424338 6A00
push 00000000
:0042433A 6835FFFFFF push
FFFFFF35
:0042433F E85C370000 call
00427AA0
:00424344 83C410
add esp, 00000010
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424332(C)
|
:00424347 6820DD4A00 push
004ADD20
:0042434C E89F060000 call
004249F0 <--在这里按F8进入
:00424351 83C404
add esp, 00000004
:00424354 C705ECDE4A0001000000 mov dword ptr [004ADEEC], 00000001
进入后会到这里：
* Referenced by a CALL at Addresses:
|:0042434C , :00424425
|
:004249F0 81EC50020000 sub esp,
00000250
:004249F6 53
push ebx
:004249F7 B9947BECBE mov
ecx, BEEC7B94 <--BEEC7B94和下一个的6962423E均为u4的黑名单
:004249FC B83E426269 mov
eax, 6962423E
:00424A01 56
push esi
:00424A02 57
push edi
:00424A03 C7442414F219749C mov [esp+14], 9C7419F2
<--9C7419F2和以下的也是黑名单
:00424A0B C7442418026BCB74 mov [esp+18], 74CB6B02
:00424A13 C744241C6BE1237B mov [esp+1C], 7B23E16B
:00424A1B C744242087F1202E mov [esp+20], 2E20F187
:00424A23 C7442424E3BD575B mov [esp+24], 5B57BDE3
:00424A2B C7442428CB5E95FF mov [esp+28], FF955ECB
:00424A33 C744242C0F362704 mov [esp+2C], 0427360F
:00424A3B C7442430991AD3FC mov [esp+30], FCD31A99
:00424A43 C74424341F907CFA mov [esp+34], FA7C901F
:00424A4B C74424383096C30F mov [esp+38], 0FC39630
:00424A53 C744243C8876E44A mov [esp+3C], 4AE47688
:00424A5B C7442440207B6B77 mov [esp+40], 776B7B20
:00424A63 C7442444379F82C6 mov [esp+44], C6829F37
:00424A6B C7442448BD9B4A53 mov [esp+48], 534A9BBD
:00424A73 C744244C6E4AD346 mov [esp+4C], 46D34A6E
:00424A7B C74424508F31A8A7 mov [esp+50], A7A8318F
:00424A83 C7442454B6FF065E mov [esp+54], 5E06FFB6
:00424A8B C74424581040B78F mov [esp+58], 8FB74010
:00424A93 C744245C9B0083D9 mov [esp+5C], D983009B
:00424A9B C7442460F77F1105 mov [esp+60], 05117FF7
:00424AA3 C74424641889E956 mov [esp+64], 56E98918
:00424AAB C744246865F557DA mov [esp+68], DA57F565
:00424AB3 C744246CA340DE10 mov [esp+6C], 10DE40A3
:00424ABB C74424706D611D09 mov [esp+70], 091D616D
:00424AC3 C744247440F1DECF mov [esp+74], CFDEF140
:00424ACB C7442478C0CB2B0A mov [esp+78], 0A2BCBC0
:00424AD3 C744247CB437E178 mov [esp+7C], 78E137B4
:00424ADB C784248000000086B1D7CC mov dword ptr [esp+00000080], CCD7B186
:00424AE6 C78424840000002B400C9A mov dword ptr [esp+00000084], 9A0C402B
:00424AF1 C7842488000000CF24DEBE mov dword ptr [esp+00000088], BEDE24CF
:00424AFC C784248C0000004C0464E4 mov dword ptr [esp+0000008C], E464044C
:00424B07 C78424900000009F3DCD1C mov dword ptr [esp+00000090], 1CCD3D9F
:00424B12 C7842494000000C4F3FC0C mov dword ptr [esp+00000094], 0CFCF3C4
:00424B1D C78424980000005B6632E8 mov dword ptr [esp+00000098], E832665B
:00424B28 C784249C0000009573EABD mov dword ptr [esp+0000009C], BDEA7395
:00424B33 C78424A0000000AE960F86 mov dword ptr [esp+000000A0], 860F96AE
:00424B3E C78424A4000000EA0DE039 mov dword ptr [esp+000000A4], 39E00DEA
:00424B49 C78424A8000000702C89D2 mov dword ptr [esp+000000A8], D2892C70
:00424B54 C78424AC0000003B07435E mov dword ptr [esp+000000AC], 5E43073B
:00424B5F C78424B000000010925172 mov dword ptr [esp+000000B0], 72519210
:00424B6A C78424B4000000C856D743 mov dword ptr [esp+000000B4], 43D756C8
:00424B75 C78424B80000003BD6A585 mov dword ptr [esp+000000B8], 85A5D63B
:00424B80 898C24BC000000 mov dword ptr
[esp+000000BC], ecx
:00424B87 898424C0000000 mov dword ptr
[esp+000000C0], eax
:00424B8E C78424C4000000BCF1F1C4 mov dword ptr [esp+000000C4], C4F1F1BC
:00424B99 C78424C8000000B210BD6F mov dword ptr [esp+000000C8], 6FBD10B2
:00424BA4 C78424CC0000007150FCF2 mov dword ptr [esp+000000CC], F2FC5071
:00424BAF C78424D0000000A1AA5BF8 mov dword ptr [esp+000000D0], F85BAAA1
:00424BBA C78424D400000089E541A2 mov dword ptr [esp+000000D4], A241E589
:00424BC5 C78424D8000000E48ECBDD mov dword ptr [esp+000000D8], DDCB8EE4
:00424BD0 C78424DC000000F629A74C mov dword ptr [esp+000000DC], 4CA729F6
:00424BDB C78424E0000000115A059C mov dword ptr [esp+000000E0], 9C055A11
:00424BE6 C78424E400000086A0B24A mov dword ptr [esp+000000E4], 4AB2A086
:00424BF1 C78424E80000008FA4D3E3 mov dword ptr [esp+000000E8], E3D3A48F
:00424BFC C78424EC00000096878DCC mov dword ptr [esp+000000EC], CC8D8796
:00424C07 C78424F0000000B0F80B64 mov dword ptr [esp+000000F0], 640BF8B0
:00424C12 C78424F4000000FEDE03F4 mov dword ptr [esp+000000F4], F403DEFE
:00424C1D C78424F80000004EEA5B65 mov dword ptr [esp+000000F8], 655BEA4E
:00424C28 C78424FC000000791A49AE mov dword ptr [esp+000000FC], AE491A79
:00424C33 C7842400010000CA0708EE mov dword ptr [esp+00000100], EE0807CA
:00424C3E C78424040100004AC3A72E mov dword ptr [esp+00000104], 2EA7C34A
:00424C49 C784240801000077D0E14F mov dword ptr [esp+00000108], 4FE1D077
:00424C54 C784240C0100009C2FA21A mov dword ptr [esp+0000010C], 1AA22F9C
:00424C5F C7842410010000A19D120D mov dword ptr [esp+00000110], 0D129DA1
:00424C6A C7842414010000F5E9DAA3 mov dword ptr [esp+00000114], A3DAE9F5
:00424C75 C784241801000060571A3C mov dword ptr [esp+00000118], 3C1A5760
:00424C80 C784241C0100001AE50B72 mov dword ptr [esp+0000011C], 720BE51A
:00424C8B C7842420010000F4FFADF0 mov dword ptr [esp+00000120], F0ADFFF4
:00424C96 C78424240100004D955A7F mov dword ptr [esp+00000124], 7F5A954D
:00424CA1 C784242801000027E4CADF mov dword ptr [esp+00000128], DFCAE427
:00424CAC C784242C010000D4F3A51C mov dword ptr [esp+0000012C], 1CA5F3D4
:00424CB7 C78424300100003EADE8D6 mov dword ptr [esp+00000130], D6E8AD3E
:00424CC2 C78424340100002CB7896E mov dword ptr [esp+00000134], 6E89B72C
:00424CCD C78424380100000C22B146 mov dword ptr [esp+00000138], 46B1220C
:00424CD8 C784243C0100004C30F574 mov dword ptr [esp+0000013C], 74F5304C
:00424CE3 C7842440010000E46A51A9 mov dword ptr [esp+00000140], A9516AE4
:00424CEE 8BB42460020000 mov esi, dword
ptr [esp+00000260]
:00424CF5 898C242C020000 mov dword ptr
[esp+0000022C], ecx
:00424CFC 89842430020000 mov dword ptr
[esp+00000230], eax
:00424D03 33FF
xor edi, edi
:00424D05 8B16
mov edx, dword ptr [esi]
:00424D07 C78424440100000007F858 mov dword ptr [esp+00000144], 58F80700
:00424D12 C78424480100007A2E6396 mov dword ptr [esp+00000148], 96632E7A
:00424D1D C784244C010000ED92EA4C mov dword ptr [esp+0000014C], 4CEA92ED
:00424D28 C7842450010000A3747F7A mov dword ptr [esp+00000150], 7A7F74A3
:00424D33 C7842454010000D4E5B9BC mov dword ptr [esp+00000154], BCB9E5D4
:00424D3E C7842458010000ED132F38 mov dword ptr [esp+00000158], 382F13ED
:00424D49 C784245C010000708F3F52 mov dword ptr [esp+0000015C], 523F8F70
:00424D54 C78424600100003C09796F mov dword ptr [esp+00000160], 6F79093C
:00424D5F C7842464010000C26B3CEB mov dword ptr [esp+00000164], EB3C6BC2
:00424D6A C7842468010000B85CD5BC mov dword ptr [esp+00000168], BCD55CB8
:00424D75 C784246C01000033D74E1B mov dword ptr [esp+0000016C], 1B4ED733
:00424D80 C7842470010000D9BB22F1 mov dword ptr [esp+00000170], F122BBD9
:00424D8B C78424740100004E80F4C7 mov dword ptr [esp+00000174], C7F4804E
:00424D96 C78424780100006ADA3DFD mov dword ptr [esp+00000178], FD3DDA6A
:00424DA1 C784247C010000BB6B47F9 mov dword ptr [esp+0000017C], F9476BBB
:00424DAC C7842480010000563242A5 mov dword ptr [esp+00000180], A5423256
:00424DB7 C78424840100002F33ADEC mov dword ptr [esp+00000184], ECAD332F
:00424DC2 C784248801000015635500 mov dword ptr [esp+00000188], 00556315
:00424DCD C784248C010000279EA928 mov dword ptr [esp+0000018C], 28A99E27
:00424DD8 C7842490010000C3D7A0D9 mov dword ptr [esp+00000190], D9A0D7C3
:00424DE3 C78424940100006EAF16C0 mov dword ptr [esp+00000194], C016AF6E
:00424DEE C784249801000053A1ACB6 mov dword ptr [esp+00000198], B6ACA153
:00424DF9 C784249C010000F311FF1B mov dword ptr [esp+0000019C], 1BFF11F3
:00424E04 C78424A00100007FFA4A11 mov dword ptr [esp+000001A0], 114AFA7F
:00424E0F C78424A40100002680190E mov dword ptr [esp+000001A4], 0E198026
:00424E1A C78424A801000009990021 mov dword ptr [esp+000001A8], 21009909
:00424E25 C78424AC010000D1A8A14D mov dword ptr [esp+000001AC], 4DA1A8D1
:00424E30 C78424B0010000ED000012 mov dword ptr [esp+000001B0], 120000ED
:00424E3B C78424B40100006A274114 mov dword ptr [esp+000001B4], 1441276A
:00424E46 C78424B8010000182975CE mov dword ptr [esp+000001B8], CE752918
:00424E51 C78424BC010000DC9DF7D8 mov dword ptr [esp+000001BC], D8F79DDC
:00424E5C C78424C00100009938A35C mov dword ptr [esp+000001C0], 5CA33899
:00424E67 C78424C4010000F2C0A635 mov dword ptr [esp+000001C4], 35A6C0F2
:00424E72 C78424C80100003BA6FC5D mov dword ptr [esp+000001C8], 5DFCA63B
:00424E7D C78424CC010000616CF549 mov dword ptr [esp+000001CC], 49F56C61
:00424E88 C78424D0010000F5D34ADD mov dword ptr [esp+000001D0], DD4AD3F5
:00424E93 C78424D4010000F9F39E77 mov dword ptr [esp+000001D4], 779EF3F9
:00424E9E C78424D801000093A56641 mov dword ptr [esp+000001D8], 4166A593
:00424EA9 C78424DC010000FBB547C8 mov dword ptr [esp+000001DC], C847B5FB
:00424EB4 C78424E0010000996E1682 mov dword ptr [esp+000001E0], 82166E99
:00424EBF C78424E4010000C1483A70 mov dword ptr [esp+000001E4], 703A48C1
:00424ECA C78424E8010000B05B00BF mov dword ptr [esp+000001E8], BF005BB0
:00424ED5 C78424EC0100008AE26E87 mov dword ptr [esp+000001EC], 876EE28A
:00424EE0 C78424F0010000FDC18C7D mov dword ptr [esp+000001F0], 7D8CC1FD
:00424EEB C78424F4010000E1C1329B mov dword ptr [esp+000001F4], 9B32C1E1
:00424EF6 C78424F8010000C5CEDF41 mov dword ptr [esp+000001F8], 41DFCEC5
:00424F01 C78424FC010000858A0B0F mov dword ptr [esp+000001FC], 0F0B8A85
:00424F0C C7842400020000A8F7B49B mov dword ptr [esp+00000200], 9BB4F7A8
:00424F17 C78424040200006F9BA29A mov dword ptr [esp+00000204], 9AA29B6F
:00424F22 C7842408020000DDCF7D82 mov dword ptr [esp+00000208], 827DCFDD
:00424F2D C784240C020000810829FE mov dword ptr [esp+0000020C], FE290881
:00424F38 C7842410020000D344D0EB mov dword ptr [esp+00000210], EBD044D3
:00424F43 C784241402000045621FF7 mov dword ptr [esp+00000214], F71F6245
:00424F4E C784241802000081DB5AF0 mov dword ptr [esp+00000218], F05ADB81
:00424F59 C784241C02000011E4F0AB mov dword ptr [esp+0000021C], ABF0E411
:00424F64 C7842420020000DFD567EB mov dword ptr [esp+00000220], EB67D5DF
:00424F6F C78424240200006F404C30 mov dword ptr [esp+00000224], 304C406F
:00424F7A C78424280200001941279A mov dword ptr [esp+00000228], 9A274119
:00424F85 C7842434020000C50A9410 mov dword ptr [esp+00000234], 10940AC5
:00424F90 C7842438020000FD37B872 mov dword ptr [esp+00000238], 72B837FD
:00424F9B C784243C0200008BE00FAE mov dword ptr [esp+0000023C], AE0FE08B
:00424FA6 C784244002000058050368 mov dword ptr [esp+00000240], 68030558
:00424FB1 C7842444020000F6F6D1C8 mov dword ptr [esp+00000244], C8D1F6F6
:00424FBC C7842448020000E41606BD mov dword ptr [esp+00000248], BD0616E4
:00424FC7 C784244C0200005B5FC673 mov dword ptr [esp+0000024C], 73C65F5B
:00424FD2 C78424500200006288114A mov dword ptr [esp+00000250], 4A118862
:00424FDD C7842454020000FA38D8DA mov dword ptr [esp+00000254], DAD838FA
:00424FE8 C7842458020000445C278A mov dword ptr [esp+00000258], 8A275C4
:00424FF3 C744240C6A1A9E5C mov [esp+0C], 5C9E1A6A
:00424FFB C7442410144043EF mov [esp+10], EF434014
:00425003 33C9
xor ecx, ecx
:00425005 8D442418
lea eax, dword ptr [esp+18]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042501C(C)
|
:00425009 8B18
mov ebx, dword ptr [eax]
:0042500B 81F390AD34B8 xor ebx,
B834AD90
:00425011 3BD3
cmp edx, ebx
:00425013 7434
je 00425049
:00425015 83C008
add eax, 00000008
:00425018 41
inc ecx
:00425019 83F949
cmp ecx, 00000049
:0042501C 7CEB
jl 00425009
:0042501E 33C9
xor ecx, ecx
:00425020 8D442410
lea eax, dword ptr [esp+10]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425037(C)
|
:00425024 8B30
mov esi, dword ptr [eax]
:00425026 81F690AD34B8 xor esi,
B834AD90
:0042502C 3BD6
cmp edx, esi
:0042502E 740F
je 0042503F
:00425030 83C008
add eax, 00000008
:00425033 41
inc ecx
:00425034 83F901
cmp ecx, 00000001
:00425037 7CEB
jl 00425024
:00425039 893D30514A00 mov dword
ptr [004A5130], edi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042502E(C)
|
:0042503F 5F
pop edi
:00425040 5E
pop esi
:00425041 5B
pop ebx
:00425042 81C450020000 add esp,
00000250
:00425048 C3
ret
呵呵！这些黑名单还真不少啊，希望你的不会在此之列！继续按F10经过两个ret后会来到如下地方：
* Possible StringData Ref from Data Obj ->"CDRWIN.DAT"
|
:004034E6 68CC124A00 push
004A12CC
:004034EB C645FC01
mov [ebp-04], 01
:004034EF E83C0C0200 call
00424130
:004034F4 83C40C
add esp, 0000000C <--来到这里
:004034F7 895DFC
mov dword ptr [ebp-04], ebx
:004034FA E8711B0200 call
00425070 <--按F8进入
:004034FF 85C0
test eax, eax
:00403501 7542
jne 00403545 <--一定要跳转，否则就弹出了那讨厌的窗口
:00403503 53
push ebx
:00403504 8D4D88
lea ecx, dword ptr [ebp-78]
:00403507 E834F60000 call
00412B40
:0040350C 8D4D88
lea ecx, dword ptr [ebp-78]
:0040350F C645FC03
mov [ebp-04], 03
:00403513 E8CA5A0600 call
00468FE2
:00403518 8D4D88
lea ecx, dword ptr [ebp-78]
:0040351B 885DFC
mov byte ptr [ebp-04], bl
:0040351E E800570600 call
00468C23
:00403523 8D4DEC
lea ecx, dword ptr [ebp-14]
:00403526 C745FCFFFFFFFF mov [ebp-04],
FFFFFFFF
:0040352D E811970600 call
0046CC43
:00403532 33C0
xor eax, eax
:00403534 8B4DF4
mov ecx, dword ptr [ebp-0C]
:00403537 64890D00000000 mov dword ptr
fs:[00000000], ecx
:0040353E 5F
pop edi
:0040353F 5E
pop esi
:00403540 5B
pop ebx
:00403541 8BE5
mov esp, ebp
:00403543 5D
pop ebp
:00403544 C3
ret
按F8进入会来到如下地方：
* Referenced by a CALL at Address:
|:004034FA
|
:00425070 51
push ecx
:00425071 A120DD4A00 mov
eax, dword ptr [004ADD20]
:00425076 6A00
push 00000000
:00425078 8D4C2404
lea ecx, dword ptr [esp+04]
:0042507C 6A04
push 00000004
:0042507E 83C064
add eax, 00000064
:00425081 51
push ecx
:00425082 68E07F4A00 push
004A7FE0
:00425087 89442410
mov dword ptr [esp+10], eax
:0042508B E8C0270200 call
00447850 <--按F8进入
:00425090 C1E810
shr eax, 10
:00425093 33D2
xor edx, edx
:00425095 66390526DD4A00 cmp word ptr
[004ADD26], ax
:0042509C 0F94C2
sete dl
:0042509F 8BC2
mov eax, edx
:004250A1 83C414
add esp, 00000014
:004250A4 C3
ret
按F8进入会来到如下地方：
* Referenced by a CALL at Addresses:
|:0042463C , :004247FE , :00424971 , :0042508B ,
:00447F8D
|
:00447850 8B442410
mov eax, dword ptr [esp+10]
:00447854 8B542408
mov edx, dword ptr [esp+08]
:00447858 57
push edi
:00447859 8B7C2410
mov edi, dword ptr [esp+10]
:0044785D 6685FF
test di, di
:00447860 743E
je 004478A0
:00447862 53
push ebx
:00447863 55
push ebp
:00447864 56
push esi
:00447865 8B742414
mov esi, dword ptr [esp+14]
:00447869 81E7FFFF0000 and edi,
0000FFFF
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044789B(C)
|
:0044786F 33C9
xor ecx, ecx
:00447871 8BE8
mov ebp, eax
:00447873 8A0A
mov cl, byte ptr [edx] <--edx为存放u4+100的内存地址
:00447875 42
inc edx
:00447876 8BD9
mov ebx, ecx
:00447878 33D8
xor ebx, eax
:0044787A 83E30F
and ebx, 0000000F
:0044787D C1ED04
shr ebp, 04
:00447880 8B049E
mov eax, dword ptr [esi+4*ebx] <--esi为存放密码表的内存地址
:00447883 33C5
xor eax, ebp
:00447885 C1E904
shr ecx, 04
:00447888 8BD8
mov ebx, eax
:0044788A 83E10F
and ecx, 0000000F
:0044788D 83E30F
and ebx, 0000000F
:00447890 33CB
xor ecx, ebx
:00447892 C1E804
shr eax, 04
:00447895 8B0C8E
mov ecx, dword ptr [esi+4*ecx]
:00447898 33C1
xor eax, ecx
:0044789A 4F
dec edi
:0044789B 75D2
jne 0044786F
:0044789D 5E
pop esi
:0044789E 5D
pop ebp
:0044789F 5B
pop ebx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447860(C)
|
:004478A0 5F
pop edi
:004478A1 C3
ret
大家对上面这段代码是不是有点眼熟，是的。可惜是“代码依旧，密码已非”。这次我想大家应该能够编出正确的注册机了吧！
附：密码表2
00000000 1DB71064 3B6E20C8
26D930AC
76DC4190 6B6B51F4 4DB26158
5005713C
EDB88320 F00F9344 D6D6A3E8
CB61B38C
9B64C2B0 86D3D2D4 A00AE278
BDBDF21C
我的正确的注册码：
name：时空幻影
company：湖南长沙
Unlock Key：69684041-65AD2ED1-4B34AD7F-A9D27FF5
Check Key：C0BA3FB4-0CC56E90-2E9983AE-E2E6D28A
