贴一个朋友问的关于《学生评语系统》的破解过程14千字)
（1）该软件加了PEcompact壳，可以用风飘雪的脱壳机脱壳，然后就能看到它是用DELPHI编
写的。用W32dasm8反汇编。
试着运行软件，进行注册，先要让你填用户名和单位、地址，注意字数要够。然后点击生成
注册码文件。分析注册码文件，看到里面有一行字串：
userid=0310206410913919500818002711023914226309313612401220911328701503705316115
2071115115276163151041148019121215163174294049092008099084062121169134235004132
2550
点击注册，提示：没有有效的注册信息。在W32dasm反汇编的文件中搜索：“注册”
:0052C3AC E86F03F2FF call 0044C720
:0052C3B1 837DE800 cmp dword ptr [ebp-18], 00000000
:0052C3B5 7522 jne 0052C3D9 //在这跳，为了更好的观
察，我先不让它强行跳，
看如何才能真正的跳。
:0052C3B7 6A10 push 00000010
* Possible StringData Ref from Code Obj ->"错误"
|
:0052C3B9 B9E4C45200 mov ecx, 0052C4E4
* Possible StringData Ref from Code Obj ->"文件中不存在有效的注册信息"
|
:0052C3BE BAECC45200 mov edx, 0052C4EC
:0052C3C3 A1F0285600 mov eax, dword ptr [005628F0]
:0052C3C8 8B00 mov eax, dword ptr [eax]
:0052C3CA E8F909F4FF call 0046CDC8 //出现错误，看哪能跳过
:0052C3CF E8647FEDFF call 00404338
:0052C3D4 E9A6000000 jmp 0052C47F
? Referenced by a (U)nconditional or (C)onditional Jump at Address:
》》》
》》》
在W32dasm反汇编的文件中搜索：“userid”，找到：
:0050B653 8D4598 lea eax, dword ptr [ebp-68]
:0050B656 50 push eax
* Possible StringData Ref from Code Obj ->"userid" //关键字
|
:0050B657 B9CCBB5000 mov ecx, 0050BBCC
* Possible StringData Ref from Code Obj ->"register" //关键字，所以在注册文件中写入一
行。
|
:0050B65C BAB8BB5000 mov edx, 0050BBB8
注册文件的内容设为：
userid=0310206410913919500818002711023914226309313612401220911328701503705316115
2071115115276163151041148019121215163174294049092008099084062121169134235004132
2550
register=67889898487684685674683228091890489843747578474732873877883684383738749
8739873987398574874987378436268374854759859875876985798748739473547598798798449
3759873（注：数字是乱填的）
这回上面的错误提示没有了，接着看：
由上面跳到这：
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0052C3B5(C)
|
:0052C3D9 33C0 xor eax, eax
:0052C3DB 5A pop edx
:0052C3DC 59 pop ecx
:0052C3DD 59 pop ecx
:0052C3DE 648910 mov dword ptr fs:[eax], edx
:0052C3E1 68F8C35200 push 0052C3F8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0052C3F6(U)
|
:0052C3E6 B201 mov dl, 01
:0052C3E8 8B45F8 mov eax, dword ptr [ebp-08]
:0052C3EB 8B08 mov ecx, dword ptr [eax]
:0052C3ED FF51FC call [ecx-04]
:0052C3F0 C3 ret
:0052C3F1 E99A7DEDFF jmp 00404190
:0052C3F6 EBEE jmp 0052C3E6
:0052C3F8 A1A4245600 mov eax, dword ptr [005624A4]
:0052C3FD C60001 mov byte ptr [eax], 01
:0052C400 8D55E4 lea edx, dword ptr [ebp-1C]
:0052C403 8B45FC mov eax, dword ptr [ebp-04]
:0052C406 8B8008030000 mov eax, dword ptr [eax+00000308]
:0052C40C E80F03F2FF call 0044C720
:0052C411 8B4DE4 mov ecx, dword ptr [ebp-1C]
:0052C414 8B55F4 mov edx, dword ptr [ebp-0C]
:0052C417 B001 mov al, 01
:0052C419 E82202FEFF call 0050C640 //注册判断关键CALL
:0052C41E E86531FEFF call 0050F588
:0052C423 A124265600 mov eax, dword ptr [00562624]
:0052C428 8B00 mov eax, dword ptr [eax]
:0052C42A E831D3EDFF call 00409760
:0052C42F E8901BFEFF call 0050DFC4
:0052C434 A1A4245600 mov eax, dword ptr [005624A4]
:0052C439 803800 cmp byte ptr [eax], 00 //注意看EAX中的地址：
0056446C，下中断BPM
0056446C，重新跟踪。
:0052C43C 741A je 0052C458 //关键跳转，直接改虽然可以看到
注册正确的提示，但不行。
:0052C43E 6A40 push 00000040
* Possible StringData Ref from Code Obj ->"提示"
|
:0052C440 B908C55200 mov ecx, 0052C508
* Possible StringData Ref from Code Obj ->"注册成功！感谢您的支持！"
|
:0052C445 BA10C55200 mov edx, 0052C510
:0052C44A A1F0285600 mov eax, dword ptr [005628F0]
:0052C44F 8B00 mov eax, dword ptr [eax]
:0052C451 E87209F4FF call 0046CDC8
:0052C456 EB18 jmp 0052C470
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0052C43C(C)
|
:0052C458 6A10 push 00000010
* Possible StringData Ref from Code Obj ->"错误"
|
:0052C45A B9E4C45200 mov ecx, 0052C4E4
* Possible StringData Ref from Code Obj ->"注册失败，请与作者联系！"
|
:0052C45F BA2CC55200 mov edx, 0052C52C
:0052C464 A1F0285600 mov eax, dword ptr [005628F0]
:0052C469 8B00 mov eax, dword ptr [eax]
:0052C46B E85809F4FF call 0046CDC8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0052C456(U)
|
:0052C470 8B45FC mov eax, dword ptr [ebp-04]
:0052C473 E824CFF3FF call 0046939C
:0052C478 C6054445560001 mov byte ptr [00564544], 01
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0052C32A(C), :0052C3D4(U)
|
:0052C47F 33C0 xor eax, eax
:0052C481 5A pop edx
:0052C482 59 pop ecx
:0052C483 59 pop ecx
:0052C484 648910 mov dword ptr fs:[eax], edx
:0052C487 68B9C45200 push 0052C4B9
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0052C4B7(U)
|
:0052C48C 8D45E4 lea eax, dword ptr [ebp-1C]
:0052C48F BA02000000 mov edx, 00000002
:0052C494 E8D383EDFF call 0040486C
:0052C499 8D45EC lea eax, dword ptr [ebp-14]
:0052C49C E8A783EDFF call 00404848
:0052C4A1 8D45F0 lea eax, dword ptr [ebp-10]
:0052C4A4 E89F83EDFF call 00404848
:0052C4A9 8D45F4 lea eax, dword ptr [ebp-0C]
:0052C4AC E89783EDFF call 00404848
:0052C4B1 C3 ret
0056446C是关键的判断注册与否的地址，但每次运行时软件要对它重新判断赋值。调用的
代码段和上面判断注册时是同一段。其关键CALL是上面的0052C419处的0050C640：
* Referenced by a CALL at Addresses:
|:0052C419 , :0052C60A , :0055E0A2
|
:0050C640 55 push ebp
:0050C641 8BEC mov ebp, esp
。。。《略》 。。。
:0050C680 8945EC mov dword ptr [ebp-14], eax
:0050C683 C645F300 mov [ebp-0D], 00
:0050C687 C6056C44560000 mov byte ptr [0056446C], 00 //赋初始值
:0050C68E 8D45E0 lea eax, dword ptr [ebp-20]
* Possible StringData Ref from Code Obj ->"\wlm.dat"
|
:0050C691 B9FCCB5000 mov ecx, 0050CBFC
:0050C696 8B1570445600 mov edx, dword ptr [00564470]
:0050C69C E8AB84EFFF call 00404B4C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0050C62D(C)
|
:0050C6A1 8B45E0 mov eax, dword ptr [ebp-20]
* Possible StringData Ref from Code Obj ->"wlm"
|
:0050C6A4 BA10CC5000 mov edx, 0050CC10
:0050C6A9 E83E190000 call 0050DFEC
:0050C6AE B201 mov dl, 01
:0050C6B0 A144304700 mov eax, dword ptr [00473044]
:0050C6B5 E88A6AF6FF call 00473144
:0050C6BA 8945E8 mov dword ptr [ebp-18], eax
:0050C6BD 807DFF00 cmp byte ptr [ebp-01], 00
:0050C6C1 0F8552020000 jne 0050C919
:0050C6C7 BA02000080 mov edx, 80000002
:0050C6CC 8B45E8 mov eax, dword ptr [ebp-18]
:0050C6CF E8106BF6FF call 004731E4
:0050C6D4 B101 mov cl, 01
* Possible StringData Ref from Code Obj ->"Software\学生评语管理系统" //写入注册表
|
:0050C6D6 BA1CCC5000 mov edx, 0050CC1C
:0050C6DB 8B45E8 mov eax, dword ptr [ebp-18]
:0050C6DE E8656BF6FF call 00473248
:0050C6E3 84C0 test al, al
:0050C6E5 7413 je 0050C6FA
:0050C6E7 8B0D70445600 mov ecx, dword ptr [00564470]
* Possible StringData Ref from Code Obj ->"installpath" //写入注册表
|
:0050C6ED BA40CC5000 mov edx, 0050CC40
:0050C6F2 8B45E8 mov eax, dword ptr [ebp-18]
:0050C6F5 E8EA6CF6FF call 004733E4
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0050C6E5(C)
|
:0050C6FA 8B45E8 mov eax, dword ptr [ebp-18]
:0050C6FD E8B26AF6FF call 004731B4
:0050C702 BA02000080 mov edx, 80000002
:0050C707 8B45E8 mov eax, dword ptr [ebp-18]
:0050C70A E8D56AF6FF call 004731E4
:0050C70F B101 mov cl, 01
* Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\CurrentVersion" ////写
入注册表中
的位置
|
:0050C711 BA54CC5000 mov edx, 0050CC54
:0050C716 8B45E8 mov eax, dword ptr [ebp-18]
:0050C719 E82A6BF6FF call 00473248
:0050C71E 84C0 test al, al
:0050C720 0F84E3010000 je 0050C909
* Possible StringData Ref from Code Obj ->"ProductWRemark" //注册表中关键性的键值，是
否注册，是否到使用次数等都决定于它，后面还会出现多处。
|
:0050C726 BA88CC5000 mov edx, 0050CC88
。。。《略》 。。。
:0050C74C 50 push eax
:0050C74D 8D4DD0 lea ecx, dword ptr [ebp-30]
* Possible StringData Ref from Code Obj ->"ProductWRemark"
|
:0050C750 BA88CC5000 mov edx, 0050CC88
。。。《略》 。。。
:0050C787 8D4DC4 lea ecx, dword ptr [ebp-3C]
* Possible StringData Ref from Code Obj ->"ProductWRemark"
|
:0050C78A BA88CC5000 mov edx, 0050CC88
。。。《略》 。。。
:0050C880 66BA97FF mov dx, FF97
:0050C884 E88FD5FFFF call 00509E18
:0050C889 8B4DC0 mov ecx, dword ptr [ebp-40]
* Possible StringData Ref from Code Obj ->"ProductWRemark"
|
:0050C88C BA88CC5000 mov edx, 0050CC88
:0050C891 8B45E8 mov eax, dword ptr [ebp-18]
。。。《略》 。。。
:0050C8F4 E81FD5FFFF call 00509E18
:0050C8F9 8B4DB0 mov ecx, dword ptr [ebp-50]
* Possible StringData Ref from Code Obj ->"ProductWRemark"
|
:0050C8FC BA88CC5000 mov edx, 0050CC88
。。。《略》 。。。
:0050C92F E8B068F6FF call 004731E4
:0050C934 B101 mov cl, 01
* Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\CurrentVersion"
|
:0050C936 BA54CC5000 mov edx, 0050CC54
:0050C93B 8B45E8 mov eax, dword ptr [ebp-18]
:0050C93E E80569F6FF call 00473248
:0050C943 84C0 test al, al
:0050C945 0F84AF010000 je 0050CAFA
:0050C94B 8D45E4 lea eax, dword ptr [ebp-1C]
:0050C94E 8B55F4 mov edx, dword ptr [ebp-0C]
:0050C951 E88A7FEFFF call 004048E0
:0050C956 8D55A4 lea edx, dword ptr [ebp-5C]
:0050C959 8B45E4 mov eax, dword ptr [ebp-1C] //送入register值
:0050C95C E843CAEFFF call 004093A4
:0050C961 8B55A4 mov edx, dword ptr [ebp-5C]
:0050C964 8B45F8 mov eax, dword ptr [ebp-08] //送入usterid值
:0050C967 E8C8DDFFFF call 0050A734 //关键判断CALL，想知道算法
的话，就跟进去。我比较懒。
:0050C96C 84C0 test al, al
:0050C96E 0F8441010000 je 0050CAB5 //此处不让它跳就成功一半了！！
:0050C974 33C0 xor eax, eax
:0050C976 55 push ebp
:0050C977 68E9C95000 push 0050C9E9
:0050C97C 64FF30 push dword ptr fs:[eax]
:0050C97F 648920 mov dword ptr fs:[eax], esp
:0050C982 E8012C0000 call 0050F588
:0050C987 8D4598 lea eax, dword ptr [ebp-68]
:0050C98A B9C4CC5000 mov ecx, 0050CCC4
:0050C98F 8B1580445600 mov edx, dword ptr [00564480]
:0050C995 E8B281EFFF call 00404B4C
:0050C99A 8B4598 mov eax, dword ptr [ebp-68]
:0050C99D 8D4D9C lea ecx, dword ptr [ebp-64]
:0050C9A0 66BA14E2 mov dx, E214
:0050C9A4 E86FD4FFFF call 00509E18
:0050C9A9 8B459C mov eax, dword ptr [ebp-64]
:0050C9AC 8D4DA0 lea ecx, dword ptr [ebp-60]
:0050C9AF 66BA97FF mov dx, FF97
:0050C9B3 E860D4FFFF call 00509E18
:0050C9B8 8B4DA0 mov ecx, dword ptr [ebp-60]
* Possible StringData Ref from Code Obj ->"ProductWRemark"
|
:0050C9BB BA88CC5000 mov edx, 0050CC88
:0050C9C0 8B45E8 mov eax, dword ptr [ebp-18]
:0050C9C3 E81C6AF6FF call 004733E4
:0050C9C8 C6056C44560001 mov byte ptr [0056446C], 01 //此处赋注册正确的
值。
:0050C9CF 8B45E8 mov eax, dword ptr [ebp-18]
:0050C9D2 E8DD67F6FF call 004731B4
:0050C9D7 8B45E8 mov eax, dword ptr [ebp-18]
:0050C9DA E81D70EFFF call 004039FC
:0050C9DF 33C0 xor eax, eax
:0050C9E1 5A pop edx
:0050C9E2 59 pop ecx
:0050C9E3 59 pop ecx
:0050C9E4 648910 mov dword ptr fs:[eax], edx
:0050C9E7 EB0A jmp 0050C9F3
:0050C9E9 E9EE74EFFF jmp 00403EDC
:0050C9EE E81579EFFF call 00404308
》》》 》》》
总结：在0050C96E处下断点，改跳转，就显示注册成功了，将注册表中值导出成注册文件。
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
"ProductWRemark"="BB21C32E08E9F15F750A"
注意：经过上面的修改并未破解成功，请看（2）。
