怎样在内存中找到它的注册码： (2千字)
怎样在内存中找到它的注册码：by Fpc[CCG]/6767[BCG]
一切的计算来自于这个call中：
Exported fn(): Regist::RegTwoWar(void()) - Ord:0018h
:00401600 55 push ebp
:00401601 8BEC mov ebp, esp
:00401603 81C4BCFCFFFF add esp, FFFFFCBC
:00401609 33C0 xor eax, eax
... ...
更正一点：lijing是对的，Msimgsiz.cfg(在windows文件夹下)是keyfile。
经过努力，找到注册码的计算方法，先看下面这一段：
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401E15(C)
|
:00401DF9 8B45FC mov eax, dword ptr [ebp-04]
:00401DFC 8A80270D4B00 mov al, byte ptr [eax+004B0D27] <- keyfile的一部分内容
:00401E02 2C64 sub al, 64 <- al-=0x64
:00401E04 8B55FC mov edx, dword ptr [ebp-04]
:00401E07 8884152AFFFFFF mov byte ptr [ebp+edx-000000D6], al <- 保存，下面比较时用到
:00401E0E FF45FC inc [ebp-04]
:00401E11 837DFC07 cmp dword ptr [ebp-04], 00000007 <- 7个字节(其实用到6个)
:00401E15 75E2 jne 00401DF9
:00401E17 C6458F0E mov [ebp-71], 0E
那么先怎么作呢？用symble Loader载入，下：bpx 401dfc do "d eax+4b0d27"。拦下后记下数据窗口中显示的前6个字节。
bd *关断点，下：bpx 401ff8 do "d eax+ebp-13b"，因为：
:00401FEE C745FC01000000 mov [ebp-04], 00000001
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402035(C)
|
:00401FF5 8B45FC mov eax, dword ptr [ebp-04]
:00401FF8 8A8405C5FEFFFF mov al, byte ptr [ebp+eax-0000013B] <- 从keyfile生成的一个字串
:00401FFF 8B55FC mov edx, dword ptr [ebp-04]
:00402002 3A84152AFFFFFF cmp al, byte ptr [ebp+edx-000000D6] <- 上面的字串，比较
:00402009 7423 je 0040202E <- 一致则继续比较
:0040200B C605C40B4B0000 mov byte ptr [004B0BC4], 00 <- 否则标志置0
:00402012 C6052E0D4B0000 mov byte ptr [004B0D2E], 00
:00402019 A1C00B4B00 mov eax, dword ptr [004B0BC0]
:0040201E 8B80E8020000 mov eax, dword ptr [eax+000002E8]
:00402024 33D2 xor edx, edx
:00402026 89500C mov dword ptr [eax+0C], edx
:00402029 E91D030000 jmp 0040234B <- 跳下去，返回，byebye crackerz
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402009(C)
|
:0040202E FF45FC inc [ebp-04]
:00402031 837DFC07 cmp dword ptr [ebp-04], 00000007
:00402035 75BE jne 00401FF5 <- 比较下一字节
:00402037 803DC40B4B0000 cmp byte ptr [004B0BC4], 00
拦下后，把数据窗口的前六个字节分别都加上 0x64，记下结果。Bd *关断点。F5让程序运行，退出。
用ultraedit打开Msimgsiz.cfg，到文件偏移0x220处，你会发现此处与你第一次记下的六个字节相同，把他们改为上面加0x64所得到和，存盘，退出。
运行目标，关于对话框的注册项消失，target beaten!!
BTW: 还没有玩到15关，聪明人请快测试。
