Icontoy3.1破解纪录(下) (7千字)
Icontoy3.1破解纪录(下)接着来吧!看看如果注册码正确,有什么现象发生?
跳与不跳的比较语句是:
015F:00485E99 803D00E9480001 CMP BYTE [0048E900],01
015F:00485EA0 0F85C4000000 JNZ NEAR 00485F6A
哦!原来,只要0048E900处的值等于1就行了!那程序是在哪里让其值变化的呢?当然就是在判断注册码正确与否的的关键CALL里了!好,让我们进到判断注册码正确与否的的关键CALL里(用F8!),你就看到:
015F:00485C58 55 PUSH EBP
015F:00485C59 8BEC MOV EBP,ESP
015F:00485C5B 6A00 PUSH BYTE +00
015F:00485C5D 33D2 XOR EDX,EDX
015F:00485C5F 55 PUSH EBP
015F:00485C60 68C05D4800 PUSH DWORD 00485DC0
015F:00485C65 64FF32 PUSH DWORD [FS:EDX]
015F:00485C68 648922 MOV [FS:EDX],ESP
015F:00485C6B 3D7CACEB01 CMP EAX,01EBAC7C <---------------------------------------|
015F:00485C70 0F84B1000000 JZ NEAR 00485D27 这一大堆的CMP是什么意思呢? |
015F:00485C76 3D52821C00 CMP EAX,001C8252 D EAX,什么也没有. 555555 |
015F:00485C7B 0F84A6000000 JZ NEAR 00485D27 ? EAX呢?哈哈............. |
015F:00485C81 3D8C7E1900 CMP EAX,00197E8C DEC=654321!这不就是明摆的事 |
015F:00485C86 0F849B000000 JZ NEAR 00485D27 了吗? |
015F:00485C8C 3DBE431900 CMP EAX,001943BE 我笑!哈哈哈......... |
015F:00485C91 0F8490000000 JZ NEAR 00485D27 |
015F:00485C97 3D0A153B00 CMP EAX,003B150A 随便找一个CMP,"?" 吧!我选的是 |
015F:00485C9C 0F8485000000 JZ NEAR 00485D27 ? 1EBAC7C 结果为: |
015F:00485CA2 3D56193B00 CMP EAX,003B1956 DEC=32222332,呵呵... |
015F:00485CA7 747E JZ 00485D27 |
015F:00485CA9 3DF0183F00 CMP EAX,003F18F0 |
015F:00485CAE 7477 JZ 00485D27 |
015F:00485CB0 3D26E92B00 CMP EAX,002BE926 |
015F:00485CB5 7470 JZ 00485D27 |
015F:00485CB7 3D5636DF01 CMP EAX,01DF3656 |
015F:00485CBC 7469 JZ 00485D27 |
015F:00485CBE 3D3A362000 CMP EAX,0020363A |
015F:00485CC3 7462 JZ 00485D27 |
015F:00485CC5 3D823A4800 CMP EAX,00483A82 |
015F:00485CCA 745B JZ 00485D27 |
015F:00485CCC 3D027AE905 CMP EAX,05E97A02 |
015F:00485CD1 7454 JZ 00485D27 |
015F:00485CD3 3DC2579700 CMP EAX,009757C2 |
015F:00485CD8 744D JZ 00485D27 |
015F:00485CDA 3D12BF8500 CMP EAX,0085BF12 |
015F:00485CDF 7446 JZ 00485D27 |
015F:00485CE1 3D16C07200 CMP EAX,0072C016 |
015F:00485CE6 743F JZ 00485D27 |
015F:00485CE8 3DA8387800 CMP EAX,007838A8 |
015F:00485CED 7438 JZ 00485D27 |
015F:00485CEF 3DCA129800 CMP EAX,009812CA |
015F:00485CF4 7431 JZ 00485D27 |
015F:00485CF6 3D50A42F00 CMP EAX,002FA450 |
015F:00485CFB 742A JZ 00485D27 |
015F:00485CFD 3D8EC55000 CMP EAX,0050C58E |
015F:00485D02 7423 JZ 00485D27 |
015F:00485D04 3DD2229500 CMP EAX,009522D2 |
015F:00485D09 741C JZ 00485D27 |
015F:00485D0B 3DA6841D00 CMP EAX,001D84A6 |
015F:00485D10 7415 JZ 00485D27 |
015F:00485D12 3DD81DFB01 CMP EAX,01FB1DD8 |
015F:00485D17 740E JZ 00485D27 |
015F:00485D19 3DB473B500 CMP EAX,00B573B4 |
015F:00485D1E 7407 JZ 00485D27 |
015F:00485D20 3DBCE4AB00 CMP EAX,00ABE4BC <-----如果EAX还不正确的话,就..嘿嘿.... |
015F:00485D25 757C JNZ 00485DA3 <--------------------------------------|
015F:00485D27 C60500E9480001 MOV BYTE [0048E900],01 <-------这里就是注册成功的标志!
015F:00485D2E A1FCE84800 MOV EAX,[0048E8FC]
015F:00485D33 8B80D0020000 MOV EAX,[EAX+02D0]
015F:00485D39 33D2 XOR EDX,EDX
015F:00485D3B E820C1FCFF CALL 00451E60
015F:00485D40 A1FCE84800 MOV EAX,[0048E8FC]
015F:00485D45 8B90CC020000 MOV EDX,[EAX+02CC]
015F:00485D4B A1FCE84800 MOV EAX,[0048E8FC]
015F:00485D50 8B80C8020000 MOV EAX,[EAX+02C8]
015F:00485D56 E8EDC7FCFF CALL 00452548
015F:00485D5B 8D45FC LEA EAX,[EBP-04]
015F:00485D5E 8B0D08E94800 MOV ECX,[0048E908]
015F:00485D64 BAD45D4800 MOV EDX,00485DD4
015F:00485D69 E862E0F7FF CALL 00403DD0
015F:00485D6E 8B55FC MOV EDX,[EBP-04]
015F:00485D71 A1FCE84800 MOV EAX,[0048E8FC]
015F:00485D76 8B80E8020000 MOV EAX,[EAX+02E8]
015F:00485D7C E8BB57FAFF CALL 0042B53C
015F:00485D81 A180D24800 MOV EAX,[0048D280]
015F:00485D86 8B00 MOV EAX,[EAX]
015F:00485D88 8B80D8030000 MOV EAX,[EAX+03D8]
015F:00485D8E 33D2 XOR EDX,EDX
015F:00485D90 E88F56FAFF CALL 0042B424
015F:00485D95 A180D24800 MOV EAX,[0048D280]
015F:00485D9A 8B00 MOV EAX,[EAX]
015F:00485D9C 33D2 XOR EDX,EDX
015F:00485D9E 89500C MOV [EAX+0C],EDX
015F:00485DA1 EB07 JMP SHORT 00485DAA <--------正确的时候就跳过去了!
015F:00485DA3 C60500E9480000 MOV BYTE [0048E900],00 <--------呵呵..不用我多说了吧?
015F:00485DAA 33C0 XOR EAX,EAX
015F:00485DAC 5A POP EDX
015F:00485DAD 59 POP ECX
015F:00485DAE 59 POP ECX
015F:00485DAF 648910 MOV [FS:EAX],EDX
015F:00485DB2 68C75D4800 PUSH DWORD 00485DC7
015F:00485DB7 8D45FC LEA EAX,[EBP-04]
015F:00485DBA E849DDF7FF CALL 00403B08
015F:00485DBF C3 RET
呵呵...看到这里,注册这种小事对于你来说应该就是:A PIECE OF CAKE了吧?
另外再说两句,注册成功后,程序会在注册表中新建如下两个键,删掉后,程序又成为未注册版了(你又可以练习了,多好的事啊!呵呵....)
HKEY_CURRENT_USER\SOFTWARE\LIGHTTEK\ICONTOY\01 注册名
HKEY_CURRENT_USER\SOFTWARE\LIGHTTEK\ICONTOY\02 加密后的注册码(我才是这样的,因为它什么都不象)
完成!收工!好累呀.........如果这篇教程能给大家哪怕是一丁点的帮助的话,我也就非常高兴了!
请多指教!
