查找Sachs Marine Aquarium 0.99G Beta 注册码要点 (2千字)
Sachs Marine Aquarium 0.99G Beta 破解要点1、输入任意注册码，但要求格式为6个大字字母+6位数字，我输入的是：AAAAAA123456
打bpx hmemcpy下断点，中断后，小心地跟踪，一直来到：
* Possible StringData Ref from Data Obj ->"TESTFISH"
|
:0040DABF 6834064200 push 00420634
:0040DAC4 684C1E4200 push 00421E4C
* Reference To: KERNEL32.lstrcmpiA, Ord:02FFh
|
:0040DAC9 FF1598B04100 Call dword ptr [0041B098] ; 比较临时注册码'TESTFISH'
:0040DACF 85C0 test eax, eax
:0040DAD1 750A jne 0040DADD
:0040DAD3 C7057020420001000000 mov dword ptr [00422070], 00000001
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DAD1(C)
|
:0040DADD 6A02 push 00000002
:0040DADF E82C5DFFFF call 00403810 ; 进入后，可找到BASIC注册码
:0040DAE4 83C404 add esp, 00000004
:0040DAE7 85C0 test eax, eax
:0040DAE9 7414 je 0040DAFF
:0040DAEB C7057020420002000000 mov dword ptr [00422070], 00000002
:0040DAF5 6A01 push 00000001
:0040DAF7 E8B964FFFF call 00403FB5
:0040DAFC 83C404 add esp, 00000004
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DAE9(C)
|
:0040DAFF 6A03 push 00000003
:0040DB01 E80A5DFFFF call 00403810 ; 进入后，可找到DELUXE注册码
:0040DB06 83C404 add esp, 00000004
:0040DB09 8945F8 mov dword ptr [ebp-08], eax
:0040DB0C 837DF800 cmp dword ptr [ebp-08], 00000000
:0040DB10 7414 je 0040DB26
:0040DB12 C7057020420003000000 mov dword ptr [00422070], 00000003
:0040DB1C 6A01 push 00000001
:0040DB1E E89264FFFF call 00403FB5
:0040DB23 83C404 add esp, 00000004
2、进入 call 00403810 ，来到下边时，可找到真正注册码：
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040398E(C)
|
:004039A1 8D45E8 lea eax, dword ptr [ebp-18]
:004039A4 50 push eax ; d eax，可看到真注册码
:004039A5 684C1E4200 push 00421E4C ; d 00421E4C，可看到假注册码
* Reference To: KERNEL32.lstrcmpiA, Ord:02FFh
|
:004039AA FF1598B04100 Call dword ptr [0041B098] ; 注册码比较
:004039B0 85C0 test eax, eax
:004039B2 7507 jne 004039BB
:004039B4 B801000000 mov eax, 00000001
:004039B9 EB02 jmp 004039BD
3、如果只需要注册码的话，可以直接下断点bpx 004039A4，然后打d eax，即可得到正确的注册码。第1次中断得到BASIC REGISTRATION CODE，第2次中断得到DELUXE REGISTRATION CODE。
