GetSmart暴力破解手记-----有谁愿意写追注册码和注册机！下载http://sffs.6to23.com (6千字)
GetSmart暴力破解主页：http://sffs.6to23.com
据说这个软件比Jetcar还好，可是我没觉出来，呵呵，不管了，破解了再说。
修改点3ECB8和4857A。 下面我们来看看喽：
首先破解的是使用天数的限制，我们先使软件过期，然后查找出错提示语句：
* Possible Reference to String Resource ID=00012: "FireWall refused to connect."
|
:0043ECA2 6A0C push 0000000C
* Reference To: GDI32.CreateFontA, Ord:0036h
|
:0043ECA4 FF1578904700 Call dword ptr [00479078]
:0043ECAA A3301F4900 mov dword ptr [00491F30], eax
:0043ECAF 33C0 xor eax, eax
:0043ECB1 A0325F4800 mov al, byte ptr [00485F32]
:0043ECB6 85C0 test eax, eax
:0043ECB8 751D jne 0043ECD7 //------------就是这里了，改751D->741D，即jne->je
:0043ECBA 8B0DF46F4800 mov ecx, dword ptr [00486FF4]
:0043ECC0 51 push ecx
* Possible StringData Ref from Data Obj ->"Unregistered - day %ld of evaluation." //未注册版本
| //天数限制提示
:0043ECC1 68F41E4800 push 00481EF4
:0043ECC6 8D9500FCFFFF lea edx, dword ptr [ebp+FFFFFC00]
:0043ECCC 52 push edx
:0043ECCD E80DFF0200 call 0046EBDF
:0043ECD2 83C40C add esp, 0000000C
:0043ECD5 EB14 jmp 0043ECEB
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ECB8(C) //-------------->这就是我们修改成注册版本的地方，往上找吧。
|
* Possible StringData Ref from Data Obj ->"Registered version." //注册版本
|
:0043ECD7 681C1F4800 push 00481F1C
:0043ECDC 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00]
:0043ECE2 50 push eax
:0043ECE3 E8F7FE0200 call 0046EBDF
:0043ECE8 83C408 add esp, 00000008
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ECD5(U)
|
:0043ECEB 8D8D00FCFFFF lea ecx, dword ptr [ebp+FFFFFC00]
:0043ECF1 51 push ecx
:0043ECF2 6827040000 push 00000427
:0043ECF7 8B5508 mov edx, dword ptr [ebp+08]
:0043ECFA 52 push edx
然后咱们再来破解注册失败的地方，修改为注册成功，查找出错提示语句，会看到：
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448F1C(U)
|
:00448F2D 8B8530F9FFFF mov eax, dword ptr [ebp+FFFFF930]
:00448F33 25FF000000 and eax, 000000FF
:00448F38 3B8580F9FFFF cmp eax, dword ptr [ebp+FFFFF980]
:00448F3E 7310 jnb 00448F50
:00448F40 8B8D34F9FFFF mov ecx, dword ptr [ebp+FFFFF934]
:00448F46 8B11 mov edx, dword ptr [ecx]
:00448F48 899534F9FFFF mov dword ptr [ebp+FFFFF934], edx
:00448F4E EBCE jmp 00448F1E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448F3E(C)
|
:00448F50 8B8534F9FFFF mov eax, dword ptr [ebp+FFFFF934]
:00448F56 8A4804 mov cl, byte ptr [eax+04]
:00448F59 880DDF6C4800 mov byte ptr [00486CDF], cl
:00448F5F E8DAD4FDFF call 0042643E
:00448F64 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"GetSmart is now registered!!" //注册成功
|
:00448F66 68F42B4800 push 00482BF4
* Possible StringData Ref from Data Obj ->"Thanks you for supporting GetSmart." //注册成功
|
:00448F6B 68142C4800 push 00482C14
* Possible Reference to String Resource ID=00192: "Thanks you for supporting GetSmart." //注册成功
|
:00448F70 68C0000000 push 000000C0
:00448F75 E8C5810100 call 0046113F
:00448F7A 83C408 add esp, 00000008
:00448F7D 50 push eax
:00448F7E E815850100 call 00461498
:00448F83 83C40C add esp, 0000000C
:00448F86 E8F3810100 call 0046117E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044857A(C) //---------------修改这里了，呵呵。
|
:00448F8B EB44 jmp 00448FD1
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044856B(C)
|
:00448F8D C605325F480000 mov byte ptr [00485F32], 00
* Possible Reference to String Resource ID=00024: "Can't start download!"
|
:00448F94 6A18 push 00000018
:00448F96 6A00 push 00000000
:00448F98 68C86C4800 push 00486CC8
:00448F9D E87E5F0200 call 0046EF20
:00448FA2 83C40C add esp, 0000000C
:00448FA5 E894D4FDFF call 0042643E
:00448FAA 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"Wrong serial number!" //错误提示
|
:00448FAC 68382C4800 push 00482C38
* Possible StringData Ref from Data Obj ->"Your serial number is invalid" //错误提示
|
:00448FB1 68502C4800 push 00482C50
* Possible Reference to String Resource ID=00193: "Your serial number is invalid" //错误提示
|
:00448FB6 68C1000000 push 000000C1
:00448FBB E87F810100 call 0046113F
:00448FC0 83C408 add esp, 00000008
:00448FC3 50 push eax
:00448FC4 E8CF840100 call 00461498
:00448FC9 83C40C add esp, 0000000C
:00448FCC E8AD810100 call 0046117E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448F8B(U)
|
:00448FD1 833D286D480000 cmp dword ptr [00486D28], 00000000
:00448FD8 740F je 00448FE9
我们晚上找找看看0044857A地方；
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044854D(C)
|
:0044855F 8B8D70F9FFFF mov ecx, dword ptr [ebp+FFFFF970]
:00448565 0FBE5104 movsx edx, byte ptr [ecx+04]
:00448569 85D2 test edx, edx
:0044856B 0F841C0A0000 je 00448F8D
:00448571 33C0 xor eax, eax
:00448573 A0325F4800 mov al, byte ptr [00485F32]
:00448578 85C0 test eax, eax
:0044857A 0F850B0A0000 jne 00448F8B //--------->修改85->84,即jne->je
:00448580 C605325F480001 mov byte ptr [00485F32], 01
* Reference To: KERNEL32.GetTickCount, Ord:016Dh
|
:00448587 FF15A0914700 Call dword ptr [004791A0]
:0044858D 33D2 xor edx, edx
好了，完成了破解，在修改后一定要注意先随便输入注册码，成为“正版”哟，呵呵。
