与peterchen大哥商榷,Active Registry Monitor的另一种轻松破解!!! (5千字)
与peterchen大哥商榷,Active Registry Monitor的另一种轻松破解!!!按照peterchen大哥的<<完美的暴力!>>一文的方法
seach:85C074BE8945F8--->75 也就是je->jne
^^
所有的限制都除去了,但遗憾的是---在我的机器上(W2000),'options'菜单中的子菜单'Settings'不能使用!不知道在Window98上能不能使用?
怎么办? 当然'操家伙'干掉它了!!!
.
.
.
:00496B63 E880D1F6FF call 00403CE8
:00496B68 83F818 cmp eax, 00000018----------->注册码是否是24位
:00496B6B 0F85A6000000 jne 00496C17
:00496B71 8B45EC mov eax, dword ptr [ebp-14]
:00496B74 E833D3F6FF call 00403EAC
:00496B79 8945F8 mov dword ptr [ebp-08], eax
:00496B7C 8B45F8 mov eax, dword ptr [ebp-08]
:00496B7F E864ECFFFF call 004957E8----------------------->关键对比!!!
:00496B84 84C0 test al, al
:00496B86 7478 je 00496C00------------------------->跳就死!!!
:00496B88 B201 mov dl, 01
:00496B8A A1F8D64400 mov eax, dword ptr [0044D6F8]
:00496B8F E8106DFBFF call 0044D8A4
:00496B94 8945F0 mov dword ptr [ebp-10], eax
:00496B97 BA01000080 mov edx, 80000001
:00496B9C 8B45F0 mov eax, dword ptr [ebp-10]
:00496B9F E8986DFBFF call 0044D93C
:00496BA4 B101 mov cl, 01
* Possible StringData Ref from Code Obj ->"\SOFTWARE\SmartLine Vision\ARM\Registration"
|
:00496BA6 BAE46C4900 mov edx, 00496CE4
:00496BAB 8B45F0 mov eax, dword ptr [ebp-10]
:00496BAE E8E56EFBFF call 0044DA98
:00496BB3 8845F7 mov byte ptr [ebp-09], al
:00496BB6 8D45E8 lea eax, dword ptr [ebp-18]
:00496BB9 8B55F8 mov edx, dword ptr [ebp-08]
:00496BBC E85FD0F6FF call 00403C20
:00496BC1 8B4DE8 mov ecx, dword ptr [ebp-18]
* Possible StringData Ref from Code Obj ->"Code"
|
:00496BC4 BA186D4900 mov edx, 00496D18
:00496BC9 8B45F0 mov eax, dword ptr [ebp-10]
:00496BCC E8F373FBFF call 0044DFC4
:00496BD1 6A00 push 00000000
:00496BD3 668B0D206D4900 mov cx, word ptr [00496D20]
:00496BDA B202 mov dl, 02
* Possible StringData Ref from Code Obj ->"Thank you for registering !"
|
:00496BDC B82C6D4900 mov eax, 00496D2C
:00496BE1 E8E6E4FBFF call 004550CC
:00496BE6 A124744B00 mov eax, dword ptr [004B7424]
:00496BEB 8B00 mov eax, dword ptr [eax]
:00496BED E83A27FBFF call 0044932C
:00496BF2 A1E8704B00 mov eax, dword ptr [004B70E8]
:00496BF7 C60001 mov byte ptr [eax], 01
:00496BFA C645FF01 mov [ebp-01], 01
:00496BFE EB2C jmp 00496C2C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00496B86(C)
|
:00496C00 6A00 push 00000000
:00496C02 668B0D206D4900 mov cx, word ptr [00496D20]
:00496C09 33D2 xor edx, edx
* Possible StringData Ref from Code Obj ->"The registration code is invalid!"
|
:00496C0B B8506D4900 mov eax, 00496D50
:00496C10 E8B7E4FBFF call 004550CC
:00496C15 EB15 jmp 00496C2C
.
.
.
.
由以上w32dam反汇编的代码可看出,(用查找文本"Thank you for registering"可轻易找到),
:00496B86 je 00496C00 是关键的跳跃,运行Active Registry Monitor,输入注册码123456781234567812345678(注意必须为24位),ctrl+D呼出softice ,下断点bpx showwindow
来到:00496B86 je 00496C00 用命令r fl z ,然后F5,弹出对话框---You have regestered version. Ok!! 马上启动Hex WorkShop 将84c07478b201改为84c07578b201,存盘,重新运行
Active Registry Monitor,哎呀,提示对话框'涛声依旧',随便输入注册码(24位),弹出对话框
---You have regestered version. 看来只成功了一半!!!
另一半在哪儿呢? 肯定是程序中的其它地方还进行了对比!!!
:00496B7F E864ECFFFF call 004957E8 该call为关键call,F8进去
看看,
* Referenced by a CALL at Addresses:
|:004958EE , :00496B7F ------------------------------------->增大眼睛哟!!!!
|
:004957E8 55 push ebp
:004957E9 8BEC mov ebp, esp
:004957EB 83C4D8 add esp, FFFFFFD8
:004957EE 33D2 xor edx, edx
.
.
.
原来:004958EE处也进行了对比,这下就清楚了,跳到
:004958EE E8F5FEFFFF call 004957E8
:004958F3 84C0 test al, al
:004958F5 740C je 00495903------------------>关键!!!
:004958F7 C645FF01 mov [ebp-01], 01
:004958FB A1E8704B00 mov eax, dword ptr [004B70E8]
:00495900 C60001 mov byte ptr [eax], 01
如法炮制,马上启动Hex WorkShop 将84c0740cc645ff01改为84c0750cc645ff01,存盘,重新运行
Active Registry Monitor,哎呀,提示对话框不见了,试一试'options'菜单中的子菜单'Settings'
,一切OK,大功告成!!!!!!
总结:
将84c07478b201改为84c07578b201
将84c0740cc645ff01改为84c0750cc645ff01
