今天是平安夜，忍不住拿篇破解笔记请各位指教！希望大家平安夜快乐！：） (24千字)
以下是破解wplaypro2.0时的笔记，开始目的只是为了去掉启动的窗口，后来看了看算法，也不知道对不对，毕竟才接触汇编10天，请大家多多指教！开始
用trw找到注册入口00415EF1和出错点004533AB
入口没法继续了，从后面看吧！
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045337B(C)
|
:0045339B 6A00 push 00000000
:0045339D 668B0DF0334500 mov cx, word ptr [004533F0]
:004533A4 B201 mov dl, 01
* Possible StringData Ref from Code Obj ->"The Key is not correct. Please "
->"register WPlay and receive your "
->"own personal key."
|
:004533A6 B850344500 mov eax, 00453450
:004533AB E880F3FDFF call 00432730
--------------------
上追：
:0045337B 741E je 0045339B 改吧！还是假成功！
跳过弹出窗口：
:004260CB 7405 je 004260D2 没用
:004245F2 E859150000 call 00425B50-----调用处，进入（不对）
* Referenced by a CALL at Addresses:
|:004245F2 , :00425D1F
|
:00425B50 53 push ebx
:00425B51 8BD8 mov ebx, eax
:00425B53 8BC3 mov eax, ebx
:00425B55 E836FFFFFF call 00425A90
:00425B5A 84C0 test al, al
:00425B5C 7507 jne 00425B65 改
:00425B5E 8BC3 mov eax, ebx
:00425B60 E86F040000 call 00425FD4
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425B5C(C)
|
:00425B65 5B pop ebx
:00425B66 C3 ret
中止
继续时间12/23 19：49
找到成功段
:00453374 E813E3FFFF call 0045168C 成功判断，跟入，见下
:00453379 84C0 test al, al 成功标志位
:0045337B 741E je 0045339B
:0045337D 6A00 push 00000000
:0045337F 668B0DF0334500 mov cx, word ptr [004533F0]
:00453386 B202 mov dl, 02
* Possible StringData Ref from Code Obj ->"Thank you for your registration. "
->"You are now a registered WPlay "
->"Pro user."
-----------------------------------------------------
* Referenced by a CALL at Addresses:
|:00453374 , :00482E6A
:0045168C 55 push ebp EBP入栈
:0045168D 8BEC mov ebp, esp 栈目前指针到ebp
:0045168F 33C9 xor ecx, ecx ecx=0
:00451691 51 push ecx
:00451692 51 push ecx
:00451693 51 push ecx
:00451694 51 push ecx 入四个32位0进栈
:00451695 53 push ebx ebx入栈
:00451696 56 push esi esi入栈
:00451697 57 push edi edi入栈
:00451698 BF40864800 mov edi, 00488640 edi=00488640
:0045169D 33C0 xor eax, eax eax清0
:0045169F 55 push ebp ebp入栈
:004516A0 6842194500 push 00451942 00451942入栈
:004516A5 64FF30 push dword ptr fs:[eax] fs首地址入栈
:004516A8 648920 mov dword ptr fs:[eax], esp 堆栈目前指针入fs
:004516AB C645FF00 mov [ebp-01], 00 ebp-01=00
:004516AF 8D55F8 lea edx, dword ptr [ebp-08]
:004516B2 A18C7E4800 mov eax, dword ptr [00487E8C] 不管他
:004516B7 8B8030030000 mov eax, dword ptr [eax+00000330] eax目前为0
:004516BD E87627FCFF call 00413E38 一个大量调用处
:004516C2 8B45F8 mov eax, dword ptr [ebp-08]
:004516C5 E8AA20FBFF call 00403774
:004516CA 83F81E cmp eax, 0000001E eax与30比较（eax为注册号长度）
:004516CD 0F854C020000 jne 0045191F 如果不是就玩完（验证对）
:004516D3 BB01000000 mov ebx, 00000001 ebx清1
:004516D8 8BF7 mov esi, edi esi=edi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004516FB(C)
|
:004516DA 8D55F8 lea edx, dword ptr [ebp-08]
:004516DD A18C7E4800 mov eax, dword ptr [00487E8C]
:004516E2 8B8030030000 mov eax, dword ptr [eax+00000330]
:004516E8 E84B27FCFF call 00413E38
:004516ED 8B45F8 mov eax, dword ptr [ebp-08] 注册号首地址到eax
:004516F0 8A4418FF mov al, byte ptr [eax+ebx-01] 送一个字节到al
:004516F4 8806 mov byte ptr [esi], al 此字节到esi所指处
:004516F6 43 inc ebx ebx++
:004516F7 46 inc esi esi++
:004516F8 83FB1F cmp ebx, 0000001F ebx与30比较
:004516FB 75DD jne 004516DA 相等时继续（将注册号依次送esi）
:004516FD 8A07 mov al, byte ptr [edi] 第一位到al
:004516FF A260864800 mov byte ptr [00488660], al 再到00488660
:00451704 8A4701 mov al, byte ptr [edi+01] 第二位到al
:00451707 A261864800 mov byte ptr [00488661], al 再……
:0045170C 8A4702 mov al, byte ptr [edi+02]
:0045170F A262864800 mov byte ptr [00488662], al
:00451714 8A4703 mov al, byte ptr [edi+03]
:00451717 A263864800 mov byte ptr [00488663], al edi所指四个字节（前四个字节）送到00488663所指处
:0045171C 33DB xor ebx, ebx ebx清0
以下设注册码从高到低为(a1)(a2).........(a30)
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045174E(C)
:0045171E 8BF3 mov esi, ebx ebx到esi(先是第一次循环）
:00451720 03F6 add esi, esi esi=esi*2
:00451722 8BC6 mov eax, esi eax=esi
:00451724 83C005 add eax, 00000005 eax+=5
:00451727 8A0407 mov al, byte ptr [edi+eax] 第五个(a5)到al(eax改变)
:0045172A E8B5FEFFFF call 004515E4 将al中ASCII码转为十六进制存到eax和edx （注册码只允许ASCII的0-9，A-F，a-f）
:0045172F C1E004 shl eax, 04 eax逻辑左移4位（eax*16）
eax=000000(a5)0
:00451732 50 push eax eax入栈
:00451733 83C606 add esi, 00000006 esi+=00000006
:00451736 8A0437 mov al, byte ptr [edi+esi] (a6)到al（eax改变）
:00451739 E8A6FEFFFF call 004515E4 转换
:0045173E 5A pop edx edx=000000(a5)0
:0045173F 0BD0 or edx, eax edx与eax进行 或 运算
:00451741 8D4304 lea eax, dword ptr [ebx+04]
:00451744 889060864800 mov byte ptr [eax+00488660], dl 将dl存到00488664当作第五个
:0045174A 43 inc ebx ebx++
:0045174B 83FB04 cmp ebx, 00000004 如果不是4
:0045174E 75CE jne 0045171E 就跳到回去（处理第5，7，9，11个注册码存到00488660的第5，6，7，8个）
:00451750 33DB xor ebx, ebx 否则ebx清0继续
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451782(C)
|
:00451752 8BF3 mov esi, ebx esi=ebx
:00451754 03F6 add esi, esi esi*2
:00451756 8BC6 mov eax, esi eax=esi
:00451758 83C00E add eax, 0000000E eax=14
:0045175B 8A0407 mov al, byte ptr [edi+eax] 第15位到al（eax改变）
:0045175E E881FEFFFF call 004515E4 转换
:00451763 C1E004 shl eax, 04 eax逻辑左移4位
:00451766 50 push eax eax入栈
:00451767 83C60F add esi, 0000000F esi+=15
:0045176A 8A0437 mov al, byte ptr [edi+esi] 第16位到al（eax改变）
:0045176D E872FEFFFF call 004515E4 转换
:00451772 5A pop edx 入栈的原eax值出栈到edx
:00451773 0BD0 or edx, eax 或运算（al已经变了）
:00451775 8D4308 lea eax, dword ptr [ebx+08]
:00451778 889060864800 mov byte ptr [eax+00488660], dl 存dl到目标第九位
:0045177E 43 inc ebx ebx++
:0045177F 83FB04 cmp ebx, 00000004 ebx等于4时
:00451782 75CE jne 00451752 停止循环（4次）（取注册码第（15，16），（17，18）（19，20）（21，22）位到目标第9，10，11，12位）
:00451784 8A4712 mov al, byte ptr [edi+12] 注册码第13位到al
:00451787 E858FEFFFF call 004515E4 转换(eax改变）
:0045178C 8BD8 mov ebx, eax ebx=eax
:0045178E C1E30C shl ebx, 0C ebx左移12位（16进制3位）
:00451791 8A4713 mov al, byte ptr [edi+13] 第14位到al
:00451794 E84BFEFFFF call 004515E4 转换(eax改变）
:00451799 C1E008 shl eax, 08 eax左移8位
:0045179C 0BD8 or ebx, eax ebx与eax或运算
:0045179E 8A4714 mov al, byte ptr [edi+14] 第15位到al
:004517A1 E83EFEFFFF call 004515E4 转换（eax改变）
:004517A6 C1E004 shl eax, 04 eax左移4位
:004517A9 0BD8 or ebx, eax ebx再与eax或
:004517AB 8A4715 mov al, byte ptr [edi+15] 第16位到al
:004517AE E831FEFFFF call 004515E4 转换(eax改变）
:004517B3 0BD8 or ebx, eax ebx再与eax或
:004517B5 8A4716 mov al, byte ptr [edi+16] 第17位到al
:004517B8 E827FEFFFF call 004515E4 转换(eax改变）
:004517BD 8BF0 mov esi, eax esi=eax
:004517BF C1E61C shl esi, 1C esi左移28位
:004517C2 8A4717 mov al, byte ptr [edi+17] 第18位到al
:004517C5 E81AFEFFFF call 004515E4 转换(eax改变）
:004517CA C1E018 shl eax, 18 eax左移24位
:004517CD 0BF0 or esi, eax esi与eax或
:004517CF 8A4718 mov al, byte ptr [edi+18] 第19位到al
:004517D2 E80DFEFFFF call 004515E4 转换(eax改变）
:004517D7 C1E014 shl eax, 14 eax左移20位
:004517DA 0BF0 or esi, eax esi再与eax或
:004517DC 8A4719 mov al, byte ptr [edi+19] 第20位
:004517DF E800FEFFFF call 004515E4
:004517E4 C1E010 shl eax, 10
:004517E7 0BF0 or esi, eax
:004517E9 8A471A mov al, byte ptr [edi+1A] 第21位
:004517EC E8F3FDFFFF call 004515E4
:004517F1 C1E00C shl eax, 0C
:004517F4 0BF0 or esi, eax
:004517F6 8A471B mov al, byte ptr [edi+1B] 第22位
:004517F9 E8E6FDFFFF call 004515E4
:004517FE C1E008 shl eax, 08
:00451801 0BF0 or esi, eax
:00451803 8A471C mov al, byte ptr [edi+1C] 第23位
:00451806 E8D9FDFFFF call 004515E4
:0045180B C1E004 shl eax, 04
:0045180E 0BF0 or esi, eax
:00451810 8A471D mov al, byte ptr [edi+1D] 第24位
:00451813 E8CCFDFFFF call 004515E4 调用（此位下面:0045181A的调用要用到）
:00451818 0BF0 or esi, eax esi再于eax或，结果到esi
:0045181A E861FDFFFF call 00451580 调用见下
:0045181F 3BD8 cmp ebx, eax 比较ebx与eax
:00451821 0F85F8000000 jne 0045191F 不等于就玩完
:00451827 E888FDFFFF call 004515B4 调用类似上一个
:0045182C 3BF0 cmp esi, eax 比较esi与eax
:0045182E 0F85EB000000 jne 0045191F 不等于就玩完
:00451834 8A4707 mov al, byte ptr [edi+07] 注册码第8位到al
:00451837 E8A8FDFFFF call 004515E4 还记得这个转换吧
:0045183C 83F803 cmp eax, 00000003 eax与3比较
:0045183F 0F85DA000000 jne 0045191F 不等于就玩完
:00451845 8A4708 mov al, byte ptr [edi+08]
:00451848 E897FDFFFF call 004515E4
:0045184D 83F802 cmp eax, 00000002
:00451850 0F85C9000000 jne 0045191F 不等于就玩完
:00451856 807F042D cmp byte ptr [edi+04], 2D
:0045185A 0F85BF000000 jne 0045191F 不等于就玩完
:00451860 807F0D2D cmp byte ptr [edi+0D], 2D
:00451864 0F85B5000000 jne 0045191F 不等于就玩完
:0045186A 8D45F0 lea eax, dword ptr [ebp-10] 、
:0045186D 8A17 mov dl, byte ptr [edi] |
:0045186F E89C1EFBFF call 00403710 |
:00451874 8B45F0 mov eax, dword ptr [ebp-10] |
:00451877 8D55F4 lea edx, dword ptr [ebp-0C] |
:0045187A E81546FBFF call 00405E94 》一个块
:0045187F 8B45F4 mov eax, dword ptr [ebp-0C] |
:00451882 BA5C194500 mov edx, 0045195C |
:00451887 E8F81FFBFF call 00403884 |
:0045188C 0F858D000000 jne 0045191F ~ 还是玩完
:00451892 8D45F0 lea eax, dword ptr [ebp-10]
:00451895 8A5701 mov dl, byte ptr [edi+01]
:00451898 E8731EFBFF call 00403710
:0045189D 8B45F0 mov eax, dword ptr [ebp-10]
:004518A0 8D55F4 lea edx, dword ptr [ebp-0C]
:004518A3 E8EC45FBFF call 00405E94
:004518A8 8B45F4 mov eax, dword ptr [ebp-0C]
:004518AB BA68194500 mov edx, 00451968
:004518B0 E8CF1FFBFF call 00403884
:004518B5 7568 jne 0045191F
:004518B7 8D45F0 lea eax, dword ptr [ebp-10]
:004518BA 8A5702 mov dl, byte ptr [edi+02]
:004518BD E84E1EFBFF call 00403710
:004518C2 8B45F0 mov eax, dword ptr [ebp-10]
:004518C5 8D55F4 lea edx, dword ptr [ebp-0C]
:004518C8 E8C745FBFF call 00405E94
:004518CD 8B45F4 mov eax, dword ptr [ebp-0C]
:004518D0 BA74194500 mov edx, 00451974
:004518D5 E8AA1FFBFF call 00403884
:004518DA 7543 jne 0045191F
:004518DC 8D45F0 lea eax, dword ptr [ebp-10]
:004518DF 8A5703 mov dl, byte ptr [edi+03]
:004518E2 E8291EFBFF call 00403710
:004518E7 8B45F0 mov eax, dword ptr [ebp-10]
:004518EA 8D55F4 lea edx, dword ptr [ebp-0C]
:004518ED E8A245FBFF call 00405E94
:004518F2 8B45F4 mov eax, dword ptr [ebp-0C]
:004518F5 BA80194500 mov edx, 00451980
:004518FA E8851FFBFF call 00403884
:004518FF 751E jne 0045191F
:00451901 8A4705 mov al, byte ptr [edi+05]
:00451904 E8DBFCFFFF call 004515E4 转换
:00451909 83F803 cmp eax, 00000003
:0045190C 7511 jne 0045191F 不等于就玩完
:0045190E 8A4706 mov al, byte ptr [edi+06]
:00451911 E8CEFCFFFF call 004515E4
:00451916 83F802 cmp eax, 00000002
:00451919 7504 jne 0045191F 不等于就玩完
:0045191B C645FF01 mov [ebp-01], 01
-------------------------------------------------------------------
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004516CD(C), :00451821(C), :0045182E(C), :0045183F(C), :00451850(C)
|:0045185A(C), :00451864(C), :0045188C(C), :004518B5(C), :004518DA(C)
|:004518FF(C), :0045190C(C), :00451919(C)
| 准备返回喽！
:0045191F 33C0 xor eax, eax
:00451921 5A pop edx
:00451922 59 pop ecx
:00451923 59 pop ecx
:00451924 648910 mov dword ptr fs:[eax], edx
:00451927 6849194500 push 00451949
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451947(U)
|
:0045192C 8D45F0 lea eax, dword ptr [ebp-10]
:0045192F BA02000000 mov edx, 00000002
:00451934 E8E71CFBFF call 00403620
:00451939 8D45F8 lea eax, dword ptr [ebp-08]
:0045193C E8BF1CFBFF call 00403600
:
:00451941 C3 ret
------------------------------------------------------
ASCII数字转16进制数字
* Referenced by a CALL at Addresses:
|:0045172A , :00451739 , :0045175E , :0045176D , :00451787
|:00451794 , :004517A1 , :004517AE , :004517B8 , :004517C5
|:004517D2 , :004517DF , :004517EC , :004517F9 , :00451806
|:00451813 , :00451837 , :00451848 , :00451904 , :00451911
|
:004515E4 3C30 cmp al, 30
:004515E6 7502 jne 004515EA
:004515E8 33D2 xor edx, edx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004515E6(C)
|
:004515EA 3C31 cmp al, 31
:004515EC 7505 jne 004515F3
:004515EE BA01000000 mov edx, 00000001
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004515EC(C)
|
:004515F3 3C32 cmp al, 32
:004515F5 7505 jne 004515FC
:004515F7 BA02000000 mov edx, 00000002
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004515F5(C)
|
:004515FC 3C33 cmp al, 33
:004515FE 7505 jne 00451605
:00451600 BA03000000 mov edx, 00000003
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004515FE(C)
|
:00451605 3C34 cmp al, 34
:00451607 7505 jne 0045160E
:00451609 BA04000000 mov edx, 00000004
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451607(C)
|
:0045160E 3C35 cmp al, 35
:00451610 7505 jne 00451617
:00451612 BA05000000 mov edx, 00000005
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451610(C)
|
:00451617 3C36 cmp al, 36
:00451619 7505 jne 00451620
:0045161B BA06000000 mov edx, 00000006
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451619(C)
|
:00451620 3C37 cmp al, 37
:00451622 7505 jne 00451629
:00451624 BA07000000 mov edx, 00000007
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451622(C)
|
:00451629 3C38 cmp al, 38
:0045162B 7505 jne 00451632
:0045162D BA08000000 mov edx, 00000008
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045162B(C)
|
:00451632 3C39 cmp al, 39
:00451634 7505 jne 0045163B
:00451636 BA09000000 mov edx, 00000009
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451634(C)
|
:0045163B 3C61 cmp al, 61
:0045163D 7404 je 00451643
:0045163F 3C41 cmp al, 41
:00451641 7505 jne 00451648
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045163D(C)
|
:00451643 BA0A000000 mov edx, 0000000A
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451641(C)
|
:00451648 3C62 cmp al, 62
:0045164A 7404 je 00451650
:0045164C 3C42 cmp al, 42
:0045164E 7505 jne 00451655
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045164A(C)
|
:00451650 BA0B000000 mov edx, 0000000B
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045164E(C)
|
:00451655 3C63 cmp al, 63
:00451657 7404 je 0045165D
:00451659 3C43 cmp al, 43
:0045165B 7505 jne 00451662
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451657(C)
|
:0045165D BA0C000000 mov edx, 0000000C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045165B(C)
|
:00451662 3C64 cmp al, 64
:00451664 7404 je 0045166A
:00451666 3C44 cmp al, 44
:00451668 7505 jne 0045166F
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451664(C)
|
:0045166A BA0D000000 mov edx, 0000000D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451668(C)
|
:0045166F 3C65 cmp al, 65
:00451671 7404 je 00451677
:00451673 3C45 cmp al, 45
:00451675 7505 jne 0045167C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451671(C)
|
:00451677 BA0E000000 mov edx, 0000000E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451675(C)
|
:0045167C 3C66 cmp al, 66
:0045167E 7404 je 00451684
:00451680 3C46 cmp al, 46
:00451682 7505 jne 00451689
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045167E(C)
|
:00451684 BA0F000000 mov edx, 0000000F
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451682(C)
|
:00451689 8BC2 mov eax, edx
:0045168B C3 ret
------------------------------------------------------------
* Referenced by a CALL at Address:
|:0045181A
|
:00451580 53 push ebx
:00451581 33D2 xor edx, edx edx清0
:00451583 B908000000 mov ecx, 00000008 ecx=00000008
:00451588 B860864800 mov eax, 00488660 eax=00488660 改变后存号码的地址
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004515A9(C)
|
:0045158D 33DB xor ebx, ebx ebx清0
:0045158F 8A18 mov bl, byte ptr [eax] 第一个到bl（ebx改变）
:00451591 33DA xor ebx, edx ebx与edx（dl为注册码第24位）异或
:00451593 81E3FF000000 and ebx, 000000FF ebx&000000FF（保留bl）
:00451599 8B1C9D745E4800 mov ebx, dword ptr [4*ebx+00485E74] ebx=[4*ebx+00485E74]地址的值（00485E74 转换表的地址）
:004515A0 C1EA08 shr edx, 08 edx右移8位（16进制2位）
:004515A3 33DA xor ebx, edx ebx与edx异或（ebx与edx合并）
:004515A5 8BD3 mov edx, ebx edx=ebx
:004515A7 40 inc eax eax++
:004515A8 49 dec ecx ecx--
:004515A9 75E2 jne 0045158D 循环8次（注册转换码前8个（共12个））
:004515AB 8BC2 mov eax, edx eax=edx
:004515AD 25FFFF0000 and eax, 0000FFFF eax&0000FFFF 只取高四位到eax
:004515B2 5B pop ebx 还原ebx
:004515B3 C3 ret
------------------------------------------------------------
* Referenced by a CALL at Address:
|:00451827
|
:004515B4 53 push ebx
:004515B5 33D2 xor edx, edx
:004515B7 B908000000 mov ecx, 00000008
:004515BC B864864800 mov eax, 00488664 从第5位开始
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004515DD(C)
|
:004515C1 33DB xor ebx, ebx
:004515C3 8A18 mov bl, byte ptr [eax]
:004515C5 33DA xor ebx, edx
:004515C7 81E3FF000000 and ebx, 000000FF
:004515CD 8B1C9D745E4800 mov ebx, dword ptr [4*ebx+00485E74]
:004515D4 C1EA08 shr edx, 08
:004515D7 33DA xor ebx, edx
:004515D9 8BD3 mov edx, ebx
:004515DB 40 inc eax
:004515DC 49 dec ecx
:004515DD 75E2 jne 004515C1 八次循环处理的是注册变换后码的8-12位
:004515DF 8BC2 mov eax, edx
:004515E1 5B pop ebx
:004515E2 C3 ret
---------------------------------------------------------
现在
继续
先试试暴力破解：找到那些跳转处一个个nop掉，呵呵成功！
现在
