下载地址：http://www.imoney.com.cn/download/software/mh2001plus.exe
8950k
1、运行winspect.exe，发现财智2001注册窗口的form名字为TRegisterFm。
关闭软件。
2、运行dede3.0，选择文件，点process，编译结束后点form，找到 TRegisterFm，看events
object RegisterFm: TRegisterFm
..........
object Panel2: TPanel
Left = 0
Top = 323
Width = 549
Height = 40
Align = alBottom
TabOrder = 1
object btnReg: TBitBtn
Left = 434
Top = 7
Width = 89
Height = 25
Caption = '完成注册'
TabOrder = 0
OnClick = btnRegClick//找到event，双击
Kind = bkOK
end
object btnCancel: TBitBtn
Left = 332
Top = 7
Width = 91
Height = 25
Caption = '稍后注册'
TabOrder = 1
Kind = bkCancel
end
....................
出现如下代码，分析
004C4E18 55
push ebp
004C4E19 8BEC
mov ebp, esp
004C4E1B 6A00
push $00
004C4E1D 53
push ebx
004C4E1E 8BD8
mov ebx, eax
004C4E20 33C0
xor eax, eax
004C4E22 55
push ebp
* Possible String Reference to: '長塍�腽[Y]?
|
004C4E23 68E74E4C00 push
$004C4EE7
***** TRY
|
004C4E28 64FF30
push dword ptr fs:[eax]
004C4E2B 648920
mov fs:[eax], esp
* Reference to control btnCancel : TBitBtn
|
004C4E2E 8B83FC020000 mov
eax, [ebx+$02FC]
004C4E34 80784700 cmp
byte ptr [eax+$47], $00
004C4E38 0F8493000000 jz
004C4ED1
004C4E3E 8D55FC
lea edx, [ebp-$04]
* Reference to control edRegCode : TEdit
|
004C4E41 8B83F4020000 mov
eax, [ebx+$02F4]
* Reference to: controls.TControl.GetText(TControl):System.String;
|
004C4E47 E8702CF7FF call
00437ABC
004C4E4C 8B45FC
mov eax, [ebp-$04]
|
004C4E4F E850F8FFFF call
004C46A4//关键call,跟入看看
004C4E54 84C0
test al, al
004C4E56 744F
jz 004C4EA7
004C4E58 A17CB96500 mov
eax, dword ptr [$65B97C]
004C4E5D 8B00
mov eax, [eax]
004C4E5F 8B55FC
mov edx, [ebp-$04]
|
004C4E62 E8E190FFFF call
004BDF48//存入注册表
004C4E67 6A00
push $00
004C4E69 668B0DF44E4C00 mov cx,
word ptr [$4C4EF4]
004C4E70 B202
mov dl, $02
* Possible String Reference to: '祝贺您,注册成功！'
|
004C4E72 B8004F4C00 mov
eax, $004C4F00
|
004C4E77 E818A5F9FF call
0045F394
004C4E7C 8D832C030000 lea
eax, [ebx+$032C]
004C4E82 8B55FC
mov edx, [ebp-$04]
* Reference to: system.@LStrAsg;
|
004C4E85 E886F1F3FF call
00404010
004C4E8A 8BC3
mov eax, ebx
|
004C4E8C E81FFCFFFF call
004C4AB0
004C4E91 C783300300000F270000 mov dword ptr [ebx+$0330],
$0000270F
004C4E9B C7833402000001000000 mov dword ptr [ebx+$0234],
$00000001
004C4EA5 EB2A
jmp 004C4ED1
004C4EA7 6A00
push $00
004C4EA9 668B0DF44E4C00 mov cx,
word ptr [$4C4EF4]
004C4EB0 B201
mov dl, $01
* Possible String Reference to: '对不起，注册失败,请校对注册码'
|
004C4EB2 B81C4F4C00 mov
eax, $004C4F1C
|
004C4EB7 E8D8A4F9FF call
0045F394
* Reference to control edRegCode : TEdit
|
004C4EBC 8B93F4020000 mov
edx, [ebx+$02F4]
004C4EC2 8BC3
mov eax, ebx
* Reference to: forms.TCustomForm.SetActiveControl(TCustomForm;Controls.TWinControl);
|
004C4EC4 E85FCBF8FF call
00451A28
004C4EC9 33C0
xor eax, eax
004C4ECB 898334020000 mov
[ebx+$0234], eax
004C4ED1 33C0
xor eax, eax
004C4ED3 5A
pop edx
004C4ED4 59
pop ecx
004C4ED5 59
pop ecx
004C4ED6 648910
mov fs:[eax], edx
****** FINALLY
|
* Possible String Reference to: '[Y]?
|
004C4ED9 68EE4E4C00 push
$004C4EEE
004C4EDE 8D45FC
lea eax, [ebp-$04]
* Reference to: system.@LStrClr(String);
|
004C4EE1 E8D6F0F3FF call
00403FBC
004C4EE6 C3
ret
004C4EE7 E94CEBF3FF jmp
00403A38
004C4EEC EBF0
jmp 004C4EDE
****** END
|
004C4EEE 5B
pop ebx
004C4EEF 59
pop ecx
004C4EF0 5D
pop ebp
004C4EF1 C3
ret
====================================================================================
那个call的内容如下：
004C46A4 55
push ebp
004C46A5 8BEC
mov ebp, esp
004C46A7 6A00
push $00
004C46A9 6A00
push $00
004C46AB 6A00
push $00
004C46AD 53
push ebx
004C46AE 8945FC
mov [ebp-$04], eax//输入的假注册码
004C46B1 8B45FC
mov eax, [ebp-$04]
* Reference to: system.@LStrAddRef;
|
004C46B4 E847FDF3FF call
00404400
004C46B9 33C0
xor eax, eax
004C46BB 55
push ebp
004C46BC 6819474C00 push
$004C4719
***** TRY
|
004C46C1 64FF30
push dword ptr fs:[eax]
004C46C4 648920
mov fs:[eax], esp
004C46C7 8D45F4
lea eax, [ebp-$0C]
|
004C46CA E831FFFFFF call
004C4600
004C46CF 8B45F4
mov eax, [ebp-$0C]//机器码
004C46D2 8D55F8
lea edx, [ebp-$08]
|
004C46D5 E846FFFFFF call
004C4620
004C46DA 8B45F8
mov eax, [ebp-$08]
|
004C46DD E8FAFCFFFF call
004C43DC//此处下d eax可看到真的注册码
004C46E2 8BD8
mov ebx, eax
004C46E4 8B45FC
mov eax, [ebp-$04]
|
004C46E7 E8F0FCFFFF call
004C43DC
004C46EC 85C0
test eax, eax
004C46EE 7504
jnz 004C46F4
004C46F0 33DB
xor ebx, ebx
004C46F2 EB0A
jmp 004C46FE
004C46F4 3BC3
cmp eax, ebx
004C46F6 7504
jnz 004C46FC
004C46F8 B301
mov bl, $01
004C46FA EB02
jmp 004C46FE
004C46FC 33DB
xor ebx, ebx
004C46FE 33C0
xor eax, eax
004C4700 5A
pop edx
004C4701 59
pop ecx
004C4702 59
pop ecx
004C4703 648910
mov fs:[eax], edx
****** FINALLY
3、运行trw，下bpx 004C46DD， 中断后d eax 看到我的注册码
3126-0351
重新输入注册码，注册成功
- 标 题：学习篇---用dede3.0破财智2001家庭理财加强版注册版 (7千字)
- 作 者：staray
- 时 间：2002-3-11 16:58:48
- 链 接：http://bbs.pediy.com