软件大小： 799
KB
软件语言： 英文
软件类别： 国外软件 / 共享版 / 下载工具
应用平台： Win9x/NT/2000/XP
加入时间： 2003-07-05 09:48:51
下载次数： 5008
推荐等级： ★★★
软件下载: http://count.skycn.com/softdown.php?id=9310&url=http://gd-http.skycn.net:8080/down/fdt.zip
软件介绍：
Flashdown让你将Internet网页中的Flash动画文件下载到电脑中,Flash精简的文件大小与音效支持功能成为许多人的最爱，因此是目前常见的网络动画文件格式。不过当你想要将这些网页上的动画放到自己的电脑内慢慢欣赏时，就会发现这些文件并无法让你下载。不过这个问题遇上了Flashdown就能迎刃而解。
破解工具：TRW1.22,OllyDbg1.09,PWdasm
作者声明：初学破解，仅作学习交流之用，失误之处敬请大侠赐教!
软件未加壳,VC编写,用bpx getwindowtexta下断,OD载入分析!
【简要过程】:
用户名:ShenGe[BCG]
试验码:12345678908765
.............(略)
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:0043687A(C)
|
:0043688A 52
push edx
:0043688B 68D8525300 push
005352D8
:00436890 E86B1A0300 call
00468300
:00436895 83C408 add
esp, 00000008
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:00436854(C)
|
:00436898 8B542414 mov
edx, dword ptr [esp+14]
<===edx="12345678908765",试验码
:0043689C 837AF40E cmp
dword ptr [edx-0C], 0000000E
<===判断试验码长度是否为14位
:004368A0 0F8522010000 jne 004369C8
:004368A6 8B442410 mov
eax, dword ptr [esp+10]
<===eax="ShenGe[BCG]",用户名
:004368AA 3958F4 cmp
dword ptr [eax-0C], ebx
<===判断有无输入用户名
:004368AD 0F8E15010000 jle 004369C8
:004368B3 6A04
push 00000004
<===入栈参数1
:004368B5 8D4C2420 lea
ecx, dword ptr [esp+20]
:004368B9 51
push ecx
:004368BA 8D4C241C lea
ecx, dword ptr [esp+1C]
<===[ecx]="12345678908765"
:004368BE E80D6DFEFF call
0041D5D0
<===取试验码的前4位为"1234"
:004368C3 B302
mov bl, 02
:004368C5 8D4C2410 lea
ecx, dword ptr [esp+10]
<===ecx="ShenGe[BCG]",用户名
:004368C9 885C242C mov
byte ptr [esp+2C], bl
:004368CD E8FEC5FCFF call
00402ED0
<===此Call将字母大写转小写
:004368D2 8B442410 mov
eax, dword ptr [esp+10]
<===eax="shenge[bcg]"
:004368D6 51
push ecx
:004368D7 83C0F0 add
eax, FFFFFFF0
:004368DA 8964241C mov
dword ptr [esp+1C], esp
:004368DE 8BFC
mov edi, esp
:004368E0 50
push eax
:004368E1 E8FAB4FCFF call
00401DE0
:004368E6 83C010 add
eax, 00000010
:004368E9 8907
mov dword ptr [edi], eax
:004368EB 8B6C2424 mov
ebp, dword ptr [esp+24]
:004368EF 83C5F0 add
ebp, FFFFFFF0
:004368F2 89642428 mov
dword ptr [esp+28], esp
:004368F6 8BFC
mov edi, esp
:004368F8 55
push ebp
:004368F9 C644243803 mov [esp+38],
03
:004368FE E8DDB4FCFF call
00401DE0
:00436903 83C010 add
eax, 00000010
:00436906 83C404 add
esp, 00000004
:00436909 8907
mov dword ptr [edi], eax
<===[edi]="1234",试验码前4位
:0043690B 885C2434 mov
byte ptr [esp+34], bl
<===[esp+34]=bl=02
:0043690F E87CFBFFFF call
00436490
<===追算法的话跟进此Call!①
:00436914 83C408 add
esp, 00000008
:00436917 83F801 cmp
eax, 00000001
:0043691A 8BCE
mov ecx, esi
:0043691C 7521
jne 0043693F
:0043691E C7467803000000 mov [esi+78], 00000003
:00436925 8B15E07C5700 mov edx, dword
ptr [00577CE0]
:0043692B C782B001000020000000 mov dword ptr [ebx+000001B0],
00000020
:00436935 8B06
mov eax, dword ptr [esi]
:00436937 FF904C010000 call dword
ptr [eax+0000014C]
:0043693D EB6B
jmp 004369AA
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:0043691C(C)
|
:0043693F 8B7E70 mov
edi, dword ptr [esi+70]
:00436942 47
inc edi
:00436943 6874040000 push
00000474
:00436948 897E70 mov
dword ptr [esi+70], edi
:0043694B E877A90C00 call
005012C7
:00436950 8BF0
mov esi, eax
:00436952 E8C3B50C00 call
00501F1A
:00436957 8B10
mov edx, dword ptr [eax]
:00436959 8BC8
mov ecx, eax
:0043695B FF520C call
[edx+0C]
:0043695E 83C010 add
eax, 00000010
:00436961 89442418 mov
dword ptr [esp+18], eax
* Possible Reference to String
Resource ID=00151: "Incomplete or incorrect information."
|
:00436965 6897000000 push
00000097
:0043696A 8D4C241C lea
ecx, dword ptr [esp+1C]
:0043696E C644243004 mov [esp+30],
04
:00436973 E8F8C5FCFF call
00402F70
:00436978 8B7C2418 mov
edi, dword ptr [esp+18]
:0043697C 57
push edi
:0043697D 8BCE
mov ecx, esi
:0043697F E867AA0C00 call
005013EB
:00436984 6AFF
push FFFFFFFF
★★★★★★★★★★★★★★★★★★
①跟进这个关键的Call,来到如下代码:
:00436490 6AFF
push FFFFFFFF
:00436492 683B5A5200 push
00525A3B
:00436497 64A100000000 mov eax, dword
ptr fs:[00000000]
:0043649D 50
push eax
:0043649E 64892500000000 mov dword ptr fs:[00000000],
esp
:004364A5 81EC40010000 sub esp, 00000140
:004364AB 53
push ebx
:004364AC 55
push ebp
:004364AD 56
push esi
:004364AE 57
push edi
:004364AF BD01000000 mov ebp,
00000001
:004364B4 33C9
xor ecx, ecx
:004364B6 89AC2458010000 mov dword ptr [esp+00000158],
ebp
:004364BD 894C2418 mov
dword ptr [esp+18], ecx
:004364C1 C744242417000000 mov [esp+24], 00000017
:004364C9 C744241C05000000 mov [esp+1C], 00000005
:004364D1 896C2420 mov
dword ptr [esp+20], ebp
:004364D5 33C0
xor eax, eax
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004364E4(C)
:004364D7 8AD0
mov dl, al
:004364D9 80C241 add
dl, 41
:004364DC 8854042C mov
byte ptr [esp+eax+2C], dl
:004364E0 40
inc eax
:004364E1 83F81A cmp
eax, 0000001A
:004364E4 7CF1
jl 004364D7
:004364E6 C644244630 mov [esp+46],
30
:004364EB C644244731 mov [esp+47],
31
:004364F0 C644244832 mov [esp+48],
32
:004364F5 C644244933 mov [esp+49],
33
:004364FA C644244A34 mov [esp+4A],
34
:004364FF C644244B35 mov [esp+4B],
35
:00436504 C644244C36 mov [esp+4C],
36
:00436509 C644244D37 mov [esp+4D],
37
:0043650E C644244E38 mov [esp+4E],
38
:00436513 C644244F39 mov [esp+4F],
39
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
这1段给[esp+eax+2c]始的内存处赋值字符A～Z,0～9,如下:
0088F714 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 ABCDEFGHIJKLMNOP
0088F724 51 52 53 54 55 56 57 58 59 5A 30 31 32 33 34 35 QRSTUVWXYZ012345
0088F734 36 37 38 39 01 00 00 00 92 00 00 00 04 00 00 80 6789...?....�0
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:00436531(C)
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
:00436518 8BC1
mov eax, ecx
:0043651A 99
cdq
:0043651B BE24000000 mov esi,
00000024
:00436520 F7FE
idiv esi
:00436522 41
inc ecx
:00436523 81F900010000 cmp ecx, 00000100
:00436529 8A44142C mov
al, byte ptr [esp+edx+2C]
:0043652D 88440C4F mov
byte ptr [esp+ecx+4F], al
:00436531 7CE5
jl 00436518
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
还是复制字符操作,把上面内存中赋值的36个字符连续复制7次,结果如下:
0088F738 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 ABCDEFGHIJKLMNOP
0088F748 51 52 53 54 55 56 57 58 59 5A 30 31 32 33 34 35 QRSTUVWXYZ012345
0088F758 36 37 38 39 41 42 43 44 45 46 47 48 49 4A 4B 4C 6789ABCDEFGHIJKL
0088F768 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 30 31 MNOPQRSTUVWXYZ01
0088F778 32 33 34 35 36 37 38 39 41 42 43 44 45 46 47 48 23456789ABCDEFGH
0088F788 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 IJKLMNOPQRSTUVWX
0088F798 59 5A 30 31 32 33 34 35 36 37 38 39 41 42 43 44 YZ0123456789ABCD
0088F7A8 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 EFGHIJKLMNOPQRST
0088F7B8 55 56 57 58 59 5A 30 31 32 33 34 35 36 37 38 39 UVWXYZ0123456789
0088F7C8 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 ABCDEFGHIJKLMNOP
0088F7D8 51 52 53 54 55 56 57 58 59 5A 30 31 32 33 34 35 QRSTUVWXYZ012345
0088F7E8 36 37 38 39 41 42 43 44 45 46 47 48 49 4A 4B 4C 6789ABCDEFGHIJKL
0088F7F8 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 30 31 MNOPQRSTUVWXYZ01
0088F808 32 33 34 35 36 37 38 39 41 42 43 44 45 46 47 48 23456789ABCDEFGH
0088F818 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 IJKLMNOPQRSTUVWX
0088F828 59 5A 30 31 32 33 34 35 36 37 38 39 41 42 43 44 YZ0123456789ABCD
:00436533 8BB42464010000
mov esi, dword ptr [esp+00000164]
:0043653A 51
push ecx
:0043653B 8D7EF0 lea
edi, dword ptr [esi-10]
:0043653E 89642418 mov
dword ptr [esp+18], esp
:00436542 8BDC
mov ebx, esp
:00436544 57
push edi
:00436545 897C241C mov
dword ptr [esp+1C], edi
:00436549 E892B8FCFF call
00401DE0
:0043654E 83C010 add
eax, 00000010
:00436551 83C404 add
esp, 00000004
:00436554 8903
mov dword ptr [ebx], eax
<---[ebx]="shenge[bcg]"
:00436556 E885ED0200 call
004652E0
:0043655B 83C404 add
esp, 00000004
:0043655E 85C0
test eax, eax
:00436560 754E
jne 004365B0
:00436562 88842458010000 mov byte ptr [esp+00000158],
al
:00436569 8B842460010000 mov eax, dword
ptr [esp+00000160]
:00436570 83C0F0 add
eax, FFFFFFF0
:00436573 8D480C lea
ecx, dword ptr [eax+0C]
:00436576 83CAFF or
edx, FFFFFFFF
:00436579 F0
lock
:0043657A 0FC111 xadd
dword ptr [ecx], edx
:0043657D 4A
dec edx
:0043657E 85D2
test edx, edx
:00436580 7F08
jg 0043658A
:00436582 8B08
mov ecx, dword ptr [eax]
:00436584 8B11
mov edx, dword ptr [ecx]
:00436586 50
push eax
:00436587 FF5204 call
[edx+04]
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:00436580(C)
|
:0043658A C7842458010000FFFFFFFF mov dword ptr [esp+00000158], FFFFFFFF
:00436595 8D470C lea
eax, dword ptr [edi+0C]
:00436598 83C9FF or
ecx, FFFFFFFF
:0043659B F0
lock
:0043659C 0FC108 xadd
dword ptr [eax], ecx
:0043659F 49
dec ecx
:004365A0 85C9
test ecx, ecx
:004365A2 0F8FC0010000 jg 00436768
:004365A8 8B0F
mov ecx, dword ptr [edi]
:004365AA 57
push edi
:004365AB E9B3010000 jmp 00436763
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:00436560(C)
|
:004365B0 8B46F4 mov
eax, dword ptr [esi-0C]
:004365B3 33C9
xor ecx, ecx
:004365B5 85C0
test eax, eax
:004365B7 7E1B
jle 004365D4
:004365B9 8DA42400000000 lea esp, dword
ptr [esp]
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004365D2(C)
|
:004365C0 0FB61431 movzx
edx, byte ptr [ecx+esi]
<===按位取"shenge[bcg]"的字符值到edx中
<===dl=73
<===dl=68
......(略)
:004365C4 8B7C241C
mov edi, dword ptr [esp+1C]
<===edi中的初始值为5
<===edi=EB
......(略)
:004365C8 41
inc ecx
:004365C9 3BC8
cmp ecx, eax
<===比较是否取完用户名
:004365CB 8D1457 lea
edx, dword ptr [edi+2*edx]
<===edx=6+2*73=EB
<===edx=EB+2*68=1BB
......(略)
:004365CE 8954241C
mov dword ptr [esp+1C], edx
<===结果存入[esp+1c]中循环结束后我的
结果为:8C1
:004365D2 7CEC
jl 004365C0
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004365B7(C)
|
:004365D4 33C9
xor ecx, ecx
:004365D6 85C0
test eax, eax
:004365D8 7E19
jle 004365F3
:004365DA 8D9B00000000 lea ebx, dword
ptr [ebx+00000000]
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004365ED(C)
|
:004365E0 0FB61431 movzx
edx, byte ptr [ecx+esi]
<===按位取"shenge[bcg]"的字符值到edx中
<===dl=73
<===dl=68
......(略)
:004365E4 41
inc ecx
:004365E5 3BC8
cmp ecx, eax
<===比较是否取完用户名
:004365E7 8D3C2A lea
edi, dword ptr [edx+ebp]
<===edi=edx+ebp=74,ebp的初值为1
<===edi=68+15A=1C2
......(略)
:004365EA 8D2C57
lea ebp, dword ptr [edi+2*edx]
<===ebp=74+2*73=15A
<===ebp=1C2+2*68=292
......(略)
我最后的结果为:<===ebp=D1B
:004365ED 7CF1
jl 004365E0
:004365EF 896C2420 mov
dword ptr [esp+20], ebp
<===最后结果存入[esp+20]中
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004365D8(C)
|
:004365F3 33C9
xor ecx, ecx
:004365F5 85C0
test eax, eax
:004365F7 7E1B
jle 00436614
:004365F9 8DA42400000000 lea esp, dword
ptr [esp]
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:00436612(C)
|
:00436600 0FB61431 movzx
edx, byte ptr [ecx+esi]
<===按位取"shenge[bcg]"的字符值到edx中
<===dl=73
<===dl=68
......(略)
:00436604 8B7C2424 mov
edi, dword ptr [esp+24]
<===edi中的初始值为17
<===edi=1E3
......(略)
:00436608 41
inc ecx
:00436609 3BC8
cmp ecx, eax
<===比较是否取完用户名
:0043660B 8D1497 lea
edx, dword ptr [edi+4*edx]
<===edx=17+4*73=1E3
<===edx=1E3+4*68=383
......(略)
:0043660E 89542424 mov
dword ptr [esp+24], edx
<===结果存入[esp+24]中,我最后得
到的结果为:118F
:00436612 7CEC
jl 00436600
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004365F7(C)
|
:00436614 8B44241C mov
eax, dword ptr [esp+1C]
<===eax=8C1,第1次计算结果
:00436618 8B4C2424 mov
ecx, dword ptr [esp+24]
<===ecx=118F,第3次计算结果
:0043661C 03C5
add eax, ebp
<===eax=8C1+D1B=15DC,ebp中为第2次计算结果
:0043661E 03C1
add eax, ecx
<===eax=15DC+118F=276B
:00436620 89442418 mov
dword ptr [esp+18], eax
:00436624 E8F1B80C00 call
00501F1A
:00436629 8B10
mov edx, dword ptr [eax]
:0043662B 8BC8
mov ecx, eax
:0043662D FF520C call
[edx+0C]
:00436630 8D7010 lea
esi, dword ptr [eax+10]
:00436633 89742428 mov
dword ptr [esp+28], esi
:00436637 C684245801000002 mov byte ptr [esp+00000158],
02
:0043663F 33ED
xor ebp, ebp
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:00436687(C)
|
:00436641 0FB644AC18 movzx
eax, byte ptr [esp+4*ebp+18]
<===还记得上面得到的结果吗,上面一段没加注释的代
码应该是内存复制操作,此时在内存中看到的为
6B 27 00 00 C1 08 00 00 1B 0D 00 00 8F 11 00 00
上面的第4、1、2、3次计算结果,取低位
<===eax=6B
<===eax=C1
<===eax=1B
<===eax=8F
:00436646 8A4C0450 mov
cl, byte ptr [esp+eax+50]
<===根据eax值查表,此表详见前面代码:436531处所列
<===cl=39--->"9"
<===cl=4E--->"N"
<===cl=31--->"1"
<===cl=39--->"9"
:0043664A 8B46FC mov
eax, dword ptr [esi-04]
:0043664D 8B5EF4 mov
ebx, dword ptr [esi-0C]
:00436650 884C2410 mov
byte ptr [esp+10], cl
:00436654 B901000000 mov ecx,
00000001
:00436659 2BC8
sub ecx, eax
:0043665B 8B46F8 mov
eax, dword ptr [esi-08]
:0043665E 8D7B01 lea
edi, dword ptr [ebx+01]
:00436661 2BC7
sub eax, edi
:00436663 0BC1
or eax, ecx
:00436665 7D0E
jge 00436675
:00436667 57
push edi
:00436668 8D4C242C lea
ecx, dword ptr [esp+2C]
:0043666C E81FB7FCFF call
00401D90
:00436671 8B742428 mov
esi, dword ptr [esp+28]
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:00436665(C)
|
:00436675 8A542410 mov
dl, byte ptr [esp+10]
:00436679 881433 mov
byte ptr [ebx+esi], dl
<===上面查表的结果存入[ebx+esi]中,最后
为"9N19"
:0043667C 45
inc ebp
:0043667D 83FD04 cmp
ebp, 00000004
:00436680 897EF4 mov
dword ptr [esi-0C], edi
:00436683 C6043700 mov
byte ptr [edi+esi], 00
:00436687 7CB8
jl 00436641
:00436689 8BBC2460010000 mov edi, dword
ptr [esp+00000160]
<===edi="1234",试验码前4位
:00436690 57
push edi
:00436691 56
push esi
<===esi="9N19",嗬嗬,太明显了吧!
:00436692 E880D80600 call
004A3F17
:00436697 83C408 add
esp, 00000008
:0043669A 83CAFF or
edx, FFFFFFFF
:0043669D 85C0
test eax, eax
:0043669F 8D46F0 lea
eax, dword ptr [esi-10]
:004366A2 C684245801000001 mov byte ptr [esp+00000158],
01
:004366AA 8D480C lea
ecx, dword ptr [eax+0C]
:004366AD 7560
jne 0043670F
<===不能跳噢!
:004366AF F0
lock
:004366B0 0FC111 xadd
dword ptr [ecx], edx
:004366B3 4A
dec edx
:004366B4 85D2
test edx, edx
:004366B6 7F08
jg 004366C0
:004366B8 8B08
mov ecx, dword ptr [eax]
:004366BA 8B11
mov edx, dword ptr [ecx]
:004366BC 50
push eax
:004366BD FF5204 call
[edx+04]
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004366B6(C)
|
:004366C0 8D47F0 lea
eax, dword ptr [edi-10]
:004366C3 C684245801000000 mov byte ptr [esp+00000158],
00
:004366CB 8D480C lea
ecx, dword ptr [eax+0C]
:004366CE 83CAFF or
edx, FFFFFFFF
:004366D1 F0
lock
:004366D2 0FC111 xadd
dword ptr [ecx], edx
:004366D5 4A
dec edx
:004366D6 85D2
test edx, edx
:004366D8 7F08
jg 004366E2
:004366DA 8B08
mov ecx, dword ptr [eax]
:004366DC 8B11
mov edx, dword ptr [ecx]
:004366DE 50
push eax
:004366DF FF5204 call
[edx+04]
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004366D8(C)
|
:004366E2 8B442414 mov
eax, dword ptr [esp+14]
:004366E6 C7842458010000FFFFFFFF mov dword ptr [esp+00000158], FFFFFFFF
:004366F1 8D480C lea
ecx, dword ptr [eax+0C]
:004366F4 83CAFF or
edx, FFFFFFFF
:004366F7 F0
lock
:004366F8 0FC111 xadd
dword ptr [ecx], edx
:004366FB 4A
dec edx
:004366FC 85D2
test edx, edx
:004366FE 7F08
jg 00436708
:00436700 8B08
mov ecx, dword ptr [eax]
:00436702 8B11
mov edx, dword ptr [ecx]
:00436704 50
push eax
:00436705 FF5204 call
[edx+04]
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004366FE(C)
|
:00436708 B801000000 mov eax,
00000001
<===eax=1!
:0043670D EB5B
jmp 0043676A
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004366AD(C)
|
:0043670F F0
lock
:00436710 0FC111 xadd
dword ptr [ecx], edx
:00436713 4A
dec edx
:00436714 85D2
test edx, edx
:00436716 7F08
jg 00436720
:00436718 8B08
mov ecx, dword ptr [eax]
:0043671A 8B11
mov edx, dword ptr [ecx]
:0043671C 50
push eax
:0043671D FF5204 call
[edx+04]
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:00436716(C)
|
:00436720 8D47F0 lea
eax, dword ptr [edi-10]
:00436723 C684245801000000 mov byte ptr [esp+00000158],
00
:0043672B 8D480C lea
ecx, dword ptr [eax+0C]
:0043672E 83CAFF or
edx, FFFFFFFF
:00436731 F0
lock
:00436732 0FC111 xadd
dword ptr [ecx], edx
:00436735 4A
dec edx
:00436736 85D2
test edx, edx
:00436738 7F08
jg 00436742
:0043673A 8B08
mov ecx, dword ptr [eax]
:0043673C 8B11
mov edx, dword ptr [ecx]
:0043673E 50
push eax
:0043673F FF5204 call
[edx+04]
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:00436738(C)
|
:00436742 8B442414 mov
eax, dword ptr [esp+14]
:00436746 C7842458010000FFFFFFFF mov dword ptr [esp+00000158], FFFFFFFF
:00436751 8D480C lea
ecx, dword ptr [eax+0C]
:00436754 83CAFF or
edx, FFFFFFFF
:00436757 F0
lock
:00436758 0FC111 xadd
dword ptr [ecx], edx
:0043675B 4A
dec edx
:0043675C 85D2
test edx, edx
:0043675E 7F08
jg 00436768
:00436760 8B08
mov ecx, dword ptr [eax]
:00436762 50
push eax
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004365AB(U)
|
:00436763 8B11
mov edx, dword ptr [ecx]
:00436765 FF5204 call
[edx+04]
* Referenced by a (U)nconditional
or (C)onditional Jump at Addresses:
|:004365A2(C), :0043675E(C)
|
:00436768 33C0
xor eax, eax
<===eax=0!
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:0043670D(U)
|
:0043676A 8B8C2450010000 mov ecx, dword
ptr [esp+00000150]
:00436771 5F
pop edi
:00436772 5E
pop esi
:00436773 5D
pop ebp
:00436774 64890D00000000 mov dword ptr fs:[00000000],
ecx
:0043677B 5B
pop ebx
:0043677C 81C44C010000 add esp, 0000014C
:00436782 C3
ret
【总结】:注册码的必须为14位,前4位与用户名有关,后10位任意.
给出一个可用注册码:
用户名:ShenGe[BCG]
注册码:9N195678908765
补充一点，破解后再次运行程序它又跳出对话框要求注册，输入后又可以用了，我开始以为程序重启后还有一次判断，但跟了半天没有结果，也未发现程序中有暗桩,还是请高手有空看看吧!我猜想软件就是做成这样的吧！？：P
Cracked
By ShenGe[BCG] 2003.07.06