【破解作者】 落魄浪子
【使用工具】 FlyOD1.1
【破解平台】 Win9x/NT/2000/XP
【软件名称】 智能开关机 V3.20
【下载地址】 http://www.gwbsoft.com
【破解声明】 我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------------------------
【破解内容】
因为我有时在星期六下班时电脑还在工作，而星期天又没有来。那电脑就这样一直开着，又不想自已来关，所以
下了这个软件好让它在完成任务后自已关机。启动软件，30天限制.
开启OD载入程序，找到出错的地方并在关键点下断：
004B7C73 |. 8B45 E0 mov eax,dword ptr ss:[ebp-20] 断在这里，机器码入EAX
004B7C76 |. 8D4D E4 lea ecx,dword ptr ss:[ebp-1C]
004B7C79 |. BA 987E4B00 mov edx,autoss.004B7E98 ; ASCII "DS$%^TG"预置数入EDX
004B7C7E |. E8 51CA0200 call autoss.004E46D4 进入看看
----------------------------------------------------------------------------
004E46D4 /$ 55 push ebp 进入后来到这里
004E46D5 |. 8BEC mov ebp,esp
004E46D7 |. 83C4 F0 add esp,-10
004E46DA |. 53 push ebx
004E46DB |. 56 push esi
004E46DC |. 57 push edi
004E46DD |. 894D F4 mov dword ptr ss:[ebp-C],ecx
004E46E0 |. 8955 F8 mov dword ptr ss:[ebp-8],edx 预置数
004E46E3 |. 8945 FC mov dword ptr ss:[ebp-4],eax 机器码
004E46E6 |. 8B45 FC mov eax,dword ptr ss:[ebp-4] 机器码
004E46E9 |. E8 8200F2FF call autoss.00404770
004E46EE |. 8B45 F8 mov eax,dword ptr ss:[ebp-8] 预置数
004E46F1 |. E8 7A00F2FF call autoss.00404770
004E46F6 |. 33C0 xor eax,eax
004E46F8 |. 55 push ebp
004E46F9 |. 68 9E474E00 push autoss.004E479E
004E46FE |. 64:FF30 push dword ptr fs:[eax]
004E4701 |. 64:8920 mov dword ptr fs:[eax],esp
004E4704 |. 837D F8 00 cmp dword ptr ss:[ebp-8],0 比较预置数是否为空
004E4708 |. 75 0D jnz short autoss.004E4717 为空则预置数为"TG^u"
004E470A |. 8D45 F8 lea eax,dword ptr ss:[ebp-8]
004E470D |. BA B4474E00 mov edx,autoss.004E47B4 ; ASCII "TG^u"
004E4712 |. E8 41FCF1FF call autoss.00404358
004E4717 |> BE 01000000 mov esi,1 初始计数器1
004E471C |. 8B45 FC mov eax,dword ptr ss:[ebp-4] 机器码入EAX
004E471F |. E8 5CFEF1FF call autoss.00404580 取长度
004E4724 |. 8BF8 mov edi,eax
004E4726 |. 85FF test edi,edi
004E4728 |. 7E 4E jle short autoss.004E4778
004E472A |. BB 01000000 mov ebx,1 初始计数器2
004E472F |> 8B45 FC /mov eax,dword ptr ss:[ebp-4] 机器码入EAX
004E4732 |. 8A4418 FF |mov al,byte ptr ds:[eax+ebx-1] 取机器码的一位的HEX入AL记为S1
004E4736 |. 24 0F |and al,0F S1与0F作与运算结果记为N1
004E4738 |. 8B55 F8 |mov edx,dword ptr ss:[ebp-8] 预置数"DS$%^TG"入EDX
004E473B |. 8A5432 FF |mov dl,byte ptr ds:[edx+esi-1] 取预置数的一位的HEX入DL记为S2
004E473F |. 80E2 0F |and dl,0F S2与0F作与运算结果记为N2
004E4742 |. 32C2 |xor al,dl N1与N2异或运算结果记为N3
004E4744 |. 8845 F3 |mov byte ptr ss:[ebp-D],al
004E4747 |. 8D45 FC |lea eax,dword ptr ss:[ebp-4]
004E474A |. E8 8900F2FF |call autoss.004047D8
004E474F |. 8B55 FC |mov edx,dword ptr ss:[ebp-4] 机器码入EDX
004E4752 |. 8A541A FF |mov dl,byte ptr ds:[edx+ebx-1] 取机器码的一位的HEX记为S3
004E4756 |. 80E2 F0 |and dl,0F0 S3与0F0作与运算结果记为N4
004E4759 |. 8A4D F3 |mov cl,byte ptr ss:[ebp-D] N3入CL
004E475C |. 02D1 |add dl,cl N4加N3结果记为N5
004E475E |. 885418 FF |mov byte ptr ds:[eax+ebx-1],dl
004E4762 |. 46 |inc esi 计数器1加1
004E4763 |. 8B45 F8 |mov eax,dword ptr ss:[ebp-8] 预置数"DS$%^TG"入EAX
004E4766 |. E8 15FEF1FF |call autoss.00404580 取长度
004E476B |. 3BF0 |cmp esi,eax
004E476D |. 7E 05 |jle short autoss.004E4774 是否取完
004E476F |. BE 01000000 |mov esi,1 取完则再初始计数器1
004E4774 |> 43 |inc ebx 计数器2加1
004E4775 |. 4F |dec edi 机器码长度减1
004E4776 |.^ 75 B7 \jnz short autoss.004E472F 没有完则继续
004E4778 |> 8B45 F4 mov eax,dword ptr ss:[ebp-C]
004E477B |. 8B55 FC mov edx,dword ptr ss:[ebp-4] 这就是计算完的后9位注册码
004E477E |. E8 91FBF1FF call autoss.00404314
004E4783 |. 33C0 xor eax,eax
004E4785 |. 5A pop edx
004E4786 |. 59 pop ecx
004E4787 |. 59 pop ecx
004E4788 |. 64:8910 mov dword ptr fs:[eax],edx
004E478B |. 68 A5474E00 push autoss.004E47A5
004E4790 |> 8D45 F8 lea eax,dword ptr ss:[ebp-8]
004E4793 |. BA 02000000 mov edx,2
004E4798 |. E8 47FBF1FF call autoss.004042E4
004E479D \. C3 retn
004E479E .^ E9 7DF4F1FF jmp autoss.00403C20
004E47A3 .^ EB EB jmp short autoss.004E4790
004E47A5 . 5F pop edi
004E47A6 . 5E pop esi
004E47A7 . 5B pop ebx
004E47A8 . 8BE5 mov esp,ebp
004E47AA . 5D pop ebp
004E47AB . C3 retn 返回
----------------------------------------------------------------------------
004B7C83 |. 8B45 E4 mov eax,dword ptr ss:[ebp-1C] 返回到这里
004B7C86 |. 50 push eax
004B7C87 |. 8D55 D8 lea edx,dword ptr ss:[ebp-28]
004B7C8A |. 8B83 48030000 mov eax,dword ptr ds:[ebx+348]
004B7C90 |. E8 DBDFF9FF call autoss.00455C70
004B7C95 |. 8B45 D8 mov eax,dword ptr ss:[ebp-28] 机器码入EAX
004B7C98 |. 8D55 DC lea edx,dword ptr ss:[ebp-24]
004B7C9B |. E8 1CCB0200 call autoss.004E47BC 进入看看
----------------------------------------------------------------------------
004E47BC /$ 55 push ebp 进入后来到这里
004E47BD |. 8BEC mov ebp,esp
004E47BF |. 33C9 xor ecx,ecx
004E47C1 |. 51 push ecx
004E47C2 |. 51 push ecx
004E47C3 |. 51 push ecx
004E47C4 |. 51 push ecx
004E47C5 |. 51 push ecx
004E47C6 |. 53 push ebx
004E47C7 |. 56 push esi
004E47C8 |. 57 push edi
004E47C9 |. 8955 F8 mov dword ptr ss:[ebp-8],edx
004E47CC |. 8945 FC mov dword ptr ss:[ebp-4],eax
004E47CF |. 8B45 FC mov eax,dword ptr ss:[ebp-4]
004E47D2 |. E8 99FFF1FF call autoss.00404770
004E47D7 |. 33C0 xor eax,eax
004E47D9 |. 55 push ebp
004E47DA |. 68 91484E00 push autoss.004E4891
004E47DF |. 64:FF30 push dword ptr fs:[eax]
004E47E2 |. 64:8920 mov dword ptr fs:[eax],esp
004E47E5 |. 837D FC 00 cmp dword ptr ss:[ebp-4],0
004E47E9 |. 75 0A jnz short autoss.004E47F5
004E47EB |. 8B45 F8 mov eax,dword ptr ss:[ebp-8]
004E47EE |. E8 CDFAF1FF call autoss.004042C0
004E47F3 |. EB 79 jmp short autoss.004E486E
004E47F5 |> 8D45 F4 lea eax,dword ptr ss:[ebp-C]
004E47F8 |. BA A8484E00 mov edx,autoss.004E48A8 ; ASCII "a1b5JHT^UJKLKj8dk9l0welks%^$#@)(" 预置数记为K1
004E47FD |. E8 56FBF1FF call autoss.00404358
004E4802 |. 8D45 F0 lea eax,dword ptr ss:[ebp-10]
004E4805 |. E8 B6FAF1FF call autoss.004042C0
004E480A |. 8B45 FC mov eax,dword ptr ss:[ebp-4] 机器码入EAX
004E480D |. E8 6EFDF1FF call autoss.00404580 取长度
004E4812 |. 8BF0 mov esi,eax
004E4814 |. 85F6 test esi,esi
004E4816 |. 7E 4B jle short autoss.004E4863
004E4818 |. BB 01000000 mov ebx,1 初始计数器记为H1
004E481D |> 8B45 F4 /mov eax,dword ptr ss:[ebp-C] K1入EAX
004E4820 |. E8 5BFDF1FF |call autoss.00404580 取长度记为H2
004E4825 |. 50 |push eax
004E4826 |. 8BC3 |mov eax,ebx
004E4828 |. 5A |pop edx
004E4829 |. 8BCA |mov ecx,edx
004E482B |. 99 |cdq
004E482C |. F7F9 |idiv ecx H1除H2，取余数记为H3
004E482E |. 8BFA |mov edi,edx
004E4830 |. 47 |inc edi H3加1记为H4
004E4831 |. 8B45 F4 |mov eax,dword ptr ss:[ebp-C] K1入EAX
004E4834 |. 0FB64438 FF |movzx eax,byte ptr ds:[eax+edi-1] 取K1的一位的HEX入EAX记为H5
004E4839 |. B9 0A000000 |mov ecx,0A
004E483E |. 33D2 |xor edx,edx
004E4840 |. F7F1 |div ecx H5除0A取余数记为H6
004E4842 |. 8B45 FC |mov eax,dword ptr ss:[ebp-4] 机器码入EAX
004E4845 |. 0FB64418 FF |movzx eax,byte ptr ds:[eax+ebx-1] 取机器码一位的HEX记为H7
004E484A |. 33D0 |xor edx,eax H6与H7作异或结果记H8
004E484C |. 8D45 EC |lea eax,dword ptr ss:[ebp-14]
004E484F |. E8 54FCF1FF |call autoss.004044A8
004E4854 |. 8B55 EC |mov edx,dword ptr ss:[ebp-14]
004E4857 |. 8D45 F0 |lea eax,dword ptr ss:[ebp-10]
004E485A |. E8 29FDF1FF |call autoss.00404588
004E485F |. 43 |inc ebx 计数器加1
004E4860 |. 4E |dec esi 机器码长度减1
004E4861 |.^ 75 BA \jnz short autoss.004E481D 没有完则继续
004E4863 |> 8B45 F8 mov eax,dword ptr ss:[ebp-8]
004E4866 |. 8B55 F0 mov edx,dword ptr ss:[ebp-10] 这就是前9位注册码
004E4869 |. E8 A6FAF1FF call autoss.00404314
004E486E |> 33C0 xor eax,eax
004E4870 |. 5A pop edx
004E4871 |. 59 pop ecx
004E4872 |. 59 pop ecx
004E4873 |. 64:8910 mov dword ptr fs:[eax],edx
004E4876 |. 68 98484E00 push autoss.004E4898
004E487B |> 8D45 EC lea eax,dword ptr ss:[ebp-14]
004E487E |. BA 03000000 mov edx,3
004E4883 |. E8 5CFAF1FF call autoss.004042E4
004E4888 |. 8D45 FC lea eax,dword ptr ss:[ebp-4]
004E488B |. E8 30FAF1FF call autoss.004042C0
004E4890 \. C3 retn
004E4891 .^ E9 8AF3F1FF jmp autoss.00403C20
004E4896 .^ EB E3 jmp short autoss.004E487B
004E4898 . 5F pop edi
004E4899 . 5E pop esi
004E489A . 5B pop ebx
004E489B . 8BE5 mov esp,ebp
004E489D . 5D pop ebp
004E489E . C3 retn
-----------------------------------------------------------------------------------------
004B7CA0 |. 8B55 DC mov edx,dword ptr ss:[ebp-24]
004B7CA3 |. 8D45 F8 lea eax,dword ptr ss:[ebp-8]
004B7CA6 |. 59 pop ecx
004B7CA7 |. E8 20C9F4FF call autoss.004045CC
004B7CAC |. 8D55 D4 lea edx,dword ptr ss:[ebp-2C]
004B7CAF |. 8B83 4C030000 mov eax,dword ptr ds:[ebx+34C]
004B7CB5 |. E8 B6DFF9FF call autoss.00455C70
004B7CBA |. 8B45 D4 mov eax,dword ptr ss:[ebp-2C]
004B7CBD |. 8B55 F8 mov edx,dword ptr ss:[ebp-8]
004B7CC0 |. E8 07CAF4FF call autoss.004046CC
004B7CC5 |. 74 57 je short autoss.004B7D1E
004B7CC7 |. 8D55 D0 lea edx,dword ptr ss:[ebp-30]
004B7CCA |. 8B83 4C030000 mov eax,dword ptr ds:[ebx+34C]
004B7CD0 |. E8 9BDFF9FF call autoss.00455C70
004B7CD5 |. 8B45 D0 mov eax,dword ptr ss:[ebp-30]
004B7CD8 |. BA A87E4B00 mov edx,autoss.004B7EA8
004B7CDD |. E8 EAC9F4FF call autoss.004046CC 注册码比较CALL
004B7CE2 |. 74 3A je short autoss.004B7D1E
004B7CE4 |. A1 A09B4E00 mov eax,dword ptr ds:[4E9BA0]
004B7CE9 |. 8B00 mov eax,dword ptr ds:[eax]
004B7CEB |. 8B98 E8040000 mov ebx,dword ptr ds:[eax+4E8]
004B7CF1 |. C643 48 01 mov byte ptr ds:[ebx+48],1
004B7CF5 |. A1 A09B4E00 mov eax,dword ptr ds:[4E9BA0]
004B7CFA |. 8D43 68 lea eax,dword ptr ds:[ebx+68]
004B7CFD |. BA C87E4B00 mov edx,autoss.004B7EC8 ; 注册码错误！
004B7D02 |. E8 0DC6F4FF call autoss.00404314
004B7D07 |. A1 A09B4E00 mov eax,dword ptr ds:[4E9BA0]
004B7D0C |. 8B00 mov eax,dword ptr ds:[eax]
004B7D0E |. 8B80 E8040000 mov eax,dword ptr ds:[eax+4E8]
004B7D14 |. 8B10 mov edx,dword ptr ds:[eax]
004B7D16 |. FF52 30 call dword ptr ds:[edx+30]
004B7D19 |. E9 EC000000 jmp autoss.004B7E0A
【破解总决】
下面凑合着来个VB.NET注册机：
Dim A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11, A12, A13, A14
A1 = "DS$%^TG"
A2 = "a1b5JHT^UJKLKj8dk9l0welks%^$#@)("
If TextBox1.Text = "" Then
MsgBox("对不起！请输入你的机器码。", , "智能开关机3.20注册机")
Exit Sub
Else
For A3 = 1 To Len(TextBox1.Text)
If A3 > Len(A1) Then
A5 = A3 - Len(A1)
Else
A5 = A3
End If
A4 = Asc(Mid(TextBox1.Text, A3, 1)) And 15
A6 = Asc(Mid(A1, A5, 1)) And 15
A7 = A4 Xor A6
A8 = (Asc(Mid(TextBox1.Text, A3, 1)) And 240) + A7
A9 = A9 & Chr(A8)
Next
End If
For A10 = 1 To Len(TextBox1.Text)
A11 = A10 Mod Len(A2) + 1
A12 = Asc(Mid(A2, A11, 1)) Mod 10
A13 = Asc(Mid(TextBox1.Text, A10, 1))
A14 = A12 Xor A13
A9 = A9 & Chr(A14)
Next
TextBox3.Text = Mid(A9, 10, 9) & Mid(A9, 1, 9)
本注册机在WinXP SP2 VB.Net环境下编译通过。
--------------------------------------------------------------------------------
【版权声明】 本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!