《登录奇兵》v3.01的破解
======================================
3.01版可登录5400个网站.本人破解只为学习,因是初涉,可能在破解中存在许多错误之处,
烦请各位前辈不吝赐教,因本人手中没有全部网站资料,所以无法测试,如那位大侠有资料的
话,请发给我一份,谢谢!
本人信箱:langlirong@163.net
=======================================
破解过程:
---------------------------------------------
(1)将软件装入w32dsm之后,查到错误提示处:
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A3A00(C)
| ^^^^^^^^^^^
* Possible StringData Ref from Code Obj ->"Invalid key. Please re enter"
|
:004A3B8D B8F03C4A00 mov eax,
004A3CF0
:004A3B92 E8B514FBFF call
0045504C
----------------------------------------------
看到用^画线之处,跳槽到004A3A00处:
----------------------------------------------
* Possible StringData Ref from Code Obj ->"Addurlversion 1.0"
|
:004A39F3 B9183C4A00 mov ecx,
004A3C18
:004A39F8 5A
pop edx
:004A39F9 E84EFDFFFF call
004A374C
:004A39FE 84C0
test al, al
:004A3A00 0F8487010000 je 004A3B8D
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
* Possible StringData Ref from Code Obj ->"winzips32.ini"
|
:004A3A06 B9483C4A00 mov ecx,
004A3C48
-------------------------------------------------
将 je 改为 jne .为何这样改,俺也不知道,照葫芦画瓢呗.
(2)然后找到如下之处:
-------------------------------------------------
:00505E06 E865DFEFFF call
00403D70
:00505E0B 8B8304030000 mov eax, dword
ptr [ebx+00000304]
:00505E11 8B10
mov edx, dword ptr [eax]
:00505E13 FF92F4000000 call dword
ptr [edx+000000F4]
:00505E19 83F832
cmp eax, 00000032
:00505E1C 7F25
jg 00505E43
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
:00505E1E 8B8328030000 mov eax, dword
ptr [ebx+00000328]
:00505E24 8B10
mov edx, dword ptr [eax]
:00505E26 FF92F4000000 call dword
ptr [edx+000000F4]
:00505E2C 83F832
cmp eax, 00000032
:00505E2F 7F12
jg 00505E43
--------------------------------------------------
将 00505E1C 7F25 改为 00505E1C EB25
或 00505E2F 7F12 改为 00505E2F EB12
(3)去掉登录著名目录搜索限制,找到:
--------------------------------------------------
:0051287A FF92F4000000 call dword
ptr [edx+000000F4]
:00512880 83F832
cmp eax, 00000032
:00512883 7E16
jle 0051289B
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
:00512885 8B45FC
mov eax, dword ptr [ebp-04]
:00512888 8B8028030000 mov eax, dword
ptr [eax+00000328]
:0051288E 8B10
mov edx, dword ptr [eax]
:00512890 FF92F4000000 call dword
ptr [edx+000000F4]
:00512896 83F832
cmp eax, 00000032
:00512899 7F1D
jg 005128B8
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00512883(C)
|
:0051289B 6A40
push 00000040
* Possible StringData Ref from Code Obj ->"注册用户专用！"
|
:0051289D B9D04C5100 mov ecx,
00514CD0
* Possible StringData Ref from Code Obj ->"注册用户才可以使用本功能"
----------------------------------------------------
将 7E16 改为 9090
7F1D 改为 EB1D
(4)去掉引擎搜索50个的限制
----------------------------------------------------
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005063E2(U)
|
:005063F4 8D55F4
lea edx, dword ptr [ebp-0C]
:005063F7 8B8300050000 mov eax, dword
ptr [ebx+00000500]
:005063FD E8F6C7F2FF call
00432BF8
:00506402 8B45F4
mov eax, dword ptr [ebp-0C]
:00506405 E8C62EF0FF call
004092D0
:0050640A 3BF0
cmp esi, eax
:0050640C EB30
jmp 0050643E
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
:0050640E 6A40
push 00000040
* Possible StringData Ref from Code Obj ->"IptErrNue ny��"
|
:00506410 B9BC645000 mov ecx,
005064BC
* Possible StringData Ref from Code Obj ->"Your Entry a Range To Number Bigger
"
->"Than Total
Board Count"
----------------------------------------------------
将 :0050640C EB30 处改为 jmp (上面之处是我已改过的)
破解结束.
由于水平有限,破解过程个能过于繁琐,有不当之处请指正.
欢迎光临《阿郎居》
langlirong@163.net
http://alang.shangdu.net
- 标 题：《登录奇兵》v3.01的破解---请指教 (4千字)
- 作 者：alang
- 时 间：2001-2-16 13:08:05
- 链 接：http://bbs.pediy.com