这几天就是想找个能自己写注册机的东西,可就是不能如愿.
刚找来这个"神通2001"豪华版,还是个非明码注册的!
我对这个本来就晕,可竟然还是破了!
就写了个过程.也许对人有用哦:>
软件:神通2001豪华版
一款功能强大的系统增强、系统维护工具软件
工具:trw2000,fi,guw
软件本身被aspack2.1压缩.
开始我试破时并没有脱壳,后来还是脱了.不过我发现除了软件体积大了,其他的,脱没脱并没有变化.
我发现实际是很多软件你根本不用脱壳,一样破!
用trw2000装载神通后,按十四下F12,然后两下F10就到这里了
016F:004AE00B MOV EAX,[EBP+FFFFFE18]
016F:004AE011 CALL 00403F10
016F:004AE016 CMP EAX,BYTE +14.......注册码是否20
016F:004AE019 JG 004AE02A......要大于20,否则,嘿嘿!
016F:004AE01B MOV EAX,004AE324
016F:004AE020 CALL 004557F0......到这里就没戏啦.
016F:004AE025 JMP 004AE2B8
016F:004AE02A LEA EAX,[EBP-04]...从这里在开始!
016F:004AE02D PUSH EAX
016F:004AE02E LEA EDX,[EBP+FFFFFE14]
016F:004AE034 MOV EAX,[EBX+030C]
016F:004AE03A CALL 00432010
016F:004AE03F MOV EAX,[EBP+FFFFFE14]
016F:004AE045 MOV ECX,0A
016F:004AE04A MOV EDX,01
016F:004AE04F CALL 00404118
016F:004AE054 LEA EDX,[EBP+FFFFFE10]
016F:004AE05A MOV EAX,[EBX+030C]
016F:004AE060 CALL 00432010
016F:004AE065 MOV EAX,[EBP+FFFFFE10]
016F:004AE06B PUSH EAX
016F:004AE06C LEA EDX,[EBP+FFFFFE0C]
016F:004AE072 MOV EAX,[EBX+0304]
016F:004AE078 CALL 00432010
016F:004AE07D MOV EAX,[EBP+FFFFFE0C]
016F:004AE083 POP EDX
016F:004AE084 CALL 004041FC……追进去!
016F:004AE089 MOV ESI,EAX
016F:004AE08B TEST ESI,ESI
016F:004AE08D JNZ 004AE09E……要跳!
016F:004AE08F MOV EAX,004AE358
016F:004AE094 CALL 004557F0……到这里就错了!
016F:004AE099 JMP 004AE2B8
016F:004AE09E XOR EAX,EAX
016F:004AE0A0 PUSH EBP
016F:004AE0A1 PUSH DWORD 004AE0FB
016F:004AE0A6 PUSH DWORD [FS:EAX]
016F:004AE0A9 MOV [FS:EAX],ESP
016F:004AE0AC LEA EAX,[EBP-08]
016F:004AE0AF PUSH EAX
016F:004AE0B0 LEA EDX,[EBP+FFFFFE08]
016F:004AE0B6 MOV EAX,[EBX+0304]
016F:004AE0BC CALL 00432010
016F:004AE0C1 MOV EAX,[EBP+FFFFFE08]
016F:004AE0C7 CALL 00403F10
016F:004AE0CC ADD ESI,EAX
016F:004AE0CE PUSH ESI
016F:004AE0CF LEA EDX,[EBP+FFFFFE04]
016F:004AE0D5 MOV EAX,[EBX+030C]
016F:004AE0DB CALL 00432010
016F:004AE0E0 MOV EAX,[EBP+FFFFFE04]
016F:004AE0E6 MOV ECX,0A
016F:004AE0EB POP EDX
016F:004AE0EC CALL 00404118
016F:004AE0F1 XOR EAX,EAX
016F:004AE0F3 POP EDX
016F:004AE0F4 POP ECX
016F:004AE0F5 POP ECX
016F:004AE0F6 MOV [FS:EAX],EDX
016F:004AE0F9 JMP SHORT 004AE119……跳!
016F:004AE0FB JMP 004033F0
016F:004AE100 MOV EAX,004AE370
016F:004AE105 CALL 004557F0
016F:004AE10A CALL 0040374C
016F:004AE10F JMP 004AE2B8
016F:004AE114 CALL 0040374C
016F:004AE119 XOR EDI,EDI……到这里!
016F:004AE11B XOR EAX,EAX
016F:004AE11D MOV [EBP-10],EAX
016F:004AE120 MOV EAX,[EBP-04]
016F:004AE123 CALL 00403F10
016F:004AE128 MOV EBX,EAX
016F:004AE12A TEST EBX,EBX
016F:004AE12C JNG 004AE154……不要跳!
016F:004AE12E MOV ESI,01
016F:004AE133 LEA EAX,[EBP-0C]
016F:004AE136 PUSH EAX
016F:004AE137 MOV ECX,01
016F:004AE13C MOV EDX,ESI
016F:004AE13E MOV EAX,[EBP-04]
016F:004AE141 CALL 00404118……取代码前十位
016F:004AE146 MOV EAX,[EBP-0C]
016F:004AE149 CALL 00408C20
016F:004AE14E ADD EDI,EAX
016F:004AE150 INC ESI
016F:004AE151 DEC EBX
016F:004AE152 JNZ 004AE133……要跳!取完往下!
016F:004AE154 MOV EAX,[EBP-08]
016F:004AE157 CALL 00403F10
016F:004AE15C MOV EBX,EAX
016F:004AE15E TEST EBX,EBX
016F:004AE160 JNG 004AE189
016F:004AE162 MOV ESI,01
016F:004AE167 LEA EAX,[EBP-0C]
016F:004AE16A PUSH EAX
016F:004AE16B MOV ECX,01
016F:004AE170 MOV EDX,ESI
016F:004AE172 MOV EAX,[EBP-08]
016F:004AE175 CALL 00404118……从注册码第八位取到第十七位!
016F:004AE17A MOV EAX,[EBP-0C]
016F:004AE17D CALL 00408C20
016F:004AE182 ADD [EBP-10],EAX
016F:004AE185 INC ESI
016F:004AE186 DEC EBX
016F:004AE187 JNZ 004AE167……取第八到十七位!要跳!然后往下!
016F:004AE189 LEA EAX,[EBP+FFFFFE00]......取第十一位到十七位
016F:004AE18F PUSH EAX
016F:004AE190 LEA EDX,[EBP+FFFFFDFC]
016F:004AE196 MOV EAX,EDI......取第十四十五两位!
016F:004AE198 CALL 00408BF0
016F:004AE19D MOV EAX,[EBP+FFFFFDFC]
016F:004AE1A3 MOV ECX,01
016F:004AE1A8 MOV EDX,01
016F:004AE1AD CALL 00404118
016F:004AE1B2 MOV EAX,[EBP+FFFFFE00]
016F:004AE1B8 PUSH EAX
016F:004AE1B9 LEA EAX,[EBP+FFFFFDF8]
016F:004AE1BF PUSH EAX
016F:004AE1C0 LEA EDX,[EBP+FFFFFDF4]
016F:004AE1C6 MOV EAX,[EBP-10]
016F:004AE1C9 CALL 00408BF0
016F:004AE1CE MOV EAX,[EBP+FFFFFDF4]
016F:004AE1D4 MOV ECX,01
016F:004AE1D9 MOV EDX,01
016F:004AE1DE CALL 00404118
016F:004AE1E3 MOV EDX,[EBP+FFFFFDF8]
016F:004AE1E9 POP EAX
016F:004AE1EA CALL 00404020
016F:004AE1EF JNZ NEAR 004AE2AE.....此处千万不要跳!
016F:004AE1F5 MOV EAX,004AE388
016F:004AE1FA CALL 004557F0.......到这里就成功了!注意:是同一个call来显示成功或失败窗口!
016F:004AE1FF MOV DL,01
016F:004AE201 MOV EAX,[004569D8]
016F:004AE206 CALL 00456AD8
016F:004AE20B MOV EBX,EAX
016F:004AE20D MOV EDX,80000000
016F:004AE212 MOV EAX,EBX
016F:004AE214 CALL 00456B78
016F:004AE219 MOV CL,01
016F:004AE21B MOV EDX,004AE3D4
016F:004AE220 MOV EAX,EBX
016F:004AE222 CALL 00456BE0
016F:004AE227 MOV ECX,004AE3E0
016F:004AE22C XOR EDX,EDX
016F:004AE22E MOV EAX,EBX
016F:004AE230 CALL 00457044
016F:004AE235 MOV EAX,EBX
016F:004AE237 CALL 00456B48
016F:004AE23C MOV EAX,EBX
016F:004AE23E CALL 00402F44
016F:004AE243 LEA EAX,[EBP+FFFFFDF0]
016F:004AE249 MOV EDX,[EBP-14]
016F:004AE24C CALL 00403E48
016F:004AE251 LEA EAX,[EBP+FFFFFDF0]
016F:004AE257 MOV EDX,004AE3EC
016F:004AE25C CALL 00403F18
016F:004AE261 MOV EDX,[EBP+FFFFFDF0]
016F:004AE267 LEA EAX,[EBP+FFFFFE20]
016F:004AE26D CALL 00405EA2
016F:004AE272 LEA EAX,[EBP+FFFFFE20]
016F:004AE278 CALL 0040612A
016F:004AE27D CALL 00402804
016F:004AE282 MOV EDX,004AE408
016F:004AE287 LEA EAX,[EBP+FFFFFE20]
016F:004AE28D CALL 004042A8
016F:004AE292 CALL 00406203
016F:004AE297 CALL 00402804
016F:004AE29C LEA EAX,[EBP+FFFFFE20]
016F:004AE2A2 CALL 00405F44
016F:004AE2A7 CALL 00402804
016F:004AE2AC JMP SHORT 004AE2B8
016F:004AE2AE MOV EAX,004AE370......从这里一直往下走,直到程序退出!
016F:004AE2B3 CALL 004557F0
016F:004AE2B8 XOR EAX,EAX
016F:004AE2BA POP EDX
016F:004AE2BB POP ECX
016F:004AE2BC POP ECX
016F:004AE2BD MOV [FS:EAX],EDX
016F:004AE2C0 PUSH DWORD 004AE2FA
016F:004AE2C5 LEA EAX,[EBP+FFFFFDF0]
016F:004AE2CB MOV EDX,05
016F:004AE2D0 CALL 00403CB4
016F:004AE2D5 LEA EAX,[EBP+FFFFFE04]
016F:004AE2DB MOV EDX,07
016F:004AE2E0 CALL 00403CB4
016F:004AE2E5 LEA EAX,[EBP-0C]
016F:004AE2E8 MOV EDX,03
016F:004AE2ED CALL 00403CB4
016F:004AE2F2 RET
016F:004AE2F3 JMP 004036A4
016F:004AE2F8 JMP SHORT 004AE2C5
016F:004AE2FA POP EDI
016F:004AE2FB POP ESI
016F:004AE2FC POP EBX
016F:004AE2FD MOV ESP,EBP
016F:004AE2FF POP EBP
你走一段后会到一处循环,改动那个跳转使程序能经过被跳过的两个winapi函数,然后,继续按住f10直到"神通"自行退出.
重新启动,再看注册处,显示已经注册,按钮也便灰.
我本来还想写的更详细点,不过我找了半天也没发现它存注册文件的地方.注册表里没有关于注册的项目,软件本身目录下有个reg文件,移走后重起显示仍然注册.删除注册表主键,删除软件,重新安装也仍然显示注册!我晕!
只好这样了!
- 标 题:神通2001豪华版之破解....sorry,刚刚忘了贴内容:> (8千字)
- 作 者:eryl
- 时 间:2002-1-6 3:38:06
- 链 接:http://bbs.pediy.com