软件名称:Audio Compositor v4.4
破解者:fhmdw[BCG]
难 度:易
破解工具:trw2000 w32dasm keymake
软件简介:一个标准MIDI的编辑与制作软件,能直接即时方式转换成数码音响输出
软件大小:1510KB
下载地址:http://newhua.ruyi.com/down/ac44.exe
破解流程:
1.用w32dasm查找"The name/code combination is invalid",向上查找关键call
2.用trw载入,输入用户名和假码78787878,下断点bpx 44D63D 跟踪关键call,找出注册码
3.用keymake做另类注册机
==================================>>双击来到这里,向上找可以跳过出错信息的call
:0044D655 57
push edi
:0044D656 57
push edi
* Possible StringData Ref from
Data Obj ->"The name/code combination is invalid."
|
:0044D657 6838C14D00
push 004DC138
==================================>>向上来到这里
* Possible Reference to String Resource ID=00001: "Audio Compositor"
|
:0044D5DA 6A01
push 00000001
:0044D5DC 897DFC
mov dword ptr [ebp-04], edi
:0044D5DF E86FA20300 call 00487853
:0044D5E4 8B465C
mov eax, dword ptr [esi+5C]
:0044D5E7 8378F808
cmp dword ptr [eax-08], 00000008----->注册码必须为8位
:0044D5EB 7409
je 0044D5F6
:0044D5ED 57
push edi
:0044D5EE 57
push edi
* Possible
StringData Ref from Data Obj ->"The registration code must be "
->"8 characters long."
|
:0044D5EF 689CC14D00
push 004DC19C
:0044D5F4 EB66
jmp 0044D65C
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:0044D5EB(C)
|
:0044D5F6 8B4660
mov eax, dword ptr [esi+60]
:0044D5F9 8D5E60
lea ebx, dword ptr [esi+60]
:0044D5FC 8378F805
cmp dword ptr [eax-08], 00000005----->用户名不能小于5位
:0044D600 7D09
jge 0044D60B
:0044D602 57
push edi
:0044D603 57
push edi
* Possible
StringData Ref from Data Obj ->"The registration name must be "
->"at least 5 characters long."
|
:0044D604 6860C14D00
push 004DC160
:0044D609 EB51
jmp 0044D65C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D600(C)
|
* Possible StringData Ref from Data Obj ->"%s is not a valid
output device"
|
:0044D60B 68F8724D00
push 004D72F8
:0044D610 8D4DEC
lea ecx, dword ptr [ebp-14]
:0044D613 E832740300 call
00484A4A
:0044D618 50
push eax
:0044D619 8D45F0
lea eax, dword ptr [ebp-10]
:0044D61C
53
push ebx
:0044D61D 50
push eax
:0044D61E C645FC01
mov [ebp-04], 01
:0044D622 E889C6FBFF
call 00409CB0------>计算注册码的call
:0044D627
8065FC00 and byte ptr [ebp-04],
00
:0044D62B 83C40C
add esp, 0000000C
:0044D62E 8D4DEC
lea ecx, dword ptr [ebp-14]
:0044D631 E8A6730300
call 004849DC
:0044D636 FF75F0
push [ebp-10]
:0044D639
8B465C mov eax,
dword ptr [esi+5C]
:0044D63C 50
push eax
:0044D63D E83C230200
call 0046F97E------>比较真假,F8追入
:0044D642
59
pop ecx
:0044D643 59
pop ecx
:0044D644 85C0
test eax, eax------>注册标志
* Possible
StringData Ref from Data Obj ->" "
|
:0044D646 68EC724D00
push 004D72EC
:0044D64B 8D4DF0
lea ecx, dword ptr [ebp-10]
:0044D64E 7413
je 0044D663------>跳则注册成功
:0044D650 E810750300 call
00484B65
==================================>>由44D63D来到这里
//
* Referenced by a (U)nconditional
or (C)onditional Jump at Address://这里开始将真假码逐位比较
|:0046FA08(U)
//
|
//
:0046F9AD 660FB60F
movzx cx, byte ptr [edi]------>逐个取出假码
:0046F9B1 0FB6C1
movzx eax, cl
:0046F9B4
47
inc edi--------->计数器
:0046F9B5 894D0C
mov dword ptr [ebp+0C], ecx
:0046F9B8 F6806184540004
test byte ptr [eax+00548461], 04
:0046F9BF 7416
je 0046F9D7
:0046F9C1 8A07
mov al, byte ptr [edi]
:0046F9C3 84C0
test al, al
:0046F9C5 7506
jne 0046F9CD
:0046F9C7 83650C00
and dword ptr [ebp+0C], 00000000
:0046F9CB EB0A
jmp 0046F9D7
* Referenced by a (U)nconditional or (C)onditional
Jump at Address:
|:0046F9C5(C)
|
:0046F9CD 33D2
xor edx, edx
:0046F9CF 47
inc edi
:0046F9D0 8AF1
mov dh, cl
:0046F9D2 8AD0
mov dl, al
:0046F9D4 89550C
mov dword ptr [ebp+0C], edx
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046F9BF(C),
:0046F9CB(U)
|
:0046F9D7 660FB61E
movzx bx, byte ptr [esi]------->下d esi得真码
:0046F9DB
0FB6C3 movzx eax,
bl
:0046F9DE 46
inc esi
:0046F9DF F6806184540004
test byte ptr [eax+00548461], 04
:0046F9E6 7413
je 0046F9FB
总结:
name:fhmdw[BCG]
code:3UooUSpf
算法段有点烦,追了半天,算法还没分析出,视力倒增加了不少,只好用keymake来个另类注册机:
运行keymake,点击另类注册机,
1.按“浏览”按钮,选择Ac.exe
2.写入以下数值:
第一个中断地址:
中断地址:44D63D
中断次数:1
第一字节:E8
指令长度:5
第二个中断地址:
中断地址:46F9D7
中断次数:1
第一字节:66
指令长度:4
3.在右边注册码选项中选择“内存方式”,并勾选其下方的单选框,选择ESI
4.按“生成”,输入生成的EXE文件名
好啦,收工!
整理于2002.4.21
18:00
- 标 题:Audio Compositor v4.4破解手记 (6千字)
- 作 者:fhmdw
- 时 间:2002-4-21
18:01:48
- 链 接:http://bbs.pediy.com