Authreg1

标题：Authreg1
作者：fly
时间：2003/04/18 12:35pm　
链接：http://bbs.pediy.com

简单算法——Authreg1

下载地址：http://tongtian.net/pediy/usr/19/19_2169.rar
软件大小：18K

【软件简介】：CrackMe？或许是某个软件的注册部分。yimotep没说，我不知道。

【软件限制】：必须注册。

【作者声明】：初学Crack，只是感兴趣，没有其它目的。失误之处敬请诸位大侠赐教！

【破解工具】：TRW2000娃娃修改版、Ollydbg1.09、PEiD、W32Dasm 9.0白金版

—————————————————————————————————
【过程】：

Authreg1.exe 无壳。Visual C++ 6.0 编写。
这个东东直接用Ollydbg载入会有点麻烦，所以先运行Authreg1.exe，然后再用Ollydbg附加。

User ID：fly
试炼码：1234-5678-90AB-CDEF （分别填入4个注册框，不要-）
—————————————————————————————————
* Referenced by a CALL at Address:
|:0040194F
|
:004023D0 83EC40 sub esp, 00000040
:004023D3 8B0D28AC4000 mov ecx, dword ptr [0040AC28]
:004023D9 56 push esi

* Reference To: USER32.GetWindowTextA, Ord:015Eh
|
:004023DA 8B358C714000 mov esi, dword ptr [0040718C]
:004023E0 8D442404 lea eax, dword ptr [esp+04]
:004023E4 6A08 push 00000008
:004023E6 50 push eax
:004023E7 51 push ecx
:004023E8 FFD6 call esi
:004023EA A124AC4000 mov eax, dword ptr [0040AC24]
:004023EF 8D542409 lea edx, dword ptr [esp+09]
:004023F3 6A08 push 00000008
:004023F5 52 push edx
:004023F6 50 push eax
:004023F7 FFD6 call esi
:004023F9 8B1530AC4000 mov edx, dword ptr [0040AC30]
:004023FF 8D4C240E lea ecx, dword ptr [esp+0E]
:00402403 6A08 push 00000008
:00402405 51 push ecx
:00402406 52 push edx
:00402407 FFD6 call esi
:00402409 8B0D2CAC4000 mov ecx, dword ptr [0040AC2C]
:0040240F 8D442413 lea eax, dword ptr [esp+13]
:00402413 6A08 push 00000008
:00402415 50 push eax
:00402416 51 push ecx
:00402417 FFD6 call esi
:00402419 8B1520AC4000 mov edx, dword ptr [0040AC20]
:0040241F 6800010000 push 00000100
:00402424 B02D mov al, 2D
====>AL=2D 下面在试炼码每隔4位间插入-

:00402426 6860AD4000 push 0040AD60
:0040242B 52 push edx
:0040242C 8844241E mov byte ptr [esp+1E], al
====>1234 5678 90AB-CDEF

:00402430 88442419 mov byte ptr [esp+19], al
====>1234 5678-90AB-CDEF

:00402434 88442414 mov byte ptr [esp+14], al
====>1234-5678-90AB-CDEF

:00402438 C644242300 mov [esp+23], 00
:0040243D FFD6 call esi
:0040243F 8D442404 lea eax, dword ptr [esp+04]
====>EAX=1234-5678-90AB-CDEF

:00402443 50 push eax
:00402444 6860AD4000 push 0040AD60
====>0040AD60=fly

:00402449 E8F20F0000 call 00403440
====>关键CALL!进入!

:0040244E F7D8 neg eax
:00402450 1BC0 sbb eax, eax
:00402452 8D4C2404 lea ecx, dword ptr [esp+04]
:00402456 F7D8 neg eax
:00402458 51 push ecx
:00402459 6860AD4000 push 0040AD60
:0040245E A320D84000 mov dword ptr [0040D820], eax
:00402463 E838000000 call 004024A0
:00402468 8B442450 mov eax, dword ptr [esp+50]
:0040246C 8B0D44AD4000 mov ecx, dword ptr [0040AD44]
:00402472 83C408 add esp, 00000008
:00402475 8D542404 lea edx, dword ptr [esp+04]
:00402479 52 push edx
:0040247A 6830234000 push 00402330
:0040247F 50 push eax
:00402480 6A69 push 00000069
:00402482 51 push ecx

* Reference To: USER32.DialogBoxParamA, Ord:0093h
|
:00402483 FF15B8714000 Call dword ptr [004071B8]
====>根据上面EAX的值，弹出成功或者失败的对话框！
====>呵呵，胜利女神！
====>BAD BOY！

:00402489 A120D84000 mov eax, dword ptr [0040D820]
:0040248E 5E pop esi
:0040248F 83C440 add esp, 00000040
:00402492 C3 ret

—————————————————————————————————
进入关键CALL：402449 call 00403440
四组注册码的运算的流程是差不多的，参数不同。因此只是记录了第一组注册码的过程。

* Referenced by a CALL at Addresses:
|:004021E3 , :00402449
|
:00403440 83EC20 sub esp, 00000020
:00403443 33C0 xor eax, eax
:00403445 B908000000 mov ecx, 00000008
:0040344A 53 push ebx
:0040344B 56 push esi
:0040344C 57 push edi
:0040344D 8D7C240C lea edi, dword ptr [esp+0C]
:00403451 F3 repz
:00403452 AB stosd
:00403453 8B442430 mov eax, dword ptr [esp+30]
====>EAX=00666C79

:00403457 33FF xor edi, edi
:00403459 50 push eax
:0040345A E8C1010000 call 00403620
====>对79 6C 66 00进行运算得出一组新值00 1E B6 33

:0040345F 89442410 mov dword ptr [esp+10], eax
====>[esp+10]=EAX=001EB633

:00403463 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403489(C)
|
:00403466 8D743C0C lea esi, dword ptr [esp+edi+0C]
:0040346A 0FBE06 movsx eax, byte ptr [esi]
1、 ====>EAX=33
2、 ====>EAX=B6
3、 ====>EAX=1E
4、 ====>EAX=00

:0040346D 83F841 cmp eax, 00000041
:00403470 7C08 jl 0040347A
:00403472 83F85A cmp eax, 0000005A
:00403475 7F03 jg 0040347A
:00403477 83C020 add eax, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403470(C), :00403475(C)
|
:0040347A 50 push eax
:0040347B 47 inc edi
:0040347C E86F020000 call 004036F0
====>对33B61E00检测运算，得出下面的AL值

:00403481 83C404 add esp, 00000004
:00403484 8806 mov byte ptr [esi], al
====>保存结果
1、 ====>AL=33 既：字符3
2、 ====>AL=36 既：字符6
3、 ====>AL=31 既：字符1
4、 ====>AL=31 既：字符1

:00403486 83FF04 cmp edi, 00000004
:00403489 7CDB jl 00403466
====>循环4次

:0040348B 33C9 xor ecx, ecx
:0040348D 8B742434 mov esi, dword ptr [esp+34]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004034B3(C)
|
:00403491 0FBE040E movsx eax, byte ptr [esi+ecx]
:00403495 83F841 cmp eax, 00000041
:00403498 7C08 jl 004034A2
:0040349A 83F85A cmp eax, 0000005A
:0040349D 7F03 jg 004034A2
:0040349F 83C020 add eax, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403498(C), :0040349D(C)
|
:004034A2 0FBE540C0C movsx edx, byte ptr [esp+ecx+0C]
:004034A7 3BD0 cmp edx, eax
====>逐位比较比较前4位！
====>[esp+0C]=3611
====>[esi]=1234
★★★★ 一、 ====>所以注册码的前4位是：3611

:004034A9 0F8519010000 jne 004035C8
====>跳则OVER！

:004034AF 41 inc ecx
:004034B0 83F904 cmp ecx, 00000004
:004034B3 7CDC jl 00403491
:004034B5 8B44240C mov eax, dword ptr [esp+0C]
====>EAX=31313633

:004034B9 33DB xor ebx, ebx
:004034BB 8D0440 lea eax, dword ptr [eax+2*eax]
====>EAX=31313633 * 3=9393A299

:004034BE C1E002 shl eax, 02
====>EAX=9393A299 SHL 02=4E4E8A64 得出运算6-9位注册码的参数！

:004034C1 89442410 mov dword ptr [esp+10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004034E8(C)
|
:004034C5 8D7C1C10 lea edi, dword ptr [esp+ebx+10]
:004034C9 8A07 mov al, byte ptr [edi]
:004034CB 50 push eax
:004034CC 53 push ebx
:004034CD 43 inc ebx
:004034CE E82D010000 call 00403600
====>对64 8A 4E 4E进行运算得出一组新值B2 45 13 09

:004034D3 83C408 add esp, 00000008
:004034D6 33C9 xor ecx, ecx
:004034D8 8AC8 mov cl, al
:004034DA 51 push ecx
:004034DB E810020000 call 004036F0
====>对B2 45 13 09进行运算得出一组新值32 65 33 37

:004034E0 83C404 add esp, 00000004
:004034E3 8807 mov byte ptr [edi], al
====>[edi]=2e37 保存结果

:004034E5 83FB04 cmp ebx, 00000004
:004034E8 7CDB jl 004034C5
====>循环4次

:004034EA 33C9 xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040350F(C)
|
:004034EC 0FBE440E05 movsx eax, byte ptr [esi+ecx+05]
:004034F1 83F841 cmp eax, 00000041
:004034F4 7C08 jl 004034FE
:004034F6 83F85A cmp eax, 0000005A
:004034F9 7F03 jg 004034FE
:004034FB 83C020 add eax, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004034F4(C), :004034F9(C)
|
:004034FE 0FBE540C10 movsx edx, byte ptr [esp+ecx+10]
:00403503 3BD0 cmp edx, eax
====>逐位比较比较6-9位！
====>[esp+10]=2e37
====>[esi+05]=5678
★★★★ 二、 ====>所以注册码的6-9位是：2e37

:00403505 0F85C8000000 jne 004035D3
====>跳则OVER！

:0040350B 41 inc ecx
:0040350C 83F904 cmp ecx, 00000004
:0040350F 7CDB jl 004034EC
:00403511 8B442410 mov eax, dword ptr [esp+10]
====>EAX=37336532

:00403515 33DB xor ebx, ebx
:00403517 3344240C xor eax, dword ptr [esp+0C]
====>EAX=37336532 XOR 31313633=06025301

:0040351B 83C002 add eax, 00000002
====>EAX=06025301 + 00000002=06025303

:0040351E 0FAF44240C imul eax, dword ptr [esp+0C]
====>EAX=06025303 * 31313633=268C2B99

:00403523 03442410 add eax, dword ptr [esp+10]
====>EAX=268C2B99 + 37336532=5DBF90CB 得出运算11-14位注册码的参数！

:00403527 89442414 mov dword ptr [esp+14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403541(C)
|
:0040352B 8D7C1C14 lea edi, dword ptr [esp+ebx+14]
:0040352F 43 inc ebx
:00403530 0FBE07 movsx eax, byte ptr [edi]
:00403533 50 push eax
:00403534 E8B7010000 call 004036F0
====>对CB 90 BF 5D进行运算得出一组新值6B 31 31 73

:00403539 83C404 add esp, 00000004
:0040353C 8807 mov byte ptr [edi], al
====>[edi]=k11s 保存结果

:0040353E 83FB04 cmp ebx, 00000004
:00403541 7CE8 jl 0040352B
====>循环4次

:00403543 33C9 xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403564(C)
|
:00403545 0FBE440E0A movsx eax, byte ptr [esi+ecx+0A]
:0040354A 83F841 cmp eax, 00000041
:0040354D 7C08 jl 00403557
:0040354F 83F85A cmp eax, 0000005A
:00403552 7F03 jg 00403557
:00403554 83C020 add eax, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040354D(C), :00403552(C)
|
:00403557 0FBE540C14 movsx edx, byte ptr [esp+ecx+14]
:0040355C 3BD0 cmp edx, eax
====>逐位比较比较后4位！
====>[esp+14]=k11s
====>[esi+0A]=90AB
★★★★ 三、 ====>所以注册码的11-14位是：k11s

:0040355E 757E jne 004035DE
====>跳则OVER！

:00403560 41 inc ecx
:00403561 83F904 cmp ecx, 00000004
:00403564 7CDF jl 00403545
:00403566 8B442410 mov eax, dword ptr [esp+10]
====>EAX=37336532

:0040356A 33FF xor edi, edi
:0040356C 0FAF442414 imul eax, dword ptr [esp+14]
====>EAX=37336532 * 7331316B=BD6BDDE6

:00403571 40 inc eax
:00403572 0FAF44240C imul eax, dword ptr [esp+0C]
====>EAX=BD6BDDE6 * 31313633=2D82EF05

:00403577 03442414 add eax, dword ptr [esp+14]
====>EAX=2D82EF05 + 7331316B=A0B42070 得出运算最后位注册码的参数！

:0040357B 89442418 mov dword ptr [esp+18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403595(C)
|
:0040357F 8D5C3C18 lea ebx, dword ptr [esp+edi+18]
:00403583 47 inc edi
:00403584 0FBE03 movsx eax, byte ptr [ebx]
:00403587 50 push eax
:00403588 E863010000 call 004036F0
====>对70 20 B4 A0进行运算得出一组新值70 31 34 31

:0040358D 83C404 add esp, 00000004
:00403590 8803 mov byte ptr [ebx], al
====>[ebx]=p141 保存结果

:00403592 83FF04 cmp edi, 00000004
:00403595 7CE8 jl 0040357F
====>循环4次

:00403597 33C9 xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004035B8(C)
|
:00403599 0FBE440E0F movsx eax, byte ptr [esi+ecx+0F]
:0040359E 83F841 cmp eax, 00000041
:004035A1 7C08 jl 004035AB
:004035A3 83F85A cmp eax, 0000005A
:004035A6 7F03 jg 004035AB
:004035A8 83C020 add eax, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004035A1(C), :004035A6(C)
|
:004035AB 0FBE540C18 movsx edx, byte ptr [esp+ecx+18]
:004035B0 3BD0 cmp edx, eax
====>逐位比较比较后4位！
====>[esp+18]=p141
====>[esi+0F]=CDEF
★★★★ 四、 ====>所以注册码的最后4位是：p141

:004035B2 7535 jne 004035E9
====>跳则OVER！

:004035B4 41 inc ecx
:004035B5 83F904 cmp ecx, 00000004
:004035B8 7CDF jl 00403599

* Possible Reference to String Resource ID=00001: "Register Success"
|
:004035BA B801000000 mov eax, 00000001
====>置1则OK！

:004035BF 5F pop edi
:004035C0 5E pop esi
:004035C1 5B pop ebx
:004035C2 83C420 add esp, 00000020
:004035C5 C20800 ret 0008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004034A9(C)
|
:004035C8 33C0 xor eax, eax
====>清0则OVER！

:004035CA 5F pop edi
:004035CB 5E pop esi
:004035CC 5B pop ebx
:004035CD 83C420 add esp, 00000020
:004035D0 C20800 ret 0008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403505(C)
|
:004035D3 33C0 xor eax, eax
====>清0则OVER！

:004035D5 5F pop edi
:004035D6 5E pop esi
:004035D7 5B pop ebx
:004035D8 83C420 add esp, 00000020
:004035DB C20800 ret 0008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040355E(C)
|
:004035DE 33C0 xor eax, eax
====>清0则OVER！

:004035E0 5F pop edi
:004035E1 5E pop esi
:004035E2 5B pop ebx
:004035E3 83C420 add esp, 00000020
:004035E6 C20800 ret 0008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004035B2(C)
|
:004035E9 33C0 xor eax, eax
====>清0则OVER！

:004035EB 5F pop edi
:004035EC 5E pop esi
:004035ED 5B pop ebx
:004035EE 83C420 add esp, 00000020
:004035F1 C20800 ret 0008

—————————————————————————————————
进入40345A call 00403620

* Referenced by a CALL at Address:
|:0040345A
|
:00403620 81EC00020000 sub esp, 00000200
:00403626 33C0 xor eax, eax
:00403628 B980000000 mov ecx, 00000080
:0040362D 53 push ebx
:0040362E 56 push esi
:0040362F 33DB xor ebx, ebx
:00403631 57 push edi
:00403632 55 push ebp
:00403633 8D7C2410 lea edi, dword ptr [esp+10]
:00403637 F3 repz
:00403638 AB stosd
:00403639 8BB42414020000 mov esi, dword ptr [esp+00000214]
:00403640 56 push esi

* Reference To: KERNEL32.lstrlenA, Ord:0308h
|
:00403641 FF15F4704000 Call dword ptr [004070F4]
:00403647 3D00020000 cmp eax, 00000200
:0040364C 8BE8 mov ebp, eax
:0040364E 7612 jbe 00403662
:00403650 BD00020000 mov ebp, 00000200
:00403655 8D7C2410 lea edi, dword ptr [esp+10]
:00403659 B980000000 mov ecx, 00000080
:0040365E F3 repz
:0040365F A5 movsd
:00403660 EB0C jmp 0040366E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040364E(C)
|
:00403662 8D442410 lea eax, dword ptr [esp+10]
:00403666 56 push esi
:00403667 50 push eax

* Reference To: KERNEL32.lstrcpyA, Ord:0302h
|
:00403668 FF15E4704000 Call dword ptr [004070E4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403660(U)
|
:0040366E 8BC5 mov eax, ebp
:00403670 99 cdq
:00403671 83E203 and edx, 00000003
:00403674 03C2 add eax, edx
:00403676 C1F802 sar eax, 02

* Possible Reference to String Resource ID=00003: "User ID is need,Please Input"
|
:00403679 F7C503000000 test ebp, 00000003
:0040367F 8BF0 mov esi, eax
:00403681 7401 je 00403684
:00403683 46 inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403681(C)
|
:00403684 33FF xor edi, edi
:00403686 85ED test ebp, ebp
:00403688 7E17 jle 004036A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040369F(C)
|
:0040368A 8B443C10 mov eax, dword ptr [esp+edi+10]
====>依次取fly字符的HEX值
1、 ====>EAX=66
2、 ====>EAX=6C
3、 ====>EAX=79

:0040368E 50 push eax
:0040368F 57 push edi
:00403690 47 inc edi
:00403691 E86AFFFFFF call 00403600
====>对上面的EAX值依次运算得出新值！进入！

:00403696 88443C17 mov byte ptr [esp+edi+17], al
====>保存结果
1、 ====>AL=33
2、 ====>AL=B6
3、 ====>AL=1E

:0040369A 83C408 add esp, 00000008
:0040369D 3BFD cmp edi, ebp
:0040369F 7CE9 jl 0040368A
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403688(C)
|
:004036A1 33FF xor edi, edi
:004036A3 85F6 test esi, esi
:004036A5 7E1A jle 004036C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004036BF(C)
|
:004036A7 035CBC10 add ebx, dword ptr [esp+4*edi+10]
====>EBX=00000000 + 001EB633=001EB633

:004036AB 8BC7 mov eax, edi
:004036AD 83E01F and eax, 0000001F
:004036B0 47 inc edi
:004036B1 50 push eax
:004036B2 53 push ebx
:004036B3 E818000000 call 004036D0
:004036B8 83C408 add esp, 00000008
:004036BB 8BD8 mov ebx, eax
:004036BD 3BFE cmp edi, esi
:004036BF 7CE6 jl 004036A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004036A5(C)
|
:004036C1 8BC3 mov eax, ebx
:004036C3 5D pop ebp
:004036C4 5F pop edi
:004036C5 5E pop esi
:004036C6 5B pop ebx
:004036C7 81C400020000 add esp, 00000200
:004036CD C3 ret

—————————————————————————————————
进入00403691 call 00403600

* Referenced by a CALL at Addresses:
|:004034CE , :00403691
|
:00403600 53 push ebx
:00403601 8A442408 mov al, byte ptr [esp+08]
:00403605 8A5C240C mov bl, byte ptr [esp+0C]
====>BL=依次取fly字符的HEX值

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403614(C)
|
:00403609 F6C3C3 test bl, C3
:0040360C 7A01 jpe 0040360F
:0040360E F9 stc

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040360C(C)
|
:0040360F C0DB01 rcr bl, 01
1、 ====>BL=66 RCR 1=带进位循环右移256次=33
2、 ====>BL=6C RCR 1=带进位循环右移 1 次=B6
3、 ====>BL=3C RCR 1=带进位循环右移 2 次=1E

:00403612 FEC8 dec al
:00403614 75F3 jne 00403609
====>继续循环？！

:00403616 885C240C mov byte ptr [esp+0C], bl
:0040361A 8A44240C mov al, byte ptr [esp+0C]
:0040361E 5B pop ebx
:0040361F C3 ret

—————————————————————————————————
进入0040347C call 004036F0
对EAX的值进行比较，按条件进行运算，很简单，所以不记录了。只要自己亲自跟踪一下就会明白的！

* Referenced by a CALL at Addresses:
|:0040347C , :004034DB , :00403534 , :00403588
|
:004036F0 8B442404 mov eax, dword ptr [esp+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403731(U)
|
:004036F4 83E07F and eax, 0000007F
:004036F7 3C41 cmp al, 41
:004036F9 7208 jb 00403703
:004036FB 83F85A cmp eax, 0000005A
:004036FE 7F03 jg 00403703
:00403700 83C820 or eax, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004036F9(C), :004036FE(C)
|
:00403703 83F86F cmp eax, 0000006F
:00403706 7505 jne 0040370D
:00403708 35FF000000 xor eax, 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403706(C)
|
:0040370D 83F830 cmp eax, 00000030
:00403710 7505 jne 00403717
:00403712 35FF000000 xor eax, 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403710(C)
|
:00403717 83F861 cmp eax, 00000061
:0040371A 7C05 jl 00403721
:0040371C 83F87A cmp eax, 0000007A
:0040371F 7E12 jle 00403733

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040371A(C)
|
:00403721 83F831 cmp eax, 00000031
:00403724 7C05 jl 0040372B
:00403726 83F839 cmp eax, 00000039
:00403729 7E08 jle 00403733

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403724(C)
|
:0040372B 83F03F xor eax, 0000003F
:0040372E 83C831 or eax, 00000031
:00403731 EBC1 jmp 004036F4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040371F(C), :00403729(C)
|
:00403733 C3 ret

—————————————————————————————————
【注册信息保存】：

Authreg1.exe启动时找几个DLL、INI文件，或许这个东东只是某个程序的注册部分?
每次启动时都需要重新注册！

—————————————————————————————————
【整理】：

User ID：fly
注册码：3611-2e37-k11s-p141

—————————————————————————————————

Cracked By 巢水工作坊——fly [OCN][FCG]

2003-04-17 18:23:07