网神通 V1.89

标题：易语言程序——网神通 V1.89
作者：fly
时间：2003/09/07 02:54am
链接：http://bbs.pediy.com

易语言程序——网神通 V1.89

下载地址： http://count.skycn.com/softdown.php?id=1984&url=http://hn-http.skycn.net/down/wst.zip
软件大小： 910 KB
软件语言：简体中文
软件类别：国产软件 / 共享版 / 网站推广
应用平台： Win9x/NT/2000/XP
加入时间： 2003-04-08 08:43:51
下载次数： 3311
推荐等级： ***
开发商： http://page.zsnet.com/~xyjtxlt/

【软件简介】：这是一款可以向西陆，新浪和网易163社区,乐趣园.搜狐，269家园社区,焦点网,001社区，中国用户，中国学生网，中国学生兴趣小组，网际精灵,网大社区,17173游戏，玫瑰社区论坛群远程发贴的远程登陆群发软件，速度快，效率高，你只要简单输入如用户名，和你要提交的主页网址.LOGE等.软件将为你做远程提交.其中你可选择点击单发（可弹出流览页），群发（跟据网速自选间隔和起点），乐趣园3万个论坛的一次性批量注册，所有发送都可查看到对方服务器响应情况。是同类软件中的精品。

【软件限制】：功能限制

【作者声明】：初学Crack，只是感兴趣，没有其它目的。失误之处敬请诸位大侠赐教！

【破解工具】：TRW2000娃娃修改版、Ollydbg1.09、PEiD、W32Dasm 9.0白金版

—————————————————————————————————
【过程】：

呵呵，很少碰易语言编写的东东。^O^ 今天有朋友拿来这个程序要我看看，发现这个易语言的东西还算比较的“温柔”，主体部分很象是VC呀。看到很少有写易语言的笔记，索性整理了一下，贴出来大家凑和着看看。这个版本应该是比较旧了的，相信作者已经升过级了。 :-)

网神通1.89.exe 无壳。易语言编写。

参考码：561584633321
试炼码：1357-2468-9012-3456
—————————————————————————————————
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00493A16(C)
|
:00493A1D 50 push eax
:00493A1E 6801000000 push 00000001
:00493A23 BB68010000 mov ebx, 00000168
:00493A28 E8EFF80100 call 004B331C
:00493A2D 83C410 add esp, 00000010
:00493A30 8945D8 mov dword ptr [ebp-28], eax
====>[ebp-28]=561584633321 参考码

…… …… 省略 …… ……

:00493AD5 8B45DC mov eax, dword ptr [ebp-24]
====>EAX=[ebp-24]=561

…… …… 省略 …… ……

:00493B0A DD45D4 fld qword ptr [ebp-2C]
====>[ebp-2C]=561.0000000000000 装入实数

…… …… 省略 …… ……

:00493B81 8945D8 mov dword ptr [ebp-28], eax
====>EAX=[ebp-28]=584

…… …… 省略 …… ……

:00493BD0 DD45D0 fld qword ptr [ebp-30]
====>[ebp-30]=584.0000000000000

…… …… 省略 …… ……

:00493C1C 8B45DC mov eax, dword ptr [ebp-24]
====>EAX=[ebp-24]=321

…… …… 省略 …… ……

:00493C51 DD45D4 fld qword ptr [ebp-2C]
====>[ebp-2C]=321.0000000000000

…… …… 省略 …… ……

:00493CE2 8B45D8 mov eax, dword ptr [ebp-28]
====>EAX=[ebp-28]=633

…… …… 省略 …… ……

:00493D17 DD45D0 fld qword ptr [ebp-30]
====>[ebp-30]=633.0000000000000

:00493D1A E8274AFDFF call 00468746
:00493D1F 8945E0 mov dword ptr [ebp-20], eax
:00493D22 8955E4 mov dword ptr [ebp-1C], edx
:00493D25 DF6DF8 fild qword ptr [ebp-08]
:00493D28 DD5DD8 fstp qword ptr [ebp-28]
:00493D2B DD45D8 fld qword ptr [ebp-28]
:00493D2E DF6DF0 fild qword ptr [ebp-10]
:00493D31 DD5DD8 fstp qword ptr [ebp-28]
:00493D34 DC4DD8 fmul qword ptr [ebp-28]
====>ST=561.00000000000000000 * 584.0000000000000=327624.00000000000000

:00493D37 DD5DD8 fstp qword ptr [ebp-28]
:00493D3A DF6DE8 fild qword ptr [ebp-18]
:00493D3D DD5DD0 fstp qword ptr [ebp-30]
:00493D40 DD45D0 fld qword ptr [ebp-30]
:00493D43 DC0D29010000 fmul qword ptr [00000129]
====>ST=321.00000000000000000 * 3.000000000000000=963.00000000000000000

:00493D49 DD5DD0 fstp qword ptr [ebp-30]
:00493D4C DD45D8 fld qword ptr [ebp-28]
:00493D4F DC45D0 fadd qword ptr [ebp-30]
====>ST=327624.00000000000000 + 963.0000000000000=328587.00000000000000

:00493D52 DD5DC8 fstp qword ptr [ebp-38]
:00493D55 6801060080 push 80000601
:00493D5A FF75CC push [ebp-34]
:00493D5D FF75C8 push [ebp-38]
:00493D60 6801000000 push 00000001
:00493D65 BB68010000 mov ebx, 00000168
:00493D6A E8ADF50100 call 004B331C
:00493D6F 83C410 add esp, 00000010
:00493D72 8945C4 mov dword ptr [ebp-3C], eax
====>[ebp-3C]=328587

:00493D75 6801030080 push 80000301
:00493D7A 6A00 push 00000000
:00493D7C 6804000000 push 00000004
:00493D81 6804000080 push 80000004
:00493D86 6A00 push 00000000
:00493D88 8B45C4 mov eax, dword ptr [ebp-3C]
:00493D8B 85C0 test eax, eax
:00493D8D 7505 jne 00493D94
:00493D8F B8F3000000 mov eax, 000000F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00493D8D(C)
|
:00493D94 50 push eax
:00493D95 6802000000 push 00000002
:00493D9A BB38010000 mov ebx, 00000138
:00493D9F E878F50100 call 004B331C
====>取328587的后4位进去看看

:00493DA4 83C41C add esp, 0000001C
:00493DA7 8945C0 mov dword ptr [ebp-40], eax
====>[ebp-40]=8587

:00493DAA 8B5DC4 mov ebx, dword ptr [ebp-3C]
:00493DAD 85DB test ebx, ebx
:00493DAF 7409 je 00493DBA
:00493DB1 53 push ebx
:00493DB2 E84DF50100 call 004B3304
:00493DB7 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00493DAF(C)
|
:00493DBA 6AFF push FFFFFFFF
:00493DBC 6A08 push 00000008
:00493DBE 6808070116 push 16010708
:00493DC3 6800070152 push 52010700
:00493DC8 E855F50100 call 004B3322
:00493DCD 83C410 add esp, 00000010
:00493DD0 8945BC mov dword ptr [ebp-44], eax
====>[ebp-44]=1357 试炼码的第一段

:00493DD3 8B45C0 mov eax, dword ptr [ebp-40]
====>EAX=[ebp-40]=8587 注册码的第一段

:00493DD6 50 push eax
:00493DD7 FF75BC push [ebp-44]
:00493DDA E8D34BFDFF call 004689B2
====>比较CALL！①

:00493DDF 83C408 add esp, 00000008
:00493DE2 83F800 cmp eax, 00000000
:00493DE5 B800000000 mov eax, 00000000
:00493DEA 0F94C0 sete al
====>正确则AL=1

:00493DED 8945B8 mov dword ptr [ebp-48], eax
:00493DF0 8B5DBC mov ebx, dword ptr [ebp-44]
:00493DF3 85DB test ebx, ebx
:00493DF5 7409 je 00493E00
:00493DF7 53 push ebx
:00493DF8 E807F50100 call 004B3304
:00493DFD 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00493DF5(C)
|
:00493E00 8B5DC0 mov ebx, dword ptr [ebp-40]
:00493E03 85DB test ebx, ebx
:00493E05 7409 je 00493E10
:00493E07 53 push ebx
:00493E08 E8F7F40100 call 004B3304
:00493E0D 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00493E05(C)
|
:00493E10 837DB800 cmp dword ptr [ebp-48], 00000000
:00493E14 0F8458030000 je 00494172
====>跳则OVER！

:00493E1A DF6DF0 fild qword ptr [ebp-10]
:00493E1D DD5DB0 fstp qword ptr [ebp-50]
:00493E20 DD45B0 fld qword ptr [ebp-50]
:00493E23 DF6DE8 fild qword ptr [ebp-18]
:00493E26 DD5DB0 fstp qword ptr [ebp-50]
:00493E29 DC4DB0 fmul qword ptr [ebp-50]
====>ST=584.00000000000000000 * 321.0000000000000=187464.00000000000000

:00493E2C DD5DB0 fstp qword ptr [ebp-50]
:00493E2F DF6DE0 fild qword ptr [ebp-20]
:00493E32 DD5DA8 fstp qword ptr [ebp-58]
:00493E35 DD45A8 fld qword ptr [ebp-58]
:00493E38 DC0DE3000000 fmul qword ptr [000000E3]
====>ST=633.00000000000000000 * 4.000000000000000=2532.0000000000000000

:00493E3E DD5DA8 fstp qword ptr [ebp-58]
:00493E41 DD45B0 fld qword ptr [ebp-50]
:00493E44 DC45A8 fadd qword ptr [ebp-58]
====>ST=187464.00000000000000 + 2532.000000000000=189996.00000000000000

:00493E47 DD5DA0 fstp qword ptr [ebp-60]
:00493E4A 6801060080 push 80000601
:00493E4F FF75A4 push [ebp-5C]
:00493E52 FF75A0 push [ebp-60]
:00493E55 6801000000 push 00000001
:00493E5A BB68010000 mov ebx, 00000168
:00493E5F E8B8F40100 call 004B331C
:00493E64 83C410 add esp, 00000010
:00493E67 89459C mov dword ptr [ebp-64], eax
====>[ebp-64]=189996

:00493E6A 6801030080 push 80000301
:00493E6F 6A00 push 00000000
:00493E71 6804000000 push 00000004
:00493E76 6804000080 push 80000004
:00493E7B 6A00 push 00000000
:00493E7D 8B459C mov eax, dword ptr [ebp-64]
:00493E80 85C0 test eax, eax
:00493E82 7505 jne 00493E89
:00493E84 B8F3000000 mov eax, 000000F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00493E82(C)
|
:00493E89 50 push eax
:00493E8A 6802000000 push 00000002
:00493E8F BB38010000 mov ebx, 00000138
:00493E94 E883F40100 call 004B331C
====>取189996的后4位

:00493E99 83C41C add esp, 0000001C
:00493E9C 894598 mov dword ptr [ebp-68], eax
====>[ebp-68]=9996

:00493E9F 8B5D9C mov ebx, dword ptr [ebp-64]
:00493EA2 85DB test ebx, ebx
:00493EA4 7409 je 00493EAF
:00493EA6 53 push ebx
:00493EA7 E858F40100 call 004B3304
:00493EAC 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00493EA4(C)
|
:00493EAF 6AFF push FFFFFFFF
:00493EB1 6A08 push 00000008
:00493EB3 6805070116 push 16010705
:00493EB8 6800070152 push 52010700
:00493EBD E860F40100 call 004B3322
:00493EC2 83C410 add esp, 00000010
:00493EC5 894594 mov dword ptr [ebp-6C], eax
====>[ebp-6C]=2468 试炼码的第二段

:00493EC8 8B4598 mov eax, dword ptr [ebp-68]
====>EAX=[ebp-68]=9996 注册码的第二段

:00493ECB 50 push eax
:00493ECC FF7594 push [ebp-6C]
:00493ECF E8DE4AFDFF call 004689B2
====>比较CALL！②

:00493ED4 83C408 add esp, 00000008
:00493ED7 83F800 cmp eax, 00000000
:00493EDA B800000000 mov eax, 00000000
:00493EDF 0F94C0 sete al
====>正确则AL=1

:00493EE2 894590 mov dword ptr [ebp-70], eax
:00493EE5 8B5D94 mov ebx, dword ptr [ebp-6C]
:00493EE8 85DB test ebx, ebx
:00493EEA 7409 je 00493EF5
:00493EEC 53 push ebx
:00493EED E812F40100 call 004B3304
:00493EF2 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00493EEA(C)
|
:00493EF5 8B5D98 mov ebx, dword ptr [ebp-68]
:00493EF8 85DB test ebx, ebx
:00493EFA 7409 je 00493F05
:00493EFC 53 push ebx
:00493EFD E802F40100 call 004B3304
:00493F02 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00493EFA(C)
|
:00493F05 837D9000 cmp dword ptr [ebp-70], 00000000
:00493F09 0F8463020000 je 00494172
====>跳则OVER！

:00493F0F DF6DE8 fild qword ptr [ebp-18]
:00493F12 DD5D88 fstp qword ptr [ebp-78]
:00493F15 DD4588 fld qword ptr [ebp-78]
:00493F18 DF6DE0 fild qword ptr [ebp-20]
:00493F1B DD5D88 fstp qword ptr [ebp-78]
:00493F1E DC4D88 fmul qword ptr [ebp-78]
====>ST=321.00000000000000000 * 633.0000000000000=203193.00000000000000

:00493F21 DD5D88 fstp qword ptr [ebp-78]
:00493F24 DF6DF0 fild qword ptr [ebp-10]
:00493F27 DD5D80 fstp qword ptr [ebp-80]
:00493F2A DD4580 fld qword ptr [ebp-80]
:00493F2D DC0D31010000 fmul qword ptr [00000131]
====>ST=584.00000000000000000 * 2.000000000000000=1168.0000000000000000

:00493F33 DD5D80 fstp qword ptr [ebp-80]
:00493F36 DD4588 fld qword ptr [ebp-78]
:00493F39 DC4580 fadd qword ptr [ebp-80]
====>ST=203193.00000000000000 + 1168.000000000000=204361.00000000000000

:00493F3C DD9D78FFFFFF fstp qword ptr [ebp+FFFFFF78]
:00493F42 6801060080 push 80000601
:00493F47 FFB57CFFFFFF push dword ptr [ebp+FFFFFF7C]
:00493F4D FFB578FFFFFF push dword ptr [ebp+FFFFFF78]
:00493F53 6801000000 push 00000001
:00493F58 BB68010000 mov ebx, 00000168
:00493F5D E8BAF30100 call 004B331C
:00493F62 83C410 add esp, 00000010
:00493F65 898574FFFFFF mov dword ptr [ebp+FFFFFF74], eax
====>[ebp+FFFFFF74]=204361

:00493F6B 6801030080 push 80000301
:00493F70 6A00 push 00000000
:00493F72 6804000000 push 00000004
:00493F77 6804000080 push 80000004
:00493F7C 6A00 push 00000000
:00493F7E 8B8574FFFFFF mov eax, dword ptr [ebp+FFFFFF74]
:00493F84 85C0 test eax, eax
:00493F86 7505 jne 00493F8D
:00493F88 B8F3000000 mov eax, 000000F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00493F86(C)
|
:00493F8D 50 push eax
:00493F8E 6802000000 push 00000002
:00493F93 BB38010000 mov ebx, 00000138
:00493F98 E87FF30100 call 004B331C
====>取204361的后4位

:00493F9D 83C41C add esp, 0000001C
:00493FA0 898570FFFFFF mov dword ptr [ebp+FFFFFF70], eax
====>[ebp+FFFFFF70]=4361

:00493FA6 8B9D74FFFFFF mov ebx, dword ptr [ebp+FFFFFF74]
:00493FAC 85DB test ebx, ebx
:00493FAE 7409 je 00493FB9
:00493FB0 53 push ebx
:00493FB1 E84EF30100 call 004B3304
:00493FB6 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00493FAE(C)
|
:00493FB9 6AFF push FFFFFFFF
:00493FBB 6A08 push 00000008
:00493FBD 6806070116 push 16010706
:00493FC2 6800070152 push 52010700
:00493FC7 E856F30100 call 004B3322
:00493FCC 83C410 add esp, 00000010
:00493FCF 89856CFFFFFF mov dword ptr [ebp+FFFFFF6C], eax
====>[ebp+FFFFFF6C]=9012 试炼码的第三段

:00493FD5 8B8570FFFFFF mov eax, dword ptr [ebp+FFFFFF70]
====>EAX=[ebp+FFFFFF70]=4361 注册码的第三段

:00493FDB 50 push eax
:00493FDC FFB56CFFFFFF push dword ptr [ebp+FFFFFF6C]
:00493FE2 E8CB49FDFF call 004689B2
====>比较CALL！③

:00493FE7 83C408 add esp, 00000008
:00493FEA 83F800 cmp eax, 00000000
:00493FED B800000000 mov eax, 00000000
:00493FF2 0F94C0 sete al
====>正确则AL=1

:00493FF5 898568FFFFFF mov dword ptr [ebp+FFFFFF68], eax
:00493FFB 8B9D6CFFFFFF mov ebx, dword ptr [ebp+FFFFFF6C]
:00494001 85DB test ebx, ebx
:00494003 7409 je 0049400E
:00494005 53 push ebx
:00494006 E8F9F20100 call 004B3304
:0049400B 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00494003(C)
|
:0049400E 8B9D70FFFFFF mov ebx, dword ptr [ebp+FFFFFF70]
:00494014 85DB test ebx, ebx
:00494016 7409 je 00494021
:00494018 53 push ebx
:00494019 E8E6F20100 call 004B3304
:0049401E 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00494016(C)
|
:00494021 83BD68FFFFFF00 cmp dword ptr [ebp+FFFFFF68], 00000000
:00494028 0F8444010000 je 00494172
====>跳则OVER！

:0049402E DF6DE0 fild qword ptr [ebp-20]
:00494031 DD9D60FFFFFF fstp qword ptr [ebp+FFFFFF60]
:00494037 DD8560FFFFFF fld qword ptr [ebp+FFFFFF60]
:0049403D DF6DF8 fild qword ptr [ebp-08]
:00494040 DD9D60FFFFFF fstp qword ptr [ebp+FFFFFF60]
:00494046 DC8D60FFFFFF fmul qword ptr [ebp+FFFFFF60]
====>ST=633.00000000000000000 * 561.0000000000000=355113.00000000000000

:0049404C DD9D60FFFFFF fstp qword ptr [ebp+FFFFFF60]
:00494052 DF6DF8 fild qword ptr [ebp-08]
:00494055 DD9D58FFFFFF fstp qword ptr [ebp+FFFFFF58]
:0049405B DD8558FFFFFF fld qword ptr [ebp+FFFFFF58]
:00494061 DC0D39010000 fmul qword ptr [00000139]
====>ST=561.00000000000000000 * 5.000000000000000=2805.0000000000000000

:00494067 DD9D58FFFFFF fstp qword ptr [ebp+FFFFFF58]
:0049406D DD8560FFFFFF fld qword ptr [ebp+FFFFFF60]
:00494073 DC8558FFFFFF fadd qword ptr [ebp+FFFFFF58]
====>ST=355113.00000000000000 + 2805.000000000000=357918.00000000000000

:00494079 DD9D50FFFFFF fstp qword ptr [ebp+FFFFFF50]
:0049407F 6801060080 push 80000601
:00494084 FFB554FFFFFF push dword ptr [ebp+FFFFFF54]
:0049408A FFB550FFFFFF push dword ptr [ebp+FFFFFF50]
:00494090 6801000000 push 00000001
:00494095 BB68010000 mov ebx, 00000168
:0049409A E87DF20100 call 004B331C
:0049409F 83C410 add esp, 00000010
:004940A2 89854CFFFFFF mov dword ptr [ebp+FFFFFF4C], eax
====>[ebp+FFFFFF4C]=357918

:004940A8 6801030080 push 80000301
:004940AD 6A00 push 00000000
:004940AF 6804000000 push 00000004
:004940B4 6804000080 push 80000004
:004940B9 6A00 push 00000000
:004940BB 8B854CFFFFFF mov eax, dword ptr [ebp+FFFFFF4C]
:004940C1 85C0 test eax, eax
:004940C3 7505 jne 004940CA
:004940C5 B8F3000000 mov eax, 000000F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004940C3(C)
|
:004940CA 50 push eax
:004940CB 6802000000 push 00000002
:004940D0 BB38010000 mov ebx, 00000138
:004940D5 E842F20100 call 004B331C
====>取357918的后4位

:004940DA 83C41C add esp, 0000001C
:004940DD 898548FFFFFF mov dword ptr [ebp+FFFFFF48], eax
====>[ebp+FFFFFF78]=7918

:004940E3 8B9D4CFFFFFF mov ebx, dword ptr [ebp+FFFFFF4C]
:004940E9 85DB test ebx, ebx
:004940EB 7409 je 004940F6
:004940ED 53 push ebx
:004940EE E811F20100 call 004B3304
:004940F3 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004940EB(C)
|
:004940F6 6AFF push FFFFFFFF
:004940F8 6A08 push 00000008
:004940FA 6807070116 push 16010707
:004940FF 6800070152 push 52010700
:00494104 E819F20100 call 004B3322
:00494109 83C410 add esp, 00000010
:0049410C 898544FFFFFF mov dword ptr [ebp+FFFFFF44], eax
====>[ebp+FFFFFF44]=3456 试炼码的第四段

:00494112 8B8548FFFFFF mov eax, dword ptr [ebp+FFFFFF48]
====>EAX=[ebp+FFFFFF48]=7918 注册码的第四段

:00494118 50 push eax
:00494119 FFB544FFFFFF push dword ptr [ebp+FFFFFF44]
:0049411F E88E48FDFF call 004689B2
====>比较CALL！④

:00494124 83C408 add esp, 00000008
:00494127 83F800 cmp eax, 00000000
:0049412A B800000000 mov eax, 00000000
:0049412F 0F94C0 sete al
====>正确则AL=1

:00494132 898540FFFFFF mov dword ptr [ebp+FFFFFF40], eax
:00494138 8B9D44FFFFFF mov ebx, dword ptr [ebp+FFFFFF44]
:0049413E 85DB test ebx, ebx
:00494140 7409 je 0049414B
:00494142 53 push ebx
:00494143 E8BCF10100 call 004B3304
:00494148 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00494140(C)
|
:0049414B 8B9D48FFFFFF mov ebx, dword ptr [ebp+FFFFFF48]
:00494151 85DB test ebx, ebx
:00494153 7409 je 0049415E
:00494155 53 push ebx
:00494156 E8A9F10100 call 004B3304
:0049415B 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00494153(C)
|
:0049415E 83BD40FFFFFF00 cmp dword ptr [ebp+FFFFFF40], 00000000
:00494165 0F8407000000 je 00494172
====>跳则OVER！

:0049416B B801000000 mov eax, 00000001
:00494170 EB02 jmp 00494174

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00493E14(C), :00493F09(C), :00494028(C), :00494165(C)
|
:00494172 33C0 xor eax, eax
====>跳到这里清0就OVER了！

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00494170(U)
|
:00494174 85C0 test eax, eax
:00494176 0F84782C0000 je 00496DF4

…… ……省略…… …… 唉，很长一段代码都是保存注册信息的。有必要如此吗？:-(

:00495C14 E803D70100 call 004B331C
====>呵呵，胜利女神！

:00497273 E8A4C00100 call 004B331C
====>BAD BOY！

—————————————————————————————————
进入关键CALL：00493D9F call 004B331C 取后4位字符

* Referenced by a CALL at Addresses:
|:0046873A , :00468846 , :004688FB , :0046891F , :004689A6

…… …… 省略 …… …… 如此多的地方来这里！

再进入：004B331C jmp dword ptr [0000000C] 这里面是易语言的代码了 ^O^
再进入：100257ED call dword ptr ds:[ebx]

10052730 56 push esi ; KRNLN.100D6BD0
10052731 8B7424 10 mov esi,dword ptr ss:[esp+10]
10052735 57 push edi
10052736 83C9 FF or ecx,FFFFFFFF
10052739 8B16 mov edx,dword ptr ds:[esi]
====>EDX=328587

1005273B 33C0 xor eax,eax
1005273D 8BFA mov edi,edx
1005273F F2:AE repne scas byte ptr es:[edi]
10052741 8B46 0C mov eax,dword ptr ds:[esi+C]
====>EAX=[esi+C]=4 这个是“法定长度”了

10052744 F7D1 not ecx
10052746 49 dec ecx
====>和1005273F处取328587长度 ECX=6

10052747 3BC8 cmp ecx,eax
====>和4比较

10052749 8BF1 mov esi,ecx
1005274B 7C 02 jl short KRNLN.1005274F
1005274D 8BF0 mov esi,eax
1005274F 5F pop edi
10052750 85F6 test esi,esi
10052752 5E pop esi
10052753 7D 16 jge short KRNLN.1005276B
10052755 33C0 xor eax,eax
10052757 2BD0 sub edx,eax
10052759 03D1 add edx,ecx
1005275B 52 push edx
1005275C E8 6F97FFFF call KRNLN.1004BED0
10052761 8B4C24 08 mov ecx,dword ptr ss:[esp+8]
10052765 83C4 04 add esp,4
10052768 8901 mov dword ptr ds:[ecx],eax
1005276A C3 retn

1005276B 3BC8 cmp ecx,eax
1005276D 7D 02 jge short KRNLN.10052771
1005276F 8BC1 mov eax,ecx
10052771 2BD0 sub edx,eax
10052773 03D1 add edx,ecx
====>呵呵，这2步就简单的完成取后4位了

10052775 52 push edx
====>EDX=8587

10052776 E8 5597FFFF call KRNLN.1004BED0
1005277B 8B4C24 08 mov ecx,dword ptr ss:[esp+8]
1005277F 83C4 04 add esp,4
10052782 8901 mov dword ptr ds:[ecx],eax
10052784 C3 retn

其他几部分取后4位的步骤是相同的。

—————————————————————————————————
【算法总结】：

1、参考码：561584633321 分为4段：A=561 B=584 C=633 D=321

2、注册码1=A * B + D * 3=328587 的后4为数字：8587

3、注册码2=B * D + C * 4=189996 的后4为数字：9996

4、注册码3=D * C + B * 2=204361 的后4为数字：4361

5、注册码4=C * A + A * 5=357918 的后4为数字：7918

得出注册码：8587-9996-4361-7918

注：乘以3、4、2、5这几个数我不清楚是否是固定值，哪位朋友看了的话麻烦告之。

—————————————————————————————————
【KeyMake之{110th}内存注册机】：

中断地址：00493DD6
中断次数：1
第一字节：50
指令长度：1
内存方式：EAX 结尾插入 -

中断地址：00493ECB
中断次数：1
第一字节：50
指令长度：1
内存方式：EAX 结尾插入 -

中断地址：00493FDB
中断次数：1
第一字节：50
指令长度：1
内存方式：EAX 结尾插入 -

中断地址：00494118
中断次数：1
第一字节：50
指令长度：1

内存方式：EAX

修改内存：
1、00493DEA 0F94C0 改为：B00190
2、00493EDF 0F94C0 改为：B00190
3、00493FF2 0F94C0 改为：B00190

—————————————————————————————————
【注册信息保存】：

呵呵，算是服了他了，分开几处保存注册标志。 ^O^ ^O^

1、[HKEY_CURRENT_USER\Software\STREG\cankaoma]
"Fvbhryh-jk"="inwWBoUgJJ"

2、[HKEY_CURRENT_USER\Software\Afghfg-76\cankaoma]
"Fvbhryh-jk"="jYx7SifwkB"

3、[HKEY_CURRENT_USER\Software\Homecctv\cankaoma]
"Fvbhryh-jk"="EluvrWjFLj"

4、[HKEY_CURRENT_USER\Software\086KGJFt-56\cankaoma]
"Fvbhryh-jk"="HYhiJzFMt"

—————————————————————————————————
【整理】：

参考码：561584633321
注册码：8587-9996-4361-7918

—————————————————————————————————

, _/
/| _.-~/ \_ , 青春都一饷
( /~ / \~-._ |\
`\\ _/ \ ~\ ) 忍把浮名
_-~~~-.) )__/;;,. \_ //'
/'_,\ --~ \ ~~~- ,;;\___( (.-~~~-. 换了破解轻狂
`~ _( ,_..--\ ( ,;'' / ~-- /._`\
/~~//' /' `~\ ) /--.._, )_ `~
" `~" " `" /~'`\ `\\~~\
" " "~' ""

Cracked By 巢水工作坊——fly [OCN][FCG]