菜鳥破解實錄（八）之 超級信封列印工具 v3.2
軟體名稱：超級信封列印工具 v3.2 -->(30天試用)
簡 介：看名字就知道。
作 者：xiA Qin
級 別：很菜.....很菜......
解密日前：2000年7月21日
解密工具：Trw2000 1.22
破解目的：軟體作者的太串了、太囂張了，為破解論談爭氣。
說 明：
本文是在我的軟體破解記錄上整理出來的。所以在文中沒有任何的註冊碼，只作技術交流。如若有紕漏，請各位大俠多指教！
首先執行超級信封列印工具
輸入註冊資訊
register key: xxxx-xx-xxx
下指令bpx hmemcpy //下中斷點
按F5回到程式，按確定，這時會被Trw2000攔截到。
下指令bd * //屏障中斷點
下指令pmodule //直接跳到程式的領空
按F10來到下面指令
...............
015F:004AB037 807C38FF2D CMP BYTE [EAX+EDI-01],2D
015F:004AB03C 7503 JNZ
004AB041
015F:004AB03E FF45F8 INC
DWORD [EBP-08]
015F:004AB041 47 INC
EDI
015F:004AB042 4E DEC
ESI
015F:004AB043 75E1 JNZ
004AB026
015F:004AB045 837DF802 CMP DWORD
[EBP-08],BYTE +02
015F:004AB049 0F857E010000 JNZ NEAR 004AB1CD
//檢查註冊碼的格式
015F:004AB04F 8D55F4 LEA
EDX,[EBP-0C] 是否是xxxx-xx-xxx格式
015F:004AB052 8B83D0020000 MOV EAX,[EBX+02D0]
015F:004AB058 E8EB87F8FF CALL 00433848
015F:004AB05D 8B55F4 MOV
EDX,[EBP-0C]
015F:004AB060 A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB065 8B00 MOV
EAX,[EAX]
015F:004AB067 0518110000 ADD EAX,1118
015F:004AB06C E87B8CF5FF CALL 00403CEC
015F:004AB071 A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB076 8B00 MOV
EAX,[EAX]
015F:004AB078 8B55FC MOV
EDX,[EBP-04]
015F:004AB07B E870480200 CALL 004CF8F0
015F:004AB080 A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB085 8B00 MOV
EAX,[EAX]
015F:004AB087 8B55FC MOV
EDX,[EBP-04]
015F:004AB08A E861470200 CALL 004CF7F0
015F:004AB08F A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB094 8B00 MOV
EAX,[EAX]
015F:004AB096 8B55FC MOV
EDX,[EBP-04]
015F:004AB099 E852490200 CALL 004CF9F0
015F:004AB09E A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB0A3 8B00 MOV
EAX,[EAX]
015F:004AB0A5 8B80781B0000 MOV EAX,[EAX+1B78]
015F:004AB0AB 8B15A42C4D00 MOV EDX,[004D2CA4]
015F:004AB0B1 8B12 MOV
EDX,[EDX]
015F:004AB0B3 3B82081D0000 CMP EAX,[EDX+1D08]
015F:004AB0B9 0F8504010000 JNZ NEAR 004AB1C3
//註冊碼中間的位數
015F:004AB0BF A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB0C4 8B00 MOV
EAX,[EAX]
015F:004AB0C6 8B80C0710000 MOV EAX,[EAX+71C0]
015F:004AB0CC 8B15A42C4D00 MOV EDX,[004D2CA4]
015F:004AB0D2 8B12 MOV
EDX,[EDX]
015F:004AB0D4 3B8208700000 CMP EAX,[EDX+7008]
015F:004AB0DA 0F85E3000000 JNZ NEAR 004AB1C3
//比較註冊碼後面的第一位。
015F:004AB0E0 A1A42C4D00 MOV EAX,[004D2CA4]
正確就成功註冊。
015F:004AB0E5 8B00 MOV
EAX,[EAX]
015F:004AB0E7 8B8034710000 MOV EAX,[EAX+7134]
015F:004AB0ED 8B15A42C4D00 MOV EDX,[004D2CA4]
015F:004AB0F3 8B12 MOV
EDX,[EDX]
015F:004AB0F5 3B82A46F0000 CMP EAX,[EDX+6FA4]
015F:004AB0FB 0F85C2000000 JNZ NEAR 004AB1C3
015F:004AB101 B804B24A00 MOV EAX,004AB204
015F:004AB106 E879A4FAFF CALL 00455584
//註冊成功對話方塊
015F:004AB10B 8B8314030000 MOV EAX,[EBX+0314]
015F:004AB111 E82A28F8FF CALL 0042D940
015F:004AB116 8D55F4 LEA
EDX,[EBP-0C]
015F:004AB119 8B83D0020000 MOV EAX,[EBX+02D0]
015F:004AB11F E82487F8FF CALL 00433848
015F:004AB124 8B55F4 MOV
EDX,[EBP-0C]
015F:004AB127 8B8314030000 MOV EAX,[EBX+0314]
015F:004AB12D 8B80EC010000 MOV EAX,[EAX+01EC]
015F:004AB133 8B08 MOV
ECX,[EAX]
015F:004AB135 FF5134 CALL NEAR
[ECX+34]
015F:004AB138 A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB13D 8B00 MOV
EAX,[EAX]
015F:004AB13F 8B808C030000 MOV EAX,[EAX+038C]
015F:004AB145 B201 MOV
DL,01
015F:004AB147 E8247BF9FF CALL 00442C70
015F:004AB14C A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB151 8B00 MOV
EAX,[EAX]
015F:004AB153 055C770000 ADD EAX,775C
015F:004AB158 BA1CB24A00 MOV EDX,004AB21C
015F:004AB15D E88A8BF5FF CALL 00403CEC
015F:004AB162 A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB167 8B00 MOV
EAX,[EAX]
015F:004AB169 8B8880050000 MOV ECX,[EAX+0580]
015F:004AB16F A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB174 8B00 MOV
EAX,[EAX]
015F:004AB176 8B905C770000 MOV EDX,[EAX+775C]
015F:004AB17C 8D45F0 LEA
EAX,[EBP-10]
015F:004AB17F E8DC8DF5FF CALL 00403F60
015F:004AB184 8B55F0 MOV
EDX,[EBP-10]
015F:004AB187 A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB18C 8B00 MOV
EAX,[EAX]
015F:004AB18E E8E586F8FF CALL 00433878
015F:004AB193 A1A42C4D00 MOV EAX,[004D2CA4]
015F:004AB198 8B00 MOV
EAX,[EAX]
015F:004AB19A 8B907C050000 MOV EDX,[EAX+057C]
015F:004AB1A0 8D45F0 LEA
EAX,[EBP-10]
015F:004AB1A3 B93CB24A00 MOV ECX,004AB23C
015F:004AB1A8 E8B38DF5FF CALL 00403F60
015F:004AB1AD 8B55F0 MOV
EDX,[EBP-10]
015F:004AB1B0 8B8314030000 MOV EAX,[EBX+0314]
015F:004AB1B6 8B80EC010000 MOV EAX,[EAX+01EC]
015F:004AB1BC 8B08 MOV
ECX,[EAX]
015F:004AB1BE FF5164 CALL NEAR
[ECX+64]
015F:004AB1C1 EB0A JMP
SHORT 004AB1CD
015F:004AB1C3 B854B24A00 MOV EAX,004AB254
015F:004AB1C8 E8B7A3FAFF CALL 00455584
//註冊失敗對話方塊
整裡一下：
軟體比較註冊碼xxxx-xx-xxx
^
第一位數字
所以將註冊碼 0000-00-x00 將x用阿拉伯數字123456789都試一遍。就可以註冊。
^^^^ ^^ ^^
隨便輸
比如：我的計算機是 0000-00-600
後 記：
超級信封列印工具 v3.2是透過讀取安裝目錄下的檔案zhuceFile.data來判斷，程式是否註冊。如果把檔案zhuceFile.data刪除，
超級信封列印工具 v3.2又成了非註冊版。
軟體作者的太串了、太囂張了，我從看到他的留言到現在連吃飯、下載、分析、記錄破解過程一共用了2小時。沒有破不掉的軟體。希望他記住他講過的話。