破解華琦庫管精靈1.2.4 (8千字)

破解華琦庫管精靈1.2.4
註冊時隨便輸入8位非零字元的註冊碼即可註冊成功，但在錄入資料時提示註冊不正確。
其過程式如下：

* Possible StringData Ref from Code Obj ->"EoF"
|
:0047D9BC 6818104100 push 00411018

* Reference To: MSVBVM60.__vbaStrCmp, Ord:0000h
|
:0047D9C1 8B3548114000 mov esi, dword ptr [00401148]
:0047D9C7 FFD6 call esi
:0047D9C9 85C0 test eax, eax 錄入資料時比較
:0047D9CB 0F8424010000 je 0047DAF5 -->> 0F8524010000如註冊碼正確則跳
:0047D9D1 BA05000000 mov edx, 00000005
:0047D9D6 A124D14D00 mov eax, dword ptr [004DD124]
:0047D9DB 2B5014 sub edx, dword ptr [eax+14]
:0047D9DE 8B400C mov eax, dword ptr [eax+0C]
:0047D9E1 8B0C90 mov ecx, dword ptr [eax+4*edx]
:0047D9E4 51 push ecx

* Possible StringData Ref from Code Obj ->"00000000"
|
:0047D9E5 6824104100 push 00411024
:0047D9EA FFD6 call esi
:0047D9EC 85C0 test eax, eax
:0047D9EE 757C jne 0047DA6C
:0047D9F0 8D55B0 lea edx, dword ptr [ebp-50]
:0047D9F3 52 push edx

* Reference To: MSVBVM60.rtcGetDateVar, Ord:0262h
|
:0047D9F4 FF15A0124000 Call dword ptr [004012A0]
:0047D9FA B902000000 mov ecx, 00000002
:0047D9FF A124D14D00 mov eax, dword ptr [004DD124]
:0047DA04 2B4814 sub ecx, dword ptr [eax+14]
:0047DA07 8B500C mov edx, dword ptr [eax+0C]
:0047DA0A 8B048A mov eax, dword ptr [edx+4*ecx]
:0047DA0D 50 push eax

* Reference To: MSVBVM60.__vbaDateStr, Ord:0000h
|
:0047DA0E FF15E8114000 Call dword ptr [004011E8]
:0047DA14 DD9D58FFFFFF fstp qword ptr [ebp+FFFFFF58]
:0047DA1A C78550FFFFFF07000000 mov dword ptr [ebp+FFFFFF50], 00000007
:0047DA24 8D4DB0 lea ecx, dword ptr [ebp-50]
:0047DA27 51 push ecx
:0047DA28 8D9550FFFFFF lea edx, dword ptr [ebp+FFFFFF50]
:0047DA2E 52 push edx
:0047DA2F 8D45A0 lea eax, dword ptr [ebp-60]
:0047DA32 50 push eax

* Reference To: MSVBVM60.__vbaVarSub, Ord:0000h
|
:0047DA33 FF1504104000 Call dword ptr [00401004]
:0047DA39 50 push eax

* Reference To: MSVBVM60.__vbaI4Var, Ord:0000h
|
:0047DA3A FF1594124000 Call dword ptr [00401294]
:0047DA40 8BF0 mov esi, eax
:0047DA42 8D4DB0 lea ecx, dword ptr [ebp-50]

* Reference To: MSVBVM60.__vbaFreeVar, Ord:0000h
|
:0047DA45 FF1524104000 Call dword ptr [00401024]
:0047DA4B 83FE1E cmp esi, 0000001E
:0047DA4E 7F10 jg 0047DA60
:0047DA50 85F6 test esi, esi
:0047DA52 7C0C jl 0047DA60
:0047DA54 C745DC00000000 mov [ebp-24], 00000000
:0047DA5B E9DC000000 jmp 0047DB3C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DA4E(C), :0047DA52(C)
|
:0047DA60 C745DC01000000 mov [ebp-24], 00000001
:0047DA67 E9D0000000 jmp 0047DB3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D9EE(C)
|
:0047DA6C 8B0D24D14D00 mov ecx, dword ptr [004DD124]
:0047DA72 8B4114 mov eax, dword ptr [ecx+14]
:0047DA75 8B490C mov ecx, dword ptr [ecx+0C]
:0047DA78 8D148500000000 lea edx, dword ptr [4*eax+00000000]
:0047DA7F 8BF9 mov edi, ecx
:0047DA81 2BFA sub edi, edx
:0047DA83 8B5704 mov edx, dword ptr [edi+04]
:0047DA86 52 push edx
:0047DA87 BA03000000 mov edx, 00000003
:0047DA8C 2BD0 sub edx, eax
:0047DA8E 8B0491 mov eax, dword ptr [ecx+4*edx]
:0047DA91 50 push eax

* Reference To: MSVBVM60.__vbaStrCat, Ord:0000h
|
:0047DA92 FF156C104000 Call dword ptr [0040106C]
:0047DA98 8BD0 mov edx, eax
:0047DA9A 8D4DD8 lea ecx, dword ptr [ebp-28]

* Reference To: MSVBVM60.__vbaStrMove, Ord:0000h
|
:0047DA9D 8B3DF0124000 mov edi, dword ptr [004012F0]
:0047DAA3 FFD7 call edi
:0047DAA5 B905000000 mov ecx, 00000005
:0047DAAA A124D14D00 mov eax, dword ptr [004DD124]
:0047DAAF 2B4814 sub ecx, dword ptr [eax+14]
:0047DAB2 8B500C mov edx, dword ptr [eax+0C]
:0047DAB5 8B048A mov eax, dword ptr [edx+4*ecx]
:0047DAB8 50 push eax
:0047DAB9 8D4DD8 lea ecx, dword ptr [ebp-28]
:0047DABC 51 push ecx
:0047DABD E85E27FDFF call 00450220
:0047DAC2 8BD0 mov edx, eax
:0047DAC4 8D4DD4 lea ecx, dword ptr [ebp-2C]
:0047DAC7 FFD7 call edi
:0047DAC9 50 push eax
:0047DACA FFD6 call esi
:0047DACC 8BF0 mov esi, eax
:0047DACE F7DE neg esi
:0047DAD0 1BF6 sbb esi, esi
:0047DAD2 46 inc esi
:0047DAD3 F7DE neg esi
:0047DAD5 8D55D4 lea edx, dword ptr [ebp-2C]
:0047DAD8 52 push edx
:0047DAD9 8D45D8 lea eax, dword ptr [ebp-28]
:0047DADC 50 push eax
:0047DADD 6A02 push 00000002

* Reference To: MSVBVM60.__vbaFreeStrList, Ord:0000h
|
:0047DADF FF156C124000 Call dword ptr [0040126C]
:0047DAE5 83C40C add esp, 0000000C
:0047DAE8 66F7DE neg si
:0047DAEB 1BF6 sbb esi, esi
:0047DAED 83C603 add esi, 00000003
:0047DAF0 8975DC mov dword ptr [ebp-24], esi
:0047DAF3 EB47 jmp 0047DB3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D9CB(C)
|
:0047DAF5 8B0D38D04D00 mov ecx, dword ptr [004DD038]
:0047DAFB 51 push ecx

* Possible StringData Ref from Code Obj ->"storage.Dat"
|
:0047DAFC 683C114100 push 0041113C

* Reference To: MSVBVM60.__vbaStrCat, Ord:0000h
|
:0047DB01 FF156C104000 Call dword ptr [0040106C]
:0047DB07 8BD0 mov edx, eax
:0047DB09 8D4DD8 lea ecx, dword ptr [ebp-28]

* Reference To: MSVBVM60.__vbaStrMove, Ord:0000h
|
:0047DB0C FF15F0124000 Call dword ptr [004012F0]
:0047DB12 50 push eax

* Reference To: MSVBVM60.rtcFileLen, Ord:0242h
|
:0047DB13 FF1584124000 Call dword ptr [00401284]
:0047DB19 33D2 xor edx, edx
:0047DB1B 3DA0F70300 cmp eax, 0003F7A0
:0047DB20 0F9FC2 setg dl
:0047DB23 F7DA neg edx
:0047DB25 8BF2 mov esi, edx
:0047DB27 8D4DD8 lea ecx, dword ptr [ebp-28]

* Reference To: MSVBVM60.__vbaFreeStr, Ord:0000h
|
:0047DB2A FF153C134000 Call dword ptr [0040133C]
:0047DB30 6685F6 test si, si 再一次比較註冊資訊
:0047DB33 7407 je 0047DB3C -->> EB07註冊資訊正確才跳
:0047DB35 C745DC04000000 mov [ebp-24], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DA5B(U), :0047DA67(U), :0047DAF3(U), :0047DB33(C)
|
:0047DB3C 6A52 push 00000052
:0047DB3E 8D45B0 lea eax, dword ptr [ebp-50]
:0047DB41 50 push eax

* Reference To: MSVBVM60.rtcVarBstrFromAnsi, Ord:0260h
|
:0047DB42 8B3500124000 mov esi, dword ptr [00401200]
:0047DB48 FFD6 call esi
:0047DB4A 6A65 push 00000065
:0047DB4C 8D4DA0 lea ecx, dword ptr [ebp-60]
:0047DB4F 51 push ecx
:0047DB50 FFD6 call esi
:0047DB52 6A67 push 00000067
:0047DB54 8D5580 lea edx, dword ptr [ebp-80]
:0047DB57 52 push edx
:0047DB58 FFD6 call esi

* Possible StringData Ref from Code Obj ->"State"

破解華琦庫管精靈1.2.4 (8千字)

相關文章