FISH精美屏保暴力破解---WD32ASM893版 (6千字)

FISH精美屏保暴力破解---WD32ASM893版
作者：孫鋒
Email：sffs@263.net
主頁：http://sffs.6to23.com

先用WD32ASM8.93超級中文版進行反彙編，然後查詢，會看到：

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D097(C)
|
:0040D0AD 6A03 push 00000003
:0040D0AF E82C67FFFF call 004037E0
:0040D0B4 83C404 add esp, 00000004
:0040D0B7 8945F8 mov dword ptr [ebp-08], eax
:0040D0BA 837DF800 cmp dword ptr [ebp-08], 00000000
:0040D0BE 7414 je 0040D0D4 //----->修改74-75即jne->je
:0040D0C0 C70500FE410003000000 mov dword ptr [0041FE00], 00000003
:0040D0CA 6A01 push 00000001
:0040D0CC E8A86EFFFF call 00403F79
:0040D0D1 83C404 add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D0BE(C) //---------->修改處，往上找。
|
:0040D0D4 833D00FE410000 cmp dword ptr [0041FE00], 00000000
:0040D0DB 7458 je 0040D135 //---------------修改74->75即jne->je
:0040D0DD C605B1DD410001 mov byte ptr [0041DDB1], 01
:0040D0E4 C605B2DD410001 mov byte ptr [0041DDB2], 01
:0040D0EB 833D00FE410001 cmp dword ptr [0041FE00], 00000001
:0040D0F2 7514 jne 0040D108 //-------------------修改74->75即jne->je

* Possible StringData Ref from Data Obj ->"TEMP registration OK" //-----2條魚！
|
:0040D0F4 6834E54100 push 0041E534
:0040D0F9 6892000000 push 00000092
:0040D0FE 8B4D08 mov ecx, dword ptr [ebp+08]
:0040D101 51 push ecx

* Reference To: USER32.SetDlgItemTextA, Ord:022Ch
|
:0040D102 FF1514A24100 Call dword ptr [0041A214]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D0F2(C) //-------------修改的地方，往上找
|
:0040D108 833D00FE410002 cmp dword ptr [0041FE00], 00000002
:0040D10F 7514 jne 0040D125

* Possible StringData Ref from Data Obj ->"BASIC registration OK" //-------3條魚！
|
:0040D111 684CE54100 push 0041E54C
:0040D116 6892000000 push 00000092
:0040D11B 8B5508 mov edx, dword ptr [ebp+08]
:0040D11E 52 push edx

* Reference To: USER32.SetDlgItemTextA, Ord:022Ch
|
:0040D11F FF1514A24100 Call dword ptr [0041A214]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D10F(C)
|
:0040D125 833D00FE410003 cmp dword ptr [0041FE00], 00000003 //----->
:0040D12C 7D07 jge 0040D135 //------>　比較大於則跳，所以改為小於7D->7E
:0040D12E 33C0 xor eax, eax
:0040D130 E91B010000 jmp 0040D250

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D0DB(C), :0040D12C(C)
|
:0040D135 833D00FE410003 cmp dword ptr [0041FE00], 00000003
:0040D13C 7545 jne 0040D183 //--------修改75-74即jne->je

* Possible StringData Ref from Data Obj ->"DELUXE registration OK" //-----7條魚！
|
:0040D13E 6864E54100 push 0041E564
:0040D143 6892000000 push 00000092
:0040D148 8B4508 mov eax, dword ptr [ebp+08]
:0040D14B 50 push eax

* Reference To: USER32.SetDlgItemTextA, Ord:022Ch
|
:0040D14C FF1514A24100 Call dword ptr [0041A214]
:0040D152 C605B1DD410001 mov byte ptr [0041DDB1], 01 //----
:0040D159 C605B2DD410001 mov byte ptr [0041DDB2], 01 //----
:0040D160 C605B3DD410001 mov byte ptr [0041DDB3], 01 //----
:0040D167 C605B4DD410001 mov byte ptr [0041DDB4], 01 //----
:0040D16E C605B5DD410001 mov byte ptr [0041DDB5], 01 //----
:0040D175 C605B6DD410001 mov byte ptr [0041DDB6], 01 //----
:0040D17C 33C0 xor eax, eax
:0040D17E E9CD000000 jmp 0040D250

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D13C(C) //-------------------------根據上面的值變化，也要修改。
|
:0040D183 6878104200 push 00421078
:0040D188 6892000000 push 00000092
:0040D18D 8B4D08 mov ecx, dword ptr [ebp+08]
:0040D190 51 push ecx

* Reference To: USER32.SetDlgItemTextA, Ord:022Ch
|
:0040D191 FF1514A24100 Call dword ptr [0041A214]
:0040D197 33C0 xor eax, eax
:0040D199 E9B2000000 jmp 0040D250

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CFD1(C)

下面是參考dyiyd兄的提示寫的：感謝dyiyd兄。

修改了上面的內容註冊就是任意註冊碼了。而且是DELUXE，7條魚！！！但是還有啟動註冊框NAG，下面來去掉他！

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404194(C)
|
:004041A0 833D00FE410000 cmp dword ptr [0041FE00], 00000000 //----0041FE00是否為0
:004041A7 740E je 004041B7 //-----等於0就跳，玩完了。 74->75即je->jne
:004041A9 C605B1DD410001 mov byte ptr [0041DDB1], 01
:004041B0 C605B2DD410001 mov byte ptr [0041DDB2], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004041A7(C)
|
:004041B7 6A03 push 00000003
:004041B9 E822F6FFFF call 004037E0
:004041BE 83C404 add esp, 00000004
:004041C1 85C0 test eax, eax
:004041C3 7434 je 004041F9 //------>eax=0就跳，玩完了。74->75即je->jne
:004041C5 C70500FE410003000000 mov dword ptr [0041FE00], 00000003 //-----使0041FE00=3
:004041CF C605B1DD410001 mov byte ptr [0041DDB1], 01
:004041D6 C605B2DD410001 mov byte ptr [0041DDB2], 01
:004041DD C605B3DD410001 mov byte ptr [0041DDB3], 01
:004041E4 C605B4DD410001 mov byte ptr [0041DDB4], 01
:004041EB C605B5DD410001 mov byte ptr [0041DDB5], 01
:004041F2 C605B6DD410001 mov byte ptr [0041DDB6], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404186(C), :004041C3(C)
|
:004041F9 833D00FE410000 cmp dword ptr [0041FE00], 00000000
:00404200 7410 je 00404212
:00404202 837DFC00 cmp dword ptr [ebp-04], 00000000
:00404206 740A je 00404212
:00404208 6A01 push 00000001
:0040420A E86AFDFFFF call 00403F79

所以只要使0041FE00=3就可以了，所以我們可以這麼修改。
<------------完--------->

FISH精美屏保暴力破解---WD32ASM893版 (6千字)

相關文章