轉載一篇破解教程（LeapFTP) (10千字)
凌晨2：30分，總算有空安定下來寫這篇教程了。 以前破過不少防毒、加密及註冊軟體，但還是第一次寫教程，表達可能不是很好，多看幾偏吧。OK
軟體：LeapFTP.EXE (這是一個上傳網頁的程式)版本：2.7.0.550
程式在註冊成功後會將其寫入登錄檔的HKEY_CURRENT_USER\Software\LeapWare\Registry\LeapFTP
下面,
每次啟動時都回讀取判斷. 這個程式有兩種註冊碼,並且由兩段不同的程式段進行判斷.
第一種:將使用者名稱運算後與註冊碼比較,註冊碼格式 XXXXXX-XXXXXXXXXX X為數字
列:ligang 214065-1079336565 (有效的註冊碼哦!)
第二種:使用者名稱任意,透過註冊碼來做文章. 註冊碼格式 XXXY-XXYX-XYXX-ABCD X為字母,Y為數字,A為XXXY中
各位ASCII之和除以1AH的餘數+41H所得的ASCII碼字元,B為XXYX中各位ASCII之和除以1AH的餘數+41H所得的
ASCII碼字元,C為XYXX中各位ASCII之和除以1AH的餘數+41H所得的ASCII碼字元,D為前三節ASCII之和除以1AH的
餘數+41H所得的ASCII碼字元.(好煩!!!) 列：ABC9-AB9C-A3CC-VVQG (有效的註冊碼哦!)第一種:破解工具：TRW,HIEW
先進入程式的註冊畫面添寫. ^N 進入TRW設BPX HMEMCPY 然後F5,點OK,被攔下,再F5,攔下後,BD
1 PMODULE
:004871C0 E803C8FAFF call
004339C8
:004871C5 8B55F4
mov edx, dword ptr [ebp-0C] ;按F10從幾處RET返回後到次
:004871C8 8B4DFC
mov ecx, dword ptr [ebp-04]
:004871CB 8BC3
mov eax, ebx
:004871CD E8BA010000 call
0048738C ;!!!!追進
:004871D2 84C0
test al, al ;若AL=0就完了,將其改1可成功,但從啟任然
:004871D4 7462
je 00487238 ;為UNREGSETR;call 0048738C 的進入點
. .
:00487466 E8A9CBF7FF call
00404014 ;判斷前六位
:0048746B 7548
jne 004874B5 ;決不能轉 .
.
. :004874AA E865CBF7FF
call 00404014 ;判斷後10位
:004874AF 7504
jne 004874B5 ;決不能轉
:004874B1 B301
mov bl, 01 ;呵,呵,可愛的1
:004874B3 EB02
jmp 004874B7;程式判斷比較部分
:00404014 53
push ebx
:00404015 56
push esi
:00404016 57
push edi
:00404017 89C6
mov esi, eax
:00404019 89D7
mov edi, edx
:0040401B 39D0
cmp eax, edx
:0040401D 0F848F000000 je 004040B2
:00404023 85F6
test esi, esi
:00404025 7468
je 0040408F
:00404027 85FF
test edi, edi
:00404029 746B
je 00404096
:0040402B 8B46FC
mov eax, dword ptr [esi-04]
:0040402E 8B57FC
mov edx, dword ptr [edi-04]
:00404031 29D0
sub eax, edx
:00404033 7702
ja 00404037
:00404035 01C2
add edx, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:|:00404033(C)
|:00404037 52
push edx
:00404038 C1EA02
shr edx, 02
:0040403B 7426
je 00404063
* Referenced by a (U)nconditional or (C)onditional Jump at Address:|:00404059(C)
|
:0040403D 8B0E
mov ecx, dword ptr [esi] ;下D ESI並將此處設斷(因不是一次比較完)
:0040403F 8B1F
mov ebx, dword ptr [edi] ;下D EDI 看見了甚麼???
:00404041 39D9
cmp ecx, ebx
:00404043 7558
jne 0040409D
:00404045 4A
dec edx
:00404046 7415
je 0040405D
:00404048 8B4E04
mov ecx, dword ptr [esi+04]
:0040404B 8B5F04
mov ebx, dword ptr [edi+04]
:0040404E 39D9
cmp ecx, ebx
:00404050 754B
jne 0040409D
:00404052 83C608
add esi, 00000008
:00404055 83C708
add edi, 00000008
:00404058 4A
dec edx
:00404059 75E2
jne 0040403D
:0040405B EB06
jmp 00404063
* Referenced by a (U)nconditional or (C)onditional Jump at Address:|:00404046(C)
|:0040405D 83C604
add esi, 00000004
:00404060 83C704
add edi, 00000004
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040403B(C), :0040405B(U)|:00404063 5A
pop edx
:00404064 83E203
and edx, 00000003
:00404067 7422
je 0040408B
:00404069 8B0E
mov ecx, dword ptr [esi]
:0040406B 8B1F
mov ebx, dword ptr [edi]
:0040406D 38D9
cmp cl, bl
:0040406F 7541
jne 004040B2
:00404071 4A
dec edx
:00404072 7417
je 0040408B
:00404074 38FD
cmp ch, bh
:00404076 753A
jne 004040B2
:00404078 4A
dec edx
:00404079 7410
je 0040408B
:0040407B 81E30000FF00 and ebx, 00FF0000
:00404081 81E10000FF00 and ecx, 00FF0000
:00404087 39D9
cmp ecx, ebx
:00404089 7527
jne 004040B2
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404067(C), :00404072(C), :00404079(C)|
:0040408B 01C0
add eax, eax
:0040408D EB23
jmp 004040B2
* Referenced by a (U)nconditional or (C)onditional Jump at Address:|:00404025(C)
|:0040408F 8B57FC
mov edx, dword ptr [edi-04]
:00404092 29D0
sub eax, edx
:00404094 EB1C
jmp 004040B2
* Referenced by a (U)nconditional or (C)onditional Jump at Address:|:00404029(C)
|:00404096 8B46FC
mov eax, dword ptr [esi-04]
:00404099 29D0
sub eax, edx
:0040409B EB15
jmp 004040B2
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404043(C), :00404050(C)|:0040409D 5A
pop edx
:0040409E 38D9
cmp cl, bl
:004040A0 7510
jne 004040B2
:004040A2 38FD
cmp ch, bh
:004040A4 750C
jne 004040B2
:004040A6 C1E910
shr ecx, 10
:004040A9 C1EB10
shr ebx, 10
:004040AC 38D9
cmp cl, bl
:004040AE 7502
jne 004040B2
:004040B0 38FD
cmp ch, bh
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040401D(C), :0040406F(C), :00404076(C), :00404089(C), :0040408D(U)
|:00404094(U), :0040409B(U), :004040A0(C), :004040A4(C), :004040AE(C)|
:004040B2 5F
pop edi
:004040B3 5E
pop esi
:004040B4 5B
pop ebx:004040B5 C3
ret
;程式判斷比較部分返回第二種::00487562 83F813
cmp eax, 00000013 ;比較是19字元個嗎
:00487565 0F8520010000 jne 0048768B
:0048756B 8B45FC
mov eax, dword ptr [ebp-04]
:0048756E 8078042D
cmp byte ptr [eax+04], 2D ;判斷有無"-"
:00487572 0F8513010000 jne 0048768B
:00487578 8B45FC
mov eax, dword ptr [ebp-04]
:0048757B 8078092D
cmp byte ptr [eax+09], 2D ;同上
:0048757F 0F8506010000 jne 0048768B
:00487585 8B45FC
mov eax, dword ptr [ebp-04]
:00487588 80780E2D
cmp byte ptr [eax+0E], 2D ;同上
:0048758C 0F85F9000000 jne 0048768B
. .
:004875AE 85C0
test eax, eax
:004875B0 7516
jne 004875C8
:004875B2 8B45FC
mov eax, dword ptr [ebp-04]
:004875B5 8A4418FF
mov al, byte ptr [eax+ebx-01]
:004875AE 85C0
test eax, eax
:004875B0 7516
jne 004875C8
:004875B2 8B45FC
mov eax, dword ptr [ebp-04]
:004875B5 8A4418FF
mov al, byte ptr [eax+ebx-01]
:004875B9 E84EFFFFFF call
0048750C ;對字元的判斷
:004875BE 84C0
test al, al
:004875C0 0F84C5000000 je 0048768B
:004875C6 EB22
jmp 004875EA .
.
:004875D9 8A4418FF
mov al, byte ptr [eax+ebx-01]
:004875DD E83EFFFFFF call
00487520 ;對數字的判斷
:004875E2 84C0
test al, al
:004875E4 0F84A1000000 je 0048768B
. .
:00487632 8BC6
mov eax, esi ; ESI中是第一節區ASCII之和
:00487634 BB1A000000 mov ebx,
0000001A
:00487639 99
cdq:0048763A F7FB
idiv ebx
:0048763C 83C241
add edx, 00000041 ;餘數+41H
:0048763F 8B45FC
mov eax, dword ptr [ebp-04]
:00487642 3A500F
cmp dl, byte ptr [eax+0F] ;比較 A
:00487645 7544
jne 0048768B
:00487647 8BC7
mov eax, edi ;EDI中是第二節區ASCII之和
:00487649 BB1A000000 mov ebx,
0000001A
:0048764E 99
cdq:0048764F F7FB
idiv ebx
:00487651 83C241
add edx, 00000041
:00487654 8B45FC
mov eax, dword ptr [ebp-04]
:00487657 3A5010
cmp dl, byte ptr [eax+10] ;比較 B
:0048765A 752F
jne 0048768B
:0048765C 8B45F4
mov eax, dword ptr [ebp-0C] ;[EBP-0C]中是第三節區ASCII之和
:0048765F BB1A000000 mov ebx,
0000001A
:00487664 99
cdq:00487665 F7FB
idiv ebx
:00487667 83C241
add edx, 00000041
:0048766A 8B45FC
mov eax, dword ptr [ebp-04]
:0048766D 3A5011
cmp dl, byte ptr [eax+11] ;比較 C
:00487670 7519
jne 0048768B
:00487672 8BC1
mov eax, ecx ;ECX中是第一.二.三節區ASCII之和(前面以累加)
:00487674 B91A000000 mov ecx,
0000001A
:00487679 99
cdq:0048767A F7F9
idiv ecx
:0048767C 83C241
add edx, 00000041
:0048767F 8B45FC
mov eax, dword ptr [ebp-04]
:00487682 3A5012
cmp dl, byte ptr [eax+12] ;比較 D
:00487685 7504
jne 0048768B
:00487687 C645FB01
mov [ebp-05], 01 ;呵,呵,就是它了;可以看出每一節區的字元順序可任意
:0048768B 33C0
xor eax, eax
:0048768D 5A
pop edx
:0048768E 59
pop ecx
:0048768F 59
pop ecx
:00487690 648910
mov dword ptr fs:[eax], edx
:00487693 68A8764800 push
004876A8
:00487698 8D45FC
lea eax, dword ptr [ebp-04]
:0048769B E8E4C5F7FF call
00403C84
:004876A0 C3
ret可以看出第二種手工都可以算出註冊碼哎,我打字太慢了,現在8:00整了.
相關文章
- 轉載一篇破解教程（vrv2000) 作者：飛刀浪子 (14千字)2001-03-29VR
- 一篇破解教程-----面向初學者 (15千字)2001-04-01
- leapftp教程，掌握leapftp教程只需6步2020-09-03FTP
- leapftp 3.0.1使用教程，6步掌握leapftp 3.0.1使用教程2020-09-02FTP
- leapftp 3.0.1使用教程，教你如何掌握leapftp 3.0.1使用教程2020-10-14FTP
- 破解LeapFTP 2.7剛完成的,寫得不好高手別看^_^ (7千字)2002-03-16FTP
- 轉載：“亂刀”破解手記 (1千字)2000-09-03
- 一篇破解入門 (7千字)2000-09-04
- 如何安裝leapftp，如何安裝leapftp的詳細教程2020-09-19FTP
- 轉一篇比較簡單的installshiled的破解 (2千字)2001-05-14
- 轉載：InstallShield Password 破解一例 (1千字)2001-02-09
- 《Diablo 2 暗黑破壞神 》破解（轉載） (1千字)2001-10-07
- Soundnailsd的破解教程（一） (9千字)2001-10-17AI
- Delphi元件破解教程（一）
(3千字)2015-11-15元件
- 菜鳥破解一篇：vcrkme01 (11千字)2001-10-19
- Navicat 破解版下載，Navicat破解教程2021-10-12
- crackme破解教程(續) (高手莫入) (2千字)2001-03-17
- IPTools 1.10 破解 (5千字)2001-02-11
- 轉貼一篇：FlashFXP v1.4.1 build 823 的脫殼與破解 (16千字)2001-12-30UI
- 初學者請進（一篇破解javagirl的心得） (2千字)2000-05-09Java
- 再貼一篇cd-chcek破解譯文 (4千字)2000-08-27
- Tmaster6.0 破解（我的第一篇灌水） (4千字)2001-10-04AST
- 來一篇：暴力破解Crystal Button 1.31A (7千字)2015-11-15
- [翻譯]用dede破解-另一篇~請大家指正~~ (5千字)2015-11-15
- 一篇SMC補丁方法的教程
(7千字)2015-11-15
- 破解 Zelix KlassMaster 的字串加密 在java遊戲中作弊(轉載文章) (7千字)2001-07-24SSMAST字串加密Java遊戲
- 交一篇作業---破解Hedit 2.0的註冊碼 (7千字)2001-09-30
- 控制元件破解指南（轉貼） (4千字)2002-06-27控制元件
- 硬碟保護卡的破解 (轉)~~~~ (2千字)2001-11-23硬碟
- 有聲有色 v3.16破解教程 (6千字)2000-10-03
- 用VC和自制工具VCDEBUG助手進行跟蹤破解[轉載] (3千字)2001-11-10
- BananaSplitter 1.0破解實戰 (10千字)2000-09-11NaN
- dfx V4.0破解過程 (10千字)2000-09-24
- The Cleaner 3.2 BUILD 3205的破解(10千字)2001-01-27UI
- 一篇初級破解過程，很久沒有動手了，大家不要笑我鈍啊！ (10千字)2003-01-11
- 翻譯一篇很簡單的暴力破解installshield! (6千字)2001-03-15
- 申請加入BCG之第一篇！------LC3破解！ (2千字)2001-10-06
- 木瓜破解入門教程――傻瓜篇（第一課） (2千字)2001-10-30