Flash ActionScript Tool 的註冊碼！ (22千字)

作者：南木

軟體名稱： Flash ActionScript Tool (FAST!), v1.0

軟體功能：FAST! will aide you in creating, editing,
organizing and exchanging your ActionScripts easier &
faster. (flash的指令碼編輯利器！！！)

軟體限制：If you didn't register FAST! you'll be seeing a
nag-screen everytime you start the program. You also
won't be able to copy more then 5 lines to the
clipboard.
軟體價格：Registering FAST! is $39.95 US Dollars.

下載地址：http://swifftools.com/stools/

使用工具：FI ，W32DASM，trw2000

步驟：1、用FI檢視為delphi,未加殼,省事兒！
2、W32DASM反彙編查詢“The serial number is invalid.”字樣，找到後雙擊滑鼠來到他的呼叫地址向上查詢關鍵比對的地方，如下：
**************************************************************
.
.
.
:004F13F0 55 push ebp
:004F13F1 8BEC mov ebp, esp
:004F13F3 33C9 xor ecx, ecx
:004F13F5 51 push ecx
:004F13F6 51 push ecx
:004F13F7 51 push ecx
:004F13F8 51 push ecx
:004F13F9 51 push ecx
:004F13FA 51 push ecx
:004F13FB 53 push ebx
:004F13FC 56 push esi
:004F13FD 8BD8 mov ebx, eax
:004F13FF 33C0 xor eax, eax
:004F1401 55 push ebp
:004F1402 6847154F00 push 004F1547
:004F1407 64FF30 push dword ptr fs:[eax]
:004F140A 648920 mov dword ptr fs:[eax], esp
:004F140D 8D55FC lea edx, dword ptr [ebp-04]
:004F1410 8B83D4020000 mov eax, dword ptr [ebx+000002D4]
:004F1416 E8CDB7F4FF call 0043CBE8
:004F141B 8B45FC mov eax, dword ptr [ebp-04]
:004F141E E89934F1FF call 004048BC
:004F1423 83F803 cmp eax, 00000003
:004F1426 0F8E00010000 jle 004F152C
:004F142C 8D55F8 lea edx, dword ptr [ebp-08]
:004F142F 8B83DC020000 mov eax, dword ptr [ebx+000002DC]
:004F1435 E8AEB7F4FF call 0043CBE8
:004F143A 8B45F8 mov eax, dword ptr [ebp-08]
:004F143D E87A34F1FF call 004048BC
:004F1442 83F803 cmp eax, 00000003
:004F1445 0F8EE1000000 jle 004F152C
:004F144B 8D55F4 lea edx, dword ptr [ebp-0C]
:004F144E 8B83DC020000 mov eax, dword ptr [ebx+000002DC]
:004F1454 E88FB7F4FF call 0043CBE8
:004F1459 8B45F4 mov eax, dword ptr [ebp-0C]
:004F145C 50 push eax
:004F145D 8D55F0 lea edx, dword ptr [ebp-10]
:004F1460 8B83D4020000 mov eax, dword ptr [ebx+000002D4]
:004F1466 E87DB7F4FF call 0043CBE8
:004F146B 8B55F0 mov edx, dword ptr [ebp-10]
:004F146E 8BC3 mov eax, ebx
:004F1470 59 pop ecx
:004F1471 E80AFCFFFF call 004F1080--------------->關鍵Call，追入！！
:004F1476 84C0 test al, al
:004F1478 0F8492000000 je 004F1510----------------->跳則死！！！
:004F147E 6A00 push 00000000
:004F1480 668B0D54154F00 mov cx, word ptr [004F1554]
:004F1487 B202 mov dl, 02

* Possible StringData Ref from Code Obj ->"Thank you for registering FAST!"
|
:004F1489 B860154F00 mov eax, 004F1560
:004F148E E8E9ADF7FF call 0046C27C
:004F1493 B201 mov dl, 01
:004F1495 A1EC3A4600 mov eax, dword ptr [00463AEC]
:004F149A E81128F7FF call 00463CB0
:004F149F 8BF0 mov esi, eax
:004F14A1 BA01000080 mov edx, 80000001
:004F14A6 8BC6 mov eax, esi
:004F14A8 E83329F7FF call 00463DE0
:004F14AD C6460C01 mov [esi+0C], 01
:004F14B1 B101 mov cl, 01

* Possible StringData Ref from Code Obj ->"Software\Grooveware Multimedia\FAST!\Registrat"
->"ion"
|
:004F14B3 BA88154F00 mov edx, 004F1588
:004F14B8 8BC6 mov eax, esi
:004F14BA E8D52AF7FF call 00463F94
:004F14BF 8D55EC lea edx, dword ptr [ebp-14]
:004F14C2 8B83D4020000 mov eax, dword ptr [ebx+000002D4]
:004F14C8 E81BB7F4FF call 0043CBE8
:004F14CD 8B4DEC mov ecx, dword ptr [ebp-14]

* Possible StringData Ref from Code Obj ->"Name"
|
:004F14D0 BAC4154F00 mov edx, 004F15C4
:004F14D5 8BC6 mov eax, esi
:004F14D7 E8982EF7FF call 00464374
:004F14DC 8D55E8 lea edx, dword ptr [ebp-18]
:004F14DF 8B83DC020000 mov eax, dword ptr [ebx+000002DC]
:004F14E5 E8FEB6F4FF call 0043CBE8
:004F14EA 8B4DE8 mov ecx, dword ptr [ebp-18]

* Possible StringData Ref from Code Obj ->"Serial"
|
:004F14ED BAD4154F00 mov edx, 004F15D4
:004F14F2 8BC6 mov eax, esi
:004F14F4 E87B2EF7FF call 00464374
:004F14F9 8BC6 mov eax, esi
:004F14FB E89428F7FF call 00463D94
:004F1500 8BC6 mov eax, esi
:004F1502 E81123F1FF call 00403818
:004F1507 8BC3 mov eax, ebx
:004F1509 E862C4F6FF call 0045D970
:004F150E EB1C jmp 004F152C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004F1478(C)
|
:004F1510 6A00 push 00000000
:004F1512 668B0D54154F00 mov cx, word ptr [004F1554]
:004F1519 B201 mov dl, 01

* Possible StringData Ref from Code Obj ->"The serial number is invalid."
|
:004F151B B8E4154F00 mov eax, 004F15E4
:004F1520 E857ADF7FF call 0046C27C
:004F1525 8BC3 mov eax, ebx
:004F1527 E844C4F6FF call 0045D970

3、進入004F1080關鍵Call,看看！！！

********************************************************************************
* Referenced by a CALL at Addresses:
|:004F1471 , :004F61C7
|
:004F1080 55 push ebp
:004F1081 8BEC mov ebp, esp
:004F1083 6A00 push 00000000
:004F1085 6A00 push 00000000
:004F1087 6A00 push 00000000
:004F1089 6A00 push 00000000
:004F108B 6A00 push 00000000
:004F108D 6A00 push 00000000
:004F108F 6A00 push 00000000
:004F1091 53 push ebx
:004F1092 56 push esi
:004F1093 57 push edi
:004F1094 894DF8 mov dword ptr [ebp-08], ecx
:004F1097 8955FC mov dword ptr [ebp-04], edx
:004F109A 8B45FC mov eax, dword ptr [ebp-04]---->db eax 看註冊名
:004F109D E8CE39F1FF call 00404A70
:004F10A2 8B45F8 mov eax, dword ptr [ebp-08]---->db eax看假註冊碼
:004F10A5 E8C639F1FF call 00404A70
:004F10AA 33C0 xor eax, eax *********************
:004F10AC 55 push ebp *
:004F10AD 68CD114F00 push 004F11CD *
:004F10B2 64FF30 push dword ptr fs:[eax] *
:004F10B5 648920 mov dword ptr fs:[eax], esp *
:004F10B8 33C0 xor eax, eax *
:004F10BA 55 push ebp *
:004F10BB 689E114F00 push 004F119E *
:004F10C0 64FF30 push dword ptr fs:[eax] *
:004F10C3 648920 mov dword ptr fs:[eax], esp *
:004F10C6 33C9 xor ecx, ecx *
:004F10C8 B201 mov dl, 01 *
*
* Possible StringData Ref from Code Obj ->"PKA" *
| *
:004F10CA A1D03C4800 mov eax, dword ptr [00483CD0] *
:004F10CF E85842F9FF call 0048532C *
:004F10D4 8BD8 mov ebx, eax *
:004F10D6 33D2 xor edx, edx *
:004F10D8 8BC3 mov eax, ebx *
:004F10DA E83D35F9FF call 0048461C *
:004F10DF 8D45F4 lea eax, dword ptr [ebp-0C] *
*
* Possible StringData Ref from Code Obj ->"23988732`0-1sjahh832" *
| *
:004F10E2 BAE8114F00 mov edx, 004F11E8 *
:004F10E7 E8C035F1FF call 004046AC *
:004F10EC 8B55F4 mov edx, dword ptr [ebp-0C] *
:004F10EF 8BC3 mov eax, ebx *
:004F10F1 E8CA30F9FF call 004841C0 *
:004F10F6 8D4DF0 lea ecx, dword ptr [ebp-10] *
:004F10F9 8B55FC mov edx, dword ptr [ebp-04] *
:004F10FC 8BC3 mov eax, ebx *
:004F10FE E80932F9FF call 0048430C *
*
* Possible StringData Ref from Code Obj ->"qpvltgmgd18712hge`178623" *
| *
:004F1103 BA08124F00 mov edx, 004F1208 *
:004F1108 8BC3 mov eax, ebx *
:004F110A E8B130F9FF call 004841C0 *
:004F110F 8D4DEC lea ecx, dword ptr [ebp-14] *
:004F1112 8B55F0 mov edx, dword ptr [ebp-10] *
:004F1115 8BC3 mov eax, ebx *
:004F1117 E8F031F9FF call 0048430C *
:004F111C C745E8FFFFEFFE mov [ebp-18], FEEFFFFF *
:004F1123 8B45EC mov eax, dword ptr [ebp-14] *
:004F1126 E89137F1FF call 004048BC *
:004F112B 85C0 test eax, eax *
:004F112D 7E3E jle 004F116D *
:004F112F 8D45EC lea eax, dword ptr [ebp-14] *
:004F1132 E85539F1FF call 00404A8C *
:004F1137 BA01000000 mov edx, 00000001 *
:004F113C 4A dec edx *
:004F113D 3B50FC cmp edx, dword ptr [eax-04] *
:004F1140 7205 jb 004F1147 *
:004F1142 E8D925F1FF call 00403720 計算註冊碼
*
* Referenced by a (U)nconditional or (C)onditional Jump at Address: *
|:004F1140(C) *
| *
:004F1147 42 inc edx *
:004F1148 8D4410FF lea eax, dword ptr [eax+edx-01] *
:004F114C 50 push eax *
:004F114D 8B45EC mov eax, dword ptr [ebp-14] *
:004F1150 E86737F1FF call 004048BC *
:004F1155 8BD0 mov edx, eax *
:004F1157 81FAFFFF0000 cmp edx, 0000FFFF *
:004F115D 7605 jbe 004F1164 *
:004F115F E8BC25F1FF call 00403720 *
*
* Referenced by a (U)nconditional or (C)onditional Jump at Address: *
|:004F115D(C) *
| *
:004F1164 8D4DE8 lea ecx, dword ptr [ebp-18] *
:004F1167 58 pop eax *
:004F1168 E883F8FFFF call 004F09F0 *
*
* Referenced by a (U)nconditional or (C)onditional Jump at Address: *
|:004F112D(C) *
| *
:004F116D 8B45E8 mov eax, dword ptr [ebp-18] *
:004F1170 33D2 xor edx, edx *
:004F1172 52 push edx *
:004F1173 50 push eax *
:004F1174 8D55E4 lea edx, dword ptr [ebp-1C] *
:004F1177 B820000000 mov eax, 00000020 *
:004F117C E83B95F1FF call 0040A6BC ***************
:004F1181 8B55E4 mov edx, dword ptr [ebp-1C]------>db edx 看真註冊碼
:004F1184 8B45F8 mov eax, dword ptr [ebp-08]------->db eda 看假註冊碼
:004F1187 E84038F1FF call 004049CC------>判斷真假註冊碼是否相等
:004F118C 7504 jne 004F1192---------------->不相等則跳
:004F118E B301 mov bl, 01----------->相等，則置正確標誌！！！
:004F1190 EB02 jmp 004F1194

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004F118C(C)
|
:004F1192 33DB xor ebx, ebx-------------->置錯誤標誌ebx=0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004F1190(U)
|
:004F1194 33C0 xor eax, eax
:004F1196 5A pop edx
:004F1197 59 pop ecx
:004F1198 59 pop ecx
:004F1199 648910 mov dword ptr fs:[eax], edx
:004F119C EB0C jmp 004F11AA
:004F119E E97D2BF1FF jmp 00403D20
:004F11A3 33DB xor ebx, ebx
:004F11A5 E8D22EF1FF call 0040407C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004F119C(U)
|
:004F11AA 33C0 xor eax, eax
:004F11AC 5A pop edx
:004F11AD 59 pop ecx
:004F11AE 59 pop ecx
:004F11AF 648910 mov dword ptr fs:[eax], edx
:004F11B2 68D4114F00 push 004F11D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004F11D2(U)
|
:004F11B7 8D45E4 lea eax, dword ptr [ebp-1C]
:004F11BA E85534F1FF call 00404614
:004F11BF 8D45EC lea eax, dword ptr [ebp-14]
:004F11C2 BA05000000 mov edx, 00000005
:004F11C7 E86C34F1FF call 00404638
:004F11CC C3 ret----------------------->跳到:004F11D4

:004F11CD E9022EF1FF jmp 00403FD4
:004F11D2 EBE3 jmp 004F11B7
:004F11D4 8BC3 mov eax, ebx--------------->給eax置正確標誌
:004F11D6 5F pop edi
:004F11D7 5E pop esi
:004F11D8 5B

Flash ActionScript Tool 的註冊碼！ (22千字)

相關文章