密碼大師4.0破解過程
軟體下載:http://www.inhua.com/down/jm4.0.zip
用Trw2000載入檔案執行，下斷點bpx messageboxa，選擇大於2M的檔案，被攔下，按F12到下面
016F:004020D1 LEA ECX,[EBP+FFFE772C]
016F:004020D7 CALL 004892A1
016F:004020DC MOV EDX,[EBP-10]
016F:004020DF MOV EAX,[EDX+1FBC]
016F:004020E5 MOV ECX,[EBP-10]
016F:004020E8 CMP DWORD [ECX+EAX*4+101C],00200B20
-->監測檔案長度
016F:004020F3 JNA 004020F7
-->不跳就死，改為JMP
SHORT 004020F7
016F:004020F5 JMP SHORT 00402118
016F:004020F7 MOV EDX,[EBP-10]
016F:004020FA MOV EAX,[EDX+1FBC]
016F:00402100 ADD EAX,BYTE +01
016F:00402103 MOV ECX,[EBP-10]
016F:00402106 MOV [ECX+1FBC],EAX
016F:0040210C MOV EDX,[EBP-10]
016F:0040210F CMP DWORD [EDX+1FBC],BYTE +02
-->監測載入檔案數目
016F:00402116 JNG 00402140
-->不跳就死，改為JMP
SHORT 00402140
016F:00402118 PUSH BYTE +00
016F:0040211A PUSH DWORD 005B8710
016F:0040211F PUSH DWORD 005B84DC
016F:00402124 MOV ECX,[EBP-10]
016F:00402127 CALL 00484682
-->這裡面就是錯誤提示了，向上看看
016F:0040212C MOV BYTE [EBP-04],00
016F:00402130 LEA ECX,[EBP+FFFE772C]
016F:00402136 CALL 00488A4E
016F:0040213B JMP 00402238
016F:00402140 MOV BYTE [EBP-04],00
016F:00402144 LEA ECX,[EBP+FFFE772C]
016F:0040214A CALL 00488A4E
破解完成。。。。。
退出。。。
什麼。。。。竟然有出現提示視窗，幹掉他，下斷點bpx messageboxa，執行軟體，推出，程式被欄下，按2次F12到下面
016F:00402FD9 POP ECX
016F:00402FDA MOV [EBP-04],ECX
016F:00402FDD PUSH BYTE +00
016F:00402FDF PUSH DWORD 005B8710
016F:00402FE4 PUSH DWORD 005B84DC
016F:00402FE9 MOV ECX,[EBP-04]
016F:00402FEC CALL 00484682
-->這個就是退出的提示視窗了，用5個nop蓋了它
016F:00402FF1 MOV ECX,[EBP-04]
016F:00402FF4 CALL 0047F1B9
016F:00402FF9 POP EDI
016F:00402FFA POP ESI
016F:00402FFB POP EBX
016F:00402FFC ADD ESP,BYTE +44
016F:00402FFF CMP EBP,ESP
016F:00403001 CALL 0041F440
016F:00403006 MOV ESP,EBP
016F:00403008 POP EBP
本想該結束了吧，沒想到退出時又出現了提示視窗，bpx messageboxa，按2次F12到下面
016F:00424773 AND ECX,BYTE +04
016F:00424776 TEST ECX,ECX
016F:00424778 JZ 004247E8
-->這個跳轉可以帶過下面的CALL，改為JMP SHORT 004247E8
016F:0042477A CMP DWORD [EBP+10],BYTE +00
016F:0042477E JZ 0042479D
016F:00424780 PUSH BYTE +0A
016F:00424782 LEA EDX,[EBP+FFFFCFDC]
016F:00424788 PUSH EDX
016F:00424789 MOV EAX,[EBP+10]
016F:0042478C PUSH EAX
016F:0042478D CALL 004280D0
016F:00424792 ADD ESP,BYTE +0C
016F:00424795 MOV [EBP+FFFFCFD4],EAX
016F:0042479B JMP SHORT 004247A7
016F:0042479D MOV DWORD [EBP+FFFFCFD4],00
016F:004247A7 LEA ECX,[EBP+FFFFF000]
016F:004247AD PUSH ECX
016F:004247AE MOV EDX,[EBP+14]
016F:004247B1 PUSH EDX
016F:004247B2 MOV EAX,[EBP+FFFFCFD4]
016F:004247B8 PUSH EAX
016F:004247B9 MOV ECX,[EBP+0C]
016F:004247BC PUSH ECX
016F:004247BD MOV EDX,[EBP+08]
016F:004247C0 PUSH EDX
016F:004247C1 CALL 00424800
-->這裡是錯誤框
016F:004247C6 ADD ESP,BYTE +14
016F:004247C9 MOV [EBP+FFFFEFF8],EAX
016F:004247CF CMP DWORD [EBP+08],BYTE +02
016F:004247D3 JNZ 004247E0
016F:004247D5 PUSH DWORD 005E5688
016F:004247DA CALL `KERNEL32!InterlockedDecrement`
016F:004247E0 MOV EAX,[EBP+FFFFEFF8]
016F:004247E6 JMP SHORT 004247FB
016F:004247E8 CMP DWORD [EBP+08],BYTE +02
016F:004247EC JNZ 004247F9
載執行一下，一切流暢，到此破解終於完成了
煩。。。。。
conanxu[BCG]
conanxu@eastday.com