讓程式自己告訴我們它的註冊碼---爆破進階篇
作者：風飄雪
加入BCG的第三篇
感謝看雪老師提供的代理伺服器，使我能上到國外的站點，學習他們的破解方法。
理論基礎：許多軟體在輸入錯誤的註冊碼時，會彈出錯誤資訊視窗，告訴你註冊碼不對。
我們可以用正確註冊碼替代錯誤資訊，使彈出正確註冊碼，從而達到讓程式自己告訴我們它的註冊碼
的目的。
下面舉例說明
破解物件：監獄(QUOD)1.0
下載： http://newhua.ruyi.com/down/Quod10.EXE
1.用language2000偵測是否加殼，發現aspack殼 ；2.unaspack脫殼;
3.用W32DASM反彙編
:0045F32E 8B55F0 mov edx, dword ptr [ebp-10]
:0045F331 8D4DF4 lea ecx, dword ptr [ebp-0C]
:0045F334 8BC3 mov eax, ebx
:0045F336 E8BD010000 call 0045F4F8
:0045F33B 8B55F4 mov edx, dword ptr [ebp-0C] **** 破解經典句式--------------------
:0045F33E 58 pop eax ***** edx中裝真碼
:0045F33F E8F854FAFF call 0040483C ****** 關鍵call ==============
:0045F344 7576 jne 0045F3BC ****** 關鍵跳轉 註冊碼不對跳到45f3bc-------
:0045F346 B201 mov dl, 01
:0045F348 A1E8EA4500 mov eax, dword ptr [0045EAE8]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F2DE(C)
|
:0045F34D E896F8FFFF call 0045EBE8
:0045F352 8945FC mov dword ptr [ebp-04], eax
:0045F355 33C0 xor eax, eax
:0045F357 55 push ebp
:0045F358 68B5F34500 push 0045F3B5
:0045F35D 64FF30 push dword ptr fs:[eax]
:0045F360 648920 mov dword ptr fs:[eax], esp
:0045F363 B101 mov cl, 01
* Possible StringData Ref from Code Obj ->"Software\XDZHAN\Quod"
|
:0045F365 BA00F44500 mov edx, 0045F400
:0045F36A 8B45FC mov eax, dword ptr [ebp-04]
:0045F36D E87AF9FFFF call 0045ECEC
* Possible StringData Ref from Code Obj ->"Real Programmers Use Pascal!"
|
:0045F372 B920F44500 mov ecx, 0045F420
* Possible StringData Ref from Code Obj ->"Key"
|
:0045F377 BA48F44500 mov edx, 0045F448
:0045F37C 8B45FC mov eax, dword ptr [ebp-04]
:0045F37F E804FBFFFF call 0045EE88
* Possible StringData Ref from Code Obj ->"軟體註冊成功,謝謝您的支援!"
|
:0045F384 B854F44500 mov eax, 0045F454
:0045F389 E82A39FDFF call 00432CB8
:0045F38E A1E83E4600 mov eax, dword ptr [00463EE8]
:0045F393 8B00 mov eax, dword ptr [eax]
* Possible StringData Ref from Code Obj ->"監獄(Quod)―註冊版"
|
:0045F395 BA78F44500 mov edx, 0045F478
:0045F39A E8459EFDFF call 004391E4
:0045F39F 33C0 xor eax, eax
:0045F3A1 5A pop edx
:0045F3A2 59 pop ecx
:0045F3A3 59 pop ecx
:0045F3A4 648910 mov dword ptr fs:[eax], edx
:0045F3A7 68C6F34500 push 0045F3C6
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F3BA(U)
|
:0045F3AC 8B45FC mov eax, dword ptr [ebp-04]
:0045F3AF E82043FAFF call 004036D4
:0045F3B4 C3 ret
:0045F3B5 E9AE4AFAFF jmp 00403E68
:0045F3BA EBF0 jmp 0045F3AC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F344(C) 綠色光條停在此，雙擊滑鼠右鍵，可來到跳過來的地方
|
* Possible StringData Ref from Code Obj ->"註冊碼不正確,無法註冊!"
|
:0045F3BC B894F44500 mov eax, 0045F494------跳到這裡，就改這裡=>mov eax, dword ptr [ebp-0C]
:0045F3C1 E8F238FDFF call 00432CB8
:0045F3C6 33C0 xor eax, eax
（1）第一種修改方法：
dword ptr [ebp-0C]中裝有真註冊碼
修改 0045F3BC B894F44500 mov eax, 0045F494 **459494裝錯誤資訊"註冊碼不正確,無法註冊!"
修改為 mov eax, dword
ptr [ebp-0C] ****dword ptr [ebp-0C]中裝有真註冊碼
B894F44500=〉
8B45F49090 由於保持位元組相同，補兩個90
(2)第二種修改方法：
trw下斷
bpx 45f33e
d (ebp-0c)
看到資料視窗 20CDBD00 ****注意
dd (ebp-0C)
看到00BDCD20上面的倒過來
DB (EBP-0C) 看到正確的註冊碼
按F10直到
:0045F3BC B894F44500 mov eax, 0045F494
a
mov eax,00bdcd20
繼續走，彈出註冊碼
總結：B894F44500 (mov eax, 0045F494)
=> B820CDBD00 （mov eax,00bdcd20）
用ultredit永久修改，測試成功
修改後的程式輸入姓名和任意註冊碼，便會彈出正確的註冊碼