Kryptel 3.8 暴力破解過程 (18千字)
作 者：tieji
破解時間：2001-8-18
破解工具：W32dasm黃金版 ,UltraEdit-32
作者主頁:http://www.filecryption.com/
說 明:Kryptel 3.8 1552K 整合在
Win9x中的加密工具，您只要在Windows資源管理器中點選
右鍵即可輕鬆加密單個或多個資料夾和檔案(可用
30 days)
先用language檢測，發現無殼。
用W32dasm開啟kroot.exe檔案，在串式參考中發現有“brw.exe”
原來kroot呼叫brw.exe程式，brw.exe才是真正的主程式。
於是：
用W32dasm開啟brw.exe檔案，在串式參考中找到“Registration
data accepted.Thank”
如下004015d1處：
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:0040141F(C)
|
:00401437 6890B64100
push 0041B690
:0040143C FF358CB64100
push dword ptr [0041B68C]
:00401442 680CB64100
push 0041B60C
:00401447 FF3508B64100
push dword ptr [0041B608]
:0040144D 68F4B54100
push 0041B5F4
:00401452 FF35F0B54100
push dword ptr [0041B5F0]
:00401458 6870B54100
push 0041B570
:0040145D FF356CB54100
push dword ptr [0041B56C]
:00401463 E8DB160100
call 00412B43
:00401468 FF7580
push [ebp-80]
:0040146B
FF7584 push [ebp-7C]
:0040146E 8D851CFFFFFF lea eax,
dword ptr [ebp+FFFFFF1C]
:00401474 50
push eax
:00401475 E80E170100
call 00412B88
:0040147A 83C42C
add esp, 0000002C
:0040147D 84C0
test al, al
:0040147F 0F84DD010000
je 00401662 <--------發現此處一跳就玩完了，所以不能跳
:00401485 C7050C12420001000000 mov dword ptr [0042120C], 00000001
:0040148F C7050C0A420004D0EE0B mov dword ptr [00420A0C], 0BEED004
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401435(U)
|
:00401499 8365FC00
and dword ptr [ebp-04], 00000000
:0040149D C78550FDFFFF02000080
mov dword ptr [ebp+FFFFFD50], 80000002
:004014A7 83A554FDFFFF00
and dword ptr [ebp+FFFFFD54], 00000000
:004014AE
C645FC01 mov [ebp-04],
01
:004014B2 6A02
push 00000002
:004014B4 6848BF4100
push 0041BF48
:004014B9 8D8D50FDFFFF
lea ecx, dword ptr [ebp+FFFFFD50]
:004014BF E8D6E40000
call 0040F99A
:004014C4 8BC6
mov eax, esi
:004014C6 85C0
test eax, eax
:004014C8 741E
je 004014E8
:004014CA 56
push esi
:004014CB E816EF0000
call 004103E6
:004014D0 59
pop ecx
:004014D1 83C003
add eax, 00000003
:004014D4 24FC
and al, FC
:004014D6 E8F54F0100
call 004164D0
:004014DB 8BC4
mov eax, esp
:004014DD
50
push eax
:004014DE 56
push esi
:004014DF E817EF0000
call 004103FB
:004014E4 59
pop ecx
:004014E5 59
pop ecx
:004014E6 EB02
jmp 004014EA
* Referenced by a (U)nconditional or (C)onditional
Jump at Address:
|:004014C8(C)
|
:004014E8 33C0
xor eax, eax
* Referenced
by a (U)nconditional or (C)onditional Jump at Address:
|:004014E6(U)
|
:004014EA 50
push eax
* Possible StringData Ref from Data Obj ->"UUserName"
|
:004014EB 68B4004200
push 004200B4 <--------向登錄檔寫你輸入註冊使用者名稱
:004014F0 8D8D50FDFFFF lea ecx,
dword ptr [ebp+FFFFFD50]
:004014F6 E8BBEC0000
call 004101B6
:004014FB 8D458C
lea eax, dword ptr [ebp-74]
:004014FE
85C0 test
eax, eax
:00401500 7424
je 00401526
:00401502 8D458C
lea eax, dword ptr [ebp-74]
:00401505 50
push eax
:00401506 E8DBEE0000 call
004103E6
:0040150B 59
pop ecx
:0040150C 83C003
add eax, 00000003
:0040150F 24FC
and al, FC
:00401511 E8BA4F0100 call 004164D0
:00401516 8BC4
mov eax, esp
:00401518 50
push eax
:00401519 8D458C
lea eax, dword ptr [ebp-74]
:0040151C 50
push eax
:0040151D E8D9EE0000
call 004103FB
:00401522 59
pop ecx
:00401523 59
pop ecx
:00401524
EB02 jmp
00401528
* Referenced by a (U)nconditional or (C)onditional Jump at
Address:
|:00401500(C)
|
:00401526 33C0
xor eax, eax
* Referenced
by a (U)nconditional or (C)onditional Jump at Address:
|:00401524(U)
|
:00401528 50
push eax
* Possible StringData Ref from Data Obj ->"RRegCode"
|
:00401529 689C014200
push 0042019C <--------向登錄檔寫你輸入的32位註冊碼
:0040152E 8D8D50FDFFFF lea ecx,
dword ptr [ebp+FFFFFD50]
:00401534 E87DEC0000
call 004101B6
:00401539 8D85B8FEFFFF
lea eax, dword ptr [ebp+FFFFFEB8]
:0040153F 85C0
test eax, eax
:00401541 742A
je 0040156D
:00401543 8D85B8FEFFFF
lea eax, dword ptr [ebp+FFFFFEB8]
:00401549 50
push eax
:0040154A E897EE0000
call 004103E6
:0040154F 59
pop ecx
:00401550 83C003
add eax, 00000003
:00401553 24FC
and al, FC
:00401555 E8764F0100
call 004164D0
:0040155A 8BC4
mov eax, esp
:0040155C
50
push eax
:0040155D 8D85B8FEFFFF
lea eax, dword ptr [ebp+FFFFFEB8]
:00401563 50
push eax
:00401564 E892EE0000
call 004103FB
:00401569 59
pop ecx
:0040156A 59
pop ecx
:0040156B EB02
jmp 0040156F
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:00401541(C)
|
:0040156D 33C0
xor eax, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040156B(U)
|
:0040156F 50
push eax
* Possible StringData Ref
from Data Obj ->"CChkCode"
|
:00401570
688C014200 push 0042018C
<--------向登錄檔寫你輸入的32位註冊校驗碼
:00401575 8D8D50FDFFFF
lea ecx, dword ptr [ebp+FFFFFD50]
:0040157B E836EC0000
call 004101B6
:00401580 6A03
push 00000003
:00401582 8B4584
mov eax, dword ptr [ebp-7C]
:00401585 FF30
push dword ptr [eax]
:00401587 FF7004
push [eax+04]
* Possible StringData Ref from Data Obj ->"KKrBlock"
|
:0040158A 687C014200
push 0042017C <--------向登錄檔寫
:0040158F 8D8D50FDFFFF
lea ecx, dword ptr [ebp+FFFFFD50]
:00401595
E81CED0000 call 004102B6
:0040159A 6A03
push 00000003
:0040159C 8B4580
mov eax, dword ptr [ebp-80]
:0040159F FF30
push dword ptr [eax]
:004015A1
FF7004 push [eax+04]
* Possible StringData Ref from Data Obj ->"KKrBlk"
|
:004015A4 6870014200
push 00420170 <--------向登錄檔寫krblk
:004015A9
8D8D50FDFFFF lea ecx, dword ptr [ebp+FFFFFD50]
:004015AF E802ED0000 call
004102B6
:004015B4 8065FC00
and byte ptr [ebp-04], 00
:004015B8 8D8D50FDFFFF
lea ecx, dword ptr [ebp+FFFFFD50]
:004015BE E89CE20000
call 0040F85F
:004015C3 834DFCFF
or dword ptr [ebp-04], FFFFFFFF
:004015C7 6840200100 push
00012040
* Possible StringData Ref from Data Obj ->"Krypel Registration"
|
:004015CC 685C014200
push 0042015C
* Possible StringData
Ref from Data Obj ->"Registration data accepted.
Thank "
->"you for registering
Kryptel!"
|
:004015D1 681C014200
push 0042011C <-------此處註冊成功，往上看是哪裡跳過來的
:004015D6 FF7508
push [ebp+08]
* Reference To: USER32.MessageBoxA, Ord:01C3h
|
:004015D9 FF15ECB24100
Call dword ptr [0041B2EC]
:004015DF 8D4584
lea eax, dword ptr [ebp-7C]
:004015E2 50
push eax
:004015E3 E8C8090100
call 00411FB0
:004015E8 8D4580
lea eax, dword ptr [ebp-80]
:004015EB 50
push eax
:004015EC
E8BF090100 call 00411FB0
:004015F1 59
pop ecx
:004015F2 59
pop ecx
:004015F3 685E010000
push 0000015E
:004015F8 8D8558FDFFFF
lea eax, dword ptr [ebp+FFFFFD58]
:004015FE 50
push eax
* Possible Reference to String Resource ID=00100: "Kryptel Browser"
|
:004015FF 6A64
push 00000064
:00401601
FF35840D4200 push dword ptr [00420D84]
* Reference To: USER32.LoadStringA, Ord:01AFh
|
:00401607 FF1514B34100
Call dword ptr [0041B314]
:0040160D 8D8558FDFFFF
lea eax, dword ptr [ebp+FFFFFD58]
:00401613 50
push eax
:00401614 E888010000 call
004017A1
:00401619 59
pop ecx
:0040161A 8D8558FDFFFF
lea eax, dword ptr [ebp+FFFFFD58]
:00401620 50
push eax
:00401621
FF35DC114200 push dword ptr [004211DC]
* Reference To: USER32.SetWindowTextA, Ord:0263h
|
:00401627 FF15E0B24100
Call dword ptr [0041B2E0]
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004012A3(C)
|
:0040162D FF750C
push [ebp+0C]
:00401630
FF7508 push [ebp+08]
* Reference To: USER32.EndDialog, Ord:00BBh
|
:00401633 FF151CB34100
Call dword ptr [0041B31C]
:00401639 6A01
push 00000001
:0040163B 58
pop eax
:0040163C EB53
jmp 00401691
:0040163E FF7508
push [ebp+08]
:00401641 FF35840D4200
push dword ptr [00420D84]
* Possible Reference
to String Resource ID=00349: "Regisration Error"
|
:00401647 685D010000
push 0000015D
:0040164C FFB54CFDFFFF
push dword ptr [ebp+FFFFFD4C]
:00401652 E8D5EE0000
call 0041052C
:00401657 83C410
add esp, 00000010
* Possible StringData
Ref from Code Obj ->"3??Md?"
|
:0040165A B88F164000 mov
eax, 0040168F
:0040165F C3
ret
:00401660 EB2D
jmp 0040168F
* Referenced
by a (U)nconditional or (C)onditional Jump at Address:
|:0040147F(C)
|
:00401662 6810200100 push
00012010 <--------跳到此處就玩完了........
* Possible StringData
Ref from Data Obj ->"Registration Error"
|
:00401667 68EC024200 push
004202EC
* Possible StringData Ref from Data Obj ->"Wrong user name
or registration/check "
->"code.
Please check the data you "
->"have entered."
|
:0040166C 68C8004200
push 004200C8
:00401671 FF7508
push [ebp+08]
* Reference To: USER32.MessageBoxA, Ord:01C3h
|
:00401674 FF15ECB24100
Call dword ptr [0041B2EC]
* Possible
Reference to Dialog: DialogID_0070, CONTROL_ID:03F3, ""
|
:0040167A 68F3030000
push 000003F3
* Referenced by a (U)nconditional or (C)onditional
Jump at Address:
|:00401338(U)
|
:0040167F FF7508
push [ebp+08]
* Reference
To: USER32.GetDlgItem, Ord:0105h
|
:00401682 FF15D8B24100 Call dword
ptr [0041B2D8]
:00401688 50
push eax
* Reference To: USER32.SetFocus,
Ord:0233h
|
:00401689 FF15DCB24100
Call dword ptr [0041B2DC]
* Referenced
by a (U)nconditional or (C)onditional Jump at Addresses:
|:004012A9(U), :004013B8(U),
:00401660(U)
|
:0040168F 33C0
xor eax, eax
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:0040163C(U)
|
:00401691 8DA53CFDFFFF
lea esp, dword ptr [ebp+FFFFFD3C]
:00401697
8B4DF4 mov ecx,
dword ptr [ebp-0C]
:0040169A 64890D00000000
mov dword ptr fs:[00000000], ecx
:004016A1 5F
pop edi
:004016A2 5E
pop esi
:004016A3 5B
pop ebx
:004016A4 C9
leave
:004016A5 C3
ret
在 0040147F
0F84DD010000 je 00401662 將0F84DD010000變為909090909090
執行程式，輸入使用者名稱：caoxinyu
輸入註冊碼：11111111
輸入校驗碼：22222222 按確定，提示註冊碼與校驗碼必須為4部分，每部分8個字元。
於是改為：輸入註冊碼：11111111-22222222-33333333-44444444
輸入校驗碼：55555555-66666666-77777777-88888888
按確定，註冊成功。
但退出程式，重新執行，有變無註冊版了，好，
再用W32dasm開啟brw.exe檔案，在串式參考中找到“The evaluation period has expired!Please...”
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040367A(C), :004036A9(C) <--------原來有兩個地方跳到此處
|
:0040373A 89B510FDFFFF mov
dword ptr [ebp+FFFFFD10], esi
:00403740 89B514FDFFFF
mov dword ptr [ebp+FFFFFD14], esi
:00403746 89350C124200
mov dword ptr [0042120C], esi
:0040374C
A1040A4200 mov eax, dword ptr
[00420A04]
:00403751 8B08
mov ecx, dword ptr [eax]
:00403753 BB92170000
mov ebx, 00001792
:00403758 53
push ebx
:00403759 BF008064F8 mov
edi, F8648000
:0040375E 57
push edi
:0040375F 6A5A
push 0000005A
:00403761 50
push eax
:00403762 FF5124
call [ecx+24]
:00403765 898584FEFFFF
mov dword ptr [ebp+FFFFFE84], eax
:0040376B 3BC6
cmp eax, esi
:0040376D 7C6A
jl 004037D9
:0040376F A1040A4200 mov eax,
dword ptr [00420A04]
:00403774 8B08
mov ecx, dword ptr [eax]
:00403776 8D9510FDFFFF
lea edx, dword ptr [ebp+FFFFFD10]
:0040377C
52
push edx
:0040377D 53
push ebx
:0040377E 57
push edi
:0040377F 6A5A
push 0000005A
:00403781
50
push eax
:00403782 FF512C
call [ecx+2C]
:00403785 898584FEFFFF
mov dword ptr [ebp+FFFFFE84], eax
:0040378B 3BC6
cmp eax, esi
:0040378D
7D0C jge
0040379B
:0040378F 89B510FDFFFF
mov dword ptr [ebp+FFFFFD10], esi
:00403795 89B514FDFFFF
mov dword ptr [ebp+FFFFFD14], esi
* Referenced
by a (U)nconditional or (C)onditional Jump at Address:
|:0040378D(C)
|
:0040379B 39B514FDFFFF cmp dword
ptr [ebp+FFFFFD14], esi
:004037A1 7C48
jl 004037EB
:004037A3 7F08
jg 004037AD
:004037A5
39B510FDFFFF cmp dword ptr [ebp+FFFFFD10],
esi
:004037AB 763E
jbe 004037EB
* Referenced by a (U)nconditional or (C)onditional
Jump at Address:
|:004037A3(C)
|
:004037AD 68C9000000
push 000000C9
:004037B2 6800C0692A
push 2A69C000
:004037B7 FFB514FDFFFF
push dword ptr [ebp+FFFFFD14]
:004037BD
FFB510FDFFFF push dword ptr [ebp+FFFFFD10]
:004037C3 E8582D0100 call
00416520
:004037C8 898510FDFFFF
mov dword ptr [ebp+FFFFFD10], eax
:004037CE 899514FDFFFF
mov dword ptr [ebp+FFFFFD14], edx
:004037D4 A3A80D4200
mov dword ptr [00420DA8], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040376D(C)
|
:004037D9 39B514FDFFFF cmp
dword ptr [ebp+FFFFFD14], esi
:004037DF 7F64
jg 00403845
:004037E1 7C08
jl 004037EB
:004037E3
39B510FDFFFF cmp dword ptr [ebp+FFFFFD10],
esi
:004037E9 775A
ja 00403845
* Referenced by a (U)nconditional or (C)onditional
Jump at Addresses:
|:004037A1(C), :004037AB(C), :004037E1(C)
|
:004037EB C6056404420001 mov byte ptr [00420464],
01
:004037F2 6A28
push 00000028
:004037F4 8D85ECFBFFFF
lea eax, dword ptr [ebp+FFFFFBEC]
:004037FA 50
push eax
* Possible Reference to String Resource ID=00100: "Kryptel Browser"
|
:004037FB 6A64
push 00000064
:004037FD FF35840D4200
push dword ptr [00420D84]
* Reference
To: USER32.LoadStringA, Ord:01AFh
|
:00403803 8B3D14B34100 mov edi,
dword ptr [0041B314]
:00403809 FFD7
call edi
:0040380B 68FA000000
push 000000FA
:00403810 8D8514FCFFFF
lea eax, dword ptr [ebp+FFFFFC14]
:00403816 50
push eax
* Possible Reference to String Resource ID=00570: "The evaluation period
has expired!
Please, register the sof"
|
:00403817 683A020000
push 0000023A <--------30天過後就出現這句話，往上看是哪裡跳過來的
:0040381C
FF35840D4200 push dword ptr [00420D84]
:00403822 FFD7
call edi
:00403824 6830200100
push 00012030
:00403829 8D85ECFBFFFF
lea eax, dword ptr [ebp+FFFFFBEC]
:0040382F 50
push eax
:00403830
8D8514FCFFFF lea eax, dword ptr [ebp+FFFFFC14]
:00403836 50
push eax
:00403837 FF35DC114200
push dword ptr [004211DC]
* Reference To: USER32.MessageBoxA,
Ord:01C3h
|
:0040383D FF15ECB24100
Call dword ptr [0041B2EC]
:00403843 EB29
jmp 0040386E
將0040367A及004036A9處的跳轉nop掉！
執行程式，哈，是註冊版了。
此程式的註冊碼沒追出來，先這樣湊合者用了
============================================================================
發現按滑鼠右鍵 Encrypt and Shred 及 Shred 都發現過期了。
而且呼叫help選單，於是，啟動trw
,下bpx winhelpa
按Encrypt and Shred 攔下，按F12及f10來到klx.dll領空（原來在klx.dll檔案中）：
|:75FC2F4A(C)
|
:75FC2F59 A08060FD75
mov al, byte ptr [75FD6080]
:75FC2F5E 50
push eax
:75FC2F5F
68C45EFD75 push 75FD5EC4
:75FC2F64 E873840000 call 75FCB3DC
:75FC2F69 A20896FD75 mov
byte ptr [75FD9608], al
:75FC2F6E A17898FD75
mov eax, dword ptr [75FD9878]
:75FC2F73 59
pop ecx
:75FC2F74
83F801 cmp eax,
00000001
:75FC2F77 59
pop ecx
:75FC2F78 0F84A6000000
je 75FC3024 <--------改跳 ｏｋ
:75FC2F7E 83F802
cmp eax, 00000002
:75FC2F81 0F849D000000
je 75FC3024 <--------改跳 ｏｋ
:75FC2F87
381D6894FD75 cmp byte ptr [75FD9468],
bl
:75FC2F8D 744F
je 75FC2FDE
:75FC2F8F BEAC9AFD75
mov esi, 75FD9AAC
:75FC2F94 8BC6
mov eax, esi
:75FC2F96 85C0
test eax, eax
:75FC2F98 741E
je 75FC2FB8
:75FC2F9A 56
push esi
:75FC2F9B E87B5F0000
call 75FC8F1B
:75FC2FA0 83C003
add eax, 00000003
:75FC2FA3 59
pop ecx
:75FC2FA4 24FC
and al, FC
:75FC2FA6 E8D5C80000
call 75FCF880
:75FC2FAB 8BC4
mov eax, esp
:75FC2FAD 50
push eax
:75FC2FAE
56
push esi
:75FC2FAF E8BD5F0000
call 75FC8F71
:75FC2FB4 59
pop ecx
:75FC2FB5 59
pop ecx
:75FC2FB6 EB02
jmp 75FC2FBA
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:75FC2F98(C)
|
:75FC2FB8 33C0
xor eax, eax
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:75FC2FB6(U)
|
:75FC2FBA 68424A0000
push 00004A42
:75FC2FBF 6A01
push 00000001
:75FC2FC1 50
push eax
:75FC2FC2 53
push ebx
* Reference To: USER32.WinHelpA,
Ord:02ADh
|
:75FC2FC3 FF15A851FD75
Call dword ptr [75FD51A8] <--------呼叫help選單，向上看哪裡可以跳過
:75FC2FC9 8D458C
lea eax, dword ptr [ebp-74]
:75FC2FCC 68C068FD75
push 75FD68C0
:75FC2FD1 50
push eax
:75FC2FD2 C7458C012000CB
mov [ebp-74], CB002001
======================================================================
按 Shred 攔下，按F12及f10來到：
:75FC7A08 A17898FD75
mov eax, dword ptr [75FD9878]
:75FC7A0D 895DFC
mov dword ptr [ebp-04],
ebx
:75FC7A10 83F801
cmp eax, 00000001
:75FC7A13 0F84A6000000
je 75FC7ABF
<--------改跳 ｏｋ
:75FC7A19 83F802
cmp eax, 00000002
:75FC7A1C 0F849D000000
je 75FC7ABF
<--------改跳 ｏｋ
:75FC7A22 381D6894FD75
cmp byte ptr [75FD9468], bl
:75FC7A28 744F
je 75FC7A79
:75FC7A2A
BEAC9AFD75 mov esi, 75FD9AAC
:75FC7A2F 8BC6
mov eax, esi
:75FC7A31 85C0
test eax, eax
:75FC7A33 741E
je 75FC7A53
:75FC7A35 56
push esi
:75FC7A36 E8E0140000 call
75FC8F1B
:75FC7A3B 83C003
add eax, 00000003
:75FC7A3E 59
pop ecx
:75FC7A3F 24FC
and al, FC
:75FC7A41
E83A7E0000 call 75FCF880
:75FC7A46 8BC4
mov eax, esp
:75FC7A48 50
push eax
:75FC7A49 56
push esi
:75FC7A4A E822150000
call 75FC8F71
:75FC7A4F 59
pop ecx
:75FC7A50 59
pop ecx
:75FC7A51 EB02
jmp 75FC7A55
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:75FC7A33(C)
|
:75FC7A53 33C0
xor eax, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:75FC7A51(U)
|
:75FC7A55 68424A0000
push 00004A42
:75FC7A5A 6A01
push 00000001
:75FC7A5C 50
push eax
:75FC7A5D
53
push ebx
* Reference To: USER32.WinHelpA, Ord:02ADh
|
:75FC7A5E FF15A851FD75
Call dword ptr [75FD51A8] <--------呼叫help選單，向上看哪裡可以跳過
:75FC7A64 8D45DC
lea eax, dword ptr [ebp-24]
:75FC7A67 68C068FD75
push 75FD68C0
:75FC7A6C 50
push eax
:75FC7A6D C745DC012000CB
mov [ebp-24], CB002001
到這裡按滑鼠右鍵 Encrypt
and Shred 及 Shred 都可用了。
相關文章
- 對VCDCUT 4.03的分析破解過程 (18千字)2001-08-08
- 暴力破解3 (6千字)2001-02-18
- SYSTEM CLEANER 暴力破解 (1千字)2001-01-04
- 暴力破解Security setup II (7千字)2001-10-24
- OICQ HACK 1.0 破解過程 (9千字)2001-04-23
- Nullz CrackMe 1.1破解過程 (13千字)2001-09-18Null
- WebTimeSync 5.2.0 破解過程 (14千字)2001-10-05Web
- 暴力破解windows Commander 4.52 (5千字)2001-02-19Windows
- dfx V4.0破解過程 (10千字)2000-09-24
- 破解過程-----請多多指教 (2千字)2000-12-31
- 電腦字型秀破解過程 (1千字)2001-03-18
- webeasymail的簡單破解過程 (2千字)2001-08-04WebAI
- PUZZLER1.20破解過程 (4千字)2002-01-26
- SuperCleaner2.30破解過程 (11千字)2002-02-04
- DISKdata v3.2.0之暴力破解 (6千字)2000-10-01
- Password Keeper v6.3破解過程 (8千字)2002-04-12
- post NOW! 破解過程！有意思。 (1千字)2000-12-30
- 有聲有色3.33破解過程 (4千字)2001-02-09
- 專業掃雷 1.2破解過程 (4千字)2001-02-17
- fulldisk A32 破解過程！（簡單） (1千字)2001-03-20
- 具體的破解過程來也！ (10千字)2001-04-21
- 密碼大師4.0破解過程 (3千字)2001-05-06密碼
- EmEditor v3.16破解過程 (9千字)2001-07-22
- 木馬克星5.33.60破解過程
(9千字)2002-03-28
- GaitCD破解全過程(installshield) (3千字)2015-11-15AI
- image optimizer v3.0之暴力破解 (6千字)2000-10-12
- Tornado2之Licence暴力破解 (15千字)2000-10-22
- Update NOW 2000 暴力破解方法！ (8千字)2001-02-11
- 暴力破解《網路吸血鬼3.3》 (9千字)2001-03-15
- 流光2001完全暴力破解 (3千字)2001-08-14
- 禁用登錄檔之暴力破解法。 (4千字)2001-10-14
- freeResV0.94瘋狂暴力破解 (3千字)2002-01-09
- 3.82024-06-19
- UltraEdit-32 v8.10.a 暴力破解 (4千字)2001-05-11
- 音樂賀卡廠4.10破解過程 (6千字)2001-08-11
- 蒙泰5.0加密狗破解過程 (6千字)2001-10-11加密
- 加密精靈V2.2破解過程 (9千字)2001-10-28加密
- 破解 OverNimble Localize Plus 1.04
全過程！ (13千字)2015-11-15