[作者：S.M]
這是Fpc大哥主頁上新的crackme，我來捧個場！
用softice。下bpx
hmemcpy.來到以下的地方：
0040181A CMP
EBX, 00000014 ---比較註冊碼的個數（應為20個）
所以填:1234567890asdfghjklp
0040181D
JE 00401845
* Referenced by
a (U)nconditional or (C)onditional Jumo at
Address:
|:0040181D
00401845 lea esi,
dword ptr [ebp-60]
* Referenced by a (U)nconditional
or (C)onditional Jumo at
Address:
|:004018CB
00401848 push esi
---將姓名放入堆疊
00401849
xor eax, eax
0040184B mov
esi, dword ptr [ebp-38]
0040184E
add esi, dword ptr [ebp-40]
00401851
lea edi, dword ptr [ebp-74]
00401854 xor ebx, ebx
00401856
xor ecx, ecx
---清零，準備記數。
* Referenced by a (U)nconditional
or (C)onditional Jumo at
Address:
|:00401891
00401858
cmp ecx, 00000044 ---68次迴圈？(好多呀!)
0040185B ja 00401893
....
....
....
00401861 push
ebx
00401862 mov eax, ecx
00401864
push 00000004 \
00401866 pop ebx
/ ebx==4
....
00401868 idiv
ebx 有符號除
0040186A
test edx, edx
0040186c jge
00401870 餘數大於等於0時跳
0040186E
not edx
* Referenced by
a (U)nconditional or (C)onditional Jumo at
Address:
|:0040186C
00401870 push
edx
00401871 mov eax, ecx
00401873 push 000000011
\
00401875 pop ebx
/ ebx==11;
....
00401877 idiv
ebx
00401879 test
edx, edx
0040187b jge
0040187F
0040187d
not edx
* Referenced
by a (U)nconditional or (C)onditional Jumo at
Address:
|:0040187b
0040187F mov
eax, edx
00401881 pop
edx
00401882 mov dl,
byte ptr [edi+edx] ----假註冊碼
00401885 mov
al, byte ptr [esi+eax]
----- (Who
is the Devil?)
00401888 xor
al, bl 按位加。
0040188A pop
ebx
0040188b rol
ebx, 5 ---右移5位
00401890
inc ecx
00401891 jmp
00401858
* Referenced by
a (U)nconditional or (C)onditional Jumo at
Address:
|:0040185b
00401893 xor
ecx, ecx
00401895 pop
esi
00401896 lea edi, dword
ptr [ebp+FFFFFF68]
* Referenced by a (U)nconditional
or (C)onditional Jumo at Address:
|:004018C2
0040189C mov eax, ebx
0040189E
push 000000020
\
004018A0 pop ebx
/ebx==20
....
004018A2
idiv ebx
004018A4 test
edx, edx
004018A6 jge
004018AA
004018A8 not
edx
* Referenced by a (U)nconditional
or (C)onditional Jumo at
Address:
|:004018A6
004018AA mov edx, eax
004018AC mov dl, byte
ptr [edi+edx]
004018AF mov
al, byte ptr [esi+ecx]
004018B2 test
al, al
004018B4 je
004018d5 ---移完跳出迴圈
....
....
....
....
004018BA cmp
al, dl ---一位一位比較姓名。
004018BC jne 004018D0
--不對就跳。
004018BE inc
ecx --ecx加一
004018BF
cmp ecx, 00000003
004018C2
jl 0040189C ----3個為一組迴圈比較
004018C4 add edi, 00000003
004018C7 add dword
ptr [ebp-40],00000004
004018CB jmp
00401848
隨意填了姓名：SMSMSMSM.在004018BA比較處下？dl。即為註冊碼。
得姓名：MQDRBHLJT 註冊碼：123456789asdfghjklp
關了程式，再開啟。重新填入，準備欣賞一下，結果提示錯誤。
不會吧！這也會錯。重新跟蹤，發現MQDRBH部分不變，看來後面的部分
是隨機的。
填MQDRBH.成功！！！！Fpc大哥做了一個小小的陷阱！^__^
Fpc大哥加我吧。QQ:5537188