申請加入BCG之第二篇！博奧彩票白金版破解---破解初學者之嘔血篇
軟體名稱：博奧彩票白金版
下載地點：http://www.boao.con.cn
破 解 者：紅潮風暴
時 間：2001-04-01
破解工具：TRW2000
整 理: 2001-10-06
這個軟體其實是徒有虛名（不能猜中獎的），我看了某個網頁的介紹說某某人用它中了什麼什麼的大獎，小弟就把它當下了也想發發橫財。但是用了卻它根本沒中過什麼獎，想來就有一肚子火（小弟迷上了彩票也買了快三年多了，錢花了不少就沒中過獎運氣也真背的，誰知~~~~~用了這撈什麼軟體花的錢就更多了，全扔水裡了。~~~~）。這是我第一次玩破解破的軟體,看了井風兄的博奧彩票黃金版破解就匆匆忙忙的破解開了。我那時只有TRW而且不太會用，破解它全是靠不斷的下D命令花了我半個多鍾搞得頭昏腦脹才得出註冊碼的~~~。為了加入BCG就將它整理出來了充數，寫的不好或有不當之處請大家指正。
1。執行TRW2000
2。執行RETATE。EXE 點選幫助--註冊，看到隨機碼2414812878316799刪除掉，然後輸入86357241。
撥出TRW。下斷點BPX HMEMCPY 攔住後清除斷點.領空後按F12
七次，按F10來到此處：
016F:00560A3A NOP
016F:00560A3B NOP
016F:00560A3C PUSH EBP
016F:00560A3D MOV EBP,ESP
016F:00560A3F ADD ESP,FFFFFF60
016F:00560A45 PUSH EBX
016F:00560A46 PUSH ESI
016F:00560A47 PUSH EDI
016F:00560A48 MOV [EBP+FFFFFF64],EAX
016F:00560A4E MOV EAX,006D2D80
016F:00560A53 CALL 0067D5B0
016F:00560A58 MOV EDX,[EBP+FFFFFF64]
016F:00560A5E MOV ECX,[EDX+02C4]
016F:00560A64 MOV EAX,[ECX+01F8]
016F:00560A6A SUB EAX,BYTE +02
016F:00560A6D JC 00560A74
016F:00560A6F JMP 005610D1
016F:00560A74 MOV WORD [EBP+FFFFFF78],14
016F:00560A7D XOR EDX,EDX
016F:00560A7F MOV [EBP-04],EDX
016F:00560A82 LEA EDX,[EBP-04]
016F:00560A85 INC DWORD [EBP-7C]
016F:00560A88 MOV EAX,[EBP+FFFFFF64]
016F:00560A8E MOV EAX,[EAX+02D0]
016F:00560A94 CALL 006398FC
016F:00560A99 MOV WORD [EBP+FFFFFF78],08
016F:00560AA2 MOV WORD [EBP+FFFFFF78],20
016F:00560AAB XOR EDX,EDX
016F:00560AAD MOV EAX,75
016F:00560AB2 MOV [EBP-08],EDX
016F:00560AB5 LEA EDX,[EBP-08]
016F:00560AB8 INC DWORD [EBP-7C]
016F:00560ABB CALL 00508C9C
016F:00560AC0 MOV WORD [EBP+FFFFFF78],08
016F:00560AC9 MOV WORD [EBP+FFFFFF78],2C
016F:00560AD2 XOR ECX,ECX
016F:00560AD4 MOV [EBP-0C],ECX
016F:00560AD7 LEA EAX,[EBP-0C]
016F:00560ADA INC DWORD [EBP-7C]
016F:00560ADD CALL 00507184
016F:00560AE2 MOV WORD [EBP+FFFFFF78],08
016F:00560AEB MOV WORD [EBP+FFFFFF78],38
016F:00560AF4 XOR EDX,EDX
016F:00560AF6 MOV EAX,7F
016F:00560AFB MOV [EBP-10],EDX
016F:00560AFE LEA EDX,[EBP-10]
016F:00560B01 INC DWORD [EBP-7C]
016F:00560B04 CALL 00508C9C
016F:00560B09 MOV WORD [EBP+FFFFFF78],08
016F:00560B12 MOV WORD [EBP+FFFFFF78],44
016F:00560B1B XOR ECX,ECX
016F:00560B1D MOV [EBP-24],ECX
016F:00560B20 LEA EDX,[EBP-24]
016F:00560B23 INC DWORD [EBP-7C]
016F:00560B26 MOV EAX,[EBP+FFFFFF64]
016F:00560B2C MOV EAX,[EAX+02D0]
016F:00560B32 CALL 006398FC
016F:00560B37 LEA EAX,[EBP-24]
016F:00560B3A MOV EAX,[EAX]
016F:00560B3C XOR EDX,EDX
016F:00560B3E MOV [EBP-28],EDX
016F:00560B41 LEA EDX,[EBP-28]
016F:00560B44 INC DWORD [EBP-7C]
016F:00560B47 CALL 00505914
016F:00560B4C LEA EAX,[EBP-28]
016F:00560B4F MOV EAX,[EAX]
016F:00560B51 XOR EDX,EDX
016F:00560B53 MOV [EBP-14],EDX
016F:00560B56 LEA EDX,[EBP-14]
016F:00560B59 INC DWORD [EBP-7C]
016F:00560B5C CALL 00505914
016F:00560B61 DEC DWORD [EBP-7C]
016F:00560B64 LEA EAX,[EBP-28]
016F:00560B67 MOV EDX,02
016F:00560B6C CALL 00685668
016F:00560B71 DEC DWORD [EBP-7C]
016F:00560B74 LEA EAX,[EBP-24]
016F:00560B77 MOV EDX,02
016F:00560B7C CALL 00685668
016F:00560B81 MOV WORD [EBP+FFFFFF78],08
016F:00560B8A MOV WORD [EBP+FFFFFF78],50
016F:00560B93 XOR EAX,EAX
016F:00560B95 LEA EDX,[EBP-18]
016F:00560B98 MOV [EBP-18],EAX
016F:00560B9B MOV EAX,89
016F:00560BA0 INC DWORD [EBP-7C]
016F:00560BA3 CALL 00508C9C
016F:00560BA8 MOV WORD [EBP+FFFFFF78],08
016F:00560BB1 MOV WORD [EBP+FFFFFF78],5C
016F:00560BBA XOR ECX,ECX
016F:00560BBC MOV [EBP-2C],ECX
016F:00560BBF LEA EDX,[EBP-2C]
016F:00560BC2 INC DWORD [EBP-7C]
016F:00560BC5 MOV EAX,[EBP-0C] 〈此處EBP-0C在這段程式碼中只出現一次故很可疑下D
ebp-0c無發現016F:00560BC8 CALL 00505914
《-----此處下D EAX 得真註冊碼
016F:00560BCD LEA EAX,[EBP-2C]
016F:00560BD0 MOV EAX,[EAX]
016F:00560BD2 XOR EDX,EDX
016F:00560BD4 MOV [EBP-1C],EDX
016F:00560BD7 LEA EDX,[EBP-1C]
016F:00560BDA INC DWORD [EBP-7C]
016F:00560BDD CALL 00505914
016F:00560BE2 DEC DWORD [EBP-7C]
016F:00560BE5 LEA EAX,[EBP-2C]
016F:00560BE8 MOV EDX,02
016F:00560BED CALL 00685668
016F:00560BF2 MOV WORD [EBP+FFFFFF78],08
016F:00560BFB MOV WORD [EBP+FFFFFF78],68
016F:00560C04 XOR EAX,EAX
016F:00560C06 LEA EDX,[EBP-20]
016F:00560C09 MOV [EBP-20],EAX
016F:00560C0C MOV EAX,93
016F:00560C11 INC DWORD [EBP-7C]
016F:00560C14 CALL 00508C9C
016F:00560C19 MOV WORD [EBP+FFFFFF78],08
016F:00560C22 LEA EDX,[EBP-1C]
016F:00560C25 LEA EAX,[EBP-14]
016F:00560C28 CALL 0068574C
016F:00560C2D TEST AL,AL
016F:00560C2F JZ NEAR 00561029