不知各位有沒有瀏覽過惡意網站,有沒有被禁用登錄檔編緝器,如果你被禁用的話,你可以用許多法恢復.那你有沒有試過用破解的方法呢?下面是我的破解方法:
執行登錄檔編緝器(regedit.exe),彈出禁用登錄檔的資訊,按Ctrl+D進入ICE，輸入命令HWND，看到這些東東：
Window Handle hQueue SZ QOwner Class Name
Window Procedure
0080(0) 206F 32 MSGSRV32
#32769 (Desktop) 1787:00005F92
03D8(1) 220F 32 EXPLORER
BaseBar 136F:0000028A
03DC(2) 220F 32 EXPLORER
MenuSite 136F:0000028A
0420(3) 220F 32 EXPLORER
SysPager 136F:00000140
0424(4) 220F 32 EXPLORER
ToolbarWindow32 136F:000002B6
03B0(1) 220F 32 EXPLORER
BaseBar 136F:0000028A
03B4(2) 220F 32 EXPLORER
MenuSite 136F:0000028A
略去一些
0540(1) 410F 32 REGEDIT IME
175F:00000000
053C(1) 410F 32 REGEDIT
#32770 (Dialog) 175F:00007720
0544(2) 410F 32 REGEDIT
Button 175F:000035CC ；注意
0548(2) 410F 32 REGEDIT
Static 175F:0000828E
054C(2) 410F 32 REGEDIT
Static 175F:0000828E
看到REGEDIT Buton 所對應的Window Handle為 544。
輸入命令 bmsg 544 wm_lbuttonup （544這個數字是不確定的，所以要用HWND來檢視）
這個命令的意思是當放開滑鼠左鍵的訊息傳到Button時引發中斷。
退出ICE，用滑鼠按確定鍵後引發中斷，再按F12鍵n次後，來到這裡
017F:0040CD11 57
PUSH EDI
017F:0040CD12 52
PUSH EDX
017F:0040CD13 57
PUSH EDI
017F:0040CD14 57
PUSH EDI
017F:0040CD15 51
PUSH ECX
017F:0040CD16 6800050000 PUSH
00000500
017F:0040CD1B FF150C954100 CALL
[0041950C]
017F:0040CD21 897DF8 MOV
[EBP-08],EDI
017F:0040CD24 85C0
TEST EAX,EAX
017F:0040CD26 742A
JZ 0040CD52
017F:0040CD28 397DFC CMP
[EBP-04],EDI
017F:0040CD2B 7425
JZ 0040CD52
017F:0040CD2D 8B4518 MOV
EAX,[EBP+18]
017F:0040CD30 0D00000100 OR
EAX,00010000
017F:0040CD35 50
PUSH EAX
017F:0040CD36 56
PUSH ESI
017F:0040CD37 FF75FC PUSH
DWORD PTR [EBP-04]
017F:0040CD3A FF750C PUSH
DWORD PTR [EBP+0C]
017F:0040CD3D FF1504964100 CALL
[00419604];這個CALL是彈出禁用視窗的
017F:0040CD43 FF75FC PUSH
DWORD PTR [EBP-04]；注意，EIP指向這裡
017F:0040CD46 8BF0
MOV ESI,EAX
017F:0040CD48 FF15BC944100 CALL
[004194BC]
017F:0040CD4E 8BC6
MOV EAX,ESI
017F:0040CD50 EB05
JMP 0040CD57
017F:0040CD52 B8FFFFFFFF MOV
EAX,FFFFFFFF
017F:0040CD57 5F
POP EDI
017F:0040CD58 5E
POP ESI
017F:0040CD59 8BE5
MOV ESP,EBP
017F:0040CD5B 5D
POP EBP
017F:0040CD5C C3
RET
經過兩次執行，發現0040CD24和0040CD28都不是判斷是否禁用登錄檔的地方，所以按F10鍵n次，返回上一層CALL，來到這裡：
017F:0040C7B6 E9DD000000 JMP
0040C898
017F:0040C7BB E808020000 CALL
0040C9C8
017F:0040C7C0 85C0
TEST EAX,EAX；這裡是判斷是否禁用的地方
017F:0040C7C2 741B
JZ 0040C7DF
017F:0040C7C4 6A10
PUSH 10
017F:0040C7C6 A100884100 MOV
EAX,[00418800]
017F:0040C7CB 6A10
PUSH 10
017F:0040C7CD 6A28
PUSH 28
017F:0040C7CF 6A00
PUSH 00
017F:0040C7D1 50
PUSH EAX
017F:0040C7D2 E8D1040000 CALL
0040CCA8；這個CALL是彈出禁用視窗的。
017F:0040C7D7 83C414 ADD
ESP,14；注意，EIP指向這裡
017F:0040C7DA E9B9000000 JMP
0040C898
下中斷 bpx 40c7c2 ，然後退出ICE，再執行登錄檔編緝器，當執行到40c7c2時中斷，修改EIP為40c7df ,按F5，執行正常。
用二進位制編輯器開啟regedit.exe,查詢74 1b 6a 10 a1 00 ,把74改為eb,破解完成。