軟體名稱: 我也愛背單詞2001+
版 本: V3.1 語音白金版
軟體平臺: Win9x WinNT Win2000 WinME WinXP
軟體大小: 2596KB
軟體簡介: 我也愛背單詞2001+是一款小巧精悍的綠色英語單詞輔助記憶軟體
下載地址：http://www8.pconline.com.cn/download/swdetail.phtml?id=2786
正確註冊：name:36382052Sumica.Tan4661586
sn：94978405677094
破解工具：Soft-ICE、 lauguage、GUW32
破解流程：
1.用 lauguage 偵測 是ASPpack的殼，用GUW脫之。
2.由於使用者名稱已經自動生成，故在sn裡填上 “787878787878” （12個數字）
3.進入 S-ICE，bpx hmemcpy
4.F5 回來 按 “現在註冊”
5.按 F12 12次
來到的程式碼如下：
:004823A7 837DFC00 cmp
dword ptr [ebp-04], 00000000 ；<------判斷輸入是否為空
:004823AB 750F
jne 004823BC
* Possible StringData Ref from Code Obj ->"You must have Register Name"
|
:004823AD B8A4264800 mov eax,
004826A4
:004823B2 E8FD09FDFF call 00452DB4
；<--------空 就直接完蛋
:004823B7 E98D020000 jmp 00482649
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004823AB(C)
|
:004823BC 8D55F8
lea edx, dword ptr [ebp-08]
:004823BF 8B8308030000 mov eax, dword
ptr [ebx+00000308]
:004823C5 E85EB6FAFF call 0042DA28
:004823CA 837DF800 cmp
dword ptr [ebp-08], 00000000 ;<-----------註冊碼是否為空？
:004823CE 750F
jne 004823DF
* Possible StringData Ref from Code Obj ->"You can't leave the Register Number
"
->"blank"
|
:004823D0 B8C8264800 mov eax,
004826C8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048236A(C)
|
:004823D5 E8DA09FDFF call 00452DB4
:004823DA E96A020000 jmp 00482649
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004823CE(C)
|
:004823DF 8D55F4
lea edx, dword ptr [ebp-0C]
:004823E2 8B8308030000 mov eax, dword
ptr [ebx+00000308]
:004823E8 E83BB6FAFF call 0042DA28
:004823ED 8B45F4
mov eax, dword ptr [ebp-0C]
:004823F0 50
push eax
:004823F1 8D55F0
lea edx, dword ptr [ebp-10]
:004823F4 A1F0DD4900 mov eax,
dword ptr [0049DDF0]
:004823F9 E8FEFDFFFF call 004821FC
:004823FE 8B55F0
mov edx, dword ptr [ebp-10]
:00482401 58
pop eax
:00482402 E8351AF8FF call 00403E3C
:00482407 0F85F0000000 jne 004824FD
；<－－－－關鍵第一跳
^^^^^^^^^^
×××就跳到這裡啦！
:004824FD 8D55E0
lea edx, dword ptr [ebp-20]
:00482500 8B8308030000 mov eax, dword
ptr [ebx+00000308]
:00482506 E81DB5FAFF call 0042DA28
:0048250B 8B45E0
mov eax, dword ptr [ebp-20]
:0048250E 50
push eax <-------------可以看到 假的註冊碼
:0048250F 8D55D8
lea edx, dword ptr [ebp-28]
:00482512 8B8304030000 mov eax, dword
ptr [ebx+00000304]
:00482518 E80BB5FAFF call 0042DA28
:0048251D 8B45D8
mov eax, dword ptr [ebp-28]
:00482520 8D55DC
lea edx, dword ptr [ebp-24]
:00482523 E8D4FCFFFF call 004821FC
:00482528 8B55DC
mov edx, dword ptr [ebp-24] <-----eax＝使用者名稱
:0048252B 58
pop eax
:0048252C E80B19F8FF call 00403E3C
<-------關鍵的call，註冊碼就在裡頭！！
:00482531 0F85EB000000 jne 00482622
<--------改為 je（85改為84）就直通羅馬！
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
在 :0048252C E80B19F8FF call 00403E3C 的時候我們F8進去看看（程式碼如下）
:00403E3C 53
push ebx
:00403E3D 56
push esi
:00403E3E 57
push edi
:00403E3F 89C6
mov esi, eax
:00403E41 89D7
mov edi, edx
:00403E43 39D0
cmp eax, edx <------------到這就看到真的和假的在一起啦！
:00403E45 0F848F000000 je 00403EDA
:00403E4B 85F6
test esi, esi
我第一次寫的記錄，有不好的地方就請各位多加指正！
希望轉載保持完整。謝謝！
Sumica.Tan 2001.12.7