程式名稱：UltraEdit 9.00 簡繁雙語第二版
軟體簡介：不用說了吧
下載地址：http://202.102.249.231/hanhua/DOWNLOAD/cuedit900_2.exe
破解目的：找出註冊碼。
工具： Trw2000 1.22 ,w32dsm89黃金版
說明：
Uedit32 9.00和Uedit32 8.0x一樣採用key檔案保護方式，用的是檔案Uedit32.reg。
先在Help選單下找到Register UltraEdit-32，點選會彈出一個對話方塊。填入你的大名，
還有註冊碼。我用000000，12034-12340-12034-10234註冊（註冊碼形式：XX0XX-XXXX0-
XX0XX-X0XXX）下斷點Bpx readfile do "d esp-100",按幾次F5你會在SoftICE的資料視窗看到C:\Program
Files\UltraEdit\UEDIT32.reg字樣，按12次F12後，按f10一步步地跟蹤到下面：
* Reference To: USER32.CreateWindowExA, Ord:0059h
|
:00451608 FF1598775200 Call dword ptr
[00527798]
:0045160E A3AC275700 mov dword
ptr [005727AC], eax
:00451613 8D8700050000 lea eax, dword
ptr [edi+00000500]
:00451619 885810
mov byte ptr [eax+10], bl
:0045161C FF352C8F5600 push dword ptr
[00568F2C]
:00451622 6A01
push 00000001
:00451624 50
push eax
:00451625 FF75F0
push [ebp-10]
:00451628 E83A2BFCFF call 00414167
<--關鍵，跟進
:0045162D 83C410
add esp, 00000010
:00451630 85C0
test eax, eax
:00451632 0F8489010000 je 004517C1
:00451638 391D482A5700 cmp dword ptr
[00572A48], ebx
:0045163E 0F857D010000 jne 004517C1
跟進上面的 call 後，一步步地跟蹤到下面：
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414181(C)
|
:0041418D 395D10
cmp dword ptr [ebp+10], ebx
:00414190 0F84DE020000 je 00414474
:00414196 83F806
cmp eax, 00000006 <--名字大於等於 6
:00414199 0F8CD5020000 jl 00414474
<--名字小於6就跳
:0041419F 8065EC00 and
byte ptr [ebp-14], 00
:004141A3 8065AC00 and
byte ptr [ebp-54], 00
:004141A7 80A56CFFFFFF00 and byte ptr [ebp+FFFFFF6C],
00
:004141AE 395D14
cmp dword ptr [ebp+14], ebx
:004141B1 0F84BD020000 je 00414474
:004141B7 57
push edi
:004141B8 56
push esi
:004141B9 E872620C00 call 004DA430
:004141BE 59
pop ecx
然後一步步地跟蹤到下面，就到目的地了：
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041441C(C)
|
:0041443E 8D8570FFFFFF lea eax, dword
ptr [ebp+FFFFFF70]
:00414444 50
push eax
:00414445 8D45B0
lea eax, dword ptr [ebp-50]
:00414448 50
push eax <--輸入的註冊碼
:00414449 E822760C00 call 004DBA70
:0041444E 59
pop ecx
:0041444F 85C0
test eax, eax
:00414451 59
pop ecx
:00414452 7426
je 0041447A
:00414454 8D8530FFFFFF lea eax, dword
ptr [ebp+FFFFFF30]
:0041445A 50
push eax <--正確的註冊碼
:0041445B 8D45B0
lea eax, dword ptr [ebp-50]
:0041445E 50
push eax
:0041445F E80C760C00 call 004DBA70
<--比較
:00414464 59
pop ecx
:00414465 85C0
test eax, eax
:00414467 59
pop ecx
:00414468 7410
je 0041447A
:0041446A C705648F560001000000 mov dword ptr [00568F64], 00000001
總結：
使用者名稱：000000
授權碼：B4F0J-Q901S-08R6A-A301X