FlashGet1.1
:關於FlashGet1.1
下載地址：http://soft.zz.ha.cn/query/down.asp?softnumber=7418&dtype=1&path=/fg11.exe
使用的軟體：WIN32DASM、TRW2000
網際快車是較好的下載軟體，它的歷次版本都比較好pj，而且它的pj方式大同小異。（多麼善良的作者^_^)它的註冊實際上就是去掉廣告條。
用WIN32DASM反彙編此檔案。查詢文字“REGNAME”（有的版本需要查詢兩次。前不久我pj的相同版本就是。由於重灌機，原檔案丟失，此次是我昨天剛下載的。）
程式碼如下：到底什麼意思，自己分析吧，我沒有時間寫。
* Possible StringData Ref from Data Obj ->"RegName"
|
:0041807F 6878B34D00 push 004DB378
:00418084 8D442414 lea
eax, dword ptr [esp+14]
* Possible StringData Ref from Data Obj ->"General"
|
:00418088 6848A44D00 push 004DA448
:0041808D 8BF1
mov esi, ecx
:0041808F 50
push eax
:00418090 E868C70800 call 004A47FD
* Possible Reference to Dialog:
|
:00418095 68D4134E00 push 004E13D4
* Possible StringData Ref from Data Obj ->"RegPass"
|
:0041809A 6870B34D00 push 004DB370
:0041809F 8D4C2410 lea
ecx, dword ptr [esp+10]
* Possible StringData Ref from Data Obj ->"General"
|
:004180A3 6848A44D00 push 004DA448
:004180A8 51
push ecx
:004180A9 8BCE
mov ecx, esi
:004180AB C744243400000000 mov [esp+34], 00000000
:004180B3 E845C70800 call 004A47FD
:004180B8 8B54240C mov
edx, dword ptr [esp+0C]
:004180BC BB01000000 mov ebx,
00000001
:004180C1 885C2424 mov
byte ptr [esp+24], bl
:004180C5 8B42F8 mov
eax, dword ptr [edx-08]
:004180C8 85C0
test eax, eax
:004180CA 0F84CF000000 je 0041819F
:004180D0 8B442408 mov
eax, dword ptr [esp+08]
:004180D4 8B48F8 mov
ecx, dword ptr [eax-08]
:004180D7 85C9
test ecx, ecx
:004180D9 0F84C0000000 je 0041819F
:004180DF 57
push edi
:004180E0 53
push ebx
:004180E1 6A43
push 00000043
:004180E3 8D4C2420 lea
ecx, dword ptr [esp+20]
:004180E7 E84D280700 call 0048A939
:004180EC 8D4C241C lea
ecx, dword ptr [esp+1C]
:004180F0 53
push ebx
:004180F1 51
push ecx
:004180F2 8D4C2414 lea
ecx, dword ptr [esp+14]
:004180F6 C644243002 mov [esp+30],
02
:004180FB E8F82C0700 call 0048ADF8
:00418100 8B542418 mov
edx, dword ptr [esp+18]
:00418104 8B00
mov eax, dword ptr [eax]
:00418106 52
push edx
:00418107 50
push eax
:00418108 E806380600 call 0047B913
:0041810D 83C408 add
esp, 00000008
:00418110 8D4C241C lea
ecx, dword ptr [esp+1C]
:00418114 85C0
test eax, eax
:00418116 0F94C0 sete
al
:00418119 25FF000000 and eax,
000000FF
:0041811E 8BF8
mov edi, eax
:00418120 E89E730700 call 0048F4C3
:00418125 8D4C2418 lea
ecx, dword ptr [esp+18]
:00418129 885C2428 mov
byte ptr [esp+28], bl
:0041812D E891730700 call 0048F4C3
:00418132 8B4C2410 mov
ecx, dword ptr [esp+10]
:00418136 57
push edi
:00418137 8D542418 lea
edx, dword ptr [esp+18]
:0041813B 51
push ecx
:0041813C 52
push edx
:0041813D 8BCE
mov ecx, esi
:0041813F E89C000000 call 004181E0
:00418144 8B44240C mov
eax, dword ptr [esp+0C]
:00418148 8B4C2414 mov
ecx, dword ptr [esp+14]
:0041814C 50
push eax ********假碼
:0041814D 51
push ecx ********真正的註冊碼。
:0041814E E8C0370600 call 0047B913
:00418153 83C408 add
esp, 00000008
:00418156 885C2428 mov
byte ptr [esp+28], bl
要想取得註冊碼請先開啟FLASHGET1.1輸入姓名、註冊碼後關閉。此檔案在啟動時檢查。
1、開啟秩TRW2000，裝入FLASHGET1.1。
2、設定中斷，BPX 41814e do "d ecx" 在資料區就可看到真正的註冊碼。
3、CTRL＋N
4、攔截成功。