學習篇---用dede3.0破財智2001家庭理財加強版註冊版 (7千字)

下載地址：http://www.imoney.com.cn/download/software/mh2001plus.exe 8950k
1、執行winspect.exe，發現財智2001註冊視窗的form名字為TRegisterFm。
關閉軟體。

2、執行dede3.0，選擇檔案，點process，編譯結束後點form，找到 TRegisterFm，看events
object RegisterFm: TRegisterFm
..........
object Panel2: TPanel
Left = 0
Top = 323
Width = 549
Height = 40
Align = alBottom
TabOrder = 1
object btnReg: TBitBtn
Left = 434
Top = 7
Width = 89
Height = 25
Caption = '完成註冊'
TabOrder = 0
OnClick = btnRegClick//找到event，雙擊
Kind = bkOK
end
object btnCancel: TBitBtn
Left = 332
Top = 7
Width = 91
Height = 25
Caption = '稍後註冊'
TabOrder = 1
Kind = bkCancel
end
....................

出現如下程式碼，分析
004C4E18 55 push ebp
004C4E19 8BEC mov ebp, esp
004C4E1B 6A00 push $00
004C4E1D 53 push ebx
004C4E1E 8BD8 mov ebx, eax
004C4E20 33C0 xor eax, eax
004C4E22 55 push ebp

* Possible String Reference to: 'L塍膃[Y]?
|
004C4E23 68E74E4C00 push $004C4EE7

***** TRY
|
004C4E28 64FF30 push dword ptr fs:[eax]
004C4E2B 648920 mov fs:[eax], esp

* Reference to control btnCancel : TBitBtn
|
004C4E2E 8B83FC020000 mov eax, [ebx+$02FC]
004C4E34 80784700 cmp byte ptr [eax+$47], $00
004C4E38 0F8493000000 jz 004C4ED1
004C4E3E 8D55FC lea edx, [ebp-$04]

* Reference to control edRegCode : TEdit
|
004C4E41 8B83F4020000 mov eax, [ebx+$02F4]

* Reference to: controls.TControl.GetText(TControl):System.String;
|
004C4E47 E8702CF7FF call 00437ABC
004C4E4C 8B45FC mov eax, [ebp-$04]

|
004C4E4F E850F8FFFF call 004C46A4//關鍵call,跟入看看
004C4E54 84C0 test al, al
004C4E56 744F jz 004C4EA7
004C4E58 A17CB96500 mov eax, dword ptr [$65B97C]
004C4E5D 8B00 mov eax, [eax]
004C4E5F 8B55FC mov edx, [ebp-$04]

|
004C4E62 E8E190FFFF call 004BDF48//存入登錄檔
004C4E67 6A00 push $00
004C4E69 668B0DF44E4C00 mov cx, word ptr [$4C4EF4]
004C4E70 B202 mov dl, $02

* Possible String Reference to: '祝賀您,註冊成功！'
|
004C4E72 B8004F4C00 mov eax, $004C4F00

|
004C4E77 E818A5F9FF call 0045F394
004C4E7C 8D832C030000 lea eax, [ebx+$032C]
004C4E82 8B55FC mov edx, [ebp-$04]

* Reference to: system.@LStrAsg;
|
004C4E85 E886F1F3FF call 00404010
004C4E8A 8BC3 mov eax, ebx

|
004C4E8C E81FFCFFFF call 004C4AB0
004C4E91 C783300300000F270000 mov dword ptr [ebx+$0330], $0000270F
004C4E9B C7833402000001000000 mov dword ptr [ebx+$0234], $00000001
004C4EA5 EB2A jmp 004C4ED1
004C4EA7 6A00 push $00
004C4EA9 668B0DF44E4C00 mov cx, word ptr [$4C4EF4]
004C4EB0 B201 mov dl, $01

* Possible String Reference to: '對不起，註冊失敗,請校對註冊碼'
|
004C4EB2 B81C4F4C00 mov eax, $004C4F1C

|
004C4EB7 E8D8A4F9FF call 0045F394

* Reference to control edRegCode : TEdit
|
004C4EBC 8B93F4020000 mov edx, [ebx+$02F4]
004C4EC2 8BC3 mov eax, ebx

* Reference to: forms.TCustomForm.SetActiveControl(TCustomForm;Controls.TWinControl);
|
004C4EC4 E85FCBF8FF call 00451A28
004C4EC9 33C0 xor eax, eax
004C4ECB 898334020000 mov [ebx+$0234], eax
004C4ED1 33C0 xor eax, eax
004C4ED3 5A pop edx
004C4ED4 59 pop ecx
004C4ED5 59 pop ecx
004C4ED6 648910 mov fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: '[Y]?
|
004C4ED9 68EE4E4C00 push $004C4EEE
004C4EDE 8D45FC lea eax, [ebp-$04]

* Reference to: system.@LStrClr(String);
|
004C4EE1 E8D6F0F3FF call 00403FBC
004C4EE6 C3 ret

004C4EE7 E94CEBF3FF jmp 00403A38
004C4EEC EBF0 jmp 004C4EDE

****** END
|
004C4EEE 5B pop ebx
004C4EEF 59 pop ecx
004C4EF0 5D pop ebp
004C4EF1 C3 ret
====================================================================================
那個call的內容如下：
004C46A4 55 push ebp
004C46A5 8BEC mov ebp, esp
004C46A7 6A00 push $00
004C46A9 6A00 push $00
004C46AB 6A00 push $00
004C46AD 53 push ebx
004C46AE 8945FC mov [ebp-$04], eax//輸入的假註冊碼
004C46B1 8B45FC mov eax, [ebp-$04]

* Reference to: system.@LStrAddRef;
|
004C46B4 E847FDF3FF call 00404400
004C46B9 33C0 xor eax, eax
004C46BB 55 push ebp
004C46BC 6819474C00 push $004C4719

***** TRY
|
004C46C1 64FF30 push dword ptr fs:[eax]
004C46C4 648920 mov fs:[eax], esp
004C46C7 8D45F4 lea eax, [ebp-$0C]

|
004C46CA E831FFFFFF call 004C4600
004C46CF 8B45F4 mov eax, [ebp-$0C]//機器碼
004C46D2 8D55F8 lea edx, [ebp-$08]

|
004C46D5 E846FFFFFF call 004C4620
004C46DA 8B45F8 mov eax, [ebp-$08]
|
004C46DD E8FAFCFFFF call 004C43DC//此處下d eax可看到真的註冊碼
004C46E2 8BD8 mov ebx, eax
004C46E4 8B45FC mov eax, [ebp-$04]

|
004C46E7 E8F0FCFFFF call 004C43DC
004C46EC 85C0 test eax, eax
004C46EE 7504 jnz 004C46F4
004C46F0 33DB xor ebx, ebx
004C46F2 EB0A jmp 004C46FE
004C46F4 3BC3 cmp eax, ebx
004C46F6 7504 jnz 004C46FC
004C46F8 B301 mov bl, $01
004C46FA EB02 jmp 004C46FE
004C46FC 33DB xor ebx, ebx
004C46FE 33C0 xor eax, eax
004C4700 5A pop edx
004C4701 59 pop ecx
004C4702 59 pop ecx
004C4703 648910 mov fs:[eax], edx

****** FINALLY

3、執行trw，下bpx 004C46DD，中斷後d eax 看到我的註冊碼
3126-0351

重新輸入註冊碼，註冊成功

學習篇---用dede3.0破財智2001家庭理財加強版註冊版 (7千字)

相關文章