Flash下載工具Flashdown破解簡析！

軟體大小： 799 KB
軟體語言：英文
軟體類別：國外軟體 / 共享版 / 下載工具
應用平臺： Win9x/NT/2000/XP
加入時間： 2003-07-05 09:48:51
下載次數： 5008
推薦等級： ★★★
軟體下載: http://count.skycn.com/softdown.php?id=9310&url=http://gd-http.skycn.net:8080/down/fdt.zip

軟體介紹：
Flashdown讓你將Internet網頁中的Flash動畫檔案下載到電腦中,Flash精簡的檔案大小與音效支援功能成為許多人的最愛，因此是目前常見的網路動畫檔案格式。不過當你想要將這些網頁上的動畫放到自己的電腦內慢慢欣賞時，就會發現這些檔案並無法讓你下載。不過這個問題遇上了Flashdown就能迎刃而解。

破解工具：TRW1.22,OllyDbg1.09,PWdasm
作者宣告：初學破解，僅作學習交流之用，失誤之處敬請大俠賜教!

軟體未加殼,VC編寫,用bpx getwindowtexta下斷,OD載入分析!
【簡要過程】:
使用者名稱:ShenGe[BCG]
試驗碼:12345678908765
.............(略)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043687A(C)
|
:0043688A 52 push edx
:0043688B 68D8525300 push 005352D8
:00436890 E86B1A0300 call 00468300
:00436895 83C408 add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436854(C)
|
:00436898 8B542414 mov edx, dword ptr [esp+14]
<===edx="12345678908765",試驗碼
:0043689C 837AF40E cmp dword ptr [edx-0C], 0000000E
<===判斷試驗碼長度是否為14位
:004368A0 0F8522010000 jne 004369C8
:004368A6 8B442410 mov eax, dword ptr [esp+10]
<===eax="ShenGe[BCG]",使用者名稱
:004368AA 3958F4 cmp dword ptr [eax-0C], ebx
<===判斷有無輸入使用者名稱
:004368AD 0F8E15010000 jle 004369C8
:004368B3 6A04 push 00000004
<===入棧引數1
:004368B5 8D4C2420 lea ecx, dword ptr [esp+20]
:004368B9 51 push ecx
:004368BA 8D4C241C lea ecx, dword ptr [esp+1C]
<===[ecx]="12345678908765"
:004368BE E80D6DFEFF call 0041D5D0
<===取試驗碼的前4位為"1234"
:004368C3 B302 mov bl, 02
:004368C5 8D4C2410 lea ecx, dword ptr [esp+10]
<===ecx="ShenGe[BCG]",使用者名稱
:004368C9 885C242C mov byte ptr [esp+2C], bl
:004368CD E8FEC5FCFF call 00402ED0
<===此Call將字母大寫轉小寫
:004368D2 8B442410 mov eax, dword ptr [esp+10]
<===eax="shenge[bcg]"
:004368D6 51 push ecx
:004368D7 83C0F0 add eax, FFFFFFF0
:004368DA 8964241C mov dword ptr [esp+1C], esp
:004368DE 8BFC mov edi, esp
:004368E0 50 push eax
:004368E1 E8FAB4FCFF call 00401DE0
:004368E6 83C010 add eax, 00000010
:004368E9 8907 mov dword ptr [edi], eax
:004368EB 8B6C2424 mov ebp, dword ptr [esp+24]
:004368EF 83C5F0 add ebp, FFFFFFF0
:004368F2 89642428 mov dword ptr [esp+28], esp
:004368F6 8BFC mov edi, esp
:004368F8 55 push ebp
:004368F9 C644243803 mov [esp+38], 03
:004368FE E8DDB4FCFF call 00401DE0
:00436903 83C010 add eax, 00000010
:00436906 83C404 add esp, 00000004
:00436909 8907 mov dword ptr [edi], eax
<===[edi]="1234",試驗碼前4位
:0043690B 885C2434 mov byte ptr [esp+34], bl
<===[esp+34]=bl=02
:0043690F E87CFBFFFF call 00436490
<===追演算法的話跟進此Call!①
:00436914 83C408 add esp, 00000008
:00436917 83F801 cmp eax, 00000001
:0043691A 8BCE mov ecx, esi
:0043691C 7521 jne 0043693F
:0043691E C7467803000000 mov [esi+78], 00000003
:00436925 8B15E07C5700 mov edx, dword ptr [00577CE0]
:0043692B C782B001000020000000 mov dword ptr [ebx+000001B0], 00000020
:00436935 8B06 mov eax, dword ptr [esi]
:00436937 FF904C010000 call dword ptr [eax+0000014C]
:0043693D EB6B jmp 004369AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043691C(C)
|
:0043693F 8B7E70 mov edi, dword ptr [esi+70]
:00436942 47 inc edi
:00436943 6874040000 push 00000474
:00436948 897E70 mov dword ptr [esi+70], edi
:0043694B E877A90C00 call 005012C7
:00436950 8BF0 mov esi, eax
:00436952 E8C3B50C00 call 00501F1A
:00436957 8B10 mov edx, dword ptr [eax]
:00436959 8BC8 mov ecx, eax
:0043695B FF520C call [edx+0C]
:0043695E 83C010 add eax, 00000010
:00436961 89442418 mov dword ptr [esp+18], eax

* Possible Reference to String Resource ID=00151: "Incomplete or incorrect information."
|
:00436965 6897000000 push 00000097
:0043696A 8D4C241C lea ecx, dword ptr [esp+1C]
:0043696E C644243004 mov [esp+30], 04
:00436973 E8F8C5FCFF call 00402F70
:00436978 8B7C2418 mov edi, dword ptr [esp+18]
:0043697C 57 push edi
:0043697D 8BCE mov ecx, esi
:0043697F E867AA0C00 call 005013EB
:00436984 6AFF push FFFFFFFF

★★★★★★★★★★★★★★★★★★
①跟進這個關鍵的Call,來到如下程式碼:
:00436490 6AFF push FFFFFFFF
:00436492 683B5A5200 push 00525A3B
:00436497 64A100000000 mov eax, dword ptr fs:[00000000]
:0043649D 50 push eax
:0043649E 64892500000000 mov dword ptr fs:[00000000], esp
:004364A5 81EC40010000 sub esp, 00000140
:004364AB 53 push ebx
:004364AC 55 push ebp
:004364AD 56 push esi
:004364AE 57 push edi
:004364AF BD01000000 mov ebp, 00000001
:004364B4 33C9 xor ecx, ecx
:004364B6 89AC2458010000 mov dword ptr [esp+00000158], ebp
:004364BD 894C2418 mov dword ptr [esp+18], ecx
:004364C1 C744242417000000 mov [esp+24], 00000017
:004364C9 C744241C05000000 mov [esp+1C], 00000005
:004364D1 896C2420 mov dword ptr [esp+20], ebp
:004364D5 33C0 xor eax, eax

☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004364E4(C)

:004364D7 8AD0 mov dl, al
:004364D9 80C241 add dl, 41
:004364DC 8854042C mov byte ptr [esp+eax+2C], dl
:004364E0 40 inc eax
:004364E1 83F81A cmp eax, 0000001A
:004364E4 7CF1 jl 004364D7
:004364E6 C644244630 mov [esp+46], 30
:004364EB C644244731 mov [esp+47], 31
:004364F0 C644244832 mov [esp+48], 32
:004364F5 C644244933 mov [esp+49], 33
:004364FA C644244A34 mov [esp+4A], 34
:004364FF C644244B35 mov [esp+4B], 35
:00436504 C644244C36 mov [esp+4C], 36
:00436509 C644244D37 mov [esp+4D], 37
:0043650E C644244E38 mov [esp+4E], 38
:00436513 C644244F39 mov [esp+4F], 39
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
這1段給[esp+eax+2c]始的記憶體處賦值字元A～Z,0～9,如下:
0088F714 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 ABCDEFGHIJKLMNOP
0088F724 51 52 53 54 55 56 57 58 59 5A 30 31 32 33 34 35 QRSTUVWXYZ012345
0088F734 36 37 38 39 01 00 00 00 92 00 00 00 04 00 00 80 6789...?....0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436531(C)
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
:00436518 8BC1 mov eax, ecx
:0043651A 99 cdq
:0043651B BE24000000 mov esi, 00000024
:00436520 F7FE idiv esi
:00436522 41 inc ecx
:00436523 81F900010000 cmp ecx, 00000100
:00436529 8A44142C mov al, byte ptr [esp+edx+2C]
:0043652D 88440C4F mov byte ptr [esp+ecx+4F], al
:00436531 7CE5 jl 00436518
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
還是複製字元操作,把上面記憶體中賦值的36個字元連續複製7次,結果如下:
0088F738 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 ABCDEFGHIJKLMNOP
0088F748 51 52 53 54 55 56 57 58 59 5A 30 31 32 33 34 35 QRSTUVWXYZ012345
0088F758 36 37 38 39 41 42 43 44 45 46 47 48 49 4A 4B 4C 6789ABCDEFGHIJKL
0088F768 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 30 31 MNOPQRSTUVWXYZ01
0088F778 32 33 34 35 36 37 38 39 41 42 43 44 45 46 47 48 23456789ABCDEFGH
0088F788 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 IJKLMNOPQRSTUVWX
0088F798 59 5A 30 31 32 33 34 35 36 37 38 39 41 42 43 44 YZ0123456789ABCD
0088F7A8 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 EFGHIJKLMNOPQRST
0088F7B8 55 56 57 58 59 5A 30 31 32 33 34 35 36 37 38 39 UVWXYZ0123456789
0088F7C8 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 ABCDEFGHIJKLMNOP
0088F7D8 51 52 53 54 55 56 57 58 59 5A 30 31 32 33 34 35 QRSTUVWXYZ012345
0088F7E8 36 37 38 39 41 42 43 44 45 46 47 48 49 4A 4B 4C 6789ABCDEFGHIJKL
0088F7F8 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 30 31 MNOPQRSTUVWXYZ01
0088F808 32 33 34 35 36 37 38 39 41 42 43 44 45 46 47 48 23456789ABCDEFGH
0088F818 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 IJKLMNOPQRSTUVWX
0088F828 59 5A 30 31 32 33 34 35 36 37 38 39 41 42 43 44 YZ0123456789ABCD

:00436533 8BB42464010000 mov esi, dword ptr [esp+00000164]
:0043653A 51 push ecx
:0043653B 8D7EF0 lea edi, dword ptr [esi-10]
:0043653E 89642418 mov dword ptr [esp+18], esp
:00436542 8BDC mov ebx, esp
:00436544 57 push edi
:00436545 897C241C mov dword ptr [esp+1C], edi
:00436549 E892B8FCFF call 00401DE0
:0043654E 83C010 add eax, 00000010
:00436551 83C404 add esp, 00000004
:00436554 8903 mov dword ptr [ebx], eax
<---[ebx]="shenge[bcg]"
:00436556 E885ED0200 call 004652E0
:0043655B 83C404 add esp, 00000004
:0043655E 85C0 test eax, eax
:00436560 754E jne 004365B0
:00436562 88842458010000 mov byte ptr [esp+00000158], al
:00436569 8B842460010000 mov eax, dword ptr [esp+00000160]
:00436570 83C0F0 add eax, FFFFFFF0
:00436573 8D480C lea ecx, dword ptr [eax+0C]
:00436576 83CAFF or edx, FFFFFFFF
:00436579 F0 lock
:0043657A 0FC111 xadd dword ptr [ecx], edx
:0043657D 4A dec edx
:0043657E 85D2 test edx, edx
:00436580 7F08 jg 0043658A
:00436582 8B08 mov ecx, dword ptr [eax]
:00436584 8B11 mov edx, dword ptr [ecx]
:00436586 50 push eax
:00436587 FF5204 call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436580(C)
|
:0043658A C7842458010000FFFFFFFF mov dword ptr [esp+00000158], FFFFFFFF
:00436595 8D470C lea eax, dword ptr [edi+0C]
:00436598 83C9FF or ecx, FFFFFFFF
:0043659B F0 lock
:0043659C 0FC108 xadd dword ptr [eax], ecx
:0043659F 49 dec ecx
:004365A0 85C9 test ecx, ecx
:004365A2 0F8FC0010000 jg 00436768
:004365A8 8B0F mov ecx, dword ptr [edi]
:004365AA 57 push edi
:004365AB E9B3010000 jmp 00436763

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436560(C)
|
:004365B0 8B46F4 mov eax, dword ptr [esi-0C]
:004365B3 33C9 xor ecx, ecx
:004365B5 85C0 test eax, eax
:004365B7 7E1B jle 004365D4
:004365B9 8DA42400000000 lea esp, dword ptr [esp]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004365D2(C)
|
:004365C0 0FB61431 movzx edx, byte ptr [ecx+esi]
<===按位取"shenge[bcg]"的字元值到edx中
<===dl=73
<===dl=68
......(略)

:004365C4 8B7C241C mov edi, dword ptr [esp+1C]
<===edi中的初始值為5
<===edi=EB
......(略)

:004365C8 41 inc ecx
:004365C9 3BC8 cmp ecx, eax
<===比較是否取完使用者名稱
:004365CB 8D1457 lea edx, dword ptr [edi+2*edx]
<===edx=6+2*73=EB
<===edx=EB+2*68=1BB
......(略)

:004365CE 8954241C mov dword ptr [esp+1C], edx
<===結果存入[esp+1c]中迴圈結束後我的
結果為:8C1
:004365D2 7CEC jl 004365C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004365B7(C)
|
:004365D4 33C9 xor ecx, ecx
:004365D6 85C0 test eax, eax
:004365D8 7E19 jle 004365F3
:004365DA 8D9B00000000 lea ebx, dword ptr [ebx+00000000]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004365ED(C)
|
:004365E0 0FB61431 movzx edx, byte ptr [ecx+esi]
<===按位取"shenge[bcg]"的字元值到edx中
<===dl=73
<===dl=68
......(略)

:004365E4 41 inc ecx
:004365E5 3BC8 cmp ecx, eax
<===比較是否取完使用者名稱
:004365E7 8D3C2A lea edi, dword ptr [edx+ebp]
<===edi=edx+ebp=74,ebp的初值為1
<===edi=68+15A=1C2
......(略)

:004365EA 8D2C57 lea ebp, dword ptr [edi+2*edx]
<===ebp=74+2*73=15A
<===ebp=1C2+2*68=292
......(略)
我最後的結果為:<===ebp=D1B
:004365ED 7CF1 jl 004365E0
:004365EF 896C2420 mov dword ptr [esp+20], ebp
<===最後結果存入[esp+20]中

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004365D8(C)
|
:004365F3 33C9 xor ecx, ecx
:004365F5 85C0 test eax, eax
:004365F7 7E1B jle 00436614
:004365F9 8DA42400000000 lea esp, dword ptr [esp]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436612(C)
|
:00436600 0FB61431 movzx edx, byte ptr [ecx+esi]
<===按位取"shenge[bcg]"的字元值到edx中
<===dl=73
<===dl=68
......(略)
:00436604 8B7C2424 mov edi, dword ptr [esp+24]
<===edi中的初始值為17
<===edi=1E3
......(略)
:00436608 41 inc ecx
:00436609 3BC8 cmp ecx, eax
<===比較是否取完使用者名稱
:0043660B 8D1497 lea edx, dword ptr [edi+4*edx]
<===edx=17+4*73=1E3
<===edx=1E3+4*68=383
......(略)
:0043660E 89542424 mov dword ptr [esp+24], edx
<===結果存入[esp+24]中,我最後得
到的結果為:118F
:00436612 7CEC jl 00436600

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004365F7(C)
|
:00436614 8B44241C mov eax, dword ptr [esp+1C]
<===eax=8C1,第1次計算結果
:00436618 8B4C2424 mov ecx, dword ptr [esp+24]
<===ecx=118F,第3次計算結果
:0043661C 03C5 add eax, ebp
<===eax=8C1+D1B=15DC,ebp中為第2次計算結果
:0043661E 03C1 add eax, ecx
<===eax=15DC+118F=276B
:00436620 89442418 mov dword ptr [esp+18], eax
:00436624 E8F1B80C00 call 00501F1A
:00436629 8B10 mov edx, dword ptr [eax]
:0043662B 8BC8 mov ecx, eax
:0043662D FF520C call [edx+0C]
:00436630 8D7010 lea esi, dword ptr [eax+10]
:00436633 89742428 mov dword ptr [esp+28], esi
:00436637 C684245801000002 mov byte ptr [esp+00000158], 02
:0043663F 33ED xor ebp, ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436687(C)
|
:00436641 0FB644AC18 movzx eax, byte ptr [esp+4*ebp+18]
<===還記得上面得到的結果嗎,上面一段沒加註釋的代碼應該是記憶體複製操作,此時在記憶體中看到的為
6B 27 00 00 C1 08 00 00 1B 0D 00 00 8F 11 00 00
上面的第4、1、2、3次計算結果,取低位
<===eax=6B
<===eax=C1
<===eax=1B
<===eax=8F
:00436646 8A4C0450 mov cl, byte ptr [esp+eax+50]
<===根據eax值查表,此表詳見前面程式碼:436531處所列
<===cl=39--->"9"
<===cl=4E--->"N"
<===cl=31--->"1"
<===cl=39--->"9"
:0043664A 8B46FC mov eax, dword ptr [esi-04]
:0043664D 8B5EF4 mov ebx, dword ptr [esi-0C]
:00436650 884C2410 mov byte ptr [esp+10], cl
:00436654 B901000000 mov ecx, 00000001
:00436659 2BC8 sub ecx, eax
:0043665B 8B46F8 mov eax, dword ptr [esi-08]
:0043665E 8D7B01 lea edi, dword ptr [ebx+01]
:00436661 2BC7 sub eax, edi
:00436663 0BC1 or eax, ecx
:00436665 7D0E jge 00436675
:00436667 57 push edi
:00436668 8D4C242C lea ecx, dword ptr [esp+2C]
:0043666C E81FB7FCFF call 00401D90
:00436671 8B742428 mov esi, dword ptr [esp+28]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436665(C)
|
:00436675 8A542410 mov dl, byte ptr [esp+10]
:00436679 881433 mov byte ptr [ebx+esi], dl
<===上面查表的結果存入[ebx+esi]中,最後
為"9N19"
:0043667C 45 inc ebp
:0043667D 83FD04 cmp ebp, 00000004
:00436680 897EF4 mov dword ptr [esi-0C], edi
:00436683 C6043700 mov byte ptr [edi+esi], 00
:00436687 7CB8 jl 00436641
:00436689 8BBC2460010000 mov edi, dword ptr [esp+00000160]
<===edi="1234",試驗碼前4位
:00436690 57 push edi
:00436691 56 push esi
<===esi="9N19",嗬嗬,太明顯了吧!
:00436692 E880D80600 call 004A3F17
:00436697 83C408 add esp, 00000008
:0043669A 83CAFF or edx, FFFFFFFF
:0043669D 85C0 test eax, eax
:0043669F 8D46F0 lea eax, dword ptr [esi-10]
:004366A2 C684245801000001 mov byte ptr [esp+00000158], 01
:004366AA 8D480C lea ecx, dword ptr [eax+0C]
:004366AD 7560 jne 0043670F
<===不能跳噢!
:004366AF F0 lock
:004366B0 0FC111 xadd dword ptr [ecx], edx
:004366B3 4A dec edx
:004366B4 85D2 test edx, edx
:004366B6 7F08 jg 004366C0
:004366B8 8B08 mov ecx, dword ptr [eax]
:004366BA 8B11 mov edx, dword ptr [ecx]
:004366BC 50 push eax
:004366BD FF5204 call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004366B6(C)
|
:004366C0 8D47F0 lea eax, dword ptr [edi-10]
:004366C3 C684245801000000 mov byte ptr [esp+00000158], 00
:004366CB 8D480C lea ecx, dword ptr [eax+0C]
:004366CE 83CAFF or edx, FFFFFFFF
:004366D1 F0 lock
:004366D2 0FC111 xadd dword ptr [ecx], edx
:004366D5 4A dec edx
:004366D6 85D2 test edx, edx
:004366D8 7F08 jg 004366E2
:004366DA 8B08 mov ecx, dword ptr [eax]
:004366DC 8B11 mov edx, dword ptr [ecx]
:004366DE 50 push eax
:004366DF FF5204 call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004366D8(C)
|
:004366E2 8B442414 mov eax, dword ptr [esp+14]
:004366E6 C7842458010000FFFFFFFF mov dword ptr [esp+00000158], FFFFFFFF
:004366F1 8D480C lea ecx, dword ptr [eax+0C]
:004366F4 83CAFF or edx, FFFFFFFF
:004366F7 F0 lock
:004366F8 0FC111 xadd dword ptr [ecx], edx
:004366FB 4A dec edx
:004366FC 85D2 test edx, edx
:004366FE 7F08 jg 00436708
:00436700 8B08 mov ecx, dword ptr [eax]
:00436702 8B11 mov edx, dword ptr [ecx]
:00436704 50 push eax
:00436705 FF5204 call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004366FE(C)
|
:00436708 B801000000 mov eax, 00000001
<===eax=1!
:0043670D EB5B jmp 0043676A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004366AD(C)
|
:0043670F F0 lock
:00436710 0FC111 xadd dword ptr [ecx], edx
:00436713 4A dec edx
:00436714 85D2 test edx, edx
:00436716 7F08 jg 00436720
:00436718 8B08 mov ecx, dword ptr [eax]
:0043671A 8B11 mov edx, dword ptr [ecx]
:0043671C 50 push eax
:0043671D FF5204 call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436716(C)
|
:00436720 8D47F0 lea eax, dword ptr [edi-10]
:00436723 C684245801000000 mov byte ptr [esp+00000158], 00
:0043672B 8D480C lea ecx, dword ptr [eax+0C]
:0043672E 83CAFF or edx, FFFFFFFF
:00436731 F0 lock
:00436732 0FC111 xadd dword ptr [ecx], edx
:00436735 4A dec edx
:00436736 85D2 test edx, edx
:00436738 7F08 jg 00436742
:0043673A 8B08 mov ecx, dword ptr [eax]
:0043673C 8B11 mov edx, dword ptr [ecx]
:0043673E 50 push eax
:0043673F FF5204 call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436738(C)
|
:00436742 8B442414 mov eax, dword ptr [esp+14]
:00436746 C7842458010000FFFFFFFF mov dword ptr [esp+00000158], FFFFFFFF
:00436751 8D480C lea ecx, dword ptr [eax+0C]
:00436754 83CAFF or edx, FFFFFFFF
:00436757 F0 lock
:00436758 0FC111 xadd dword ptr [ecx], edx
:0043675B 4A dec edx
:0043675C 85D2 test edx, edx
:0043675E 7F08 jg 00436768
:00436760 8B08 mov ecx, dword ptr [eax]
:00436762 50 push eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004365AB(U)
|
:00436763 8B11 mov edx, dword ptr [ecx]
:00436765 FF5204 call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004365A2(C), :0043675E(C)
|
:00436768 33C0 xor eax, eax
<===eax=0!

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043670D(U)
|
:0043676A 8B8C2450010000 mov ecx, dword ptr [esp+00000150]
:00436771 5F pop edi
:00436772 5E pop esi
:00436773 5D pop ebp
:00436774 64890D00000000 mov dword ptr fs:[00000000], ecx
:0043677B 5B pop ebx
:0043677C 81C44C010000 add esp, 0000014C
:00436782 C3 ret

【總結】:註冊碼的必須為14位,前4位與使用者名稱有關,後10位任意.

給出一個可用註冊碼:
使用者名稱:ShenGe[BCG]
註冊碼:9N195678908765

補充一點，破解後再次執行程式它又跳出對話方塊要求註冊，輸入後又可以用了，我開始以為程式重啟後還有一次判斷，但跟了半天沒有結果，也未發現程式中有暗樁,還是請高手有空看看吧!我猜想軟體就是做成這樣的吧！？：P
Cracked By ShenGe[BCG] 2003.07.06

Flash下載工具Flashdown破解簡析！

相關文章