軟體簡介：DockIt.ocx，一個比較老的控制元件了，我也不記得什麼時候放在電腦裡的，如果要下載，估計得好好找找。其功能是在VB中實現可拖放的工具視窗。
保護方式：不需要使用者名稱，純註冊碼保護。
跟蹤過程：
PART 1:
* Reference To: USER32.GetDlgItemTextA, ORd:0104h
|
:1001349B FF15E0510110 CALL dword PTR [100151E0]
:100134A1 50 PUSH eax
:100134A2 8D45E0 LEA eax, dword PTR [ebp-20]
:100134A5 50 PUSH eax
:100134A6 E8C1EAFFFF CALL 10011F6C ======>關鍵Call
:100134AB 59 POP ecx
:100134AC 85C0 TEST eax, eax
:100134AE 59 POP ecx
:100134AF 741A JE 100134CB ======>關鍵跳轉
:100134B1 8D45E0 LEA eax, dword PTR [ebp-20]
:100134B4 50 PUSH eax
:100134B5 E86EE9FFFF CALL 10011E28
:100134BA 0FB7450C MOVZX eax, wORd PTR [ebp+0C]
:100134BE 59 POP ecx
:100134BF 50 PUSH eax
:100134C0 FF7604 PUSH [esi+04]
* Reference To: USER32.Enddialog, ORd:00B9h
|
:100134C3 FF1560520110 CALL dword PTR [10015260]
:100134C9 EB35 JMP 10013500
* Referenced by a (U)nconditional OR (C)onditional Jump at Address:
|:100134AF(C)
|
:100134CB 6A10 PUSH 00000010
* Possible StringData Ref from Data Obj ->"21Hex DockIt Registration"
|
:100134CD 68A8890110 PUSH 100189A8
* Possible StringData Ref from Data Obj ->"Invalid Registration Code" ======>註冊失敗
|
:100134D2 68788B0110 PUSH 10018B78
:100134D7 FF7604 PUSH [esi+04]
=============================================================================================================================================
PART 2:
* Referenced by a CALL at Address:
|:100134A6
|
:10011F6C 56 PUSH esi
:10011F6D 8B742408 MOV esi, dword PTR [esp+08] ======>取假碼置入ESI
:10011F71 57 PUSH edi
:10011F72 33FF XOR edi, edi ======>EDI清零
:10011F74 33C0 XOR eax, eax ======>EAX清零
:10011F76 33D2 XOR edx, edx ======>EDX清零
* Referenced by a (U)nconditional OR (C)onditional Jump at Address:
|:10011F8F(C)
|
:10011F78 0FBE0C32 MOVSX ecx, byte PTR [edx+esi] ======>逐位取假碼置入ECX
:10011F7C 83E930 SUB ecx, 00000030 ======>將ECX的值減去30
:10011F7F 7809 JS 10011F8A ======>如果ECX的值為負則跳10011F8A ―
:10011F81 83F909 CMP ecx, 00000009 |檢查是否數字字元
:10011F84 7F04 JG 10011F8A ======>如果ECX的值大於9則跳10011F8A―
:10011F86 03C1 ADD eax, ecx ======>ECX的值累加到EAX
:10011F88 EB01 JMP 10011F8B
* Referenced by a (U)nconditional OR (C)onditional Jump at Addresses:
|:10011F7F(C), :10011F84(C)
|
:10011F8A 47 INC edi ======>EDI+1，記錄非數字字元的個數
* Referenced by a (U)nconditional OR (C)onditional Jump at Address:
|:10011F88(U)
|
:10011F8B 42 INC edx ======>EDX+1，記錄假碼的長度
:10011F8C 83FA0B CMP edx, 0000000B
:10011F8F 7CE7 JL 10011F78 ======>取位達到11位為止
:10011F91 85C0 TEST eax, eax
:10011F93 7439 JE 10011FCE ======>如果EAX的值為0則註冊失敗
:10011F95 83FF02 CMP edi, 00000002
:10011F98 7534 JNE 10011FCE ======>假碼中非數字字元必須為2個，否則註冊失敗
:10011F9A 6A07 PUSH 00000007
:10011F9C 99 CDQ
:10011F9D 59 POP ecx ======>ECX＝7
:10011F9E F7F9 IdiV ecx
:10011FA0 85D2 TEST edx, edx
:10011FA2 752A JNE 10011FCE ======>EAX的值必須能被7整除，否則註冊失敗(注意，沒有包括字母的ASC值)
:10011FA4 807E0933 CMP byte PTR [esi+09], 33
:10011FA8 7524 JNE 10011FCE ======>註冊碼的第10位必須為3，否則註冊失敗
:10011FAA 837C24100B CMP dword PTR [esp+10], 0000000B
:10011FAF 751D JNE 10011FCE
:10011FB1 803E31 CMP byte PTR [esi], 31
:10011FB4 751C JNE 10011FD2
:10011FB6 807E0132 CMP byte PTR [esi+01], 32
:10011FBA 7516 JNE 10011FD2
:10011FBC 807E0237 CMP byte PTR [esi+02], 37
:10011FC0 7510 JNE 10011FD2
:10011FC2 807E0331 CMP byte PTR [esi+03], 31
:10011FC6 750A JNE 10011FD2
:10011FC8 807E0433 CMP byte PTR [esi+04], 33
:10011FCC 7504 JNE 10011FD2
* Referenced by a (U)nconditional OR (C)onditional Jump at Addresses:
|:10011F93(C), :10011F98(C), :10011FA2(C), :10011FA8(C), :10011FAF(C)
|
:10011FCE 33C0 XOR eax, eax ======>EAX清零
:10011FD0 EB03 JMP 10011FD5
* Referenced by a (U)nconditional OR (C)onditional Jump at Addresses:
|:10011FB4(C), :10011FBA(C), :10011FC0(C), :10011FC6(C), :10011FCC(C)
|
:10011FD2 6A01 PUSH 00000001
:10011FD4 58 POP eax
* Referenced by a (U)nconditional OR (C)onditional Jump at Address:
|:10011FD0(U)
|
:10011FD5 5F POP edi ======>EDI清零
:10011FD6 5E POP esi ======>ESI清零
:10011FD7 C3 RET
演算法總結：
剛開始破這個東西時我偷懶，把檔案備份後直接修改關鍵跳轉便註冊成功了，後來發現恢復原檔案後也是註冊成功的！檢查登錄檔，發現HKEY_CURRENT_USERSoftware21HexDockIt下的RegId儲存註冊資訊，但我把這個鍵刪除後，控制元件還是註冊狀態。費了很多功夫才確定HKEY_CURRENT_USERSoftware21HexDockIt下的CtrlType控制註冊狀態。只要CtrlType的值為8344065（十進位制），控制元件就註冊成功了。我覺得很好笑，於是寫了個“偽序號產生器”，直接修改這個鍵值。
言歸正傳吧，我驗證過，只要符合下面的條件的註冊碼，可以註冊成功：
1、長度為11位。
2、註冊碼中非數字字元必須為2位，可以任取，放在第10位以外的任何位置。
3、各位數字的ASC值減去48後的和能被7整除（不能為0）。(即各數字相加的和能被7整除。)
4、註冊碼的第10位必須是數字3。
這個控制元件的註冊碼演算法我也只是隨便跟了一下，也許有些東西我漏掉了，不過跟它麻煩，每3次輸入錯誤的註冊碼後註冊按鍵便禁用了，還得重來，而且老是一不小心便跳走到註冊失敗處。人菜，沒辦法……。
Win2000下測試透過。
序號產生器原始碼(見笑)：(Delphi)
function RegCode(): string;
var
intSum,rdmASC,i,j:Integer;
strSerial:String;
begin
intSum:=0;
strSerial:='';
for i:=1 to 7 do
begin
rdmASC:=Random(10);
intSum:=intSum+rdmASC;
rdmASC:=rdmASC+48;
strSerial:=strSerial+Chr(rdmASC);
end;
j:=(intSum+3) Div 7;
j:=7*(j+1)-(intSum+3);
Insert(IntToStr(j),strSerial,Random(8 ));
for i:=1 to 2 do
begin
j:=Random(5);
if j=0 then Insert(Chr(Random(16)+32),strSerial,Random(10))
else Insert(Chr(Random(70)+58 ),strSerial,Random(10));
end;
Insert('3',strSerial,10);
Result:=strSerial;
end;