【文章作者：】chea
【作者邮箱：】chea0214@163.com
【软件名称：】Total Video Converter
【下载地址：】http://www.skycn.com/soft/27025.html
【加壳方式：】无加壳
【软件限制：】试用15天
【编写语言：】Microsoft Visual C++ 6.0
【使用工具：】OD
【操作平台：】WinXP sp2
【作者声明：】只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
【破解过程】
用OD载入 -> F9运行 -> 点击“我想继续试用” -> 出现结束15天试用提示注册对话框 -> F12停止 ->Alt+K
调用堆栈： 主线程, 条目 19
地址=0012A194
堆栈=0040977E
函数过程 / 参数=? <jmp.&MFC42.#1200>
调用来自=tvc.00409779
结构=0012A0F4
右键 “显示调用”停在
00409779 . E8 CE7B0800 call <jmp.&MFC42.#1200>
0040977E . 8D8C24 340900>lea ecx, dword ptr [esp+934]
00409785 . C68424 5C5D00>mov byte ptr [esp+5D5C], 20
0040978D . E8 AC7A0800 call <jmp.&MFC42.#800>
00409792 . 8D8C24 300900>lea ecx, dword ptr [esp+930]
00409799 . C68424 5C5D00>mov byte ptr [esp+5D5C], 1F
004097A1 . E8 987A0800 call <jmp.&MFC42.#800>
004097A6 . 8D8C24 BC0600>lea ecx, dword ptr [esp+6BC]
004097AD . C68424 5C5D00>mov byte ptr [esp+5D5C], 1E
004097B5 . E8 E61E0200 call 0042B6A0
004097BA . 8D8C24 480400>lea ecx, dword ptr [esp+448]
004097C1 . C68424 5C5D00>mov byte ptr [esp+5D5C], 1D
004097C9 . E8 D21E0200 call 0042B6A0
004097CE . C68424 5C5D00>mov byte ptr [esp+5D5C], 1C
004097D6 > 8D8C24 D40100>lea ecx, dword ptr [esp+1D4]
004097DD . E8 BE1E0200 call 0042B6A0
004097E2 . 8D8C24 740100>lea ecx, dword ptr [esp+174]
004097E9 . 889C24 5C5D00>mov byte ptr [esp+5D5C], bl
004097F0 . E8 3F7B0800 call <jmp.&MFC42.#641>
004097F5 .^ E9 D5FEFFFF jmp 004096CF
向上找004094DF下断
004094D9 . /0F8E B1010000 JLE tvc.00409690
004094DF > |6A 00 PUSH 0
004094E1 . |8D8C24 780100>LEA ECX,DWORD PTR SS:[ESP+178]
004094E8 . |E8 63C80100 CALL tvc.00425D50
004094ED . |8D8C24 740100>LEA ECX,DWORD PTR SS:[ESP+174]
004094F4 . |C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],16
004094FC |E8 357C0800 CALL <JMP.&MFC42.#2514> ；调用注册窗口
00409501 |83F8 01 CMP EAX,1 ；比较返回窗口按钮消息
00409504 . |0F85 D9000000 JNZ tvc.004095E3 ；关键跳
0040950A . |33C0 XOR EAX,EAX
0040950C > |8A88 68155000 MOV CL,BYTE PTR DS:[EAX+501568]
00409512 . |884C04 30 MOV BYTE PTR SS:[ESP+EAX+30],CL
00409516 . |40 INC EAX
00409517 . |84C9 TEST CL,CL
00409519 .^|75 F1 JNZ SHORT tvc.0040950C
0040951B . |8A4C24 30 MOV CL,BYTE PTR SS:[ESP+30]
0040951F . |B0 54 MOV AL,54
00409521 . |3AC8 CMP CL,AL
00409523 . |75 61 JNZ SHORT tvc.00409586
00409525 . |807C24 31 4F CMP BYTE PTR SS:[ESP+31],4F
0040952A . |75 5A JNZ SHORT tvc.00409586
0040952C . |384424 32 CMP BYTE PTR SS:[ESP+32],AL
00409530 . |75 54 JNZ SHORT tvc.00409586
00409532 . |807C24 36 56 CMP BYTE PTR SS:[ESP+36],56
00409537 . |75 4D JNZ SHORT tvc.00409586
00409539 . |807C24 33 41 CMP BYTE PTR SS:[ESP+33],41
0040953E . |75 46 JNZ SHORT tvc.00409586
00409540 . |807C24 34 4C CMP BYTE PTR SS:[ESP+34],4C
00409545 . |75 3F JNZ SHORT tvc.00409586
00409547 . |807C24 35 20 CMP BYTE PTR SS:[ESP+35],20
0040954C . |75 38 JNZ SHORT tvc.00409586
0040954E . |8D8C24 300900>LEA ECX,DWORD PTR SS:[ESP+930]
00409555 . |51 PUSH ECX
00409556 . |8D8E D0000000 LEA ECX,DWORD PTR DS:[ESI+D0]
0040955C . |E8 3D7D0800 CALL <JMP.&MFC42.#858>
00409561 . |8B9424 380900>MOV EDX,DWORD PTR SS:[ESP+938] ; MFC42.73E086D4
00409568 . |8B86 CC000000 MOV EAX,DWORD PTR DS:[ESI+CC]
0040956E . |42 INC EDX
0040956F . |8BCE MOV ECX,ESI ; tvc.0050C720
00409571 . |C1E2 10 SHL EDX,10
00409574 . |0BC2 OR EAX,EDX
00409576 . |8986 CC000000 MOV DWORD PTR DS:[ESI+CC],EAX
0040957C . |E8 2F070000 CALL tvc.00409CB0
00409581 . |E9 93000000 JMP tvc.00409619
00409586 > |8D8C24 340900>LEA ECX,DWORD PTR SS:[ESP+934]
0040958D . |C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],1B
00409595 . |E8 A47C0800 CALL <JMP.&MFC42.#800>
0040959A . |8D8C24 300900>LEA ECX,DWORD PTR SS:[ESP+930]
004095A1 . |C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],1A
004095A9 . |E8 907C0800 CALL <JMP.&MFC42.#800>
004095AE . |8D8C24 BC0600>LEA ECX,DWORD PTR SS:[ESP+6BC]
004095B5 . |C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],19
004095BD . |E8 DE200200 CALL tvc.0042B6A0
004095C2 . |8D8C24 480400>LEA ECX,DWORD PTR SS:[ESP+448]
004095C9 . |C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],18
004095D1 . |E8 CA200200 CALL tvc.0042B6A0
004095D6 . |C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],17
004095DE . |E9 F3010000 JMP tvc.004097D6
004095E3 > |8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+24]
004095E7 . |8B86 C8000000 MOV EAX,DWORD PTR DS:[ESI+C8]
004095ED . |2BC8 SUB ECX,EAX
004095EF . |B8 07452EC2 MOV EAX,C22E4507
004095F4 . |F7E9 IMUL ECX
004095F6 . |03D1 ADD EDX,ECX
004095F8 . |C1FA 10 SAR EDX,10
004095FB . |8BC2 MOV EAX,EDX
004095FD . |C1E8 1F SHR EAX,1F
00409600 . |03D0 ADD EDX,EAX
00409602 . |83FA 05 CMP EDX,5
00409605 . |0F85 14010000 JNZ tvc.0040971F
0040960B . |6A 00 PUSH 0
0040960D . |6A 00 PUSH 0
0040960F . |68 10D04F00 PUSH tvc.004FD010 ; remain 10 days free try.
00409614 > |E8 337D0800 CALL <JMP.&MFC42.#1200>
00409619 > |8D8C24 340900>LEA ECX,DWORD PTR SS:[ESP+934]
00409620 . |C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],25
00409628 . |E8 117C0800 CALL <JMP.&MFC42.#800>
0040962D . |8D8C24 300900>LEA ECX,DWORD PTR SS:[ESP+930]
00409634 . |C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],24
0040963C . |E8 FD7B0800 CALL <JMP.&MFC42.#800>
00409641 . |8D8C24 BC0600>LEA ECX,DWORD PTR SS:[ESP+6BC]
00409648 . |C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],23
00409650 . |E8 4B200200 CALL tvc.0042B6A0
00409655 . |8D8C24 480400>LEA ECX,DWORD PTR SS:[ESP+448]
0040965C . |C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],22
00409664 . |E8 37200200 CALL tvc.0042B6A0
00409669 . |8D8C24 D40100>LEA ECX,DWORD PTR SS:[ESP+1D4]
00409670 . |C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],21
00409678 . |E8 23200200 CALL tvc.0042B6A0
0040967D . |8D8C24 740100>LEA ECX,DWORD PTR SS:[ESP+174]
00409684 . |889C24 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],BL
0040968B . |E8 A47C0800 CALL <JMP.&MFC42.#641>
00409690 > \6A 00 PUSH 0
00409692 . 8D8C24 400900>LEA ECX,DWORD PTR SS:[ESP+940]
00409699 . E8 52100000 CALL tvc.0040A6F0
0040969E . 8D8C24 3C0900>LEA ECX,DWORD PTR SS:[ESP+93C]
004096A5 . C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],26
004096AD . 894E 20 MOV DWORD PTR DS:[ESI+20],ECX
004096B0 . 8D8C24 3C0900>LEA ECX,DWORD PTR SS:[ESP+93C]
004096B7 . E8 7A7A0800 CALL <JMP.&MFC42.#2514>
004096BC . 8D8C24 3C0900>LEA ECX,DWORD PTR SS:[ESP+93C]
004096C3 . 889C24 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],BL
004096CA . E8 91170000 CALL tvc.0040AE60
004096CF > 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]
004096D3 . C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],5
004096DB . E8 5E7B0800 CALL <JMP.&MFC42.#800>
004096E0 . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
004096E4 . C68424 5C5D00>MOV BYTE PTR SS:[ESP+5D5C],2
004096EC . E8 4D7B0800 CALL <JMP.&MFC42.#800>
004096F1 . 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
004096F5 . C78424 5C5D00>MOV DWORD PTR SS:[ESP+5D5C],-1
00409700 . E8 397B0800 CALL <JMP.&MFC42.#800>
00409705 > 33C0 XOR EAX,EAX
00409707 > 8B8C24 545D00>MOV ECX,DWORD PTR SS:[ESP+5D54] ; tvc.0050C720
0040970E . 5F POP EDI
0040970F . 5E POP ESI ; tvc.0050C720
00409710 . 5B POP EBX
00409711 . 64:890D 00000>MOV DWORD PTR FS:[0],ECX
00409718 . 81C4 545D0000 ADD ESP,5D54
0040971E . C3 RETN
0040971F > 3BD3 CMP EDX,EBX
00409721 . 75 0E JNZ SHORT tvc.00409731
00409723 . 6A 00 PUSH 0
00409725 . 6A 00 PUSH 0
00409727 . 68 F8CF4F00 PUSH tvc.004FCFF8 ; remain 7 days free try.
0040972C .^ E9 E3FEFFFF JMP tvc.00409614
00409731 > 83FA 0B CMP EDX,0B
00409734 . 75 0E JNZ SHORT tvc.00409744
00409736 . 6A 00 PUSH 0
00409738 . 6A 00 PUSH 0
0040973A . 68 E0CF4F00 PUSH tvc.004FCFE0 ; remain 4 days free try.
0040973F .^ E9 D0FEFFFF JMP tvc.00409614
00409744 > 83FA 0E CMP EDX,0E
00409747 . 75 0E JNZ SHORT tvc.00409757
00409749 . 6A 00 PUSH 0
0040974B . 6A 00 PUSH 0
0040974D . 68 C8CF4F00 PUSH tvc.004FCFC8 ; remain 1 day free try.
00409752 .^ E9 BDFEFFFF JMP tvc.00409614
00409757 > 83FA 0F CMP EDX,0F
0040975A . 75 0E JNZ SHORT tvc.0040976A
0040975C . 6A 00 PUSH 0
0040975E . 6A 00 PUSH 0
00409760 . 68 B0CF4F00 PUSH tvc.004FCFB0 ; remain 0 day free try.
00409765 .^ E9 AAFEFFFF JMP tvc.00409614
0040976A >^ 0F8E A9FEFFFF JLE tvc.00409619
00409770 . 6A 00 PUSH 0
00409772 . 6A 00 PUSH 0
00409774 . 68 74CF4F00 PUSH tvc.004FCF74 ; this software can only try 15 days.\n please registration!
00409779 . E8 CE7B0800 CALL <JMP.&MFC42.#1200>
到此暴破结束
004094FC |E8 357C0800 CALL <JMP.&MFC42.#2514> ；调用注册窗口
00409501 |83F8 01 CMP EAX,1 ；比较返回窗口按钮消息
00409504 . |0F85 D9000000 JNZ tvc.004095E3 ；关键跳
004094FC 用nop掉去注册窗口
修改00409501 |83F8 01 CMP EAX,1 为
00409501 |83F8 01 CMP EAX,EAX
或者
修改
00409504 . |0F85 D9000000 JNZ tvc.004095E3 为
00409504 90 NOP
00409505 90 NOP
00409506 90 NOP
00409507 90 NOP
00409508 90 NOP
00409509 90 NOP
注册码看着为明码比较，出来了几组注册都没反应，还是爆破速度。
【版权声明：】我是一只小菜鸟，偶得一点心得，愿与大家分享:)
【版权声明：】本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
下载：tvc补丁+内存注册机.rar
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
