【爆破目标】麦风店铺账本V3.5
【使用工具】PEID、OD、pexplorer资源工具
【破解声明】破解只是感兴趣，无其它目的。失误之处敬请诸位大侠赐教!
试用版本有两处限制：
1、“生成Excel表”功能不可用。
2、试用版可记账60条。
首先PEID查壳：ASPack 2.12 -> Alexey Solodovnikov
脱壳很简单，直接脱掉，OK，可以正常运行。
再查下是Microsoft Visual C++ 6.0写的
OD载入
0042C978 >/$ 55 PUSH EBP
停在这里，F9运行
0042C979 |. 8BEC MOV EBP,ESP
0042C97B |. 6A FF PUSH -1
0042C97D |. 68 E86F4300 PUSH dumped_.00436FE8
0042C982 |. 68 DCCA4200 PUSH <JMP.&msvcrt._except_handler3> ;
SE 处理程序安装
0042C987 |. 64:A1 0000000>MOV EAX,DWORD PTR FS:[0]
0042C98D |. 50 PUSH EAX
0042C98E |. 64:8925 00000>MOV DWORD PTR FS:[0],ESP
0042C995 |. 83EC 68 SUB ESP,68
0042C998 |. 53 PUSH EBX
0042C999 |. 56 PUSH ESI
0042C99A |. 57 PUSH EDI
0042C99B |. 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
0042C99E |. 33DB XOR EBX,EBX
0042C9A0 |. 895D FC MOV DWORD PTR SS:[EBP-4],EBX
0042C9A3 |. 6A 02 PUSH 2
0042C9A5 |. FF15 DC354300 CALL DWORD PTR DS:[<&msvcrt.__set_app_ty>;
msvcrt.__set_app_type
0042C9AB |. 59 POP ECX
0042C9AC |. 830D 9C284400>OR DWORD PTR DS:[44289C],FFFFFFFF
0042C9B3 |. 830D A0284400>OR DWORD PTR DS:[4428A0],FFFFFFFF
0042C9BA |. FF15 E0354300 CALL DWORD PTR DS:[<&msvcrt.__p__fmode>] ;
msvcrt.__p__fmode
0042C9C0 |. 8B0D 90284400 MOV ECX,DWORD PTR DS:[442890]
0042C9C6 |. 8908 MOV DWORD PTR DS:[EAX],ECX
0042C9C8 |. FF15 E4354300 CALL DWORD PTR DS:[<&msvcrt.__p__commode>;
msvcrt.__p__commode
0042C9CE |. 8B0D 8C284400 MOV ECX,DWORD PTR DS:[44288C]
0042C9D4 |. 8908 MOV DWORD PTR DS:[EAX],ECX
0042C9D6 |. A1 E8354300 MOV EAX,DWORD PTR DS:[<&msvcrt._adjust_f>
0042C9DB |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
0042C9DD |. A3 98284400 MOV DWORD PTR DS:[442898],EAX
0042C9E2 |. E8 22010000 CALL dumped_.0042CB09
0042C9E7 |. 391D 40264400 CMP DWORD PTR DS:[442640],EBX
0042C9ED |. 75 0C JNZ SHORT dumped_.0042C9FB
0042C9EF |. 68 06CB4200 PUSH dumped_.0042CB06
0042C9F4 |. FF15 EC354300 CALL DWORD PTR DS:[<&msvcrt.__setusermat>;
msvcrt.__setusermatherr
0042C9FA |. 59 POP ECX
0042C9FB |> E8 F4000000 CALL dumped_.0042CAF4
注册：随便输入个用户名和注册码，点注册提示“注意，请输入正确的注册码!”
F12暂停，
点K打开调用堆栈
调用堆栈： 主线程
地址 堆栈 函数过程 / 参数 调
用来自 结构
0012E3B0 77D19418 包含ntdll.KiFastSystemCallRet
USER32.77D19416 0012E3E4
0012E3B4 77D2770A USER32.WaitMessage
USER32.77D27705 0012E3E4
0012E3E8 77D249C4 USER32.77D2757B
USER32.77D249BF 0012E3E4
0012E410 77D3A956 USER32.77D2490E
USER32.77D3A951 0012E40C
0012E6D0 77D3A2BC USER32.SoftModalMessageBox
USER32.77D3A2B7 0012E6CC
0012E820 77D663FD USER32.77D3A147
USER32.77D663F8 0012E81C
0012E878 77D664A2 USER32.MessageBoxTimeoutW
USER32.77D6649D 0012E874
0012E8AC 77D50877 ? USER32.MessageBoxTimeoutA
USER32.77D50872 0012E8A8
0012E8CC 77D5082F ? USER32.MessageBoxExA
USER32.77D5082A 0012E8C8
0012E8E8 73D88411 ? USER32.MessageBoxA
mfc42.73D8840B 0012E8E4
0012E900 0042713D ? <JMP.&mfc42.#4224>
dumped_.00427138
选择 mfc42.73D8840B 双击
73D883CB /74 03 JE SHORT mfc42.73D883D0
73D883CD |8B40 20 MOV EAX,DWORD PTR DS:[EAX+20]
73D883D0 \FF7424 08 PUSH DWORD PTR SS:[ESP+8]
73D883D4 50 PUSH EAX
73D883D5 E8 0A11FCFF CALL mfc42.#6756
73D883DA 50 PUSH EAX
73D883DB E8 358CFAFF CALL mfc42.#2864
73D883E0 C2 0800 RETN 8
73D883E3 > 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
73D883E7 85C0 TEST EAX,EAX
73D883E9 56 PUSH ESI
73D883EA 8BF1 MOV ESI,ECX
73D883EC 75 08 JNZ SHORT mfc42.73D883F6
73D883EE E8 045F0300 CALL mfc42.#1168
73D883F3 8B40 10 MOV EAX,DWORD PTR DS:[EAX+10]
73D883F6 85F6 TEST ESI,ESI
73D883F8 75 04 JNZ SHORT mfc42.73D883FE
73D883FA 33C9 XOR ECX,ECX
73D883FC EB 03 JMP SHORT mfc42.73D88401
73D883FE 8B4E 20 MOV ECX,DWORD PTR DS:[ESI+20]
73D88401 FF7424 10 PUSH DWORD PTR SS:[ESP+10]
73D88405 50 PUSH EAX
73D88406 FF7424 10 PUSH DWORD PTR SS:[ESP+10]
73D8840A 51 PUSH ECX
73D8840B FF15 A0A5DC73 CALL DWORD PTR DS:[<&USER32.MessageBoxA>>;
停在这里，F2下断，运行、确定、注册，再次断下来，F2取消断点
73D88411 5E POP ESI
73D88412 C2 0C00 RETN 0C
73D88415 > 55 PUSH EBP
73D88416 8BEC MOV EBP,ESP
73D88418 56 PUSH ESI
Alt+F9执行到用户代码
00426F6C . E8 8D510000 CALL <JMP.&mfc42.#2818>
00426F71 . 83C4 14 ADD ESP,14
00426F74 . 8D4424 0C LEA EAX,DWORD PTR SS:[ESP+C]
00426F78 . 8BCC MOV ECX,ESP
00426F7A . 896424 10 MOV DWORD PTR SS:[ESP+10],ESP
00426F7E . 50 PUSH EAX
00426F7F . E8 3E510000 CALL <JMP.&mfc42.#535>
00426F84 . E8 97300000 CALL dumped_.0042A020
这里就是关键CALL， F7进去
00426F89 . 83C4 04 ADD ESP,4
00426F8C . 85C0 TEST EAX,EAX
EAX为0则跳，跳则死
00426F8E . 0F84 96010000 JE dumped_.0042712A
这里是关键跳转
00426F94 . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
00426F98 . E8 DD500000 CALL <JMP.&mfc42.#540>
00426F9D . 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]
00426FA1 . C64424 40 01 MOV BYTE PTR SS:[ESP+40],1
00426FA6 . E8 47510000 CALL <JMP.&mfc42.#533>
00426FAB . 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]
00426FAF . C64424 40 02 MOV BYTE PTR SS:[ESP+40],2
00426FB4 . E8 33510000 CALL <JMP.&mfc42.#350>
00426FB9 . 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20]
00426FBD . C64424 40 03 MOV BYTE PTR SS:[ESP+40],3
00426FC2 . E8 B3500000 CALL <JMP.&mfc42.#540>
00426FC7 . 6A 00 PUSH 0
00426FC9 . 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]
00426FCD . C64424 44 04 MOV BYTE PTR SS:[ESP+44],4
00426FD2 . C74424 14 183>MOV DWORD PTR SS:[ESP+14],dumped_.004338>
00426FDA . C74424 1C 000>MOV DWORD PTR SS:[ESP+1C],0
00426FE2 . C74424 20 FFF>MOV DWORD PTR SS:[ESP+20],-1
00426FEA . E8 F7500000 CALL <JMP.&mfc42.#860>
00426FEF . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
00426FF3 . C64424 40 05 MOV BYTE PTR SS:[ESP+40],5
00426FF8 . E8 7D500000 CALL <JMP.&mfc42.#540>
00426FFD . 8B0D 68264400 MOV ECX,DWORD PTR DS:[442668]
00427003 . 8D5424 0C LEA EDX,DWORD PTR SS:[ESP+C]
00427007 . 51 PUSH ECX
00427008 . 68 5CE14300 PUSH dumped_.0043E15C ;
ASCII "%s\ShowInfoC3.dll"
0042700D . 52 PUSH EDX
0042700E . C64424 4C 06 MOV BYTE PTR SS:[ESP+4C],6
00427013 . E8 E6500000 CALL <JMP.&mfc42.#2818>
00427018 . 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18]
0042701C . 83C4 0C ADD ESP,0C
0042701F . 8D4424 10 LEA EAX,DWORD PTR SS:[ESP+10]
00427023 . 50 PUSH EAX
00427024 . 68 01100000 PUSH 1001
00427029 . 51 PUSH ECX
0042702A . 8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+30]
0042702E . E8 AD500000 CALL <JMP.&mfc42.#5194>
00427033 . 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+24]
00427037 . 6A 02 PUSH 2
00427039 . 6A 00 PUSH 0
0042703B . 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C]
0042703F . FF52 30 CALL DWORD PTR DS:[EDX+30]
00427042 . 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
00427046 . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
0042704A . 50 PUSH EAX
0042704B . 68 A4EB4300 PUSH dumped_.0043EBA4 ;
ASCII "%s
"
00427050 . 51 PUSH ECX
00427051 . E8 A8500000 CALL <JMP.&mfc42.#2818>
00427056 . 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10]
0042705A . 83C4 0C ADD ESP,0C
0042705D . 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]
00427061 . 52 PUSH EDX
00427062 . E8 49500000 CALL <JMP.&mfc42.#6407>
00427067 . A1 64284400 MOV EAX,DWORD PTR DS:[442864]
0042706C . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
00427070 . 50 PUSH EAX
00427071 . 68 A4EB4300 PUSH dumped_.0043EBA4 ;
ASCII "%s
"
00427076 . 51 PUSH ECX
00427077 . E8 82500000 CALL <JMP.&mfc42.#2818>
0042707C . 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10]
00427080 . 83C4 0C ADD ESP,0C
00427083 . 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]
00427087 . 52 PUSH EDX
00427088 . E8 23500000 CALL <JMP.&mfc42.#6407>
0042708D . 8B46 70 MOV EAX,DWORD PTR DS:[ESI+70]
00427090 . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
00427094 . 50 PUSH EAX
00427095 . 68 A4EB4300 PUSH dumped_.0043EBA4 ;
ASCII "%s
"
0042709A . 51 PUSH ECX
0042709B . E8 5E500000 CALL <JMP.&mfc42.#2818>
004270A0 . 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10]
004270A4 . 83C4 0C ADD ESP,0C
004270A7 . 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]
004270AB . 52 PUSH EDX
004270AC . E8 FF4F0000 CALL <JMP.&mfc42.#6407>
004270B1 . 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]
004270B5 . E8 14500000 CALL <JMP.&mfc42.#1997>
004270BA . 6A 40 PUSH 40
004270BC . 68 2CF04300 PUSH dumped_.0043F02C
004270C1 . 68 181B4400 PUSH dumped_.00441B18
004270C6 . 8BCE MOV ECX,ESI
004270C8 . E8 25530000 CALL <JMP.&mfc42.#4224>
004270CD . 6A 01 PUSH 1
004270CF . 8BCE MOV ECX,ESI
004270D1 . C705 24284400>MOV DWORD PTR DS:[442824],1
004270DB . E8 32540000 CALL <JMP.&mfc42.#2645>
004270E0 . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
004270E4 . C64424 40 05 MOV BYTE PTR SS:[ESP+40],5
004270E9 . E8 924F0000 CALL <JMP.&mfc42.#800>
004270EE . C74424 10 183>MOV DWORD PTR SS:[ESP+10],dumped_.004338>
004270F6 . 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20]
004270FA . C64424 40 07 MOV BYTE PTR SS:[ESP+40],7
004270FF . E8 7C4F0000 CALL <JMP.&mfc42.#800>
00427104 . 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]
00427108 . C74424 10 043>MOV DWORD PTR SS:[ESP+10],dumped_.004338>
00427110 . C64424 40 01 MOV BYTE PTR SS:[ESP+40],1
00427115 . E8 A24F0000 CALL <JMP.&mfc42.#798>
0042711A . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
0042711E . C64424 40 00 MOV BYTE PTR SS:[ESP+40],0
00427123 . E8 584F0000 CALL <JMP.&mfc42.#800>
00427128 . EB 13 JMP SHORT dumped_.0042713D
0042712A > 6A 30 PUSH 30
0042712C . 68 68E84300 PUSH dumped_.0043E868
00427131 . 68 041B4400 PUSH dumped_.00441B04
00427136 . 8BCE MOV ECX,ESI
00427138 . E8 B5520000 CALL <JMP.&mfc42.#4224> 这
里就是调用错误提示的CALL，必须跳过
0042713D > 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
ALT+F9返回后，停在此处
00427141 . C74424 40 FFF>MOV DWORD PTR SS:[ESP+40],-1
00427149 . E8 324F0000 CALL <JMP.&mfc42.#800>
0042714E . 8B4C24 38 MOV ECX,DWORD PTR SS:[ESP+38]
00427152 . 5E POP ESI
00427153 . 64:890D 00000>MOV DWORD PTR FS:[0],ECX
0042715A . 83C4 40 ADD ESP,40
0042715D . C3 RETN
0042A020 /$ 6A FF PUSH -1
F7跟进停在这里
0042A022 |. 68 BF254300 PUSH dumped_.004325BF ;
SE 处理程序安装
0042A027 |. 64:A1 0000000>MOV EAX,DWORD PTR FS:[0]
0042A02D |. 50 PUSH EAX
0042A02E |. 64:8925 00000>MOV DWORD PTR FS:[0],ESP
0042A035 |. 81EC 4C030000 SUB ESP,34C
0042A03B |. 56 PUSH ESI
0042A03C |. 57 PUSH EDI
0042A03D |. 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
0042A041 |. C78424 5C0300>MOV DWORD PTR SS:[ESP+35C],0
0042A04C |. E8 29200000 CALL <JMP.&mfc42.#540>
0042A051 |. 8D8C24 5C0100>LEA ECX,DWORD PTR SS:[ESP+15C]
0042A058 |. C68424 5C0300>MOV BYTE PTR SS:[ESP+35C],1
0042A060 |. E8 2BE4FEFF CALL dumped_.00418490
0042A065 |. 8D8C24 B40000>LEA ECX,DWORD PTR SS:[ESP+B4]
0042A06C |. C68424 5C0300>MOV BYTE PTR SS:[ESP+35C],2
0042A074 |. E8 17E4FEFF CALL dumped_.00418490
0042A079 |. 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
0042A07D |. C68424 5C0300>MOV BYTE PTR SS:[ESP+35C],3
0042A085 |. E8 06E4FEFF CALL dumped_.00418490
0042A08A |. 8D8C24 040200>LEA ECX,DWORD PTR SS:[ESP+204]
0042A091 |. C68424 5C0300>MOV BYTE PTR SS:[ESP+35C],4
0042A099 |. E8 F2E3FEFF CALL dumped_.00418490
0042A09E |. 8D8424 640300>LEA EAX,DWORD PTR SS:[ESP+364]
0042A0A5 |. 6A 0A PUSH 0A
0042A0A7 |. 50 PUSH EAX
0042A0A8 |. 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]
0042A0AC |. C68424 640300>MOV BYTE PTR SS:[ESP+364],5
0042A0B4 |. E8 17F0FEFF CALL dumped_.004190D0
0042A0B9 |. 68 04ED4300 PUSH dumped_.0043ED04 ;
ASCII "16607"
0042A0BE |. 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
0042A0C2 |. 68 DCEB4300 PUSH dumped_.0043EBDC ;
ASCII "%s"
0042A0C7 |. 51 PUSH ECX
0042A0C8 |. E8 31200000 CALL <JMP.&mfc42.#2818>
0042A0CD |. 83C4 0C ADD ESP,0C
0042A0D0 |. 8D5424 08 LEA EDX,DWORD PTR SS:[ESP+8]
0042A0D4 |. 8D8C24 5C0100>LEA ECX,DWORD PTR SS:[ESP+15C]
0042A0DB |. 6A 0A PUSH 0A
0042A0DD |. 52 PUSH EDX
0042A0DE |. E8 EDEFFEFF CALL dumped_.004190D0
0042A0E3 |. 68 E4EC4300 PUSH dumped_.0043ECE4 ;
ASCII "1396293886155912633787961414539"
0042A0E8 |. 8D4424 0C LEA EAX,DWORD PTR SS:[ESP+C]
0042A0EC |. 68 DCEB4300 PUSH dumped_.0043EBDC ;
ASCII "%s"
0042A0F1 |. 50 PUSH EAX
0042A0F2 |. E8 07200000 CALL <JMP.&mfc42.#2818>
0042A0F7 |. 83C4 0C ADD ESP,0C
0042A0FA |. 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
0042A0FE |. 6A 0A PUSH 0A
0042A100 |. 51 PUSH ECX
0042A101 |. 8D8C24 BC0000>LEA ECX,DWORD PTR SS:[ESP+BC]
0042A108 |. E8 C3EFFEFF CALL dumped_.004190D0
0042A10D |. 8D9424 B40000>LEA EDX,DWORD PTR SS:[ESP+B4]
0042A114 |. 8D8424 5C0100>LEA EAX,DWORD PTR SS:[ESP+15C]
0042A11B |. 52 PUSH EDX
0042A11C |. 8D8C24 B00200>LEA ECX,DWORD PTR SS:[ESP+2B0]
0042A123 |. 50 PUSH EAX
0042A124 |. 51 PUSH ECX
0042A125 |. 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18]
0042A129 |. E8 12F1FEFF CALL dumped_.00419240
0042A12E |. B9 2A000000 MOV ECX,2A
0042A133 |. 8BF0 MOV ESI,EAX
0042A135 |. 8DBC24 040200>LEA EDI,DWORD PTR SS:[ESP+204]
0042A13C |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
0042A13E |. 8D8C24 AC0200>LEA ECX,DWORD PTR SS:[ESP+2AC]
0042A145 |. E8 66E3FEFF CALL dumped_.004184B0
0042A14A |. 8D5424 08 LEA EDX,DWORD PTR SS:[ESP+8]
0042A14E |. 6A 0A PUSH 0A
0042A150 |. 52 PUSH EDX
0042A151 |. 8D8C24 0C0200>LEA ECX,DWORD PTR SS:[ESP+20C]
0042A158 |. E8 03F0FEFF CALL dumped_.00419160
0042A15D |. A1 64284400 MOV EAX,DWORD PTR DS:[442864]
0042A162 |. 50 PUSH EAX ;
/s2 => "1035370186"
0042A163 |. 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C] ;
|
0042A167 |. 50 PUSH EAX ;
|s1
0042A168 |. FF15 0C364300 CALL DWORD PTR DS:[<&msvcrt._mbscmp>] ;
\_mbscmp
0042A16E |. 83C4 08 ADD ESP,8
0042A171 |. C68424 5C0300>MOV BYTE PTR SS:[ESP+35C],4
0042A179 |. 85C0 TEST EAX,EAX
0042A17B |. 5F POP EDI
0042A17C |. 5E POP ESI
0042A17D |. 8D8C24 FC0100>LEA ECX,DWORD PTR SS:[ESP+1FC]
0042A184 |. 0F85 80000000 JNZ dumped_.0042A20A
关键跳转，跳则死，NOP掉或将JNZ改为JZ
0042A18A |. E8 21E3FEFF CALL dumped_.004184B0
0042A18F |. 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
0042A193 |. C68424 540300>MOV BYTE PTR SS:[ESP+354],3
0042A19B |. E8 10E3FEFF CALL dumped_.004184B0
0042A1A0 |. 8D8C24 AC0000>LEA ECX,DWORD PTR SS:[ESP+AC]
0042A1A7 |. C68424 540300>MOV BYTE PTR SS:[ESP+354],2
0042A1AF |. E8 FCE2FEFF CALL dumped_.004184B0
0042A1B4 |. 8D8C24 540100>LEA ECX,DWORD PTR SS:[ESP+154]
0042A1BB |. C68424 540300>MOV BYTE PTR SS:[ESP+354],1
0042A1C3 |. E8 E8E2FEFF CALL dumped_.004184B0
0042A1C8 |. 8D4C24 00 LEA ECX,DWORD PTR SS:[ESP]
0042A1CC |. C68424 540300>MOV BYTE PTR SS:[ESP+354],0
0042A1D4 |. E8 A71E0000 CALL <JMP.&mfc42.#800>
0042A1D9 |. 8D8C24 5C0300>LEA ECX,DWORD PTR SS:[ESP+35C]
0042A1E0 |. C78424 540300>MOV DWORD PTR SS:[ESP+354],-1
0042A1EB |. E8 901E0000 CALL <JMP.&mfc42.#800>
0042A1F0 |. B8 01000000 MOV EAX,1
0042A1F5 |. 8B8C24 4C0300>MOV ECX,DWORD PTR SS:[ESP+34C]
0042A1FC |. 64:890D 00000>MOV DWORD PTR FS:[0],ECX
0042A203 |. 81C4 58030000 ADD ESP,358
0042A209 |. C3 RETN
0042A20A |> E8 A1E2FEFF CALL dumped_.004184B0
0042A20F |. 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
0042A213 |. C68424 540300>MOV BYTE PTR SS:[ESP+354],3
0042A21B |. E8 90E2FEFF CALL dumped_.004184B0
0042A220 |. 8D8C24 AC0000>LEA ECX,DWORD PTR SS:[ESP+AC]
0042A227 |. C68424 540300>MOV BYTE PTR SS:[ESP+354],2
0042A22F |. E8 7CE2FEFF CALL dumped_.004184B0
0042A234 |. 8D8C24 540100>LEA ECX,DWORD PTR SS:[ESP+154]
0042A23B |. C68424 540300>MOV BYTE PTR SS:[ESP+354],1
0042A243 |. E8 68E2FEFF CALL dumped_.004184B0
0042A248 |. 8D4C24 00 LEA ECX,DWORD PTR SS:[ESP]
0042A24C |. C68424 540300>MOV BYTE PTR SS:[ESP+354],0
0042A254 |. E8 271E0000 CALL <JMP.&mfc42.#800>
0042A259 |. 8D8C24 5C0300>LEA ECX,DWORD PTR SS:[ESP+35C]
0042A260 |. C78424 540300>MOV DWORD PTR SS:[ESP+354],-1
0042A26B |. E8 101E0000 CALL <JMP.&mfc42.#800>
0042A270 |. 8B8C24 4C0300>MOV ECX,DWORD PTR SS:[ESP+34C]
0042A277 |. 33C0 XOR EAX,EAX
0042A279 |. 64:890D 00000>MOV DWORD PTR FS:[0],ECX
0042A280 |. 81C4 58030000 ADD ESP,358
0042A286 \. C3 RETN
保存，关闭OD。
测试下，所有限制功能都可以使用，爆破成功!!!
还有点缺陷就是“注册”不是灰色，还可以输入
下面使用pexplorer资源工具来编辑：
用pexplorer资源工具打开破解后的文件，点击 资源查看/编辑器，
在左侧点击“菜单”前面的“+”号，选择 129—右击—编辑资源，
然后在左侧最下面选择“32795，“注册（＆R）...””
最后在右侧“变灰”“无效”前打“√”
保存，退出。
好了，软件完美爆破。
本人新手，目前只会简单爆破，追踪注册码还有待学习。
第一次写教程，不管写的怎么样，还请大家支持下!!
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
v5
