Pwdbox V2004-软件逆向-看雪-安全社区|安全招聘|kanxue.com

Pwdbox V2004

发表于: 2005-12-21 12:17 4892

Pwdbox V2004

siaoxing

2005-12-21 12:17

4892

  【文章题目】Pwdbox V2004
  【使用工具】OD,W32DASM，
  【软件限制】去除功能限制
  【破解平台】WinXP
  【软件名称】:Pwdbox V2004
  【软件作者】:张翰长 simon
  【在线注册】:www.pcs.9126.com
  【注册邮箱】:Sixmon@163.com
  【发行方式】:共享软件
  【升级时间】:2004/07/20
  【下载地址】;siaoxing.168ys.com       123456789

            Pwdbox V2004是一个能捕获大量各种密码和账号的软件，未注
册前五位用*号替代密码，可惜现在不能用了。看雪建议大家尽可能用国外软件
来作为研究对象，由于一时找不到国外软件，就拿以前破解的这个软件开刀吧！

            运行软件，输入邮箱号，点生成，得到“<siaoxing@126.com>你使用的是试用版本！”

            打开W32DASM，反汇编软件，查找“你使用的是试用版本”的字符串，找到一个。
------------------------------------------------------------------------------------------------
* Reference To: MFC42.Ordinal:0B63, Ord:0B63h
                              |
:00409CAF E8462B0000             Call 0040C7FA
:00409CB4 50                   push eax
:00409CB5 E8D9C4FFFF             call 00406193                ；注册关键CALL
:00409CBA 83C40C                add esp, 0000000C
:00409CBD 84C0                   test al, al
:00409CBF 753F                   jne 00409D00                ；跳到注册失败处
:00409CC1 2005481E4100          and byte ptr [00411E48], al
:00409CC7 FF37                   push dword ptr [edi]
:00409CC9 8D85F0FEFFFF          lea eax, dword ptr [ebp+FFFFFEF0]

* Possible StringData Ref from Data Obj ->"<%s>你使用的是试用版本！    "
                                    ->"

试用功能将有所限制。继续吗？"
                              |
:00409CCF 6878074200             push 00420778
:00409CD4 50                   push eax

-------------------------------------------------------------------------------------------------

         打开OD在00409CB5设断点，运行，输入邮箱号，点生成。中断。F7进入。

------------------------------------------------------------------------------------------------
00406193  /$  55          PUSH EBP
00406194  |.  8BEC       MOV EBP,ESP
00406196  |.  81EC 00040000 SUB ESP,400
0040619C  |.  837D 10 00 CMP DWORD PTR SS:[EBP+10],0
004061A0  |.  53          PUSH EBX
004061A1  |.  56          PUSH ESI
004061A2  |.  57          PUSH EDI
004061A3  |.  0F84 F7000000 JE PWDBOXCN.004062A0
004061A9  |.  A0 080E4200 MOV AL,BYTE PTR DS:[420E08]
004061AE  |.  B9 FF000000 MOV ECX,0FF
004061B3  |.  8885 00FCFFFF MOV BYTE PTR SS:[EBP-400],AL
004061B9  |.  33C0       XOR EAX,EAX
004061BB  |.  8DBD 01FCFFFF LEA EDI,DWORD PTR SS:[EBP-3FF]
004061C1  |.  8B35 0CE44000 MOV ESI,DWORD PTR DS:[<&MSVCRT.sprintf>] ;  MSVCRT.sprintf
004061C7  |.  F3:AB       REP STOS DWORD PTR ES:[EDI]
004061C9  |.  66:AB       STOS WORD PTR ES:[EDI]
004061CB  |.  AA          STOS BYTE PTR ES:[EDI]
004061CC  |.  8B7D 08    MOV EDI,DWORD PTR SS:[EBP+8]
004061CF  |.  8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
004061D5  |.  57          PUSH EDI                               ; /<%s>
004061D6  |.  68 C8F54100 PUSH PWDBOXCN.0041F5C8                ; |format = "C:%s"
004061DB  |.  50          PUSH EAX                               ; |s
004061DC  |.  FFD6       CALL ESI                               ; \sprintf
004061DE  |.  FF75 10    PUSH DWORD PTR SS:[EBP+10]
004061E1  |.  8B5D 0C    MOV EBX,DWORD PTR SS:[EBP+C]
004061E4  |.  8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
004061EA  |.  53          PUSH EBX
004061EB  |.  50          PUSH EAX
004061EC  |.  E8 97FDFFFF CALL PWDBOXCN.00405F88                ；正试版注册算法CALL
004061F1  |.  83C4 18    ADD ESP,18
004061F4  |.  85C0       TEST EAX,EAX
004061F6  |.  0F85 A0000000 JNZ PWDBOXCN.0040629C                   ；不相等就跳
004061FC  |.  57          PUSH EDI
004061FD  |.  8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
00406203  |.  68 C0F54100 PUSH PWDBOXCN.0041F5C0                ;  ASCII "G:%s"
00406208  |.  50          PUSH EAX
00406209  |.  FFD6       CALL ESI
0040620B  |.  FF75 10    PUSH DWORD PTR SS:[EBP+10]
0040620E  |.  8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
00406214  |.  53          PUSH EBX
00406215  |.  50          PUSH EAX
00406216  |.  E8 6DFDFFFF CALL PWDBOXCN.00405F88                ;游戏版注册算法CALL
0040621B  |.  83C4 18    ADD ESP,18
0040621E  |.  85C0       TEST EAX,EAX
00406220  |.  0F85 A7000000 JNZ PWDBOXCN.004062CD                   ；不相等就跳
00406226  |.  57          PUSH EDI
00406227  |.  8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
0040622D  |.  68 B8F54100 PUSH PWDBOXCN.0041F5B8                ;  ASCII "N:%s"
00406232  |.  50          PUSH EAX
00406233  |.  FFD6       CALL ESI
00406235  |.  FF75 10    PUSH DWORD PTR SS:[EBP+10]
00406238  |.  8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
0040623E  |.  53          PUSH EBX
0040623F  |.  50          PUSH EAX
00406240  |.  E8 43FDFFFF CALL PWDBOXCN.00405F88                ；网络完整版注册算法CALL
00406245  |.  83C4 18    ADD ESP,18
00406248  |.  85C0       TEST EAX,EAX
0040624A  |.  75 7D       JNZ SHORT PWDBOXCN.004062C9             ；不相等就跳
0040624C  |.  8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
00406252  |.  53          PUSH EBX                               ; /src
00406253  |.  50          PUSH EAX                               ; |dest
00406254  |.  E8 B7660000 CALL <JMP.&MSVCRT.strcpy>             ; \strcpy
00406259  |.  8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
0040625F  |.  50          PUSH EAX                               ; /s
00406260  |.  E8 C3660000 CALL <JMP.&MSVCRT.strlen>             ; \strlen
00406265  |.  50          PUSH EAX
00406266  |.  8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
0040626C  |.  50          PUSH EAX
0040626D  |.  E8 82FBFFFF CALL PWDBOXCN.00405DF4
00406272  |.  8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
00406278  |.  57          PUSH EDI                               ; /s2
00406279  |.  50          PUSH EAX                               ; |s1
0040627A  |.  FF15 08E44000 CALL DWORD PTR DS:[<&MSVCRT._stricmp>] ; \_stricmp
00406280  |.  83C4 1C    ADD ESP,1C
00406283  |.  85C0       TEST EAX,EAX
00406285  |.  75 4A       JNZ SHORT PWDBOXCN.004062D1
00406287  |.  8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
0040628D  |.  6A 40       PUSH 40                               ; /c = 40  ('@')
0040628F  |.  50          PUSH EAX                               ; |s
00406290  |.  FF15 40E44000 CALL DWORD PTR DS:[<&MSVCRT.strchr>]    ; \strchr
00406296  |.  59          POP ECX
00406297  |.  85C0       TEST EAX,EAX
00406299  |.  59          POP ECX
0040629A  |.  74 35       JE SHORT PWDBOXCN.004062D1
0040629C  |>  B0 01       MOV AL,1
0040629E  |.  EB 33       JMP SHORT PWDBOXCN.004062D3
004062A0  |>  8B75 08    MOV ESI,DWORD PTR SS:[EBP+8]
004062A3  |.  807E 01 3A CMP BYTE PTR DS:[ESI+1],3A
004062A7  |.  75 28       JNZ SHORT PWDBOXCN.004062D1
004062A9  |.  6A 00       PUSH 0
004062AB  |.  FF75 0C    PUSH DWORD PTR SS:[EBP+C]
004062AE  |.  56          PUSH ESI
004062AF  |.  E8 D4FCFFFF CALL PWDBOXCN.00405F88
004062B4  |.  83C4 0C    ADD ESP,0C
004062B7  |.  85C0       TEST EAX,EAX
004062B9  |.  74 16       JE SHORT PWDBOXCN.004062D1
004062BB  |.  8A06       MOV AL,BYTE PTR DS:[ESI]
004062BD  |.  3C 43       CMP AL,43
004062BF  |.^ 74 DB       JE SHORT PWDBOXCN.0040629C
004062C1  |.  3C 47       CMP AL,47
004062C3  |.  74 08       JE SHORT PWDBOXCN.004062CD
004062C5  |.  3C 4E       CMP AL,4E
004062C7  |.  75 08       JNZ SHORT PWDBOXCN.004062D1
004062C9  |>  B0 03       MOV AL,3
004062CB  |.  EB 06       JMP SHORT PWDBOXCN.004062D3
004062CD  |>  B0 02       MOV AL,2
004062CF  |.  EB 02       JMP SHORT PWDBOXCN.004062D3
004062D1  |>  32C0       XOR AL,AL
004062D3  |>  5F          POP EDI
004062D4  |.  5E          POP ESI
004062D5  |.  5B          POP EBX
004062D6  |.  C9          LEAVE
004062D7  \.  C3          RETN

------------------------------------------------------------------------------------------------

      Pwdbox V2004注册方试分为正式版、游戏版、网络完整版。正式版、游戏版有一定的限制，网络完

整版就没有任何限制，算法都差不多，我们就进入00406240的CALL分析。

------------------------------------------------------------------------------------------------
00405F88  /$  B8 C4CD4000 MOV EAX,PWDBOXCN.0040CDC4
00405F8D  |.  E8 5E690000 CALL PWDBOXCN.0040C8F0
00405F92  |.  81EC 48040000 SUB ESP,448
00405F98  |.  A0 080E4200 MOV AL,BYTE PTR DS:[420E08]
00405F9D  |.  53          PUSH EBX
00405F9E  |.  56          PUSH ESI
00405F9F  |.  57          PUSH EDI
00405FA0  |.  8885 ACFBFFFF MOV BYTE PTR SS:[EBP-454],AL
00405FA6  |.  B9 FF000000 MOV ECX,0FF
00405FAB  |.  33C0       XOR EAX,EAX
00405FAD  |.  8DBD ADFBFFFF LEA EDI,DWORD PTR SS:[EBP-453]
00405FB3  |.  F3:AB       REP STOS DWORD PTR ES:[EDI]
00405FB5  |.  66:AB       STOS WORD PTR ES:[EDI]
00405FB7  |.  33DB       XOR EBX,EBX
00405FB9  |.  33F6       XOR ESI,ESI
00405FBB  |.  895D F0    MOV DWORD PTR SS:[EBP-10],EBX
00405FBE  |.  AA          STOS BYTE PTR ES:[EDI]
00405FBF  |.  FF15 44E04000 CALL DWORD PTR DS:[<&KERNEL32.GetTickCou>; [GetTickCount *注意这里
00405FC5  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; /src
00405FC8  |.  8945 EC    MOV DWORD PTR SS:[EBP-14],EAX          ; |
00405FCB  |.  8D85 ACFBFFFF LEA EAX,DWORD PTR SS:[EBP-454]          ; |
00405FD1  |.  50          PUSH EAX                               ; |dest
00405FD2  |.  E8 4B690000 CALL <JMP.&MSVCRT.strcat>             ; \strcat
00405FD7  |.  391D C0564200 CMP DWORD PTR DS:[4256C0],EBX
00405FDD  |.  59          POP ECX
00405FDE  |.  59          POP ECX
00405FDF  |.  74 06       JE SHORT PWDBOXCN.00405FE7
00405FE1  |.  889D ACFBFFFF MOV BYTE PTR SS:[EBP-454],BL
00405FE7  |>  8D85 ACFBFFFF LEA EAX,DWORD PTR SS:[EBP-454]
00405FED  |.  50          PUSH EAX                               ; /s
00405FEE  |.  E8 35690000 CALL <JMP.&MSVCRT.strlen>             ; \strlen
00405FF3  |.  50          PUSH EAX
00405FF4  |.  8D85 ACFBFFFF LEA EAX,DWORD PTR SS:[EBP-454]
00405FFA  |.  50          PUSH EAX
00405FFB  |.  E8 131D0000 CALL PWDBOXCN.00407D13
00406000  |.  8A8D ACFBFFFF MOV CL,BYTE PTR SS:[EBP-454]
00406006  |.  83C4 0C    ADD ESP,0C
00406009  |.  3ACB       CMP CL,BL
0040600B  |.  8D85 ACFBFFFF LEA EAX,DWORD PTR SS:[EBP-454]
00406011  |.  74 16       JE SHORT PWDBOXCN.00406029
00406013  |.  8AD1       MOV DL,CL
00406015  |>  8B7D F0    /MOV EDI,DWORD PTR SS:[EBP-10]
00406018  |.  40          |INC EAX
00406019  |.  0FBED2       |MOVSX EDX,DL
0040601C  |.  8D5417 D0    |LEA EDX,DWORD PTR DS:[EDI+EDX-30]
00406020  |.  8955 F0    |MOV DWORD PTR SS:[EBP-10],EDX
00406023  |.  8A10       |MOV DL,BYTE PTR DS:[EAX]
00406025  |.  3AD3       |CMP DL,BL
00406027  |.^ 75 EC       \JNZ SHORT PWDBOXCN.00406015
00406029  |>  8145 F0 FC010>ADD DWORD PTR SS:[EBP-10],1FC
00406030  |.  8D85 ACFBFFFF LEA EAX,DWORD PTR SS:[EBP-454]
00406036  |>  3ACB       /CMP CL,BL
00406038  |.  74 0C       |JE SHORT PWDBOXCN.00406046
0040603A  |.  0FBEC9       |MOVSX ECX,CL
0040603D  |.  40          |INC EAX
0040603E  |.  8D740E D0    |LEA ESI,DWORD PTR DS:[ESI+ECX-30]
00406042  |.  8A08       |MOV CL,BYTE PTR DS:[EAX]
00406044  |.^ EB F0       \JMP SHORT PWDBOXCN.00406036
00406046  |>  8D0436       LEA EAX,DWORD PTR DS:[ESI+ESI]
00406049  |.  6A 03       PUSH 3
0040604B  |.  99          CDQ
0040604C  |.  59          POP ECX
0040604D  |.  F7F9       IDIV ECX
0040604F  |.  05 4D260000 ADD EAX,264D
00406054  |.  50          PUSH EAX                               ; /<%u>
00406055  |.  8D45 AC    LEA EAX,DWORD PTR SS:[EBP-54]          ; |
00406058  |.  FF75 F0    PUSH DWORD PTR SS:[EBP-10]             ; |<%u>
0040605B  |.  68 B0F54100 PUSH PWDBOXCN.0041F5B0                ; |format = "%u%u"
00406060  |.  50          PUSH EAX                               ; |s
00406061  |.  FF15 0CE44000 CALL DWORD PTR DS:[<&MSVCRT.sprintf>] ; \sprintf
00406067  |.  8A45 AC    MOV AL,BYTE PTR SS:[EBP-54]
0040606A  |.  8A4D AE    MOV CL,BYTE PTR SS:[EBP-52]
0040606D  |.  83C4 10    ADD ESP,10
00406070  |.  391D C8564200 CMP DWORD PTR DS:[4256C8],EBX
00406076  |.  884D AC    MOV BYTE PTR SS:[EBP-54],CL
00406079  |.  8845 AE    MOV BYTE PTR SS:[EBP-52],AL
0040607C  |.  74 1B       JE SHORT PWDBOXCN.00406099
0040607E  |.  FF75 0C    PUSH DWORD PTR SS:[EBP+C]             ; /s2
00406081  |.  8D45 AC    LEA EAX,DWORD PTR SS:[EBP-54]          ; |
00406084  |.  50          PUSH EAX                               ; |s1
00406085  |.  E8 8C680000 CALL <JMP.&MSVCRT.strcmp>             ; \strcmp
0040608A  |.  59          POP ECX
0040608B  |.  85C0       TEST EAX,EAX
0040608D  |.  59          POP ECX
0040608E  |.  74 09       JE SHORT PWDBOXCN.00406099
00406090  |.  A1 C8564200 MOV EAX,DWORD PTR DS:[4256C8]
00406095  |.  8048 10 02 OR BYTE PTR DS:[EAX+10],2
00406099  |>  FF15 44E04000 CALL DWORD PTR DS:[<&KERNEL32.GetTickCou>; [GetTickCount
0040609F  |.  2B45 EC    SUB EAX,DWORD PTR SS:[EBP-14]          ；两次时间对比
004060A2  |.  3D D0070000 CMP EAX,7D0
004060A7  |.  0F82 AB000000 JB PWDBOXCN.00406158面                *注意这里要改成JMP，否则呵呵！有你好瞧！
004060AD  |.  895D 08    MOV DWORD PTR SS:[EBP+8],EBX
004060B0  |.  8D45 EC    LEA EAX,DWORD PTR SS:[EBP-14]
004060B3  |.  FF05 EC564200 INC DWORD PTR DS:[4256EC]
004060B9  |.  50          PUSH EAX                               ; /pDisposition
004060BA  |.  8D45 F0    LEA EAX,DWORD PTR SS:[EBP-10]          ; |
004060BD  |.  50          PUSH EAX                               ; |pHandle
004060BE  |.  53          PUSH EBX                               ; |pSecurity
004060BF  |.  68 3F000F00 PUSH 0F003F                            ; |Access = KEY_ALL_ACCESS
004060C4  |.  53          PUSH EBX                               ; |Options
004060C5  |.  53          PUSH EBX                               ; |Class
004060C6  |.  53          PUSH EBX                               ; |Reserved
004060C7  |.  68 94F54100 PUSH PWDBOXCN.0041F594                ; |Subkey = "Software\CLASSES\ZPwd_box"
004060CC  |.  68 02000080 PUSH 80000002                         ; |hKey = HKEY_LOCAL_MACHINE
004060D1  |.  895D FC    MOV DWORD PTR SS:[EBP-4],EBX          ; |
004060D4  |.  895D F0    MOV DWORD PTR SS:[EBP-10],EBX          ; |
004060D7  |.  FF15 20E04000 CALL DWORD PTR DS:[<&ADVAPI32.RegCreateK>; \RegCreateKeyExA
004060DD  |.  8B3D 0CE04000 MOV EDI,DWORD PTR DS:[<&ADVAPI32.RegClos>
004060E3  |.  3BC3       CMP EAX,EBX
004060E5  |.  75 2D       JNZ SHORT PWDBOXCN.00406114
004060E7  |.  A1 EC564200 MOV EAX,DWORD PTR DS:[4256EC]
004060EC  |.  8B75 F0    MOV ESI,DWORD PTR SS:[EBP-10]
004060EF  |.  8945 EC    MOV DWORD PTR SS:[EBP-14],EAX
004060F2  |.  8D45 EC    LEA EAX,DWORD PTR SS:[EBP-14]
004060F5  |.  6A 04       PUSH 4                                  ; /BufSize = 4
004060F7  |.  50          PUSH EAX                               ; |Buffer
004060F8  |.  6A 04       PUSH 4                                  ; |ValueType = REG_DWORD
004060FA  |.  53          PUSH EBX                               ; |Reserved
004060FB  |.  68 88F54100 PUSH PWDBOXCN.0041F588                ; |ValueName = "CreakCount"
00406100  |.  56          PUSH ESI                               ; |hKey
00406101  |.  8975 08    MOV DWORD PTR SS:[EBP+8],ESI          ; |
00406104  |.  FF15 04E04000 CALL DWORD PTR DS:[<&ADVAPI32.RegSetValu>; \RegSetValueExA
0040610A  |.  3BF3       CMP ESI,EBX
0040610C  |.  74 06       JE SHORT PWDBOXCN.00406114
0040610E  |.  56          PUSH ESI                               ; /hKey
0040610F  |.  FFD7       CALL EDI                               ; \RegCloseKey
00406111  |.  895D 08    MOV DWORD PTR SS:[EBP+8],EBX
00406114  |>  833D EC564200>CMP DWORD PTR DS:[4256EC],1
0040611B  |.  76 16       JBE SHORT PWDBOXCN.00406133
0040611D  |.  53          PUSH EBX
0040611E  |.  53          PUSH EBX
0040611F  |.  53          PUSH EBX
00406120  |.  53          PUSH EBX
00406121  |.  53          PUSH EBX
00406122  |.  68 813C4000 PUSH PWDBOXCN.00403C81
00406127  |.  E8 DC640000 CALL <JMP.&MFC42.#1105_?AfxBeginThread@@>
0040612C  |.  833D EC564200>CMP DWORD PTR DS:[4256EC],1
00406133  |>  75 19       JNZ SHORT PWDBOXCN.0040614E
00406135  |.  53          PUSH EBX                               ; /Style
00406136  |.  68 D8E64000 PUSH PWDBOXCN.0040E6D8                ; |Title = "Pwdbox V2004 "
0040613B  |.  68 74F54100 PUSH PWDBOXCN.0041F574                ; |Text = "啊，敢调戏我！？"
00406140  |.  53          PUSH EBX                               ; |hOwner
00406141  |.  FF15 70E44000 CALL DWORD PTR DS:[<&USER32.MessageBoxA>>; \MessageBoxA
00406147  |.  53          PUSH EBX                               ; /ExitCode
00406148  |.  FF15 74E44000 CALL DWORD PTR DS:[<&USER32.PostQuitMess>; \PostQuitMessage
0040614E  |>  395D 08    CMP DWORD PTR SS:[EBP+8],EBX
00406151  |.  74 05       JE SHORT PWDBOXCN.00406158
00406153  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]
00406156  |.  FFD7       CALL EDI
00406158  |>  395D 10    CMP DWORD PTR SS:[EBP+10],EBX
0040615B  |.  5F          POP EDI
0040615C  |.  5E          POP ESI
0040615D  |.  5B          POP EBX
0040615E  |.  75 1D       JNZ SHORT PWDBOXCN.0040617D
00406160  |.  8D45 AC    LEA EAX,DWORD PTR SS:[EBP-54]
00406163  |.  50          PUSH EAX                               ; /src
00406164  |.  FF75 0C    PUSH DWORD PTR SS:[EBP+C]             ; |dest
00406167  |.  E8 A4670000 CALL <JMP.&MSVCRT.strcpy>             ; \strcpy
0040616C  |.  59          POP ECX
0040616D  |.  59          POP ECX
0040616E  |>  6A 01       PUSH 1
00406170  |.  58          POP EAX
00406171  |>  8B4D F4    MOV ECX,DWORD PTR SS:[EBP-C]
00406174  |.  64:890D 00000>MOV DWORD PTR FS:[0],ECX
0040617B  |.  C9          LEAVE
0040617C  |.  C3          RETN
0040617D  |>  FF75 0C    PUSH DWORD PTR SS:[EBP+C]             ; 假注册码
00406180  |.  8D45 AC    LEA EAX,DWORD PTR SS:[EBP-54]          ; |
00406183  |.  50          PUSH EAX                               ; |真注册码
00406184  |.  E8 8D670000 CALL <JMP.&MSVCRT.strcmp>             ; \strcmp
00406189  |.  59          POP ECX
0040618A  |.  85C0       TEST EAX,EAX
0040618C  |.  59          POP ECX
0040618D  |.^ 74 DF       JE SHORT PWDBOXCN.0040616E
0040618F  |.  33C0       XOR EAX,EAX
00406191  \.^ EB DE       JMP SHORT PWDBOXCN.00406171
-----------------------------------------------------------------------------------------------

  在004060A7时要小心软件两次比较时间，如大于它设定的时间就被认为被调试了。第一次时出面一个对话框

以后就在HKEY_LOCAL_MACHINE\Software\CLASSES\ZPwd_box建一值"CreakCount"里面就是你调试的次数，然后，

它就开始册除你硬盘上的文件了。你可下DeleteFileA 中断，就知它要册你什么文件了。00406183出现真注册

码做个内存注册机吧。（我在网吧写的破文，算法就不多说了，自己调试一下就知道了）
添加数据
中断地址：00406183
中断次数：3       *第一次为正试版注册码，第二次为游戏版注册码，第三次为完整版注册码。
第一字节：50
指令长度：1
内存方式：eax
地址指针：1
注册码
内存方式：eax
------------------------------------------------------------------------------------------------

            软件防sniff、netxray、dasm、ris、softice、trw、FireWall、ZoneAlarm。怎么不防OD了。

还可发现还原精灵。软件不能使用了跟

202.96.134.133

202.96.128.68

202.104.32.251

三个IP不能用有关。希高手指教。

------------------------------------------------------------------------------------------------

仗键走江湖，携雨共天涯。

孤蝶独自飞，深仙解键意。

                              siaoxing

                                    2005年12月21日

祝看雪越办越好，也祝大家新年快乐！

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)

收藏・0

免费・1

支持

最新回复 (2)
linhanshi 雪币： 97697 活跃值： (200844) 能力值： (RANK：10 ) 在线值：发帖 9249 回帖 27947 粉丝 453 关注私信	linhanshi 2 楼谢谢对论坛的支持! 2005-12-21 12:39 0
siaoxing 雪币： 119 活跃值： (40) 能力值： ( LV4，RANK：50 ) 在线值：发帖 10 回帖 37 粉丝 0 关注私信	siaoxing 1 3 楼谢谢版主，我一定会出更多的破文感谢大家 2005-12-30 15:29 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

siaoxing

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (2)
linhanshi 雪币： 97697 活跃值： (200844) 能力值： (RANK：10 ) 在线值：发帖 9249 回帖 27947 粉丝 453 关注私信	linhanshi 2 楼谢谢对论坛的支持! 2005-12-21 12:39 0
siaoxing 雪币： 119 活跃值： (40) 能力值： ( LV4，RANK：50 ) 在线值：发帖 10 回帖 37 粉丝 0 关注私信	siaoxing 1 3 楼谢谢版主，我一定会出更多的破文感谢大家 2005-12-30 15:29 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复