程序名：Hard Drive Inspector
程序说明：
Hard Drive Inspector is the most powerful, convenient and effective program
based on the S.M.A.R.T. technology to control the state of your
hard disk drives.
Most computer users agree that their data is the most valuable element
of their computer system. Through the S.M.A.R.T. System, Hard Drive Inspector
allows you to predict a possible failure of the hdd before it occurs.
As the access to electronic information becomes more and more vital
in business and at home, Hard Drive Inspector allows you to reach beyond
the traditional boundaries of hdd? reliability and extend their protection
of valuable user data to new and more sophisticated levels.
Hard Drive Inspector has a flexible option system, which allows you
to customize the functioning of this utility as you want.
限制情况：30天试用+nag
一日在电脑报上看到此软件，下后用了下，还行，顺手拿来练下手。
暴破过程：
搜字符串，无任何收获。下MSG断点也无用。猜想是消息传递的。下ShowWindow,跟踪N久后得出。
1、完美破解（去nag): （HDInspector0.exe）
bpx ShowWindow,F9断下，往上找下断点以找到返回处。不断重复直到出现下列代码
00417C35 85C0 test eax,eax
00417C37 75 29 jnz short HDInspec.00417C62 //改为jmp
00417C39 68 8CED5D00 push HDInspec.005DED8C ; hddstateinspector.ini
00417C3E 8B85 80FEFFFF mov eax,dword ptr ss:[ebp-180]
00417C44 50 push eax
00417C45 8D8D 84FEFFFF lea ecx,dword ptr ss:[ebp-17C]
00417C4B E8 10C70900 call HDInspec.004B4360
00417C50 8D85 80FEFFFF lea eax,dword ptr ss:[ebp-180]
00417C56 50 push eax
00417C57 8D8D 84FEFFFF lea ecx,dword ptr ss:[ebp-17C]
00417C5D E8 1EB60900 call HDInspec.004B3280
00417C62 0FB705 F4636300 movzx eax,word ptr ds:[6363F4]
00417C69 85C0 test eax,eax
00417C6B 75 1E jnz short HDInspec.00417C8B //nop
00417C6D 0FBE05 B4636300 movsx eax,byte ptr ds:[6363B4]
00417C74 85C0 test eax,eax
00417C76 74 13 je short HDInspec.00417C8B
00417C78 B9 88636300 mov ecx,HDInspec.00636388
00417C7D E8 6E6F0000 call HDInspec.0041EBF0
00417C82 83F8 1E cmp eax,1E
00417C85 0F87 2C010000 ja HDInspec.00417DB7
00417C8B 68 AC020000 push 2AC
00417C90 E8 7BCCFEFF call HDInspec.00404910
00417C95 8985 C4FDFFFF mov dword ptr ss:[ebp-23C],eax
00417C9B C645 FC 16 mov byte ptr ss:[ebp-4],16
00417C9F 83BD C4FDFFFF 00 cmp dword ptr ss:[ebp-23C],0
00417CA6 74 15 je short HDInspec.00417CBD
00417CA8 6A 00 push 0
00417CAA 8B8D C4FDFFFF mov ecx,dword ptr ss:[ebp-23C]
00417CB0 E8 5BAC0100 call HDInspec.00432910
00417CB5 8985 6CFDFFFF mov dword ptr ss:[ebp-294],eax
00417CBB EB 0A jmp short HDInspec.00417CC7
00417CBD C785 6CFDFFFF 000>mov dword ptr ss:[ebp-294],0
00417CC7 8B85 6CFDFFFF mov eax,dword ptr ss:[ebp-294]
00417CCD 8985 C0FDFFFF mov dword ptr ss:[ebp-240],eax
00417CD3 C645 FC 15 mov byte ptr ss:[ebp-4],15
00417CD7 8B8D C0FDFFFF mov ecx,dword ptr ss:[ebp-240]
00417CDD 898D 7CFEFFFF mov dword ptr ss:[ebp-184],ecx
00417CE3 C785 78FEFFFF 020>mov dword ptr ss:[ebp-188],2
00417CED 6A 00 push 0
00417CEF 68 9F000000 push 9F
00417CF4 A1 18656300 mov eax,dword ptr ds:[636518]
00417CF9 50 push eax
00417CFA 8B8D 7CFEFFFF mov ecx,dword ptr ss:[ebp-184]
00417D00 E8 EB5D0800 call HDInspec.0049DAF0
00417D05 85C0 test eax,eax
00417D07 74 1A je short HDInspec.00417D23 //改为jmp
00417D09 8B85 7CFEFFFF mov eax,dword ptr ss:[ebp-184]
00417D0F 8B10 mov edx,dword ptr ds:[eax]
00417D11 8B8D 7CFEFFFF mov ecx,dword ptr ss:[ebp-184]
00417D17 FF92 40010000 call dword ptr ds:[edx+140] ; nag
00417D1D 8985 78FEFFFF mov dword ptr ss:[ebp-188],eax
00417D23 8B85 7CFEFFFF mov eax,dword ptr ss:[ebp-184]
00417D29 8985 CCFDFFFF mov dword ptr ss:[ebp-234],eax
00417D2F 8B8D CCFDFFFF mov ecx,dword ptr ss:[ebp-234]
00417D35 898D C8FDFFFF mov dword ptr ss:[ebp-238],ecx
00417D3B 83BD C8FDFFFF 00 cmp dword ptr ss:[ebp-238],0
00417D42 74 1B je short HDInspec.00417D5F
00417D44 6A 01 push 1
00417D46 8B95 C8FDFFFF mov edx,dword ptr ss:[ebp-238]
00417D4C 8B02 mov eax,dword ptr ds:[edx]
00417D4E 8B8D C8FDFFFF mov ecx,dword ptr ss:[ebp-238]
00417D54 FF50 04 call dword ptr ds:[eax+4]
00417D57 8985 6CFDFFFF mov dword ptr ss:[ebp-294],eax
00417D5D EB 0A jmp short HDInspec.00417D69
00417D5F C785 6CFDFFFF 000>mov dword ptr ss:[ebp-294],0
00417D69 83BD 78FEFFFF 01 cmp dword ptr ss:[ebp-188],1
00417D70 74 45 je short HDInspec.00417DB7 //改jmp
00417D72 C785 D0FDFFFF 000>mov dword ptr ss:[ebp-230],0
00417D7C C645 FC 01 mov byte ptr ss:[ebp-4],1
00417D80 8D8D 84FEFFFF lea ecx,dword ptr ss:[ebp-17C]
00417D86 E8 05A1FEFF call HDInspec.00401E90
00417D8B C645 FC 00 mov byte ptr ss:[ebp-4],0
00417D8F 8D8D D4FEFFFF lea ecx,dword ptr ss:[ebp-12C]
00417D95 E8 86A1FEFF call HDInspec.00401F20
00417D9A C745 FC FFFFFFFF mov dword ptr ss:[ebp-4],-1
00417DA1 8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]
00417DA7 E8 74A1FEFF call HDInspec.00401F20
00417DAC 8B85 D0FDFFFF mov eax,dword ptr ss:[ebp-230]
00417DB2 E9 BD040000 jmp HDInspec.00418274
00417DB7 68 8CED5D00 push HDInspec.005DED8C ; hddstateinspector.ini
00417DBC 8B4D F0 mov ecx,dword ptr ss:[ebp-10]
00417DBF E8 21EB1800 call HDInspec.005A68E5
00417DC4 6A 04 push 4
00417DC6 8B4D F0 mov ecx,dword ptr ss:[ebp-10]
00417DC9 E8 18DF1800 call HDInspec.005A5CE6
00417DCE 68 80ED5D00 push HDInspec.005DED80 ; settings
2、去天数限制破解：（crack.exe)
0041EC96 90 nop ; 把此处改为nop
0041EC97 90 nop
0041EC98 DD45 E4 fld qword ptr ss:[ebp-1C]
0041EC9B E8 78650>call HDInspec.004D5218 ; 30变1E后给eax
0041ECA0 C745 A0 >mov dword ptr ss:[ebp-60],30 ; 把余下的使用天数给[ebp-60]
0041ECA7 90 nop
0041ECA8 90 nop
0041ECA9 90 nop
0041ECAA 90 nop
0041ECAB 90 nop
0041ECAC 8B45 A0 mov eax,dword ptr ss:[ebp-60]
00432E55 81C1 88000000 add ecx,88
00432E5B E8 40110000 call HDInspec.00433FA0
00432E60 B9 88636300 mov ecx,HDInspec.00636388
00432E65 E8 86BDFEFF call HDInspec.0041EBF0 ; 取得余下天数并把其放在[ebp-60]处
00432E6A 83F8 FF cmp eax,-1 ;与1E比较，改为-1
00432E6D 73 12 jnb short HDInspec.00432E81 ; 判断是否到30天，改jmp
00432E6F B9 88636300 mov ecx,HDInspec.00636388
00432E74 E8 77BDFEFF call HDInspec.0041EBF0
00432E79 8985 6CFFFFFF mov dword ptr ss:[ebp-94],eax
00432E7F EB 0A jmp short HDInspec.00432E8B
00432E81 C785 6CFFFFFF >mov dword ptr ss:[ebp-94],1E
00432E8B 8B85 6CFFFFFF mov eax,dword ptr ss:[ebp-94]
00432E91 50 push eax ; 以下是用消息传递形式传递nag
00432E92 8B4D F0 mov ecx,dword ptr ss:[ebp-10]
00432F3F E8 ACBCFEFF call HDInspec.0041EBF0 ; 取余下天数，nop
00432F44 85C0 test eax,eax
00432F46 EB 3D jnz short HDInspec.00432F85 ; 跳,改为jmp
00432F48 8D45 EC lea eax,dword ptr ss:[ebp-14]
nag中的计时器
432f92 计时器时间间隔改为0
下面是放余下天数的地方：
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9134D240-9098-DED4-3250-C609710E711F}\TypeLib\ProgID: 00 00 00 00 A0 E6 E2 40 余下天数值，删除后又可用30天！！！
[课程]Android-CTF解题方法汇总！
