m_hModule = GetModuleHandle(TEXT("ProtectionPlusDLL.dll"));
if (m_hModule)
{
fpAddress = GetProcAddress(m_hModule, "IsActivatedSoftwareKey");
if (fpAddress)
{
// 原始代码
//1003FAE0 > $ 8B0D B4C02A57 MOV ECX, DWORD PTR DS:[1056C0B4]
//1003FAE6 . 32C0 XOR AL, AL
//1003FAE8 . 85C9 TEST ECX, ECX
//1003FAEA . 74 0D JZ SHORT 1003FAF9
//1003FAEC . 3881 460B0000 CMP BYTE PTR DS:[ECX+00000B46], AL
//1003FAF2 . 74 05 JE SHORT 1003FAF9
//1003FAF4 . E9 C7A7FEFF JMP 1002A2C0
//1003FAF9 . C3 RETN

// 修改代码
//1003FAE0 > $ 8B0D B4C02A57 MOV ECX, DWORD PTR DS:[1056C0B4]
//1003FAE6 . B0 01 MOV AL, 0x1
//1003FAE8 . 85C9 TEST ECX, ECX
//1003FAEA . EB 0D JMP SHORT 1003FAF9
//1003FAEC . 3881 460B0000 CMP BYTE PTR DS:[ECX+00000B46], AL
//1003FAF2 . 74 05 JE SHORT 1003FAF9
//1003FAF4 . E9 C7A7FEFF JMP 1002A2C0
//1003FAF9 . C3 RETN

DWORD lpflOldProtect;
DWORD dwAddress = (DWORD)fpAddress;
VirtualProtect(fpAddress, 0x1A, PAGE_EXECUTE_READWRITE, &lpflOldProtect);
if (*(WORD*)(dwAddress + 0x06) == 0xC032) *(WORD*)(dwAddress + 0x06) = 0x01B0;
if (*(WORD*)(dwAddress + 0x0A) == 0x0D74) *(WORD*)(dwAddress + 0x0A) = 0x0DEB;
VirtualProtect(fpAddress, 0x1A, lpflOldProtect, &lpflOldProtect);
}
}