软件名称:桌面天气秀(XDeskWeather)
版本: V1.2 正式版
下载地址:
http://www2.skycn.com/soft/15631.html
加脱类型: ASpack 2.12
脱壳后Disassembler 如下:
:004A91DB 0F85DC000000 jne 004A92BD ; 这里有跳?
:004A91E1 8D45C0 lea eax, dword ptr [ebp-40]
:004A91E4 50 push eax
:004A91E5 8B45F4 mov eax, dword ptr [ebp-0C]
:004A91E8 E83BB2F5FF call 00404428
:004A91ED 8BD0 mov edx, eax
:004A91EF 83EA05 sub edx, 00000005
:004A91F2 B905000000 mov ecx, 00000005
:004A91F7 8B45F4 mov eax, dword ptr [ebp-0C]
:004A91FA E889B4F5FF call 00404688
:004A91FF 8B45C0 mov eax, dword ptr [ebp-40]
:004A9202 50 push eax
:004A9203 8D45BC lea eax, dword ptr [ebp-44]
:004A9206 50 push eax
:004A9207 A1ECB34B00 mov eax, dword ptr [004BB3EC]
:004A920C E817B2F5FF call 00404428
:004A9211 8BD0 mov edx, eax
:004A9213 83EA05 sub edx, 00000005
:004A9216 B905000000 mov ecx, 00000005
:004A921B A1ECB34B00 mov eax, dword ptr [004BB3EC]
:004A9220 E863B4F5FF call 00404688
:004A9225 8B55BC mov edx, dword ptr [ebp-44]
:004A9228 58 pop eax
:004A9229 E846B3F5FF call 00404574
:004A922E 0F8589000000 jne 004A92BD ;这里有一个跳转
:004A9234 33FF xor edi, edi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A92B7(C)
|
:004A923C 7572 jne 004A92B0 ;这里也跳转了!
:004A9236 81FFE7030000 cmp edi, 000003E7 ;注册成功后又跳回这里?
:004A923C 7572 jne 004A92B0
:004A923E 68E8030000 push 000003E8
* Reference To: kernel32.Sleep, Ord:0000h
|
:004A9243 E82442F6FF Call 0040D46C
:004A9248 8B8358030000 mov eax, dword ptr [ebx+00000358]
:004A924E 33D2 xor edx, edx
:004A9250 E8838AF8FF call 00431CD8
:004A9255 8B8358030000 mov eax, dword ptr [ebx+00000358]
:004A925B 33D2 xor edx, edx
:004A925D E8BA7EF9FF call 0044111C
:004A9262 A1D4E24A00 mov eax, dword ptr [004AE2D4]
:004A9267 C60001 mov byte ptr [eax], 01
:004A926A A1E4B34B00 mov eax, dword ptr [004BB3E4]
:004A926F 8B8048030000 mov eax, dword ptr [eax+00000348]
:004A9275 B201 mov dl, 01
:004A9277 E81C9DFAFF call 00452F98
* Possible StringData Ref from Code Obj ->"注册成功，谢谢您的支持！"
|
:004A927C B868934A00 mov eax, 004A9368
:004A9281 E85A1BF8FF call 0042ADE0
:004A9286 A1E4B34B00 mov eax, dword ptr [004BB3E4]
:004A928B 8B8014030000 mov eax, dword ptr [eax+00000314]
* Possible StringData Ref from Code Obj ->"注册成功，谢谢您的支持！"
|
:004A9291 BA68934A00 mov edx, 004A9368
:004A9296 E8917FF9FF call 0044122C
:004A929B 8B8338030000 mov eax, dword ptr [ebx+00000338]
* Possible StringData Ref from Code Obj ->"注册成功，谢谢您的支持！"
|
:004A92A1 BA68934A00 mov edx, 004A9368
:004A92A6 E8817FF9FF call 0044122C
:004A92AB E864C5FFFF call 004A5814
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A923C(C)
|
:004A92B0 47 inc edi
:004A92B1 81FFE9030000 cmp edi, 000003E9
:004A92B7 0F8579FFFFFF jne 004A9236 ; 这里跳回去就死循环了!
======================================================================================
将上面4 个位置的 Jne 改为 je
输入任意注册码dafdsfadsfadsfsaf 注册成功 !
点击下载:附件！Suc.png 点击下载:附件！suc2.png 注册码以明码形式保存在Save.ini中
[USER]
REGCODE=dafdsfadsfadsfsaf
不懂Track , 只好暴破,
但并不有真正注册成功, 在程序的配置窗口加载时,又从Save.ini中读取
Regcode 进行检验! 偶不知道它在哪进行的!
求指点,暴也行, 最好分析出其算法,写出注册机!
======================================================
请支持正版
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
