输入伪序列号注册码后找到3处可以下断处，但是跟完也没有出现输入内容结果却显示 注册错误，请大家帮忙看看关键点在哪里，下一步该怎么办？？？求助....（到第三个断点时已经sp已经指向显示注册错误信息了）
第一个断点：
111F8CE0 > 55 push ebp ；第一个断点处
111F8CE1 8BEC mov ebp, esp
111F8CE3 81EC 8C000000 sub esp, 8C
111F8CE9 C745 A8 0000000>mov dword ptr [ebp-58], 0
111F8CF0 C745 F4 0000000>mov dword ptr [ebp-C], 0
111F8CF7 C745 F0 0000000>mov dword ptr [ebp-10], 0
111F8CFE C745 A0 0000000>mov dword ptr [ebp-60], 0
111F8D05 C745 A4 0000000>mov dword ptr [ebp-5C], 0
111F8D0C C745 AC 0000000>mov dword ptr [ebp-54], 0
111F8D13 C745 F8 0000000>mov dword ptr [ebp-8], 0
111F8D1A C745 CC 0000000>mov dword ptr [ebp-34], 0
111F8D21 C745 C8 0000000>mov dword ptr [ebp-38], 0
111F8D28 8B45 08 mov eax, dword ptr [ebp+8]
111F8D2B 8B48 04 mov ecx, dword ptr [eax+4]
111F8D2E 894D BC mov dword ptr [ebp-44], ecx
111F8D31 8D55 B0 lea edx, dword ptr [ebp-50]
111F8D34 52 push edx
111F8D35 8B45 BC mov eax, dword ptr [ebp-44]
111F8D38 50 push eax
111F8D39 E8 92790C00 call ot_get_valptr_arg
111F8D3E 8945 98 mov dword ptr [ebp-68], eax
111F8D41 8B4D BC mov ecx, dword ptr [ebp-44]
111F8D44 51 push ecx
111F8D45 E8 46740C00 call ot_get_next_evaled_arg
111F8D4A 8945 B8 mov dword ptr [ebp-48], eax
111F8D4D 8B55 B8 mov edx, dword ptr [ebp-48]
111F8D50 0FB742 04 movzx eax, word ptr [edx+4]
111F8D54 83E0 01 and eax, 1
111F8D57 8945 FC mov dword ptr [ebp-4], eax
111F8D5A C745 DC 0000000>mov dword ptr [ebp-24], 0
111F8D61 837D 0C 02 cmp dword ptr [ebp+C], 2
111F8D65 76 12 jbe short 111F8D79
111F8D67 8D4D EC lea ecx, dword ptr [ebp-14]
111F8D6A 51 push ecx
111F8D6B 8B55 BC mov edx, dword ptr [ebp-44]
111F8D6E 52 push edx
111F8D6F E8 2C750C00 call ot_get_simple_intarg
111F8D74 8945 E4 mov dword ptr [ebp-1C], eax
111F8D77 EB 0E jmp short 111F8D87
111F8D79 C745 E4 0000000>mov dword ptr [ebp-1C], 0
111F8D80 C745 EC 0000000>mov dword ptr [ebp-14], 0
111F8D87 837D 0C 03 cmp dword ptr [ebp+C], 3
111F8D8B 76 12 jbe short 111F8D9F
111F8D8D 8D45 94 lea eax, dword ptr [ebp-6C]
111F8D90 50 push eax
111F8D91 8B4D BC mov ecx, dword ptr [ebp-44]
111F8D94 51 push ecx
111F8D95 E8 06750C00 call ot_get_simple_intarg
111F8D9A 8945 90 mov dword ptr [ebp-70], eax
111F8D9D EB 0E jmp short 111F8DAD
111F8D9F C745 90 0000000>mov dword ptr [ebp-70], 0
111F8DA6 C745 94 0000000>mov dword ptr [ebp-6C], 0
111F8DAD 837D 0C 04 cmp dword ptr [ebp+C], 4
111F8DB1 76 12 jbe short 111F8DC5
111F8DB3 8D55 E8 lea edx, dword ptr [ebp-18]
111F8DB6 52 push edx
111F8DB7 8B45 BC mov eax, dword ptr [ebp-44]
111F8DBA 50 push eax
111F8DBB E8 70750C00 call ot_get_intarg
111F8DC0 8945 E0 mov dword ptr [ebp-20], eax
111F8DC3 EB 0E jmp short 111F8DD3
111F8DC5 C745 E0 0100000>mov dword ptr [ebp-20], 1
111F8DCC C745 E8 0000000>mov dword ptr [ebp-18], 0
111F8DD3 837D B0 00 cmp dword ptr [ebp-50], 0
111F8DD7 0F85 16030000 jnz 111F90F3
111F8DDD 837D FC 00 cmp dword ptr [ebp-4], 0
111F8DE1 0F85 0C030000 jnz 111F90F3
111F8DE7 837D EC 00 cmp dword ptr [ebp-14], 0
111F8DEB 0F85 02030000 jnz 111F90F3
111F8DF1 837D 94 00 cmp dword ptr [ebp-6C], 0
111F8DF5 0F85 F8020000 jnz 111F90F3
111F8DFB 837D E8 00 cmp dword ptr [ebp-18], 0
111F8DFF 0F85 EE020000 jnz 111F90F3
111F8E05 8B4D 08 mov ecx, dword ptr [ebp+8]
111F8E08 8B51 52 mov edx, dword ptr [ecx+52]
111F8E0B 8955 9C mov dword ptr [ebp-64], edx
111F8E0E 8B45 B8 mov eax, dword ptr [ebp-48]
111F8E11 0FB748 06 movzx ecx, word ptr [eax+6]
111F8E15 83F9 06 cmp ecx, 6
111F8E18 74 2E je short 111F8E48
111F8E1A 6A 00 push 0
111F8E1C 68 FE010000 push 1FE
111F8E21 8B55 08 mov edx, dword ptr [ebp+8]
111F8E24 8B42 10 mov eax, dword ptr [edx+10]
111F8E27 50 push eax
111F8E28 E8 17301600 call <jmp.&PBSHR100.#5_pbstg_alc>
111F8E2D 8945 DC mov dword ptr [ebp-24], eax
111F8E30 68 FF000000 push 0FF
111F8E35 8B4D DC mov ecx, dword ptr [ebp-24]
111F8E38 51 push ecx
111F8E39 8B55 B8 mov edx, dword ptr [ebp-48]
111F8E3C 52 push edx
111F8E3D 8B45 08 mov eax, dword ptr [ebp+8]
111F8E40 50 push eax
111F8E41 E8 DA7DFCFF call FN_FormatData
111F8E46 EB 10 jmp short 111F8E58
111F8E48 8B4D B8 mov ecx, dword ptr [ebp-48]
111F8E4B 51 push ecx
111F8E4C 8B55 BC mov edx, dword ptr [ebp-44]
111F8E4F 52 push edx
111F8E50 E8 EB7C0B00 call ot_get_valptr
111F8E55 8945 DC mov dword ptr [ebp-24], eax
111F8E58 C745 B4 0020000>mov dword ptr [ebp-4C], 2000
111F8E5F 8B45 E4 mov eax, dword ptr [ebp-1C]
111F8E62 8945 84 mov dword ptr [ebp-7C], eax
111F8E65 8B4D 84 mov ecx, dword ptr [ebp-7C]
111F8E68 83E9 01 sub ecx, 1
111F8E6B 894D 84 mov dword ptr [ebp-7C], ecx
111F8E6E 837D 84 03 cmp dword ptr [ebp-7C], 3
111F8E72 77 2D ja short 111F8EA1
111F8E74 8B55 84 mov edx, dword ptr [ebp-7C]
111F8E77 FF2495 90911F11 jmp dword ptr [edx*4+111F9190]
111F8E7E 8B45 B4 mov eax, dword ptr [ebp-4C]
111F8E81 83C8 10 or eax, 10
111F8E84 8945 B4 mov dword ptr [ebp-4C], eax
111F8E87 EB 21 jmp short 111F8EAA
111F8E89 8B4D B4 mov ecx, dword ptr [ebp-4C]
111F8E8C 83C9 30 or ecx, 30
111F8E8F 894D B4 mov dword ptr [ebp-4C], ecx
111F8E92 EB 16 jmp short 111F8EAA
111F8E94 8B55 B4 mov edx, dword ptr [ebp-4C]
111F8E97 83CA 20 or edx, 20
111F8E9A 8955 B4 mov dword ptr [ebp-4C], edx
111F8E9D EB 0B jmp short 111F8EAA
111F8E9F EB 09 jmp short 111F8EAA
111F8EA1 8B45 B4 mov eax, dword ptr [ebp-4C]
111F8EA4 83C8 40 or eax, 40
111F8EA7 8945 B4 mov dword ptr [ebp-4C], eax
111F8EAA 8B4D 90 mov ecx, dword ptr [ebp-70]
111F8EAD 894D 80 mov dword ptr [ebp-80], ecx
111F8EB0 8B55 80 mov edx, dword ptr [ebp-80]
111F8EB3 83EA 01 sub edx, 1
111F8EB6 8955 80 mov dword ptr [ebp-80], edx
111F8EB9 837D 80 04 cmp dword ptr [ebp-80], 4
111F8EBD 77 41 ja short 111F8F00
111F8EBF 8B45 80 mov eax, dword ptr [ebp-80]
111F8EC2 FF2485 A0911F11 jmp dword ptr [eax*4+111F91A0]
111F8EC9 8B4D B4 mov ecx, dword ptr [ebp-4C]
111F8ECC 83C9 01 or ecx, 1
111F8ECF 894D B4 mov dword ptr [ebp-4C], ecx
111F8ED2 EB 32 jmp short 111F8F06
111F8ED4 8B55 B4 mov edx, dword ptr [ebp-4C]
111F8ED7 83CA 05 or edx, 5
111F8EDA 8955 B4 mov dword ptr [ebp-4C], edx
111F8EDD EB 27 jmp short 111F8F06
111F8EDF 8B45 B4 mov eax, dword ptr [ebp-4C]
111F8EE2 83C8 02 or eax, 2
111F8EE5 8945 B4 mov dword ptr [ebp-4C], eax
111F8EE8 EB 1C jmp short 111F8F06
111F8EEA 8B4D B4 mov ecx, dword ptr [ebp-4C]
111F8EED 83C9 04 or ecx, 4
111F8EF0 894D B4 mov dword ptr [ebp-4C], ecx
111F8EF3 EB 11 jmp short 111F8F06
111F8EF5 8B55 B4 mov edx, dword ptr [ebp-4C]
111F8EF8 83CA 03 or edx, 3
111F8EFB 8955 B4 mov dword ptr [ebp-4C], edx
111F8EFE EB 06 jmp short 111F8F06
111F8F00 8B45 B4 mov eax, dword ptr [ebp-4C]
111F8F03 8945 B4 mov dword ptr [ebp-4C], eax
111F8F06 8B4D E0 mov ecx, dword ptr [ebp-20]
111F8F09 898D 7CFFFFFF mov dword ptr [ebp-84], ecx
111F8F0F 83BD 7CFFFFFF 0>cmp dword ptr [ebp-84], 2
111F8F16 74 0B je short 111F8F23
111F8F18 83BD 7CFFFFFF 0>cmp dword ptr [ebp-84], 3
111F8F1F 74 10 je short 111F8F31
111F8F21 EB 1B jmp short 111F8F3E
111F8F23 8B55 B4 mov edx, dword ptr [ebp-4C]
111F8F26 81CA 00010000 or edx, 100
111F8F2C 8955 B4 mov dword ptr [ebp-4C], edx
111F8F2F EB 13 jmp short 111F8F44
111F8F31 8B45 B4 mov eax, dword ptr [ebp-4C]
111F8F34 0D 00020000 or eax, 200
111F8F39 8945 B4 mov dword ptr [ebp-4C], eax
111F8F3C EB 06 jmp short 111F8F44
111F8F3E 8B4D B4 mov ecx, dword ptr [ebp-4C]
111F8F41 894D B4 mov dword ptr [ebp-4C], ecx
111F8F44 8B55 9C mov edx, dword ptr [ebp-64]
111F8F47 83BA D4000000 0>cmp dword ptr [edx+D4], 0
111F8F4E 74 24 je short 111F8F74
111F8F50 6A 0B push 0B
111F8F52 8B45 9C mov eax, dword ptr [ebp-64]
111F8F55 8B88 D4000000 mov ecx, dword ptr [eax+D4]
111F8F5B 51 push ecx
111F8F5C 8B55 BC mov edx, dword ptr [ebp-44]
111F8F5F 52 push edx
111F8F60 E8 DBE10400 call ob_get_int_field
111F8F65 85C0 test eax, eax
111F8F67 74 0B je short 111F8F74
111F8F69 8B45 B4 mov eax, dword ptr [ebp-4C]
111F8F6C 0D 00001800 or eax, 180000
111F8F71 8945 B4 mov dword ptr [ebp-4C], eax
111F8F74 FF15 9C8D3711 call dword ptr [<&USER32.GetFocus>] ; USER32.GetFocus
111F8F7A 8945 A0 mov dword ptr [ebp-60], eax
111F8F7D 837D A0 00 cmp dword ptr [ebp-60], 0
111F8F81 74 10 je short 111F8F93
第二个断点处：
111F8F83 6A 00 push 0
111F8F85 6A 00 push 0
111F8F87 6A 1F push 1F
111F8F89 8B4D A0 mov ecx, dword ptr [ebp-60]
111F8F8C 51 push ecx
111F8F8D FF15 488E3711 call dword ptr [<&USER32.SendMessageW>; USER32.SendMessageW
111F8F93 FF15 848C3711 call dword ptr [<&USER32.GetCapture>] ; USER32.GetCapture
111F8F99 8945 A4 mov dword ptr [ebp-5C], eax
111F8F9C 837D A4 00 cmp dword ptr [ebp-5C], 0
111F8FA0 74 10 je short 111F8FB2
111F8FA2 6A 00 push 0
111F8FA4 6A 00 push 0
111F8FA6 6A 1F push 1F
111F8FA8 8B55 A4 mov edx, dword ptr [ebp-5C]
111F8FAB 52 push edx
111F8FAC FF15 488E3711 call dword ptr [<&USER32.SendMessageW>; USER32.SendMessageW
111F8FB2 FF15 AC813711 call dword ptr [<&KERNEL32.GetCurrent>; kernel32.GetCurrentThreadId
111F8FB8 8945 F0 mov dword ptr [ebp-10], eax
111F8FBB A1 B0A73E11 mov eax, dword ptr [113EA7B0]
111F8FC0 3B45 F0 cmp eax, dword ptr [ebp-10]
111F8FC3 0F84 A8000000 je 111F9071
111F8FC9 FF15 848C3711 call dword ptr [<&USER32.GetCapture>] ; USER32.GetCapture
111F8FCF 85C0 test eax, eax
111F8FD1 0F85 9A000000 jnz 111F9071
111F8FD7 8B4D F0 mov ecx, dword ptr [ebp-10]
111F8FDA 890D B0A73E11 mov dword ptr [113EA7B0], ecx
111F8FE0 6A 01 push 1
111F8FE2 6A 12 push 12
111F8FE4 6A 12 push 12
111F8FE6 6A 00 push 0
111F8FE8 8D55 C0 lea edx, dword ptr [ebp-40]
111F8FEB 52 push edx
111F8FEC FF15 B08D3711 call dword ptr [<&USER32.PeekMessageW>; USER32.PeekMessageW
111F8FF2 8945 F4 mov dword ptr [ebp-C], eax
111F8FF5 8B45 9C mov eax, dword ptr [ebp-64]
111F8FF8 8B48 38 mov ecx, dword ptr [eax+38]
111F8FFB 894D AC mov dword ptr [ebp-54], ecx
111F8FFE 8B55 AC mov edx, dword ptr [ebp-54]
111F9001 52 push edx
111F9002 FF15 3C8E3711 call dword ptr [<&USER32.IsWindow>] ; USER32.IsWindow
111F9008 85C0 test eax, eax
111F900A 74 0E je short 111F901A
111F900C 8B45 AC mov eax, dword ptr [ebp-54]
111F900F 50 push eax
111F9010 FF15 F48B3711 call dword ptr [<&USER32.IsWindowVisi>; USER32.IsWindowVisible
111F9016 85C0 test eax, eax
111F9018 75 07 jnz short 111F9021
111F901A C745 AC 0000000>mov dword ptr [ebp-54], 0
111F9021 8B4D 9C mov ecx, dword ptr [ebp-64]
111F9024 8379 14 00 cmp dword ptr [ecx+14], 0
111F9028 75 07 jnz short 111F9031
111F902A C745 AC 0000000>mov dword ptr [ebp-54], 0
111F9031 8B55 B4 mov edx, dword ptr [ebp-4C]
111F9034 52 push edx
111F9035 8B45 98 mov eax, dword ptr [ebp-68]
111F9038 50 push eax
111F9039 8B4D DC mov ecx, dword ptr [ebp-24]
111F903C 51 push ecx
111F903D 8B55 AC mov edx, dword ptr [ebp-54]
111F9040 52 push edx
111F9041 FF15 908E3711 call dword ptr [<&USER32.MessageBoxW>>; USER32.MessageBoxW
111F9047 8945 A8 mov dword ptr [ebp-58], eax
111F904A 837D F4 00 cmp dword ptr [ebp-C], 0
111F904E 74 15 je short 111F9065
111F9050 8B45 08 mov eax, dword ptr [ebp+8]
111F9053 50 push eax
111F9054 6A 00 push 0
111F9056 6A 12 push 12
111F9058 FF15 AC813711 call dword ptr [<&KERNEL32.GetCurrent>; kernel32.GetCurrentThreadId
111F905E 50 push eax
111F905F FF15 6C8C3711 call dword ptr [<&USER32.PostThreadMe>; USER32.PostThreadMessageW
111F9065 C705 B0A73E11 0>mov dword ptr [113EA7B0], 0
111F906F EB 07 jmp short 111F9078
111F9071 C745 A8 FFFFFFF>mov dword ptr [ebp-58], -1
111F9078 C745 F8 0100000>mov dword ptr [ebp-8], 1
111F907F 8B4D A8 mov ecx, dword ptr [ebp-58]
111F9082 898D 78FFFFFF mov dword ptr [ebp-88], ecx
111F9088 8B95 78FFFFFF mov edx, dword ptr [ebp-88]
111F908E 83C2 01 add edx, 1
111F9091 8995 78FFFFFF mov dword ptr [ebp-88], edx
111F9097 83BD 78FFFFFF 0>cmp dword ptr [ebp-88], 8
111F909E 77 53 ja short 111F90F3
111F90A0 8B85 78FFFFFF mov eax, dword ptr [ebp-88]
111F90A6 FF2485 B4911F11 jmp dword ptr [eax*4+111F91B4]
111F90AD 837D 90 01 cmp dword ptr [ebp-70], 1
111F90B1 74 06 je short 111F90B9
111F90B3 837D 90 02 cmp dword ptr [ebp-70], 2
111F90B7 75 09 jnz short 111F90C2
111F90B9 C745 F8 0200000>mov dword ptr [ebp-8], 2
111F90C0 EB 07 jmp short 111F90C9
111F90C2 C745 F8 0300000>mov dword ptr [ebp-8], 3
111F90C9 EB 28 jmp short 111F90F3
111F90CB 837D 90 03 cmp dword ptr [ebp-70], 3
111F90CF 75 07 jnz short 111F90D8
111F90D1 C745 F8 0200000>mov dword ptr [ebp-8], 2
111F90D8 EB 19 jmp short 111F90F3
111F90DA C745 F8 0300000>mov dword ptr [ebp-8], 3
111F90E1 EB 10 jmp short 111F90F3
111F90E3 C745 F8 0200000>mov dword ptr [ebp-8], 2
111F90EA EB 07 jmp short 111F90F3
111F90EC C745 F8 FFFFFFF>mov dword ptr [ebp-8], -1
111F90F3 837D 98 00 cmp dword ptr [ebp-68], 0
111F90F7 74 10 je short 111F9109
111F90F9 8B4D 98 mov ecx, dword ptr [ebp-68]
111F90FC 51 push ecx
111F90FD 8B55 08 mov edx, dword ptr [ebp+8]
111F9100 8B42 10 mov eax, dword ptr [edx+10]
111F9103 50 push eax
111F9104 E8 FF2C1600 call <jmp.&PBSHR100.#6_pbstg_fee>
111F9109 837D DC 00 cmp dword ptr [ebp-24], 0
111F910D 74 10 je short 111F911F
111F910F 8B4D DC mov ecx, dword ptr [ebp-24]
111F9112 51 push ecx
111F9113 8B55 08 mov edx, dword ptr [ebp+8]
111F9116 8B42 10 mov eax, dword ptr [edx+10]
111F9119 50 push eax
111F911A E8 E92C1600 call <jmp.&PBSHR100.#6_pbstg_fee>
111F911F 66:8B4D F8 mov cx, word ptr [ebp-8]
111F9123 66:894D 88 mov word ptr [ebp-78], cx
111F9127 66:C745 8C 0005 mov word ptr [ebp-74], 500
111F912D 66:C745 8E 0100 mov word ptr [ebp-72], 1
111F9133 837D B0 00 cmp dword ptr [ebp-50], 0
111F9137 75 24 jnz short 111F915D
111F9139 837D FC 00 cmp dword ptr [ebp-4], 0
111F913D 75 1E jnz short 111F915D
111F913F 837D EC 00 cmp dword ptr [ebp-14], 0
111F9143 75 18 jnz short 111F915D
111F9145 837D 94 00 cmp dword ptr [ebp-6C], 0
111F9149 75 12 jnz short 111F915D
111F914B 837D E8 00 cmp dword ptr [ebp-18], 0
111F914F 75 0C jnz short 111F915D
111F9151 C785 74FFFFFF 0>mov dword ptr [ebp-8C], 0
111F915B EB 0A jmp short 111F9167
111F915D C785 74FFFFFF 0>mov dword ptr [ebp-8C], 1
111F9167 0FB755 8C movzx edx, word ptr [ebp-74]
111F916B 83E2 FE and edx, FFFFFFFE
111F916E 0B95 74FFFFFF or edx, dword ptr [ebp-8C]
111F9174 66:8955 8C mov word ptr [ebp-74], dx
111F9178 8D45 88 lea eax, dword ptr [ebp-78]
111F917B 50 push eax
111F917C 8B4D BC mov ecx, dword ptr [ebp-44]
111F917F 51 push ecx
111F9180 E8 BB630C00 call ot_set_return_val
111F9185 B8 01000000 mov eax, 1
111F918A 8BE5 mov esp, ebp
111F918C 5D pop ebp
111F918D C2 0800 retn 8
111F9190 ^ 7E 8E jle short 111F9120
111F9192 1F pop ds
111F9193 1189 8E1F1194 adc dword ptr [ecx+94111F8E], ecx
111F9199 8E1F mov ds, word ptr [edi]
111F919B 119F 8E1F11C9 adc dword ptr [edi+C9111F8E], ebx
111F91A1 8E1F mov ds, word ptr [edi]
111F91A3 11D4 adc esp, edx
111F91A5 8E1F mov ds, word ptr [edi]
111F91A7 11DF adc edi, ebx
111F91A9 8E1F mov ds, word ptr [edi]
111F91AB 11EA adc edx, ebp
111F91AD 8E1F mov ds, word ptr [edi]
111F91AF 11F5 adc ebp, esi
111F91B1 8E1F mov ds, word ptr [edi]
111F91B3 11EC adc esp, ebp
111F91B5 90 nop
111F91B6 1F pop ds
111F91B7 11F3 adc ebx, esi
111F91B9 90 nop
111F91BA 1F pop ds
111F91BB 11F3 adc ebx, esi
......
......
[课程]Android-CTF解题方法汇总！
