源程序如下：
005612F8 /. 55 PUSH EBP
005612F9 |. 8BEC MOV EBP,ESP
005612FB |. B9 07000000 MOV ECX,7
00561300 |> 6A 00 /PUSH 0
00561302 |. 6A 00 |PUSH 0
00561304 |. 49 |DEC ECX
00561305 ^ 75 F9 JNZ SHORT 0.00561300 ；这里没有改
00561307 |. 51 PUSH ECX
00561308 |. 53 PUSH EBX
00561309 |. 56 PUSH ESI
0056130A |. 57 PUSH EDI
0056130B |. 8BD8 MOV EBX,EAX
0056130D |. 8B3D D8BC5600 MOV EDI,DWORD PTR DS:[56BCD8] ; 0.0056E3CC
00561313 |. 33C0 XOR EAX,EAX
00561315 |. 55 PUSH EBP
00561316 |. 68 C5155600 PUSH 0.005615C5
0056131B |. 64:FF30 PUSH DWORD PTR FS:[EAX]
0056131E |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
00561321 |. 68 E8030000 PUSH 3E8 ; /Timeout = 1000. ms
00561326 |. E8 F1D9EAFF CALL <JMP.&kernel32.Sleep> ; \Sleep
0056132B |. 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
0056132E |. 8B83 18030000 MOV EAX,DWORD PTR DS:[EBX+318]
00561334 |. E8 E342F1FF CALL 0.0047561C
00561339 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
0056133C |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
0056133F |. E8 B07DEAFF CALL 0.004090F4
00561344 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00561347 |. E8 4C33EAFF CALL 0.00404698
0056134C |. 83F8 0C CMP EAX,0C
0056134F 74 1D JE SHORT 0.0056136E 这里改成jmp
00561351 |. 6A 40 PUSH 40
00561353 |. B9 D4155600 MOV ECX,0.005615D4 ; 提示
00561358 |. BA DC155600 MOV EDX,0.005615DC ; 注册码不正确!
0056135D |. A1 98BE5600 MOV EAX,DWORD PTR DS:[56BE98]
00561362 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
00561364 |. E8 8B59F3FF CALL 0.00496CF4
00561369 E9 FD010000 JMP 0.0056156B
0056136E |> 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
00561371 |. 8B83 14030000 MOV EAX,DWORD PTR DS:[EBX+314]
00561377 |. E8 A042F1FF CALL 0.0047561C
0056137C |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
0056137F |. 50 PUSH EAX
00561380 |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
00561382 |. 8B80 EC030000 MOV EAX,DWORD PTR DS:[EAX+3EC]
00561388 |. 8B50 6C MOV EDX,DWORD PTR DS:[EAX+6C]
0056138B |. 8B40 68 MOV EAX,DWORD PTR DS:[EAX+68]
0056138E |. 81F0 C99DCE1F XOR EAX,1FCE9DC9
00561394 |. 81F2 2E000000 XOR EDX,2E
0056139A |. 05 D6000000 ADD EAX,0D6
0056139F |. 83D2 00 ADC EDX,0
005613A2 |. 52 PUSH EDX ; /Arg2
005613A3 |. 50 PUSH EAX ; |Arg1
005613A4 |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10] ; |
005613A7 |. E8 4483EAFF CALL 0.004096F0 ; \0.004096F0
005613AC |. 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10]
005613AF |. 58 POP EAX
005613B0 |. E8 2F34EAFF CALL 0.004047E4
005613B5 0F85 B0010000 JNZ 0.0056156B
005613BB |. B2 01 MOV DL,1
005613BD |. A1 68864400 MOV EAX,DWORD PTR DS:[448668]
005613C2 |. E8 0D74EEFF CALL 0.004487D4
005613C7 |. 8BF0 MOV ESI,EAX
005613C9 |. BA 02000080 MOV EDX,80000002
005613CE |. 8BC6 MOV EAX,ESI
005613D0 |. E8 DB74EEFF CALL 0.004488B0
005613D5 |. 68 F4155600 PUSH 0.005615F4 ; \software\classes\clsid\
005613DA |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
005613DC |. 8B80 EC030000 MOV EAX,DWORD PTR DS:[EAX+3EC]
005613E2 |. FF70 58 PUSH DWORD PTR DS:[EAX+58]
005613E5 |. 68 18165600 PUSH 0.00561618 ; \info
005613EA |. 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
005613ED |. BA 03000000 MOV EDX,3
005613F2 |. E8 6133EAFF CALL 0.00404758
005613F7 |. 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14]
005613FA |. B1 01 MOV CL,1
005613FC |. 8BC6 MOV EAX,ESI
005613FE |. E8 F175EEFF CALL 0.004489F4
00561403 |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
00561405 |. 8B80 EC030000 MOV EAX,DWORD PTR DS:[EAX+3EC]
0056140B |. FF70 6C PUSH DWORD PTR DS:[EAX+6C] ; /Arg2
0056140E |. FF70 68 PUSH DWORD PTR DS:[EAX+68] ; |Arg1
00561411 |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C] ; |
00561414 |. E8 D782EAFF CALL 0.004096F0 ; \0.004096F0
00561419 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
0056141C |. 8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18]
0056141F |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
00561421 |. E8 DE0B0000 CALL 0.00562004
00561426 |. 8B4D E8 MOV ECX,DWORD PTR SS:[EBP-18]
00561429 |. BA 28165600 MOV EDX,0.00561628 ; na
0056142E |. 8BC6 MOV EAX,ESI
00561430 |. E8 3B79EEFF CALL 0.00448D70
00561435 |. 8D55 DC LEA EDX,DWORD PTR SS:[EBP-24]
00561438 |. 8B83 18030000 MOV EAX,DWORD PTR DS:[EBX+318]
0056143E |. E8 D941F1FF CALL 0.0047561C
00561443 |. 8B55 DC MOV EDX,DWORD PTR SS:[EBP-24]
00561446 |. 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
00561449 |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
0056144B |. E8 B40B0000 CALL 0.00562004
00561450 |. 8B4D E0 MOV ECX,DWORD PTR SS:[EBP-20]
00561453 |. BA 34165600 MOV EDX,0.00561634 ; ke
00561458 |. 8BC6 MOV EAX,ESI
0056145A |. E8 1179EEFF CALL 0.00448D70
0056145F |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
00561461 |. 8B80 EC030000 MOV EAX,DWORD PTR DS:[EAX+3EC]
00561467 |. FF70 6C PUSH DWORD PTR DS:[EAX+6C] ; /Arg2
0056146A |. FF70 68 PUSH DWORD PTR DS:[EAX+68] ; |Arg1
0056146D |. 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C] ; |
00561470 |. E8 7B82EAFF CALL 0.004096F0 ; \0.004096F0
00561475 |. 8B55 D4 MOV EDX,DWORD PTR SS:[EBP-2C]
00561478 |. 8D4D D8 LEA ECX,DWORD PTR SS:[EBP-28]
0056147B |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
0056147D |. E8 820B0000 CALL 0.00562004
00561482 |. 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28]
00561485 |. BA 40165600 MOV EDX,0.00561640 ; id
0056148A |. 8BC6 MOV EAX,ESI
0056148C |. E8 DF78EEFF CALL 0.00448D70
00561491 |. 8BC6 MOV EAX,ESI
00561493 |. E8 E873EEFF CALL 0.00448880
00561498 |. 8BC6 MOV EAX,ESI
0056149A |. E8 C920EAFF CALL 0.00403568
0056149F |. 8D55 CC LEA EDX,DWORD PTR SS:[EBP-34]
005614A2 |. 8B83 18030000 MOV EAX,DWORD PTR DS:[EBX+318]
005614A8 |. E8 6F41F1FF CALL 0.0047561C
005614AD |. 8B45 CC MOV EAX,DWORD PTR SS:[EBP-34]
005614B0 |. 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
005614B3 |. E8 3C7CEAFF CALL 0.004090F4
005614B8 |. 8B45 D0 MOV EAX,DWORD PTR SS:[EBP-30]
005614BB |. 50 PUSH EAX
005614BC |. 8D55 C8 LEA EDX,DWORD PTR SS:[EBP-38]
005614BF |. 8B83 14030000 MOV EAX,DWORD PTR DS:[EBX+314]
005614C5 |. E8 5241F1FF CALL 0.0047561C
005614CA |. 8B55 C8 MOV EDX,DWORD PTR SS:[EBP-38]
005614CD |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
005614CF |. 8B80 EC030000 MOV EAX,DWORD PTR DS:[EAX+3EC]
005614D5 |. B9 4C165600 MOV ECX,0.0056164C ; sql decrypt 2000
005614DA |. E8 1DBCFBFF CALL 0.0051D0FC
005614DF |. 84C0 TEST AL,AL
005614E1 75 1A JNZ SHORT 0.005614FD 这里也改成JMP
005614E3 |. 6A 40 PUSH 40
005614E5 |. B9 D4155600 MOV ECX,0.005615D4 ; 提示
005614EA |. BA DC155600 MOV EDX,0.005615DC ; 注册码不正确!
005614EF |. A1 98BE5600 MOV EAX,DWORD PTR DS:[56BE98]
005614F4 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
005614F6 |. E8 F957F3FF CALL 0.00496CF4 这里改成NOP
005614FB |. EB 6E JMP SHORT 0.0056156B
005614FD |> 8B07 MOV EAX,DWORD PTR DS:[EDI]
005614FF |. 8B80 EC030000 MOV EAX,DWORD PTR DS:[EAX+3EC]
00561505 |. E8 A6B8FBFF CALL 0.0051CDB0
0056150A |. 8D55 C4 LEA EDX,DWORD PTR SS:[EBP-3C]
0056150D |. E8 F280EAFF CALL 0.00409604
00561512 |. 8B55 C4 MOV EDX,DWORD PTR SS:[EBP-3C]
00561515 |. 8B83 10030000 MOV EAX,DWORD PTR DS:[EBX+310]
0056151B |. E8 2C41F1FF CALL 0.0047564C
00561520 |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
00561522 |. 8B80 EC030000 MOV EAX,DWORD PTR DS:[EAX+3EC]
00561528 |. E8 C3B8FBFF CALL 0.0051CDF0
0056152D |. 84C0 TEST AL,AL
0056152F 74 2A JE SHORT 0.0056155B 也改成NOP
00561531 |. BA 68165600 MOV EDX,0.00561668 ; 注册
00561536 |. 8B83 08030000 MOV EAX,DWORD PTR DS:[EBX+308]
0056153C |. E8 0B41F1FF CALL 0.0047564C
00561541 |. 6A 40 PUSH 40
00561543 |. B9 D4155600 MOV ECX,0.005615D4 ; 提示
00561548 |. BA 70165600 MOV EDX,0.00561670 ; 注册成功，谢谢您的支持!
0056154D |. A1 98BE5600 MOV EAX,DWORD PTR DS:[56BE98]
00561552 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
00561554 |. E8 9B57F3FF CALL 0.00496CF4
00561559 |. EB 10 JMP SHORT 0.0056156B 这里直接就跳过啦
0056155B |> BA 90165600 MOV EDX,0.00561690 ; 未注册
00561560 |. 8B83 08030000 MOV EAX,DWORD PTR DS:[EBX+308]
00561566 |. E8 E140F1FF CALL 0.0047564C
0056156B |> 33C0 XOR EAX,EAX 跳到这里
保存文件后。注册提示成功.但功能还有限制..真是想不明白啦..请高手指点学习一下.
附件内是源文件!
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
