这是一款改变桌面壁纸的软件，没注册有功能限制。
破解只为研究。
软件界面做的很美观，很不错。现在我都喜欢直接查找字符串，而不是下断MessageBox，果然找到了如下的代码：
004D38D2 |. E8 ADE4FFFF CALL wrmain.004D1D84
004D38D7 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004D38DA |. 8B80 68030000 MOV EAX,DWORD PTR DS:[EAX+368]
004D38E0 |. BA B8394D00 MOV EDX,wrmain.004D39B8 ; 已注册...
004D38E5 |. E8 FEDAF6FF CALL wrmain.004413E8
004D38EA |. EB 55 JMP SHORT wrmain.004D3941
004D38EC |> 6A 00 PUSH 0
004D38EE |. A1 EC754D00 MOV EAX,DWORD PTR DS:[4D75EC]
004D38F3 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D38F5 |. E8 8E14F3FF CALL wrmain.00404D88
004D38FA |. 8BC8 MOV ECX,EAX
004D38FC |. BA D8394D00 MOV EDX,wrmain.004D39D8 ; 注册码不正确, 请查实.
004D3901 |. A1 D0784D00 MOV EAX,DWORD PTR DS:[4D78D0]
004D3906 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D3908 |. E8 2FDCF8FF CALL wrmain.0046153C
004D390D |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004D3910 |. 8B80 68030000 MOV EAX,DWORD PTR DS:[EAX+368]
004D3916 |. 8B10 MOV EDX,DWORD PTR DS:[EAX]
004D3918 |. FF92 C0000000 CALL DWORD PTR DS:[EDX+C0]
004D391E |. EB 21 JMP SHORT wrmain.004D3941
004D3920 |> 6A 00 PUSH 0
004D3922 |. A1 EC754D00 MOV EAX,DWORD PTR DS:[4D75EC]
004D3927 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D3929 |. E8 5A14F3FF CALL wrmain.00404D88
004D392E |. 8BC8 MOV ECX,EAX
004D3930 |. BA D8394D00 MOV EDX,wrmain.004D39D8 ; 注册码不正确, 请查实.
004D3935 |. A1 D0784D00 MOV EAX,DWORD PTR DS:[4D78D0]
004D393A |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D393C |. E8 FBDBF8FF CALL wrmain.0046153C
004D3941 |> 33C0 XOR EAX,EAX
004D3943 |. 5A POP EDX
004D3944 |. 59 POP ECX
004D3945 |. 59 POP ECX
在这段代码向上，就看到下面的代码，看注释：
004D36E9 |. 53 PUSH EBX
004D36EA |. 56 PUSH ESI
004D36EB |. 57 PUSH EDI
004D36EC |. 33C9 XOR ECX,ECX
004D36EE |. 898D F0FEFFFF MOV DWORD PTR SS:[EBP-110],ECX
004D36F4 |. 898D ECFEFFFF MOV DWORD PTR SS:[EBP-114],ECX
004D36FA |. 898D E8FEFFFF MOV DWORD PTR SS:[EBP-118],ECX
004D3700 |. 894D F4 MOV DWORD PTR SS:[EBP-C],ECX
004D3703 |. 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
004D3706 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
004D3709 |. 33C0 XOR EAX,EAX
004D370B |. 55 PUSH EBP
004D370C |. 68 6F394D00 PUSH wrmain.004D396F
004D3711 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
004D3714 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
004D3717 |. 66:BE 4F04 MOV SI,44F ;注册算法中要用到
004D371B |. 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
004D371E |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004D3721 |. 8B80 68030000 MOV EAX,DWORD PTR DS:[EAX+368]
004D3727 |. E8 8CDCF6FF CALL wrmain.004413B8
004D372C |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
004D372F |. 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
004D3732 |. E8 B956F3FF CALL wrmain.00408DF0
004D3737 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
004D373A |. E8 35E7FFFF CALL wrmain.004D1E74
004D373F |. 84C0 TEST AL,AL
004D3741 |. 74 08 JE SHORT wrmain.004D374B
004D3743 |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
004D3746 |. E8 8D11F3FF CALL wrmain.004048D8
004D374B |> 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
004D374E |. E8 3D14F3FF CALL wrmain.00404B90 ;取注册码长度
004D3753 |. 83F8 0B CMP EAX,0B ;必须大于11
004D3756 |. 0F8E C4010000 JLE wrmain.004D3920
004D375C |. 33DB XOR EBX,EBX
004D375E |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
004D3761 |. E8 2A14F3FF CALL wrmain.00404B90
004D3766 |. 8BD0 MOV EDX,EAX
004D3768 |. 85D2 TEST EDX,EDX
004D376A |. 7E 25 JLE SHORT wrmain.004D3791
004D376C |. B8 01000000 MOV EAX,1 ;以下为注册算法
004D3771 |> 8B4D F8 /MOV ECX,DWORD PTR SS:[EBP-8] ;ecx为假注册码
004D3774 |. 0FB64C01 FF |MOVZX ECX,BYTE PTR DS:[ECX+EAX-1]
004D3779 |. 0FB7FE |MOVZX EDI,SI ;si为44F
004D377C |. C1EF 08 |SHR EDI,8
004D377F |. 33CF |XOR ECX,EDI
004D3781 |. BF 12000000 |MOV EDI,12
004D3786 |. 2BF8 |SUB EDI,EAX
004D3788 |. 0FAFCF |IMUL ECX,EDI
004D378B |. 03D9 |ADD EBX,ECX
004D378D |. 40 |INC EAX
004D378E |. 4A |DEC EDX
004D378F |.^ 75 E0 \JNZ SHORT wrmain.004D3771
004D3791 |> 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
004D3794 |. 0FB640 05 MOVZX EAX,BYTE PTR DS:[EAX+5] ;注册码第六位放入eax
004D3798 |. 6BC0 13 IMUL EAX,EAX,13
004D379B |. 50 PUSH EAX
004D379C |. 8BC3 MOV EAX,EBX
004D379E |. 5A POP EDX
004D379F |. 8BCA MOV ECX,EDX
004D37A1 |. 99 CDQ
004D37A2 |. F7F9 IDIV ECX
004D37A4 85D2 TEST EDX,EDX ;如果edx为0，注册成功
004D37A6 0F85 40010000 JNZ wrmain.004D38EC ；关键跳转
004D37AC |. 6A 00 PUSH 0
004D37AE |. A1 EC754D00 MOV EAX,DWORD PTR DS:[4D75EC]
004D37B3 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D37B5 |. E8 CE15F3FF CALL wrmain.00404D88
004D37BA |. 8BC8 MOV ECX,EAX
004D37BC |. BA 80394D00 MOV EDX,wrmain.004D3980 ; 恭喜您,注册成功! 感谢您的支持!!!
004D37C1 |. A1 D0784D00 MOV EAX,DWORD PTR DS:[4D78D0]
004D37C6 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D37C8 |. E8 6FDDF8FF CALL wrmain.0046153C
注册算法很简单，注册码长度要大于12，下面是注册机：
vc6编译
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#define num 13 //改变他来改变注册码的位数
main()
{
char r[10]="1234567890";
int i,j,b,sum,t;
int a[num]={0};
sum=0;
b=0;
srand(time(0)); //产生随机数种子
do
{
for(i=0;i<num;i++)
{
j=(int)(9*rand()/(RAND_MAX+1.0)) ; //随机数控制在0~9之间
a[i]=r[j];
b++;
sum=sum+(a[i]^4)*(18-b);
}
t=sum%(a[5]*19);
if(!t)
{
for(i=0;i<num;i++)
printf("%c",a[i]);
printf("\n");
break;
}else
{
b=0;
sum=0;
continue;
}
}while(1);
return 0;
}
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
