下载页面：http://gaoasp.nease.net/doc/hzbh.htm
软件大小：538K
运行环境：Windows 9x/NT/2000
【软件简介】：可查找任一汉字或一段汉字的笔画，功能经扩展后可用于教学、娱乐、文字处理等领域，如儿童识字、笔画算命以及需要按笔画排序处理等方面的应用
【软件限制】：NAG
【作者声明】：初学Crack，只是感兴趣，没有其它目的。失误之处敬请诸位大侠赐教！
【破解工具】：TRW2000娃娃修改版、Ollydbg1.09、PEiD、W32Dasm 9.0白金版
—————————————————————————————————
【过 程】：
hzbh.exe 无壳。Visual C++ 6.0 编写。
用户名：FLY
试炼码：13572468
反汇编，根据出错提示很容易就找到核心了。
—————————————————————————————————
:004025B1 E8D60C0000 Call 0040328C
:004025B6 8D442424 lea eax, dword ptr [esp+24]
:004025BA 8D4C2418 lea ecx, dword ptr [esp+18]
:004025BE 50 push eax
:004025BF 51 push ecx
:004025C0 57 push edi
:004025C1 683F000F00 push 000F003F
:004025C6 57 push edi
* Possible StringData Ref from Data Obj ->"REG_SZ"
|
:004025C7 6814CA4000 push 0040CA14
:004025CC 57 push edi
* Possible StringData Ref from Data Obj ->"SOFTWARE\HZBH"
|
:004025CD 6804CA4000 push 0040CA04
:004025D2 6802000080 push 80000002
:004025D7 C644245801 mov [esp+58], 01
:004025DC C7442448FF000000 mov [esp+48], 000000FF
:004025E4 897C2440 mov dword ptr [esp+40], edi
* Reference To: ADVAPI32.RegCreateKeyExA, Ord:015Fh
|
:004025E8 FF1500404000 Call dword ptr [00404000]
:004025EE 3BC7 cmp eax, edi
:004025F0 0F854C010000 jne 00402742
:004025F6 8D542410 lea edx, dword ptr [esp+10]
:004025FA 8BCE mov ecx, esi
:004025FC 52 push edx
:004025FD 68F1030000 push 000003F1
* Reference To: MFC42.Ordinal:0C19, Ord:0C19h
|
:00402602 E8E50C0000 Call 004032EC
:00402607 8D442414 lea eax, dword ptr [esp+14]
:0040260B 8BCE mov ecx, esi
:0040260D 50 push eax
:0040260E 68F2030000 push 000003F2
* Reference To: MFC42.Ordinal:0C19, Ord:0C19h
|
:00402613 E8D40C0000 Call 004032EC
:00402618 8D4C2410 lea ecx, dword ptr [esp+10]
* Reference To: MFC42.Ordinal:188A, Ord:188Ah
|
:0040261C E80D0D0000 Call 0040332E
:00402621 8D4C2410 lea ecx, dword ptr [esp+10]
* Reference To: MFC42.Ordinal:188B, Ord:188Bh
|
:00402625 E8FE0C0000 Call 00403328
:0040262A 8D4C2414 lea ecx, dword ptr [esp+14]
* Reference To: MFC42.Ordinal:188A, Ord:188Ah
|
:0040262E E8FB0C0000 Call 0040332E
:00402633 8D4C2414 lea ecx, dword ptr [esp+14]
* Reference To: MFC42.Ordinal:188B, Ord:188Bh
|
:00402637 E8EC0C0000 Call 00403328
:0040263C 8D4C2410 lea ecx, dword ptr [esp+10]
* Reference To: MFC42.Ordinal:106A, Ord:106Ah
|
:00402640 E8DD0C0000 Call 00403322
====>把用户名转换成小写字母
:00402645 8B4C2410 mov ecx, dword ptr [esp+10]
====>ECX=fly 呵呵，取用户名的小写字母运算
:00402649 8B542414 mov edx, dword ptr [esp+14]
====>EDX=13572468
:0040264D 8B79F8 mov edi, dword ptr [ecx-08]
====>EDI=3 用户名长度
:00402650 8B6AF8 mov ebp, dword ptr [edx-08]
====>EBP=8 试炼码长度
:00402653 47 inc edi
:00402654 8D4C2410 lea ecx, dword ptr [esp+10]
:00402658 57 push edi
:00402659 45 inc ebp
* Reference To: MFC42.Ordinal:0B63, Ord:0B63h
|
:0040265A E8BD0C0000 Call 0040331C
:0040265F 55 push ebp
:00402660 8D4C2418 lea ecx, dword ptr [esp+18]
:00402664 89442424 mov dword ptr [esp+24], eax
* Reference To: MFC42.Ordinal:0B63, Ord:0B63h
|
:00402668 E8AF0C0000 Call 0040331C
:0040266D 8BD8 mov ebx, eax
:0040266F 8D4FFF lea ecx, dword ptr [edi-01]
:00402672 33C0 xor eax, eax
:00402674 895C2428 mov dword ptr [esp+28], ebx
:00402678 85C9 test ecx, ecx
:0040267A 761C jbe 00402698
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402692(C)
|
:0040267C 8B5C2420 mov ebx, dword ptr [esp+20]
====>EBX=[esp+20]=fly
:00402680 33D2 xor edx, edx
:00402682 8A1418 mov dl, byte ptr [eax+ebx]
====>依次取fly字符的HEX值
1、 ====>DL=66
[1] [2] [3] [4] 下一页 |
