| 【聲明】:純屬技術交流 【工具】:OllyDbg PEiD無法知道他是什么殼,暈倒,試試吧。 fi查出的是ACProtect 這殼不好脫。唉,菜鳥啊。今天不脫殼破解 用OD載入,運行軟件,能運行了,OK,因為軟件注冊的時候會給出明顯的注冊碼錯誤字樣。 不過有時候是找不到的,我也不清楚是什么原因。 用OD的插件找字符串,能找,注冊碼錯誤之類的東東。 【1載入】到 00495B44 >? 60?????????? pushad 00495B45??? E8 00000000? call My_Video.00495B4A? //這用ESP,hr 12ffa4,然后F9 00495B4A??? 5B?????????? pop ebx 00495B4B??? 8D5B C6????? lea ebx,dword ptr ds:[ebx-3A] 00495B4E??? 011B???????? add dword ptr ds:[ebx],ebx 00495B50??? 8B13???????? mov edx,dword ptr ds:[ebx] 00495B52??? 8D73 14????? lea esi,dword ptr ds:[ebx+14] 00495B55??? 6A 08??????? push 8 到 00495CA6? ^/E9 99FEFFFF? jmp My_Video.<ModuleEntryPoint> 00495CAB??? 55?????????? push ebp 00495CAC??? 8BEC???????? mov ebp,esp 00495CAE??? 83EC 30????? sub esp,30 00495CB1??? 33C0???????? xor eax,eax 不管他。 再F9,到 00495CA6? ^/E9 99FEFFFF? jmp My_Video.<ModuleEntryPoint> 00495CAB??? 55?????????? push ebp 00495CAC??? 8BEC???????? mov ebp,esp 00495CAE??? 83EC 30????? sub esp,30 00495CB1??? 33C0???????? xor eax,eax 然后刪除硬件斷點。 再F9,程序運行起來了。 就是要讓他運行起來。 查找字符串,無效注冊名或注冊碼 Ultra String Reference,項目 366 ?Address=0040747C ?Disassembly=push My_Video.0041B2C4 ?Text String=無效注冊名或注冊碼
0040736B??? 51?????????? push ecx 0040736C??? 52?????????? push edx 0040736D??? FFD0???????? call eax 0040736F??? 83C4 08????? add esp,8 00407372??? 56?????????? push esi 00407373??? FF15 B050410>call dword ptr ds:[4150B0]????????????????????? ; My_Video.00458480 00407379??? 8D8424 88000>lea eax,dword ptr ss:[esp+88] 00407380??? 8D4C24 48??? lea ecx,dword ptr ss:[esp+48] 00407384??? 50?????????? push eax 00407385??? 51?????????? push ecx 00407386??? E8 65DFFFFF? call My_Video.004052F0 0040738B??? 83C4 08????? add esp,8 0040738E??? 85C0???????? test eax,eax 00407390??? 0F85 DF00000>jnz My_Video.00407475?????????????????????????? ; 跳轉的地方 00407396??? 8A4C04 08??? mov cl,byte ptr ss:[esp+eax+8] 0040739A??? 8888 80CB410>mov byte ptr ds:[eax+41CB80],cl 004073A0??? 40?????????? inc eax 004073A1??? 84C9???????? test cl,cl 004073A3? ^ 75 F1??????? jnz short My_Video.00407396 004073A5??? 33C0???????? xor eax,eax 004073A7??? 8A4C04 48??? mov cl,byte ptr ss:[esp+eax+48] 004073AB??? 8888 D0C3410>mov byte ptr ds:[eax+41C3D0],cl 004073B1??? 40?????????? inc eax 004073B2??? 84C9???????? test cl,cl 004073B4? ^ 75 F1??????? jnz short My_Video.004073A7 004073B6??? C705 34CF410>mov dword ptr ds:[41CF34],1 004073C0??? 8B53 64????? mov edx,dword ptr ds:[ebx+64] 004073C3??? 57?????????? push edi 004073C4??? 52?????????? push edx 004073C5??? 8D8424 D0010>lea eax,dword ptr ss:[esp+1D0] 004073CC??? 68 00B34100? push My_Video.0041B300 004073D1??? 50?????????? push eax 004073D2??? FF15 9855410>call dword ptr ds:[415598]????????????????????? ; msvcrt.sprintf 004073D8??? 83C4 0C????? add esp,0C 004073DB??? 8D8C24 CC010>lea ecx,dword ptr ss:[esp+1CC] 004073E2??? 6A 40??????? push 40 004073E4??? 68 F4B24100? push My_Video.0041B2F4 004073E9??? 51?????????? push ecx 004073EA??? 8BCB???????? mov ecx,ebx 004073EC??? E8 6FBC0000? call My_Video.00413060????????????????????????? ; jmp to MFC42.#4224 004073F1??? 8D9424 CC000>lea edx,dword ptr ss:[esp+CC] 004073F8??? 52?????????? push edx 004073F9??? E8 22C3FFFF? call My_Video.00403720 004073FE??? 8DBC24 D0000>lea edi,dword ptr ss:[esp+D0] 00407405??? 83C9 FF????? or ecx,FFFFFFFF 00407408??? 33C0???????? xor eax,eax 0040740A??? 83C4 04????? add esp,4 0040740D??? F2:AE??????? repne scas byte ptr es:[edi] 0040740F??? BA E0A84100? mov edx,My_Video.0041A8E0?????????????????????? ; ASCII "option.ini" 00407414??? 8D8424 CC000>lea eax,dword ptr ss:[esp+CC] 0040741B??? F7D1???????? not ecx 0040741D??? 49?????????? dec ecx 0040741E??? 2BC2???????? sub eax,edx 00407420??? 03C8???????? add ecx,eax 00407422??? 5F?????????? pop edi 00407423??? 8A02???????? mov al,byte ptr ds:[edx] 00407425??? 880411?????? mov byte ptr ds:[ecx+edx],al 00407428??? 42?????????? inc edx 00407429??? 84C0???????? test al,al 0040742B? ^ 75 F6??????? jnz short My_Video.00407423 0040742D??? 8B35 C050410>mov esi,dword ptr ds:[4150C0]?????????????????? ; kernel32.WritePrivateProfileStringA 00407433??? 8D8C24 C8000>lea ecx,dword ptr ss:[esp+C8] 0040743A??? 51?????????? push ecx 0040743B??? 68 80CB4100? push My_Video.0041CB80????????????????????????? ; ASCII "qingye" 00407440??? 68 04A54100? push My_Video.0041A504????????????????????????? ; ASCII "User name" 00407445??? 68 34A24100? push My_Video.0041A234 0040744A??? FFD6???????? call esi 0040744C??? 8D9424 C8000>lea edx,dword ptr ss:[esp+C8] 00407453??? 52?????????? push edx 00407454??? 68 D0C34100? push My_Video.0041C3D0????????????????????????? ; ASCII "902AA1CC" 00407459??? 68 F0A44100? push My_Video.0041A4F0????????????????????????? ; ASCII "Registration code" 0040745E??? 68 34A24100? push My_Video.0041A234 00407463??? FFD6???????? call esi 00407465??? 8BCB???????? mov ecx,ebx 00407467??? E8 80BA0000? call My_Video.00412EEC????????????????????????? ; jmp to MFC42.#4853 0040746C??? 5E?????????? pop esi 0040746D??? 5B?????????? pop ebx 0040746E??? 81C4 C002000>add esp,2C0 00407474??? C3?????????? retn 00407475??? 6A 40??????? push 40 00407477??? 68 ECB24100? push My_Video.0041B2EC 0040747C??? 68 C4B24100? push My_Video.0041B2C4????????????????????????? ; 無效注冊名注冊碼 00407481??? 8BCB???????? mov ecx,ebx 00407483??? C705 34CF410>mov dword ptr ds:[41CF34],0 0040748D??? E8 CEBB0000? call My_Video.00413060????????????????????????? ; jmp to MFC42.#4224 00407492??? 5E?????????? pop esi 在00407390?上面找個地方下斷點。 然后點輸入用戶名注冊碼,點注冊碼,單步,應該能找到注冊碼 00407373??? FF15 B050410>call dword ptr ds:[4150B0]????????????????????? ; 讀取注冊碼的地方 就著,注冊碼出現在寄存器窗口。 附個內存注冊機 下載 MyVideoConverter V1.40 漢化版 |