家庭电脑相册制作系统 V6.0 标准版 算法分析
-
软件简介:
=======================================================================
家庭电脑相册制作系统 V6.0 标准版
软件大小： 956 KB
软件语言： 简体中文
软件类别： 国产软件 / 共享版 / 图像管理
应用平台： Win9x/NT/2000/XP
界面预览： 无
加入时间： 2003-04-29 17:06:20
下载次数： 30429
推荐等级：
联 系 人： kmr@163.net
开 发 商： http://www.jcok.com/
软件介绍：
本软件是为家庭电脑用户搜集图片和珍藏摄影照片而专门开发的应用工具软件。该软件易学易用，其制作的多媒体电脑相册具有图片检索、自动播放和音乐欣赏等多种功能，并能脱离原制作系统独立运行。将生成的相册刻录成光盘，更可永久收藏。当然，你也可以配合其它软件，制作出游戏画面集锦、风景名胜集锦、百科知识宝典、明星集锦和毕业纪念册等多媒体光盘。企事业单位也可以利用它收藏管理图片档案资料。十分钟成为电脑相册制作大师已不是梦想。
下载地址：
http://tjdown.skycn.com/down/dnxcbz60_setup.exe
==================================================================================
软件限制:对图片编辑数量限制.
==================================================================================
破解工具:
屠龙刀==trw2000 照妖镜==Fi2.5 降妖锤==Aspackdie14 修理工==Hiew
风云大使==W32Dasm
=======================================================================
破解过程:
1.先用照妖镜(Fi2.5)对主程序照照看看有没有妖怪,结果发现为一小妖(ASPACK2.12),拿出降妖锤(Aspackdie14)立刻把它降服.再察看,原形现出来了,原来是Delphi,大家都喜欢的程序.上一版本的
为VB程序,这次连作者都不喜欢用VB了.我等的福音啊.
2.运行程序,添入注册号(不点确定),抽出屠龙刀,大家眼睁睁的看着我向一只小羊.......(想象吧)
下万能断点回到程序,点注册拦截,下命令BD ,Pmodule ,f12 n次竟然没找到心脏,好厉害的小羊.
3.只好请出风云大使(W32Dasm),乌云密布之后,终于看到了晴天.找到了关键部位请看以下内容.
下断点bpx 4a51e7,拦截如下:
序列号:B645350798132
输入第一个注册框：88888888
输入第二个注册框：11111111
================================================================================
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A51E5(C)
|
:004A51E0 6A00 push 00000000
:004A51E2 6A00 push 00000000
:004A51E4 49 dec ecx
:004A51E5 75F9 jne 004A51E0
:004A51E7 51 push ecx
:004A51E8 53 push ebx
:004A51E9 8BD8 mov ebx, eax
:004A51EB 33C0 xor eax, eax
:004A51ED 55 push ebp
:004A51EE 6834554A00 push 004A5534
:004A51F3 64FF30 push dword ptr fs:[eax]
:004A51F6 648920 mov dword ptr fs:[eax], esp
:004A51F9 8D957CFEFFFF lea edx, dword ptr [ebp+FFFFFE7C]
:004A51FF 8B8318070000 mov eax, dword ptr [ebx+00000718]
:004A5205 E8BEA0F9FF call 0043F2C8
:004A520A 8B857CFEFFFF mov eax, dword ptr [ebp+FFFFFE7C]
============看到输入的88888888==================================
:004A5210 8D9580FEFFFF lea edx, dword ptr [ebp+FFFFFE80]
:004A5216 E88138F6FF call 00408A9C
:004A521B 8B8580FEFFFF mov eax, dword ptr [ebp+FFFFFE80]
============看到输入的88888888==================================
:004A5221 50 push eax
:004A5222 8D9574FEFFFF lea edx, dword ptr [ebp+FFFFFE74]
:004A5228 8B83FC060000 mov eax, dword ptr [ebx+000006FC]
:004A522E E895A0F9FF call 0043F2C8
:004A5233 8B8574FEFFFF mov eax, dword ptr [ebp+FFFFFE74]
==================序列号:B645350798132========================
:004A5239 8D9578FEFFFF lea edx, dword ptr [ebp+FFFFFE78]
:004A523F E85838F6FF call 00408A9C
:004A5244 8B8578FEFFFF mov eax, dword ptr [ebp+FFFFFE78]
==================序列号:B645350798132========================
:004A524A 8D4DF8 lea ecx, dword ptr [ebp-08]
:004A524D 5A pop edx
:004A524E E84122FFFF call 00497494
:004A5253 8D956CFEFFFF lea edx, dword ptr [ebp+FFFFFE6C]
:004A5259 8B831C070000 mov eax, dword ptr [ebx+0000071C]
:004A525F E864A0F9FF call 0043F2C8
:004A5264 8B856CFEFFFF mov eax, dword ptr [ebp+FFFFFE6C]
==================看到输入的11111111===============================
:004A526A 8D9570FEFFFF lea edx, dword ptr [ebp+FFFFFE70]
:004A5270 E82738F6FF call 00408A9C
:004A5275 8B8570FEFFFF mov eax, dword ptr [ebp+FFFFFE70]
==================看到输入的11111111===============================
:004A527B 50 push eax
:004A527C 8D9568FEFFFF lea edx, dword ptr [ebp+FFFFFE68]
:004A5282 8B45F8 mov eax, dword ptr [ebp-08]
========到这里就可以看到正确的注册码了,添入第二个注册框就可以成功注册===
=========第一个相当于你输入的用户名,但必须为数字,是参与运算的===========
:004A5285 E81238F6FF call 00408A9C
:004A528A 8B9568FEFFFF mov edx, dword ptr [ebp+FFFFFE68]
=========这里也可以看到正确的注册码==================================
:004A5290 58 pop eax
:004A5291 E822F8F5FF call 00404AB8
:004A5296 0F85A8010000 jne 004A5444
===---------------关键跳转,打断腿,看他还敢跳!!!!!!------------==========
:004A529C 8D9560FEFFFF lea edx, dword ptr [ebp+FFFFFE60]
:004A52A2 A19C9B4A00 mov eax, dword ptr [004A9B9C]
:004A52A7 8B00 mov eax, dword ptr [eax]
:004A52A9 E82AA4FBFF call 0045F6D8
:004A52AE 8B8560FEFFFF mov eax, dword ptr [ebp+FFFFFE60]
:004A52B4 8D9564FEFFFF lea edx, dword ptr [ebp+FFFFFE64]
:004A52BA E81D3FF6FF call 004091DC
:004A52BF 8B8564FEFFFF mov eax, dword ptr [ebp+FFFFFE64]
:004A52C5 8D55FC lea edx, dword ptr [ebp-04]
:004A52C8 E8CF37F6FF call 00408A9C
:004A52CD 8D855CFEFFFF lea eax, dword ptr [ebp+FFFFFE5C]
* Possible StringData Ref from Code Obj ->"data3"
============注册信息写入data3文件中========================== |
:004A52D3 B94C554A00 mov ecx, 004A554C
:004A52D8 8B55FC mov edx, dword ptr [ebp-04]
:004A52DB E8E0F6F5FF call 004049C0
:004A52E0 8B955CFEFFFF mov edx, dword ptr [ebp+FFFFFE5C]
:004A52E6 8D8584FEFFFF lea eax, dword ptr [ebp+FFFFFE84]
:004A52EC E8C3DAF5FF call 00402DB4
:004A52F1 BA25000000 mov edx, 00000025
:004A52F6 8D8584FEFFFF lea eax, dword ptr [ebp+FFFFFE84]
:004A52FC E8FBDEF5FF call 004031FC
:004A5301 E886D5F5FF call 0040288C
:004A5306 8D9554FDFFFF lea edx, dword ptr [ebp+FFFFFD54]
:004A530C 8B83FC060000 mov eax, dword ptr [ebx+000006FC]
:004A5312 E8B19FF9FF call 0043F2C8
:004A5317 8B8554FDFFFF mov eax, dword ptr [ebp+FFFFFD54]
:004A531D 8D9558FDFFFF lea edx, dword ptr [ebp+FFFFFD58]
:004A5323 E87437F6FF call 00408A9C
:004A5328 8B9558FDFFFF mov edx, dword ptr [ebp+FFFFFD58]
:004A532E 8D855CFDFFFF lea eax, dword ptr [ebp+FFFFFD5C]
:004A5334 B9FF000000 mov ecx, 000000FF
:004A5339 E812F6F5FF call 00404950
:004A533E 8D955CFDFFFF lea edx, dword ptr [ebp+FFFFFD5C]
:004A5344 8D45D3 lea eax, dword ptr [ebp-2D]
:004A5347 B10D mov cl, 0D
:004A5349 E8C2DBF5FF call 00402F10
:004A534E 8D954CFDFFFF lea edx, dword ptr [ebp+FFFFFD4C]
:004A5354 8B8318070000 mov eax, dword ptr [ebx+00000718]
:004A535A E8699FF9FF call 0043F2C8
:004A535F 8B854CFDFFFF mov eax, dword ptr [ebp+FFFFFD4C]
:004A5365 8D9550FDFFFF lea edx, dword ptr [ebp+FFFFFD50]
:004A536B E82C37F6FF call 00408A9C
:004A5370 8B9550FDFFFF mov edx, dword ptr [ebp+FFFFFD50]
:004A5376 8D855CFDFFFF lea eax, dword ptr [ebp+FFFFFD5C]
:004A537C B9FF000000 mov ecx, 000000FF
:004A5381 E8CAF5F5FF call 00404950
:004A5386 8D955CFDFFFF lea edx, dword ptr [ebp+FFFFFD5C]
:004A538C 8D45E1 lea eax, dword ptr [ebp-1F]
:004A538F B109 mov cl, 09
:004A5391 E87ADBF5FF call 00402F10
:004A5396 8D9544FDFFFF lea edx, dword ptr [ebp+FFFFFD44]
:004A539C 8B831C070000 mov eax, dword ptr [ebx+0000071C]
:004A53A2 E8219FF9FF call 0043F2C8
:004A53A7 8B8544FDFFFF mov eax, dword ptr [ebp+FFFFFD44]
:004A53AD 8D9548FDFFFF lea edx, dword ptr [ebp+FFFFFD48]
:004A53B3 E8E436F6FF call 00408A9C
:004A53B8 8B9548FDFFFF mov edx, dword ptr [ebp+FFFFFD48]
:004A53BE 8D855CFDFFFF lea eax, dword ptr [ebp+FFFFFD5C]
:004A53C4 B9FF000000 mov ecx, 000000FF
:004A53C9 E882F5F5FF call 00404950
:004A53CE 8D955CFDFFFF lea edx, dword ptr [ebp+FFFFFD5C]
:004A53D4 8D45EB lea eax, dword ptr [ebp-15]
:004A53D7 B10C mov cl, 0C
:004A53D9 E832DBF5FF call 00402F10
:004A53DE 8D55D3 lea edx, dword ptr [ebp-2D]
:004A53E1 8D8584FEFFFF lea eax, dword ptr [ebp+FFFFFE84]
:004A53E7 E81CDFF5FF call 00403308
:004A53EC E89BD4F5FF call 0040288C
:004A53F1 8D8584FEFFFF lea eax, dword ptr [ebp+FFFFFE84]
:004A53F7 E880DAF5FF call 00402E7C
:004A53FC E88BD4F5FF call 0040288C
:004A5401 33D2 xor edx, edx
:004A5403 8B8318070000 mov eax, dword ptr [ebx+00000718]
:004A5409 8B08 mov ecx, dword ptr [eax]
:004A540B FF5164 call [ecx+64]
:004A540E 33D2 xor edx, edx
:004A5410 8B831C070000 mov eax, dword ptr [ebx+0000071C]
:004A5416 8B08 mov ecx, dword ptr [eax]
:004A5418 FF5164 call [ecx+64]
:004A541B 33D2 xor edx, edx
:004A541D 8B8320070000 mov eax, dword ptr [ebx+00000720]
:004A5423 8B08 mov ecx, dword ptr [eax]
:004A5425 FF5164 call [ecx+64]
* Possible StringData Ref from Code Obj ->"你已注册成功！"
|
:004A5428 BA5C554A00 mov edx, 004A555C
:004A542D 8B8320070000 mov eax, dword ptr [ebx+00000720]
:004A5433 E8C09EF9FF call 0043F2F8
* Possible StringData Ref from Code Obj ->"注册成功，谢谢你对本软件的支持！"
|
:004A5438 B874554A00 mov eax, 004A5574
:004A543D E8A230F9FF call 004384E4
:004A5442 EB41 jmp 004A5485
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A5296(C)
|
:004A5444 B201 mov dl, 01
:004A5446 8B8318070000 mov eax, dword ptr [ebx+00000718]
:004A544C 8B08 mov ecx, dword ptr [eax]
:004A544E FF5164 call [ecx+64]
:004A5451 B201 mov dl, 01
:004A5453 8B831C070000 mov eax, dword ptr [ebx+0000071C]
:004A5459 8B08 mov ecx, dword ptr [eax]
:004A545B FF5164 call [ecx+64]
:004A545E B201 mov dl, 01
:004A5460 8B8320070000 mov eax, dword ptr [ebx+00000720]
:004A5466 8B08 mov ecx, dword ptr [eax]
:004A5468 FF5164 call [ecx+64]
* Possible StringData Ref from Code Obj ->"验证软件注册信息"
|
:004A546B BAA0554A00 mov edx, 004A55A0
:004A5470 8B8320070000 mov eax, dword ptr [ebx+00000720]
:004A5476 E87D9EF9FF call 0043F2F8
* Possible StringData Ref from Code Obj ->"注册失败！"
|
:004A547B B8BC554A00 mov eax, 004A55BC
:004A5480 E85F30F9FF call 004384E4
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A5442(U)
|
:004A5485 33C0 xor eax, eax
:004A5487 5A pop edx
:004A5488 59 pop ecx
:004A5489 59 pop ecx
:004A548A 648910 mov dword ptr fs:[eax], edx
:004A548D 683E554A00 push 004A553E
=================================================================
注册信息:
序列号:B645350798132
输入第一个注册框：88888888
输入第二个注册框：604461264447
注册信息保存在主程序目录下的Data3文件
===========================================================================
KeyMake内存注册机:
中断地址：4A5285 | 中断地址：4A5290
中断次数：1 | 中断次数：1
第一字节：E8 | 第一字节：58
指令长度：5 | 指令长度：1
寄存器方式：EAX | 寄存器方式：EDX 十进制
十进制
==================================================================
受eyou 兄发表的"破解之软件自己显示注册码"启发,我们也让程序自己显示注册码,赶时髦,呵呵!
我们可以观察一下.
只需要把mov eax, 004A55BC修改为mov eax, dword ptr [ebp-08]再加两个90就大工
告成了,于是叫来修理工(Hiew) ,一阵痛快的修理.再运行注册你会发现注册码乖乖出现了.
:004A5282 8B45F8 mov eax, dword ptr [ebp-08]
========到这里就可以看到正确的注册码了,添入第二个注册框就可以成功注册===
=========第一个相当于你输入的用户名,但必须为数字,是参与运算的===========
------------------------------------------------------------------------------
* Possible StringData Ref from Code Obj ->"注册失败！"
|
:004A547B B8BC554A00 mov eax, 004A55BC
:004A5480 E85F30F9FF call 004384E4
================================================================================
总结发言:
1.上次破解的5.1版的破解和写的都不完全,但是斑竹还是把它加"精"了,实在是惭愧.
2.不足之处是没有算法分析,正在学习中.欢迎哪位补充一下.也请大家多多指点.
相关视频
相关阅读 Windows错误代码大全 Windows错误代码查询激活windows有什么用Mac QQ和Windows QQ聊天记录怎么合并 Mac QQ和Windows QQ聊天记录Windows 10自动更新怎么关闭 如何关闭Windows 10自动更新windows 10 rs4快速预览版17017下载错误问题Win10秋季创意者更新16291更新了什么 win10 16291更新内容windows10秋季创意者更新时间 windows10秋季创意者更新内容kb3150513补丁更新了什么 Windows 10补丁kb3150513是什么
- 文章评论
-
热门文章
去除winrar注册框方法
最新文章
比特币病毒怎么破解 比去除winrar注册框方法
华为无线路由器HG522-C破解教程(附超级密码JEB格式文件京东电子书下载和阅读限制破解教UltraISO注册码全集(最新)通过Access破解MSSQL获得数据人气排行 华为无线路由器HG522-C破解教程(附超级密码JEB格式文件京东电子书下载和阅读限制破解教UltraISO注册码全集(最新)qq相册密码破解方法去除winrar注册框方法(适应任何版本)怎么用手机破解收费游戏华为无线猫HG522破解如何给软件脱壳基础教程
查看所有0条评论>>