PCMedik - version 3.9.2.2002 （系统优化） -pc6资讯

您的位置：首页 → 精文荟萃 → 破解文章 → PCMedik - version 3.9.2.2002 （系统优化）

PCMedik - version 3.9.2.2002 （系统优化） 时间：2004/10/15 0:56:00来源：本站整理作者：蓝点我要评论(0)

　
直接用PE-Scan脱壳，用w32dasm反汇编

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A903C(C)--------------------------跟进
|
:004A9087 6A10 push 00000010

* Possible StringData Ref from Code Obj ->"PCMedik Registration"
|
:004A9089 68E4904A00 push 004A90E4

* Possible StringData Ref from Code Obj ->"Sorry Invalid Key File!"
********************
到这儿
:004A903C 7449                   je 004A9087------------jne
:004A903E A1BC8D4C00             mov eax, dword ptr [004C8DBC]
:004A9043 E8708BFBFF             call 00461BB8
:004A9048 A1B0784C00             mov eax, dword ptr [004C78B0]
:004A904D 8B00                   mov eax, dword ptr [eax]
:004A904F 8B8014030000           mov eax, dword ptr [eax+00000314]
:004A9055 E8CEA6F5FF             call 00403728
:004A905A A1B0784C00             mov eax, dword ptr [004C78B0]
:004A905F 8B00                   mov eax, dword ptr [eax]
:004A9061 8B8018030000           mov eax, dword ptr [eax+00000318]
:004A9067 E8BCA6F5FF             call 00403728
:004A906C 6A40                   push 00000040

* Possible StringData Ref from Code Obj ->"PCMedik Registration"
|
:004A906E 68E4904A00 push 004A90E4

* Possible StringData Ref from Code Obj ->"Thank You For Registering PCMedik!"
*****************
:004AC475 E8EA050000             call 004ACA64
:004AC47A 84C0                   test al, al
:004AC47C 0F846C010000           je 004AC5EE----------跳到这儿
:004AC482 6A40                   push 00000040

* Possible StringData Ref from Code Obj ->"PCMedik Registration"
|
:004AC484 68C8C64A00 push 004AC6C8

* Possible StringData Ref from Code Obj ->"Thank You For Registering PCMedik!"

***********
跳到这儿
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004AC47C(C), :004AC4BB(U), :004AC51A(C), :004AC540(U), :004AC59F(C)
|:004AC5C1(U), :004AC5CC(C)------------修改相应跳转（je-jne,jmp不变）
|
:004AC5EE 8BC3                   mov eax, ebx
:004AC5F0 E8D3F1FBFF             call 0046B7C8
:004AC5F5 8BC3                   mov eax, ebx
:004AC5F7 E82C71F5FF             call 00403728
:004AC5FC 33C0                   xor eax, eax
:004AC5FE 5A                     pop edx
:004AC5FF 59                     pop ecx
:004AC600 59                     pop ecx
:004AC601 648910                 mov dword ptr fs:[eax], edx
:004AC604 EB0A                   jmp 004AC610
:004AC606 E9FD75F5FF             jmp 00403C08
:004AC60B E86079F5FF             call 00403F70