[讨论]来一个难点的东东大家练练手-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

最新回复 (7)
iskilo 雪币： 101 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 20 粉丝 0 关注私信	iskilo 2 楼这个软件可能跟SAFENET的开发商软件一样，增加调试检测的东东 2007-7-31 12:40 0
coolcheng 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 2 粉丝 0 关注私信	coolcheng 3 楼那应该怎么办呢?是不是都不能破解啦,这个软件已经有人破解了,只是我不知道他是怎么破解的.我弄了半天都搞不定啊,调试定时候程序界面都打不开.郁闷. 看了很多教程,那些教程都是拿很简单的东东来破解,几乎一两步就搞定,太没意思了. 2007-7-31 13:50 0
冬天的雪雪币： 203 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 49 粉丝 0 关注私信	冬天的雪 4 楼我已经破解完了，不过我是采用爆破的。可以脱壳后，查找关键断点，主要有四个判断的地方。如不清楚，可以加我QQ：747023090 2007-8-3 20:09 0
爱琴海雪币： 1355 活跃值： (344) 能力值： ( LV13，RANK：920 ) 在线值：发帖 74 回帖 660 粉丝 7 关注私信	爱琴海 13 5 楼 name:爱琴海[SCG] sn:837op1n/k/K55=PZ 就这样的软件也要人民币98元一套？人民币贬值了吗？如果急用绿色版本的这个账号先用着。有点郁闷，发现调试分析该软件的注册码怎么会每次都变的。也许现在你们又不能用这个号码了。注册信息保存在自身data目录的后缀名LCG的文件中，嵌入进去了。要重新注册的话只能先删除，或者暂时改名。这里给个内存注册机，解压密码:maple159357 这里只是本次验证部分，还有一部分是放在程序启动的时候 0060BF3B 55 push ebp 0060BF3C 68 1FC16000 push 0060C11F 0060BF41 64:FF30 push dword ptr fs:[eax] 0060BF44 64:8920 mov dword ptr fs:[eax], esp 0060BF47 8B45 F8 mov eax, dword ptr [ebp-8] 0060BF4A E8 D592DFFF call 00405224 ; 获取用户名 0060BF4F 83F8 03 cmp eax, 3 0060BF52 0F8E BD010000 jle 0060C115 ; 不能跳走，拥护名不能小于3位 0060BF58 8B45 F4 mov eax, dword ptr [ebp-C] 0060BF5B E8 C492DFFF call 00405224 ; 获取假注册码 0060BF60 83F8 10 cmp eax, 10 0060BF63 0F85 AC010000 jnz 0060C115 ; 不能跳走，注册码必须为16位 0060BF69 8D4D EC lea ecx, dword ptr [ebp-14] 0060BF6C 8B55 F4 mov edx, dword ptr [ebp-C] 0060BF6F 8B45 F8 mov eax, dword ptr [ebp-8] 0060BF72 E8 1D13F3FF call 0053D294 ; 关键算法。EDX中存有用户名，呵呵，调用程式通缉黑名单，同时是对用户名的变形。看表一 0060BF77 8B55 EC mov edx, dword ptr [ebp-14] ; 估计EDX就是注册码了，可是我看到的都是没有啊，莫非在上个CALL中就根据用户名而定？ 0060BF7A 8B45 F4 mov eax, dword ptr [ebp-C] ; 将假注册码（您输入的）送到EAX 0060BF7D E8 EE93DFFF call 00405370 ; CALL比较啊 0060BF82 0F85 8D010000 jnz 0060C115 ; 算法部分，不能跳走 0060BF88 A1 C4D06C00 mov eax, dword ptr [6CD0C4] 0060BF8D 8B00 mov eax, dword ptr [eax] 0060BF8F 8B80 44030000 mov eax, dword ptr [eax+344] 0060BF95 BA B0C16000 mov edx, 0060C1B0 ; select * from usermsg 0060BF9A E8 75FCF2FF call 0053BC14 0060BF9F 84C0 test al, al 0060BFA1 0F84 6E010000 je 0060C115 ; 不能跳走 0060BFA7 A1 C4D06C00 mov eax, dword ptr [6CD0C4] 0060BFAC 8B00 mov eax, dword ptr [eax] 0060BFAE 8B80 44030000 mov eax, dword ptr [eax+344] 0060BFB4 E8 FB84ECFF call 004D44B4 0060BFB9 8D4D E8 lea ecx, dword ptr [ebp-18] 0060BFBC 8B15 18D46C00 mov edx, dword ptr [6CD418] ; cgzllxp.006CC6D8 0060BFC2 8B12 mov edx, dword ptr [edx] 0060BFC4 8B45 F8 mov eax, dword ptr [ebp-8] 0060BFC7 E8 2CDAF2FF call 005399F8 0060BFCC 8B45 E8 mov eax, dword ptr [ebp-18] 0060BFCF 50 push eax 0060BFD0 A1 C4D06C00 mov eax, dword ptr [6CD0C4] 0060BFD5 8B00 mov eax, dword ptr [eax] 0060BFD7 8B80 44030000 mov eax, dword ptr [eax+344] 0060BFDD BA D0C16000 mov edx, 0060C1D0 ; field3 0060BFE2 E8 0D6DECFF call 004D2CF4 0060BFE7 5A pop edx 0060BFE8 8B08 mov ecx, dword ptr [eax] 0060BFEA FF91 B0000000 call dword ptr [ecx+B0] 0060BFF0 8D4D E4 lea ecx, dword ptr [ebp-1C] 0060BFF3 8B15 18D46C00 mov edx, dword ptr [6CD418] ; cgzllxp.006CC6D8 0060BFF9 8B12 mov edx, dword ptr [edx] 0060BFFB 8B45 F4 mov eax, dword ptr [ebp-C] 0060BFFE E8 F5D9F2FF call 005399F8 0060C003 8B45 E4 mov eax, dword ptr [ebp-1C] 0060C006 50 push eax 0060C007 A1 C4D06C00 mov eax, dword ptr [6CD0C4] 0060C00C 8B00 mov eax, dword ptr [eax] 0060C00E 8B80 44030000 mov eax, dword ptr [eax+344] 0060C014 BA E0C16000 mov edx, 0060C1E0 ; field4 0060C019 E8 D66CECFF call 004D2CF4 0060C01E 5A pop edx 0060C01F 8B08 mov ecx, dword ptr [eax] 0060C021 FF91 B0000000 call dword ptr [ecx+B0] 0060C027 A1 C4D06C00 mov eax, dword ptr [6CD0C4] 0060C02C 8B00 mov eax, dword ptr [eax] 0060C02E 8B80 44030000 mov eax, dword ptr [eax+344] 0060C034 8B10 mov edx, dword ptr [eax] 0060C036 FF92 4C020000 call dword ptr [edx+24C] 0060C03C 8D55 DC lea edx, dword ptr [ebp-24] 0060C03F 8B45 FC mov eax, dword ptr [ebp-4] 0060C042 8B80 30030000 mov eax, dword ptr [eax+330] 0060C048 E8 97B8E7FF call 004878E4 0060C04D 8B45 DC mov eax, dword ptr [ebp-24] 0060C050 8D55 E0 lea edx, dword ptr [ebp-20] 0060C053 E8 28DFDFFF call 00409F80 0060C058 8B55 E0 mov edx, dword ptr [ebp-20] 0060C05B A1 80D86C00 mov eax, dword ptr [6CD880] 0060C060 E8 538FDFFF call 00404FB8 0060C065 8D55 D8 lea edx, dword ptr [ebp-28] 0060C068 8B45 FC mov eax, dword ptr [ebp-4] 0060C06B 8B80 34030000 mov eax, dword ptr [eax+334] 0060C071 E8 6EB8E7FF call 004878E4 0060C076 8B55 D8 mov edx, dword ptr [ebp-28] 0060C079 A1 A4D66C00 mov eax, dword ptr [6CD6A4] 0060C07E E8 358FDFFF call 00404FB8 0060C083 A1 E0D66C00 mov eax, dword ptr [6CD6E0] 0060C088 C600 01 mov byte ptr [eax], 1 0060C08B 6A 30 push 30 0060C08D A1 CCD66C00 mov eax, dword ptr [6CD6CC] 0060C092 8B00 mov eax, dword ptr [eax] 0060C094 E8 8B93DFFF call 00405424 0060C099 50 push eax 0060C09A 68 E8C16000 push 0060C1E8 ; 注册成功！ 0060C09F 8B45 FC mov eax, dword ptr [ebp-4] 0060C0A2 E8 DD21E8FF call 0048E284 0060C0A7 50 push eax 0060C0A8 E8 6FC6DFFF call <jmp.&USER32.MessageBoxA> 0060C0AD 68 FCC16000 push 0060C1FC ; 尊敬的 0060C0B2 A1 80D86C00 mov eax, dword ptr [6CD880] 0060C0B7 FF30 push dword ptr [eax] 0060C0B9 68 0CC26000 push 0060C20C ; ， 0060C0BE A1 CCD66C00 mov eax, dword ptr [6CD6CC] 0060C0C3 FF30 push dword ptr [eax] 0060C0C5 68 18C26000 push 0060C218 ; ，助您成功! 0060C0CA 8D45 D4 lea eax, dword ptr [ebp-2C] 0060C0CD BA 05000000 mov edx, 5 0060C0D2 E8 0D92DFFF call 004052E4 0060C0D7 8B55 D4 mov edx, dword ptr [ebp-2C] 0060C0DA A1 C4D06C00 mov eax, dword ptr [6CD0C4] 0060C0DF 8B00 mov eax, dword ptr [eax] 0060C0E1 E8 2EB8E7FF call 00487914 0060C0E6 A1 4CD16C00 mov eax, dword ptr [6CD14C] 0060C0EB 8B00 mov eax, dword ptr [eax] 0060C0ED 8B40 5C mov eax, dword ptr [eax+5C] 0060C0F0 33D2 xor edx, edx 0060C0F2 E8 216DE3FF call 00442E18 0060C0F7 A1 C4D06C00 mov eax, dword ptr [6CD0C4] 0060C0FC 8B00 mov eax, dword ptr [eax] 0060C0FE E8 D9670900 call 006A28DC 0060C103 8B45 FC mov eax, dword ptr [ebp-4] 0060C106 E8 F994E9FF call 004A5604 0060C10B 33C0 xor eax, eax 0060C10D 5A pop edx 0060C10E 59 pop ecx 0060C10F 59 pop ecx 0060C110 64:8910 mov dword ptr fs:[eax], edx 0060C113 EB 3E jmp short 0060C153 0060C115 33C0 xor eax, eax 0060C117 5A pop edx 0060C118 59 pop ecx 0060C119 59 pop ecx 0060C11A 64:8910 mov dword ptr fs:[eax], edx 0060C11D EB 0A jmp short 0060C129 0060C11F ^ E9 0C84DFFF jmp 00404530 0060C124 E8 3388DFFF call 0040495C 0060C129 6A 30 push 30 0060C12B A1 CCD66C00 mov eax, dword ptr [6CD6CC] 0060C130 8B00 mov eax, dword ptr [eax] 0060C132 E8 ED92DFFF call 00405424 0060C137 50 push eax 0060C138 68 24C26000 push 0060C224 ; 注册失败！ 0060C13D 8B45 FC mov eax, dword ptr [ebp-4] 0060C140 E8 3F21E8FF call 0048E284 0060C145 50 push eax 0060C146 E8 D1C5DFFF call <jmp.&USER32.MessageBoxA> 0060C14B 8B45 FC mov eax, dword ptr [ebp-4] 0060C14E E8 B194E9FF call 004A5604 0060C153 33C0 xor eax, eax 0060C155 5A pop edx 0060C156 59 pop ecx 0060C157 59 pop ecx 表一： 0053D2DD BA 68D65300 mov edx, 0053D668 ; 帅哥 0053D2E2 E8 8980ECFF call 00405370 0053D2E7 0F84 2E030000 je 0053D61B 0053D2ED 8B45 FC mov eax, dword ptr [ebp-4] 0053D2F0 BA 78D65300 mov edx, 0053D678 ; 美女 0053D2F5 E8 7680ECFF call 00405370 0053D2FA 0F84 1B030000 je 0053D61B 0053D300 8B45 FC mov eax, dword ptr [ebp-4] 0053D303 BA 88D65300 mov edx, 0053D688 ; ankty 0053D308 E8 6380ECFF call 00405370 0053D30D 0F84 08030000 je 0053D61B 0053D313 8B45 FC mov eax, dword ptr [ebp-4] 0053D316 BA 98D65300 mov edx, 0053D698 ; 自由之翼软件站 0053D31B E8 5080ECFF call 00405370 0053D320 0F84 F5020000 je 0053D61B 0053D326 8B45 FC mov eax, dword ptr [ebp-4] 0053D329 BA B0D65300 mov edx, 0053D6B0 ; 思吧社区_xxnb 0053D32E E8 3D80ECFF call 00405370 0053D333 0F84 E2020000 je 0053D61B 0053D339 8B45 FC mov eax, dword ptr [ebp-4] 0053D33C BA C8D65300 mov edx, 0053D6C8 ; sfl4800 0053D341 E8 2A80ECFF call 00405370 0053D346 0F84 CF020000 je 0053D61B 0053D34C 8B45 FC mov eax, dword ptr [ebp-4] 0053D34F BA D8D65300 mov edx, 0053D6D8 ; zeror[czg][d.4s][dfcg][bcg] 0053D354 E8 1780ECFF call 00405370 0053D359 0F84 BC020000 je 0053D61B 0053D35F 8B45 FC mov eax, dword ptr [ebp-4] 0053D362 BA FCD65300 mov edx, 0053D6FC ; zeror[czg] 0053D367 E8 0480ECFF call 00405370 0053D36C 0F84 A9020000 je 0053D61B 0053D372 8B45 FC mov eax, dword ptr [ebp-4] 0053D375 BA 10D75300 mov edx, 0053D710 ; 嬴政天下xxnb 0053D37A E8 F17FECFF call 00405370 0053D37F 0F84 96020000 je 0053D61B 0053D385 8B45 FC mov eax, dword ptr [ebp-4] 0053D388 BA 28D75300 mov edx, 0053D728 ; binbinbin 0053D38D E8 DE7FECFF call 00405370 0053D392 0F84 83020000 je 0053D61B 0053D398 8B45 FC mov eax, dword ptr [ebp-4] 0053D39B BA 3CD75300 mov edx, 0053D73C ; greendown 0053D3A0 E8 CB7FECFF call 00405370 0053D3A5 0F84 70020000 je 0053D61B 0053D3AB 8B45 FC mov eax, dword ptr [ebp-4] 0053D3AE BA 50D75300 mov edx, 0053D750 ; lvgusoft 0053D3B3 E8 B87FECFF call 00405370 0053D3B8 0F84 5D020000 je 0053D61B 0053D3BE 8B45 FC mov eax, dword ptr [ebp-4] 0053D3C1 BA 64D75300 mov edx, 0053D764 ; sfl4800[d.4s] 0053D3C6 E8 A57FECFF call 00405370 0053D3CB 0F84 4A020000 je 0053D61B 0053D3D1 8B45 FC mov eax, dword ptr [ebp-4] 0053D3D4 BA 7CD75300 mov edx, 0053D77C ; wuhanqi 0053D3D9 E8 927FECFF call 00405370 0053D3DE 0F84 37020000 je 0053D61B 0053D3E4 8B45 FC mov eax, dword ptr [ebp-4] 0053D3E7 BA 8CD75300 mov edx, 0053D78C ; 庆贺id恢复 0053D3EC E8 7F7FECFF call 00405370 0053D3F1 0F84 24020000 je 0053D61B 0053D3F7 8D45 D8 lea eax, dword ptr [ebp-28] 0053D3FA E8 657BECFF call 00404F64 0053D3FF 8D45 EC lea eax, dword ptr [ebp-14] 0053D402 BA A0D75300 mov edx, 0053D7A0 ; 1^cgsxy- 0053D40F 8B55 FC mov edx, dword ptr [ebp-4] ; 送用户名 0053D412 8B45 EC mov eax, dword ptr [ebp-14] ; 这个特殊字符 0053D415 E8 6EC1FFFF call 00539588 0053D41A 8B55 94 mov edx, dword ptr [ebp-6C] 0053D41D 8D45 EC lea eax, dword ptr [ebp-14] 0053D420 E8 D77BECFF call 00404FFC 0053D425 8D45 F0 lea eax, dword ptr [ebp-10] 0053D428 8B55 FC mov edx, dword ptr [ebp-4] 0053D42B E8 CC7BECFF call 00404FFC 0053D430 8B45 F0 mov eax, dword ptr [ebp-10] 0053D433 E8 EC7DECFF call 00405224 ; 取用户名长度 0053D438 8BF8 mov edi, eax 0053D43A 8B45 FC mov eax, dword ptr [ebp-4] ; 取用户名 0053D43D E8 E27DECFF call 00405224 0053D442 83F8 04 cmp eax, 4 0053D445 7D 0D jge short 0053D454 ; 大于等于4位即OK了 0053D447 8B45 F4 mov eax, dword ptr [ebp-C] 0053D44A E8 157BECFF call 00404F64 0053D44F E9 C7010000 jmp 0053D61B 0053D454 33C9 xor ecx, ecx 0053D456 55 push ebp 0053D457 68 D8D55300 push 0053D5D8 0053D45C 64:FF31 push dword ptr fs:[ecx] 0053D45F 64:8921 mov dword ptr fs:[ecx], esp 0053D462 8D55 C8 lea edx, dword ptr [ebp-38] 0053D465 8B45 F0 mov eax, dword ptr [ebp-10] ; 取用户名 0053D468 E8 2BB7FFFF call 00538B98 0053D46D 8D45 E8 lea eax, dword ptr [ebp-18] 0053D470 E8 EF7AECFF call 00404F64 0053D475 8B45 EC mov eax, dword ptr [ebp-14] 0053D478 E8 A77DECFF call 00405224 ; 取注册码长度 0053D47D 8BF0 mov esi, eax 0053D47F 85F6 test esi, esi 0053D481 7E 39 jle short 0053D4BC 0053D483 BB 01000000 mov ebx, 1 0053D488 8BC3 mov eax, ebx 0053D48A 48 dec eax 0053D48B 99 cdq 0053D48C F7FF idiv edi 0053D48E 8B45 F0 mov eax, dword ptr [ebp-10] ; 取用户名 0053D491 0FB61410 movzx edx, byte ptr [eax+edx] ; 用户名第1、2、3、4、5...位ASC 0053D495 83C2 50 add edx, 50 ; 加上50 0053D498 83F2 7F xor edx, 7F ; 跟7F XOR 0053D49B 8B45 EC mov eax, dword ptr [ebp-14] 0053D49E 0FB64418 FF movzx eax, byte ptr [eax+ebx-1] ; 017EBCDC CF 6F A9 41 C5 C8 28 3F B6 94 2C 73 5A 8C E2 B8 以下是算法段了，我看得头昏眼花，什么算法？高手请指点 0053D4A3 33D0 xor edx, eax ; 再跟刚才的值XOR 0053D4A5 8D45 90 lea eax, dword ptr [ebp-70] 0053D4A8 E8 9F7CECFF call 0040514C ; 这里要注意了 0053D4AD 8B55 90 mov edx, dword ptr [ebp-70] 0053D4B0 8D45 E8 lea eax, dword ptr [ebp-18] ; 这个就是刚才运算的结果 0053D4B3 E8 747DECFF call 0040522C 0053D4B8 43 inc ebx 0053D4B9 4E dec esi ; 计数器，要求16次 0053D4BA ^ 75 CC jnz short 0053D488 0053D4BC 8D55 B8 lea edx, dword ptr [ebp-48] 0053D4BF 8B45 E8 mov eax, dword ptr [ebp-18] 0053D4C2 E8 D1B6FFFF call 00538B98 0053D4C7 BB 10000000 mov ebx, 10 0053D4CC 8D45 C8 lea eax, dword ptr [ebp-38] 0053D4CF 8D55 B8 lea edx, dword ptr [ebp-48] 0053D4D2 8D75 A8 lea esi, dword ptr [ebp-58] 0053D4D5 8A08 mov cl, byte ptr [eax] ; 又来算东西了 0053D4D7 320A xor cl, byte ptr [edx] 0053D4D9 880E mov byte ptr [esi], cl 0053D4DB 46 inc esi 0053D4DC 42 inc edx 0053D4DD 40 inc eax 0053D4DE 4B dec ebx 0053D4DF ^ 75 F4 jnz short 0053D4D5 0053D4E1 8D55 E4 lea edx, dword ptr [ebp-1C] 0053D4E4 8D45 A8 lea eax, dword ptr [ebp-58] 0053D4E7 E8 20B7FFFF call 00538C0C 0053D4EC 8D45 E0 lea eax, dword ptr [ebp-20] 0053D4EF E8 707AECFF call 00404F64 0053D4F4 8B45 E4 mov eax, dword ptr [ebp-1C] 0053D4F7 E8 287DECFF call 00405224 0053D4FC 8BF0 mov esi, eax 0053D4FE D1FE sar esi, 1 0053D500 79 03 jns short 0053D505 0053D502 83D6 00 adc esi, 0 0053D505 4E dec esi 0053D506 85F6 test esi, esi 0053D508 7C 3A jl short 0053D544 0053D50A 46 inc esi 0053D50B 33DB xor ebx, ebx 0053D50D 8D45 DC lea eax, dword ptr [ebp-24] 0053D510 50 push eax 0053D511 8BD3 mov edx, ebx 0053D513 03D2 add edx, edx 0053D515 42 inc edx 0053D516 B9 02000000 mov ecx, 2 0053D51B 8B45 E4 mov eax, dword ptr [ebp-1C] 0053D51E E8 617FECFF call 00405484 0053D523 8B45 DC mov eax, dword ptr [ebp-24] 0053D526 E8 B1FCFFFF call 0053D1DC 0053D52B 8BD0 mov edx, eax 0053D52D 8D45 8C lea eax, dword ptr [ebp-74] 0053D530 E8 177CECFF call 0040514C 0053D535 8B55 8C mov edx, dword ptr [ebp-74] 0053D538 8D45 E0 lea eax, dword ptr [ebp-20] 0053D53B E8 EC7CECFF call 0040522C 0053D540 43 inc ebx 0053D541 4E dec esi 0053D542 ^ 75 C9 jnz short 0053D50D 0053D544 8D55 98 lea edx, dword ptr [ebp-68] 0053D547 8B45 E0 mov eax, dword ptr [ebp-20] 0053D54A E8 49B6FFFF call 00538B98 0053D54F 8D45 D8 lea eax, dword ptr [ebp-28] 0053D552 E8 0D7AECFF call 00404F64 0053D557 BB 10000000 mov ebx, 10 0053D55C 8D7D 98 lea edi, dword ptr [ebp-68] 0053D55F 33C0 xor eax, eax 0053D561 8A07 mov al, byte ptr [edi] 0053D563 B9 7E000000 mov ecx, 7E 0053D568 33D2 xor edx, edx 0053D56A F7F1 div ecx 0053D56C 8BF2 mov esi, edx 0053D56E 83FE 2F cmp esi, 2F 0053D571 7D 11 jge short 0053D584 0053D573 8BC6 mov eax, esi 0053D575 B9 0B000000 mov ecx, 0B 0053D57A 99 cdq 0053D57B F7F9 idiv ecx 0053D57D 83C2 2F add edx, 2F 0053D580 8BF2 mov esi, edx 0053D582 EB 31 jmp short 0053D5B5 0053D584 83FE 3A cmp esi, 3A 0053D587 75 07 jnz short 0053D590 0053D589 BE 3C000000 mov esi, 3C 0053D58E EB 25 jmp short 0053D5B5 0053D590 83FE 3B cmp esi, 3B 0053D593 75 07 jnz short 0053D59C 0053D595 BE 3D000000 mov esi, 3D 0053D59A EB 19 jmp short 0053D5B5 0053D59C 83FE 5D cmp esi, 5D 0053D59F 7E 14 jle short 0053D5B5 0053D5A1 83FE 61 cmp esi, 61 0053D5A4 7D 0F jge short 0053D5B5 0053D5A6 8BC6 mov eax, esi 0053D5A8 B9 1D000000 mov ecx, 1D 0053D5AD 99 cdq 0053D5AE F7F9 idiv ecx 0053D5B0 83C2 61 add edx, 61 0053D5B3 8BF2 mov esi, edx 0053D5B5 8D45 88 lea eax, dword ptr [ebp-78] 0053D5B8 8BD6 mov edx, esi 0053D5BA E8 8D7BECFF call 0040514C 0053D5BF 8B55 88 mov edx, dword ptr [ebp-78] 0053D5C2 8D45 D8 lea eax, dword ptr [ebp-28] 0053D5C5 E8 627CECFF call 0040522C 0053D5CA 47 inc edi 0053D5CB 4B dec ebx 0053D5CC ^ 75 91 jnz short 0053D55F 0053D5CE 33C0 xor eax, eax 0053D5D0 5A pop edx 0053D5D1 59 pop ecx 0053D5D2 59 pop ecx 0053D5D3 64:8910 mov dword ptr fs:[eax], edx 0053D5D6 EB 0A jmp short 0053D5E2 0053D5D8 ^ E9 536FECFF jmp 00404530 0053D5DD E8 7A73ECFF call 0040495C 0053D5E2 8B45 F8 mov eax, dword ptr [ebp-8] 0053D5E5 E8 3A7CECFF call 00405224 0053D5EA 83F8 10 cmp eax, 10 0053D5ED 74 0A je short 0053D5F9 0053D5EF 8B45 F4 mov eax, dword ptr [ebp-C] 0053D5F2 E8 6D79ECFF call 00404F64 0053D5F7 EB 22 jmp short 0053D61B 0053D5F9 8B45 F4 mov eax, dword ptr [ebp-C] 0053D5FC 8B55 D8 mov edx, dword ptr [ebp-28] 0053D5FF E8 B479ECFF call 00404FB8 0053D604 8B45 F4 mov eax, dword ptr [ebp-C] 0053D607 8B00 mov eax, dword ptr [eax] 0053D609 8B55 F8 mov edx, dword ptr [ebp-8] 0053D60C E8 5F7DECFF call 00405370 0053D611 74 08 je short 0053D61B 0053D613 8B45 F4 mov eax, dword ptr [ebp-C] 0053D616 E8 4979ECFF call 00404F64 0053D61B 33C0 xor eax, eax 0053D61D 5A pop edx 0053D61E 59 pop ecx 0053D61F 59 pop ecx 0053D620 64:8910 mov dword ptr fs:[eax], edx 0053D623 68 57D65300 push 0053D657 0053D628 8D45 88 lea eax, dword ptr [ebp-78] 0053D62B BA 04000000 mov edx, 4 0053D630 E8 5379ECFF call 00404F88 0053D635 8D45 D8 lea eax, dword ptr [ebp-28] 0053D638 BA 07000000 mov edx, 7 0053D63D E8 4679ECFF call 00404F88 0053D642 8D45 F8 lea eax, dword ptr [ebp-8] 0053D645 BA 02000000 mov edx, 2 0053D64A E8 3979ECFF call 00404F88 0053D64F C3 retn 0053D650 ^ E9 8F71ECFF jmp 004047E4 0053D655 ^ EB D1 jmp short 0053D628 0053D657 5F pop edi 0053D658 5E pop esi 0053D659 5B pop ebx 0053D65A 8BE5 mov esp, ebp 0053D65C 5D pop ebp 0053D65D C3 retn 给个内存注册机,直接放在绿色版的目录下，运行即可，不必给原程序脱壳了。注意填信息时候，避开上面提到的黑名单。用户名长度必须3位或者3位以上。假注册码长度必须16位。而且原程序稳定性不好，如果关闭退出的话单击右上角的叉叉的话很可能造成程序关不了。最好是在任务栏下单击鼠标右键选择关闭。实在关不了就用任务管理器。我鄙视这样没搞头的软件。大家用这个内存注册机的时候请注意版本对号入座，这个是匹配“成功助理2.69绿色版”的 2007-8-4 00:34 0
冬天的雪雪币： 203 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 49 粉丝 0 关注私信	冬天的雪 6 楼已破解，象这种软件，有提示的，好多了。 2007-8-4 11:26 0
yingyue 雪币： 1844 活跃值： (35) 能力值： ( LV3，RANK：30 ) 在线值：发帖 16 回帖 2593 粉丝 3 关注私信	yingyue 7 楼有趣，这样的也叫难一点啊？？？？、 2007-8-4 17:57 0
爱琴海雪币： 1355 活跃值： (344) 能力值： ( LV13，RANK：920 ) 在线值：发帖 74 回帖 660 粉丝 7 关注私信	爱琴海 13 8 楼每个人的起步不一样，经验不一样。个人的评判标准也差无数了。呵呵，都原菜鸟快成长。。。 2007-8-4 19:25 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

iskilo

雪币： 101

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

1

回帖

20

粉丝

0

关注

私信

iskilo: 2 楼

这个软件可能跟SAFENET的开发商软件一样，增加调试检测的东东

2007-7-31 12:40

0

coolcheng

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

1

回帖

2

粉丝

0

关注

私信

coolcheng: 3 楼

那应该怎么办呢?是不是都不能破解啦,这个软件已经有人破解了,只是我不知道他是怎么破解的.我弄了半天都搞不定啊,调试定时候程序界面都打不开.郁闷.
看了很多教程,那些教程都是拿很简单的东东来破解,几乎一两步就搞定,太没意思了.

2007-7-31 13:50

0

冬天的雪

雪币： 203

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

1

回帖

49

粉丝

0

关注

私信

冬天的雪: 4 楼

我已经破解完了，不过我是采用爆破的。可以脱壳后，查找关键断点，主要有四个判断的地方。如不清楚，可以加我QQ：747023090

2007-8-3 20:09

0

爱琴海

雪币： 1355

活跃值： (344)

能力值：

( LV13，RANK：920 )

在线值：

发帖

74

回帖

660

粉丝

7

关注

私信

爱琴海 13: 5 楼

name:爱琴海[SCG]
sn:837op1n/k/K55=PZ

就这样的软件也要人民币98元一套？人民币贬值了吗？
如果急用绿色版本的这个账号先用着。有点郁闷，发现调试分析该软件的注册码怎么会每次都变的。
也许现在你们又不能用这个号码了。注册信息保存在自身data目录的后缀名LCG的文件中，嵌入进去了。要重新注册的话只能先删除，或者暂时改名。这里给个内存注册机，
解压密码:maple159357

这里只是本次验证部分，还有一部分是放在程序启动的时候
0060BF3B 55             push ebp
0060BF3C 68 1FC16000    push 0060C11F
0060BF41 64:FF30       push dword ptr fs:[eax]
0060BF44 64:8920       mov    dword ptr fs:[eax], esp
0060BF47 8B45 F8       mov    eax, dword ptr [ebp-8]
0060BF4A E8 D592DFFF    call 00405224                      ; 获取用户名
0060BF4F 83F8 03       cmp    eax, 3
0060BF52 0F8E BD010000 jle    0060C115                      ; 不能跳走，拥护名不能小于3位
0060BF58 8B45 F4       mov    eax, dword ptr [ebp-C]
0060BF5B E8 C492DFFF    call 00405224                      ; 获取假注册码
0060BF60 83F8 10       cmp    eax, 10
0060BF63 0F85 AC010000 jnz    0060C115                      ; 不能跳走，注册码必须为16位
0060BF69 8D4D EC       lea    ecx, dword ptr [ebp-14]
0060BF6C 8B55 F4       mov    edx, dword ptr [ebp-C]
0060BF6F 8B45 F8       mov    eax, dword ptr [ebp-8]
0060BF72 E8 1D13F3FF    call 0053D294                      ; 关键算法。EDX中存有用户名，呵呵，调用程式通缉黑名单，同时是对用户名的变形。看表一
0060BF77 8B55 EC       mov    edx, dword ptr [ebp-14]       ; 估计EDX就是注册码了，可是我看到的都是没有啊，莫非在上个CALL中就根据用户名而定？
0060BF7A 8B45 F4       mov    eax, dword ptr [ebp-C]          ; 将假注册码（您输入的）送到EAX
0060BF7D E8 EE93DFFF    call 00405370                      ; CALL比较啊
0060BF82 0F85 8D010000 jnz    0060C115                      ; 算法部分，不能跳走
0060BF88 A1 C4D06C00    mov    eax, dword ptr [6CD0C4]
0060BF8D 8B00          mov    eax, dword ptr [eax]
0060BF8F 8B80 44030000 mov    eax, dword ptr [eax+344]
0060BF95 BA B0C16000    mov    edx, 0060C1B0                   ; select * from usermsg
0060BF9A E8 75FCF2FF    call 0053BC14
0060BF9F 84C0          test al, al
0060BFA1 0F84 6E010000 je    0060C115                      ; 不能跳走
0060BFA7 A1 C4D06C00    mov    eax, dword ptr [6CD0C4]
0060BFAC 8B00          mov    eax, dword ptr [eax]
0060BFAE 8B80 44030000 mov    eax, dword ptr [eax+344]
0060BFB4 E8 FB84ECFF    call 004D44B4
0060BFB9 8D4D E8       lea    ecx, dword ptr [ebp-18]
0060BFBC 8B15 18D46C00 mov    edx, dword ptr [6CD418]       ; cgzllxp.006CC6D8
0060BFC2 8B12          mov    edx, dword ptr [edx]
0060BFC4 8B45 F8       mov    eax, dword ptr [ebp-8]
0060BFC7 E8 2CDAF2FF    call 005399F8
0060BFCC 8B45 E8       mov    eax, dword ptr [ebp-18]
0060BFCF 50             push eax
0060BFD0 A1 C4D06C00    mov    eax, dword ptr [6CD0C4]
0060BFD5 8B00          mov    eax, dword ptr [eax]
0060BFD7 8B80 44030000 mov    eax, dword ptr [eax+344]
0060BFDD BA D0C16000    mov    edx, 0060C1D0                   ; field3
0060BFE2 E8 0D6DECFF    call 004D2CF4
0060BFE7 5A             pop    edx
0060BFE8 8B08          mov    ecx, dword ptr [eax]
0060BFEA FF91 B0000000 call dword ptr [ecx+B0]
0060BFF0 8D4D E4       lea    ecx, dword ptr [ebp-1C]
0060BFF3 8B15 18D46C00 mov    edx, dword ptr [6CD418]       ; cgzllxp.006CC6D8
0060BFF9 8B12          mov    edx, dword ptr [edx]
0060BFFB 8B45 F4       mov    eax, dword ptr [ebp-C]
0060BFFE E8 F5D9F2FF    call 005399F8
0060C003 8B45 E4       mov    eax, dword ptr [ebp-1C]
0060C006 50             push eax
0060C007 A1 C4D06C00    mov    eax, dword ptr [6CD0C4]
0060C00C 8B00          mov    eax, dword ptr [eax]
0060C00E 8B80 44030000 mov    eax, dword ptr [eax+344]
0060C014 BA E0C16000    mov    edx, 0060C1E0                   ; field4
0060C019 E8 D66CECFF    call 004D2CF4
0060C01E 5A             pop    edx
0060C01F 8B08          mov    ecx, dword ptr [eax]
0060C021 FF91 B0000000 call dword ptr [ecx+B0]
0060C027 A1 C4D06C00    mov    eax, dword ptr [6CD0C4]
0060C02C 8B00          mov    eax, dword ptr [eax]
0060C02E 8B80 44030000 mov    eax, dword ptr [eax+344]
0060C034 8B10          mov    edx, dword ptr [eax]
0060C036 FF92 4C020000 call dword ptr [edx+24C]
0060C03C 8D55 DC       lea    edx, dword ptr [ebp-24]
0060C03F 8B45 FC       mov    eax, dword ptr [ebp-4]
0060C042 8B80 30030000 mov    eax, dword ptr [eax+330]
0060C048 E8 97B8E7FF    call 004878E4
0060C04D 8B45 DC       mov    eax, dword ptr [ebp-24]
0060C050 8D55 E0       lea    edx, dword ptr [ebp-20]
0060C053 E8 28DFDFFF    call 00409F80
0060C058 8B55 E0       mov    edx, dword ptr [ebp-20]
0060C05B A1 80D86C00    mov    eax, dword ptr [6CD880]
0060C060 E8 538FDFFF    call 00404FB8
0060C065 8D55 D8       lea    edx, dword ptr [ebp-28]
0060C068 8B45 FC       mov    eax, dword ptr [ebp-4]
0060C06B 8B80 34030000 mov    eax, dword ptr [eax+334]
0060C071 E8 6EB8E7FF    call 004878E4
0060C076 8B55 D8       mov    edx, dword ptr [ebp-28]
0060C079 A1 A4D66C00    mov    eax, dword ptr [6CD6A4]
0060C07E E8 358FDFFF    call 00404FB8
0060C083 A1 E0D66C00    mov    eax, dword ptr [6CD6E0]
0060C088 C600 01       mov    byte ptr [eax], 1
0060C08B 6A 30          push 30
0060C08D A1 CCD66C00    mov    eax, dword ptr [6CD6CC]
0060C092 8B00          mov    eax, dword ptr [eax]
0060C094 E8 8B93DFFF    call 00405424
0060C099 50             push eax
0060C09A 68 E8C16000    push 0060C1E8                      ; 注册成功！
0060C09F 8B45 FC       mov    eax, dword ptr [ebp-4]
0060C0A2 E8 DD21E8FF    call 0048E284
0060C0A7 50             push eax
0060C0A8 E8 6FC6DFFF    call <jmp.&USER32.MessageBoxA>
0060C0AD 68 FCC16000    push 0060C1FC                      ; 尊敬的
0060C0B2 A1 80D86C00    mov    eax, dword ptr [6CD880]
0060C0B7 FF30          push dword ptr [eax]
0060C0B9 68 0CC26000    push 0060C20C                      ; ，
0060C0BE A1 CCD66C00    mov    eax, dword ptr [6CD6CC]
0060C0C3 FF30          push dword ptr [eax]
0060C0C5 68 18C26000    push 0060C218                      ; ，助您成功!
0060C0CA 8D45 D4       lea    eax, dword ptr [ebp-2C]
0060C0CD BA 05000000    mov    edx, 5
0060C0D2 E8 0D92DFFF    call 004052E4
0060C0D7 8B55 D4       mov    edx, dword ptr [ebp-2C]
0060C0DA A1 C4D06C00    mov    eax, dword ptr [6CD0C4]
0060C0DF 8B00          mov    eax, dword ptr [eax]
0060C0E1 E8 2EB8E7FF    call 00487914
0060C0E6 A1 4CD16C00    mov    eax, dword ptr [6CD14C]
0060C0EB 8B00          mov    eax, dword ptr [eax]
0060C0ED 8B40 5C       mov    eax, dword ptr [eax+5C]
0060C0F0 33D2          xor    edx, edx
0060C0F2 E8 216DE3FF    call 00442E18
0060C0F7 A1 C4D06C00    mov    eax, dword ptr [6CD0C4]
0060C0FC 8B00          mov    eax, dword ptr [eax]
0060C0FE E8 D9670900    call 006A28DC
0060C103 8B45 FC       mov    eax, dword ptr [ebp-4]
0060C106 E8 F994E9FF    call 004A5604
0060C10B 33C0          xor    eax, eax
0060C10D 5A             pop    edx
0060C10E 59             pop    ecx
0060C10F 59             pop    ecx
0060C110 64:8910       mov    dword ptr fs:[eax], edx
0060C113 EB 3E          jmp    short 0060C153
0060C115 33C0          xor    eax, eax
0060C117 5A             pop    edx
0060C118 59             pop    ecx
0060C119 59             pop    ecx
0060C11A 64:8910       mov    dword ptr fs:[eax], edx
0060C11D EB 0A          jmp    short 0060C129
0060C11F  ^ E9 0C84DFFF    jmp    00404530
0060C124 E8 3388DFFF    call 0040495C
0060C129 6A 30          push 30
0060C12B A1 CCD66C00    mov    eax, dword ptr [6CD6CC]
0060C130 8B00          mov    eax, dword ptr [eax]
0060C132 E8 ED92DFFF    call 00405424
0060C137 50             push eax
0060C138 68 24C26000    push 0060C224                      ; 注册失败！
0060C13D 8B45 FC       mov    eax, dword ptr [ebp-4]
0060C140 E8 3F21E8FF    call 0048E284
0060C145 50             push eax
0060C146 E8 D1C5DFFF    call <jmp.&USER32.MessageBoxA>
0060C14B 8B45 FC       mov    eax, dword ptr [ebp-4]
0060C14E E8 B194E9FF    call 004A5604
0060C153 33C0          xor    eax, eax
0060C155 5A             pop    edx
0060C156 59             pop    ecx
0060C157 59             pop    ecx

表一：
0053D2DD BA 68D65300    mov    edx, 0053D668                   ; 帅哥
0053D2E2 E8 8980ECFF    call 00405370
0053D2E7 0F84 2E030000 je    0053D61B
0053D2ED 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D2F0 BA 78D65300    mov    edx, 0053D678                   ; 美女
0053D2F5 E8 7680ECFF    call 00405370
0053D2FA 0F84 1B030000 je    0053D61B
0053D300 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D303 BA 88D65300    mov    edx, 0053D688                   ; ankty
0053D308 E8 6380ECFF    call 00405370
0053D30D 0F84 08030000 je    0053D61B
0053D313 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D316 BA 98D65300    mov    edx, 0053D698                   ; 自由之翼软件站
0053D31B E8 5080ECFF    call 00405370
0053D320 0F84 F5020000 je    0053D61B
0053D326 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D329 BA B0D65300    mov    edx, 0053D6B0                   ; 思吧社区_xxnb
0053D32E E8 3D80ECFF    call 00405370
0053D333 0F84 E2020000 je    0053D61B
0053D339 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D33C BA C8D65300    mov    edx, 0053D6C8                   ; sfl4800
0053D341 E8 2A80ECFF    call 00405370
0053D346 0F84 CF020000 je    0053D61B
0053D34C 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D34F BA D8D65300    mov    edx, 0053D6D8                   ; zeror[czg][d.4s][dfcg][bcg]
0053D354 E8 1780ECFF    call 00405370
0053D359 0F84 BC020000 je    0053D61B
0053D35F 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D362 BA FCD65300    mov    edx, 0053D6FC                   ; zeror[czg]
0053D367 E8 0480ECFF    call 00405370
0053D36C 0F84 A9020000 je    0053D61B
0053D372 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D375 BA 10D75300    mov    edx, 0053D710                   ; 嬴政天下xxnb
0053D37A E8 F17FECFF    call 00405370
0053D37F 0F84 96020000 je    0053D61B
0053D385 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D388 BA 28D75300    mov    edx, 0053D728                   ; binbinbin
0053D38D E8 DE7FECFF    call 00405370
0053D392 0F84 83020000 je    0053D61B
0053D398 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D39B BA 3CD75300    mov    edx, 0053D73C                   ; greendown
0053D3A0 E8 CB7FECFF    call 00405370
0053D3A5 0F84 70020000 je    0053D61B
0053D3AB 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D3AE BA 50D75300    mov    edx, 0053D750                   ; lvgusoft
0053D3B3 E8 B87FECFF    call 00405370
0053D3B8 0F84 5D020000 je    0053D61B
0053D3BE 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D3C1 BA 64D75300    mov    edx, 0053D764                   ; sfl4800[d.4s]
0053D3C6 E8 A57FECFF    call 00405370
0053D3CB 0F84 4A020000 je    0053D61B
0053D3D1 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D3D4 BA 7CD75300    mov    edx, 0053D77C                   ; wuhanqi
0053D3D9 E8 927FECFF    call 00405370
0053D3DE 0F84 37020000 je    0053D61B
0053D3E4 8B45 FC       mov    eax, dword ptr [ebp-4]
0053D3E7 BA 8CD75300    mov    edx, 0053D78C                   ; 庆贺id恢复
0053D3EC E8 7F7FECFF    call 00405370
0053D3F1 0F84 24020000 je    0053D61B
0053D3F7 8D45 D8       lea    eax, dword ptr [ebp-28]
0053D3FA E8 657BECFF    call 00404F64
0053D3FF 8D45 EC       lea    eax, dword ptr [ebp-14]
0053D402 BA A0D75300    mov    edx, 0053D7A0                   ; *1^cgsxy*-

0053D40F 8B55 FC       mov    edx, dword ptr [ebp-4]          ; 送用户名
0053D412 8B45 EC       mov    eax, dword ptr [ebp-14]       ; 这个特殊字符
0053D415 E8 6EC1FFFF    call 00539588
0053D41A 8B55 94       mov    edx, dword ptr [ebp-6C]
0053D41D 8D45 EC       lea    eax, dword ptr [ebp-14]
0053D420 E8 D77BECFF    call 00404FFC
0053D425 8D45 F0       lea    eax, dword ptr [ebp-10]
0053D428 8B55 FC       mov    edx, dword ptr [ebp-4]
0053D42B E8 CC7BECFF    call 00404FFC
0053D430 8B45 F0       mov    eax, dword ptr [ebp-10]
0053D433 E8 EC7DECFF    call 00405224                      ; 取用户名长度
0053D438 8BF8          mov    edi, eax
0053D43A 8B45 FC       mov    eax, dword ptr [ebp-4]          ; 取用户名
0053D43D E8 E27DECFF    call 00405224
0053D442 83F8 04       cmp    eax, 4
0053D445 7D 0D          jge    short 0053D454                ; 大于等于4位即OK了
0053D447 8B45 F4       mov    eax, dword ptr [ebp-C]
0053D44A E8 157BECFF    call 00404F64
0053D44F E9 C7010000    jmp    0053D61B
0053D454 33C9          xor    ecx, ecx
0053D456 55             push ebp
0053D457 68 D8D55300    push 0053D5D8
0053D45C 64:FF31       push dword ptr fs:[ecx]
0053D45F 64:8921       mov    dword ptr fs:[ecx], esp
0053D462 8D55 C8       lea    edx, dword ptr [ebp-38]
0053D465 8B45 F0       mov    eax, dword ptr [ebp-10]       ; 取用户名
0053D468 E8 2BB7FFFF    call 00538B98
0053D46D 8D45 E8       lea    eax, dword ptr [ebp-18]
0053D470 E8 EF7AECFF    call 00404F64
0053D475 8B45 EC       mov    eax, dword ptr [ebp-14]
0053D478 E8 A77DECFF    call 00405224                      ; 取注册码长度
0053D47D 8BF0          mov    esi, eax
0053D47F 85F6          test esi, esi
0053D481 7E 39          jle    short 0053D4BC
0053D483 BB 01000000    mov    ebx, 1
0053D488 8BC3          mov    eax, ebx
0053D48A 48             dec    eax
0053D48B 99             cdq
0053D48C F7FF          idiv edi
0053D48E 8B45 F0       mov    eax, dword ptr [ebp-10]       ; 取用户名
0053D491 0FB61410       movzx edx, byte ptr [eax+edx]       ; 用户名第1、2、3、4、5...位ASC
0053D495 83C2 50       add    edx, 50                         ; 加上50
0053D498 83F2 7F       xor    edx, 7F                         ; 跟7F XOR
0053D49B 8B45 EC       mov    eax, dword ptr [ebp-14]
0053D49E 0FB64418 FF    movzx eax, byte ptr [eax+ebx-1]       ; 017EBCDC  CF 6F A9 41 C5 C8 28 3F B6 94 2C 73 5A 8C E2 B8

以下是算法段了，我看得头昏眼花，什么算法？高手请指点

0053D4A3 33D0          xor    edx, eax                      ; 再跟刚才的值XOR
0053D4A5 8D45 90       lea    eax, dword ptr [ebp-70]
0053D4A8 E8 9F7CECFF    call 0040514C                      ; 这里要注意了
0053D4AD 8B55 90       mov    edx, dword ptr [ebp-70]
0053D4B0 8D45 E8       lea    eax, dword ptr [ebp-18]       ; 这个就是刚才运算的结果
0053D4B3 E8 747DECFF    call 0040522C
0053D4B8 43             inc    ebx
0053D4B9 4E             dec    esi                            ; 计数器，要求16次
0053D4BA  ^ 75 CC          jnz    short 0053D488
0053D4BC 8D55 B8       lea    edx, dword ptr [ebp-48]
0053D4BF 8B45 E8       mov    eax, dword ptr [ebp-18]
0053D4C2 E8 D1B6FFFF    call 00538B98
0053D4C7 BB 10000000    mov    ebx, 10
0053D4CC 8D45 C8       lea    eax, dword ptr [ebp-38]
0053D4CF 8D55 B8       lea    edx, dword ptr [ebp-48]
0053D4D2 8D75 A8       lea    esi, dword ptr [ebp-58]
0053D4D5 8A08          mov    cl, byte ptr [eax]             ; 又来算东西了
0053D4D7 320A          xor    cl, byte ptr [edx]
0053D4D9 880E          mov    byte ptr [esi], cl
0053D4DB 46             inc    esi
0053D4DC 42             inc    edx
0053D4DD 40             inc    eax
0053D4DE 4B             dec    ebx
0053D4DF  ^ 75 F4          jnz    short 0053D4D5
0053D4E1 8D55 E4       lea    edx, dword ptr [ebp-1C]
0053D4E4 8D45 A8       lea    eax, dword ptr [ebp-58]
0053D4E7 E8 20B7FFFF    call 00538C0C
0053D4EC 8D45 E0       lea    eax, dword ptr [ebp-20]
0053D4EF E8 707AECFF    call 00404F64
0053D4F4 8B45 E4       mov    eax, dword ptr [ebp-1C]
0053D4F7 E8 287DECFF    call 00405224
0053D4FC 8BF0          mov    esi, eax
0053D4FE D1FE          sar    esi, 1
0053D500 79 03          jns    short 0053D505
0053D502 83D6 00       adc    esi, 0
0053D505 4E             dec    esi
0053D506 85F6          test esi, esi
0053D508 7C 3A          jl    short 0053D544
0053D50A 46             inc    esi
0053D50B 33DB          xor    ebx, ebx
0053D50D 8D45 DC       lea    eax, dword ptr [ebp-24]
0053D510 50             push eax
0053D511 8BD3          mov    edx, ebx
0053D513 03D2          add    edx, edx
0053D515 42             inc    edx
0053D516 B9 02000000    mov    ecx, 2
0053D51B 8B45 E4       mov    eax, dword ptr [ebp-1C]
0053D51E E8 617FECFF    call 00405484
0053D523 8B45 DC       mov    eax, dword ptr [ebp-24]
0053D526 E8 B1FCFFFF    call 0053D1DC
0053D52B 8BD0          mov    edx, eax
0053D52D 8D45 8C       lea    eax, dword ptr [ebp-74]
0053D530 E8 177CECFF    call 0040514C
0053D535 8B55 8C       mov    edx, dword ptr [ebp-74]
0053D538 8D45 E0       lea    eax, dword ptr [ebp-20]
0053D53B E8 EC7CECFF    call 0040522C
0053D540 43             inc    ebx
0053D541 4E             dec    esi
0053D542  ^ 75 C9          jnz    short 0053D50D
0053D544 8D55 98       lea    edx, dword ptr [ebp-68]
0053D547 8B45 E0       mov    eax, dword ptr [ebp-20]
0053D54A E8 49B6FFFF    call 00538B98
0053D54F 8D45 D8       lea    eax, dword ptr [ebp-28]
0053D552 E8 0D7AECFF    call 00404F64
0053D557 BB 10000000    mov    ebx, 10
0053D55C 8D7D 98       lea    edi, dword ptr [ebp-68]
0053D55F 33C0          xor    eax, eax
0053D561 8A07          mov    al, byte ptr [edi]
0053D563 B9 7E000000    mov    ecx, 7E
0053D568 33D2          xor    edx, edx
0053D56A F7F1          div    ecx
0053D56C 8BF2          mov    esi, edx
0053D56E 83FE 2F       cmp    esi, 2F
0053D571 7D 11          jge    short 0053D584
0053D573 8BC6          mov    eax, esi
0053D575 B9 0B000000    mov    ecx, 0B
0053D57A 99             cdq
0053D57B F7F9          idiv ecx
0053D57D 83C2 2F       add    edx, 2F
0053D580 8BF2          mov    esi, edx
0053D582 EB 31          jmp    short 0053D5B5
0053D584 83FE 3A       cmp    esi, 3A
0053D587 75 07          jnz    short 0053D590
0053D589 BE 3C000000    mov    esi, 3C
0053D58E EB 25          jmp    short 0053D5B5
0053D590 83FE 3B       cmp    esi, 3B
0053D593 75 07          jnz    short 0053D59C
0053D595 BE 3D000000    mov    esi, 3D
0053D59A EB 19          jmp    short 0053D5B5
0053D59C 83FE 5D       cmp    esi, 5D
0053D59F 7E 14          jle    short 0053D5B5
0053D5A1 83FE 61       cmp    esi, 61
0053D5A4 7D 0F          jge    short 0053D5B5
0053D5A6 8BC6          mov    eax, esi
0053D5A8 B9 1D000000    mov    ecx, 1D
0053D5AD 99             cdq
0053D5AE F7F9          idiv ecx
0053D5B0 83C2 61       add    edx, 61
0053D5B3 8BF2          mov    esi, edx
0053D5B5 8D45 88       lea    eax, dword ptr [ebp-78]
0053D5B8 8BD6          mov    edx, esi
0053D5BA E8 8D7BECFF    call 0040514C
0053D5BF 8B55 88       mov    edx, dword ptr [ebp-78]
0053D5C2 8D45 D8       lea    eax, dword ptr [ebp-28]
0053D5C5 E8 627CECFF    call 0040522C
0053D5CA 47             inc    edi
0053D5CB 4B             dec    ebx
0053D5CC  ^ 75 91          jnz    short 0053D55F
0053D5CE 33C0          xor    eax, eax
0053D5D0 5A             pop    edx
0053D5D1 59             pop    ecx
0053D5D2 59             pop    ecx
0053D5D3 64:8910       mov    dword ptr fs:[eax], edx
0053D5D6 EB 0A          jmp    short 0053D5E2
0053D5D8  ^ E9 536FECFF    jmp    00404530
0053D5DD E8 7A73ECFF    call 0040495C
0053D5E2 8B45 F8       mov    eax, dword ptr [ebp-8]
0053D5E5 E8 3A7CECFF    call 00405224
0053D5EA 83F8 10       cmp    eax, 10
0053D5ED 74 0A          je    short 0053D5F9
0053D5EF 8B45 F4       mov    eax, dword ptr [ebp-C]
0053D5F2 E8 6D79ECFF    call 00404F64
0053D5F7 EB 22          jmp    short 0053D61B
0053D5F9 8B45 F4       mov    eax, dword ptr [ebp-C]
0053D5FC 8B55 D8       mov    edx, dword ptr [ebp-28]
0053D5FF E8 B479ECFF    call 00404FB8
0053D604 8B45 F4       mov    eax, dword ptr [ebp-C]
0053D607 8B00          mov    eax, dword ptr [eax]
0053D609 8B55 F8       mov    edx, dword ptr [ebp-8]
0053D60C E8 5F7DECFF    call 00405370
0053D611 74 08          je    short 0053D61B
0053D613 8B45 F4       mov    eax, dword ptr [ebp-C]
0053D616 E8 4979ECFF    call 00404F64
0053D61B 33C0          xor    eax, eax
0053D61D 5A             pop    edx
0053D61E 59             pop    ecx
0053D61F 59             pop    ecx
0053D620 64:8910       mov    dword ptr fs:[eax], edx
0053D623 68 57D65300    push 0053D657
0053D628 8D45 88       lea    eax, dword ptr [ebp-78]
0053D62B BA 04000000    mov    edx, 4
0053D630 E8 5379ECFF    call 00404F88
0053D635 8D45 D8       lea    eax, dword ptr [ebp-28]
0053D638 BA 07000000    mov    edx, 7
0053D63D E8 4679ECFF    call 00404F88
0053D642 8D45 F8       lea    eax, dword ptr [ebp-8]
0053D645 BA 02000000    mov    edx, 2
0053D64A E8 3979ECFF    call 00404F88
0053D64F C3             retn
0053D650  ^ E9 8F71ECFF    jmp    004047E4
0053D655  ^ EB D1          jmp    short 0053D628
0053D657 5F             pop    edi
0053D658 5E             pop    esi
0053D659 5B             pop    ebx
0053D65A 8BE5          mov    esp, ebp
0053D65C 5D             pop    ebp
0053D65D C3             retn

给个内存注册机,直接放在绿色版的目录下，运行即可，不必给原程序脱壳了。注意填信息时候，避开上面提到的黑名单。用户名长度必须3位或者3位以上。假注册码长度必须16位。而且原程序稳定性不好，如果关闭退出的话单击右上角的叉叉的话很可能造成程序关不了。最好是在任务栏下单击鼠标右键选择关闭。实在关不了就用任务管理器。我鄙视这样没搞头的软件。