软件大小：404K
【软件简介】：狄奥尼索斯 说：很好用的网络游戏登入软件。呵呵，我不知道，我不用。
【软件限制】：功能限制。如果没有注册就只能用一天。
【作者声明】：初学Crack，只是感兴趣，没有其它目的。失误之处敬请诸位大侠赐教！
【破解工具】：TRW2000娃娃修改版、Ollydbg1.09、FI2.5、UPXWin、W32Dasm 10修改版
—————————————————————————————————
【过 程】：
eye.exe是UPX壳，用UPXWIN脱之。404K->1.30M。Visual C++ 5.0编写。
首先运行一下，看看作者给我们的“提示”。呵呵，作者说必须要小写字母。
反汇编，很容易就找到了核心。让我们看看吧。
试炼码：abcdefghhijklmnofghj （20位。必须在a-o之间。）
—————————————————————————————————
:00472129 6A01 push 00000001
:0047212B E83E5C0300 call 004A7D6E
:00472130 8B4F64 mov ecx, dword ptr [edi+64]
====>ECX=abcdefghhijklmnofghj
:00472133 8A01 mov al, byte ptr [ecx]
====>逐位取试炼码字符的HEX值
:00472135 33F6 xor esi, esi
:00472137 33ED xor ebp, ebp
:00472139 33DB xor ebx, ebx
:0047213B 84C0 test al, al
:0047213D 89742410 mov dword ptr [esp+10], esi
:00472141 7462 je 004721A5
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00472191(C)
|
:00472143 3C61 cmp al, 61
====>小于61？
:00472145 7C40 jl 00472187
:00472147 3C70 cmp al, 70
====>大于70？
====>所以：注册码要求在 a-o 之间。（包括a、o）
:00472149 7F3C jg 00472187
:0047214B 83FE08 cmp esi, 00000008
====>前8位不跳
:0047214E 7D0C jge 0047215C
:00472150 0FBEC0 movsx eax, al
:00472153 C1E504 shl ebp, 04
:00472156 8D6C059F lea ebp, dword ptr [ebp+eax-61]
====>前8位字符的HXE值-61 入EBP
====>结果：EBP=01234567
:0047215A EB23 jmp 0047217F
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047214E(C)
|
:0047215C 83FE10 cmp esi, 00000010
====>8-16位不跳
:0047215F 7D0C jge 0047216D
:00472161 0FBED0 movsx edx, al
:00472164 C1E304 shl ebx, 04
:00472167 8D5C139F lea ebx, dword ptr [ebx+edx-61]
====>8-16位字符的HXE值-61 入EBX
====>结果：EBX=789ABCDE
:0047216B EB12 jmp 0047217F
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047215F(C)
|
:0047216D 8B542410 mov edx, dword ptr [esp+10]
:00472171 0FBEC0 movsx eax, al
:00472174 C1E204 shl edx, 04
:00472177 8D54029F lea edx, dword ptr [edx+eax-61]
====>最后4位字符的HXE值-61 入EDX
====>结果：EDX=5679
:0047217B 89542410 mov dword ptr [esp+10], edx
====>[esp+10]=EDX=5679
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047215A(U), :0047216B(U)
|
:0047217F 46 inc esi
:00472180 83FE14 cmp esi, 00000014
:00472183 7420 je 004721A5
:00472185 EB04 jmp 0047218B
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00472145(C), :00472149(C)
|
:00472187 3C2D cmp al, 2D
:00472189 750A jne 00472195
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00472185(U)
|
:0047218B 8A4101 mov al, byte ptr [ecx+01]
:0047218E 41 inc ecx
:0047218F 84C0 test al, al
:00472191 75B0 jne 00472143
:00472193 EB10 jmp 004721A5
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00472189(C)
|
:00472195 6A00 push 00000000
:00472197 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"Use lowercase letters. There are "
->"no numbers in the code. The OK-button "
->"will reactivate when you have "
->"entered the full code correctly. "
->"Copy-pasting the code from the "
->"email would be the easist way."
====>BAD BOY！作者给的提示！
:00472199 6858714E00 push 004E7158
:0047219E 8BCF mov ecx, edi
:004721A0 E828EA0300 call 004B0BCD
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00472141(C), :00472183(C), :00472193(U)
|
:004721A5 85F6 test esi, esi
:004721A7 7454 je 004721FD
:004721A9 83FE14 cmp esi, 00000014
====>是否20位？
====>所以：注册码要求20位
:004721AC 754B jne 004721F9
====>跳则OVER！
:004721AE 8D4C242C lea ecx, dword ptr [esp+2C]
:004721B2 896C2414 mov dword ptr [esp+14], ebp
====>[esp+14]=01234567
:004721B6 895C2418 mov dword ptr [esp+18], ebx
====>[esp+18]=789ABCDE
:004721BA E8B137FAFF call 00415970
====>此CALL在内存007AF410处放置一串字符。程序自给。
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
007AF410 内存处的值：
007AF410 01 23 45 67 89 AB CD EF FE DC BA 98 76 54 32 10 #Eg壂惋簶vT289 A
007AF420 00 00 00 00 00 00 00 00 ........
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
:004721BF 6A08 push 00000008
:004721C1 8D542418 lea edx, dword ptr [esp+18]
:004721C5 8D4C2430 lea ecx, dword ptr [esp+30]
:004721C9 E8D237FAFF call 004159A0
:004721CE 8D54242C lea edx, dword ptr [esp+2C]
:004721D2 8D4C241C lea ecx, dword ptr [esp+1C]
:004721D6 E89538FAFF call 00415A70
====>关键CALL！
对上面的值进行运算得出下面的EAX和ECX值。呵呵，里面很多的异或和四则运算呀！变！
:004721DB 8B44241D mov eax, dword ptr [esp+1D]
====>EAX=[esp+1D]=D98480EA
:004721DF 8B4C241C mov ecx, dword ptr [esp+1C]
====>ECX=[esp+1C]=8480EA16
:004721E3 25FF000000 and eax, 000000FF
====>EAX=D98480EA AND FF=EA
:004721E8 81E1FF000000 and ecx, 000000FF
====>ECX=8480EA16 AND FF=16
:004721EE C1E008 shl eax, 08
====>EAX=EA SHL 08=EA00
:004721F1 03C1 add eax, ecx
====>EAX=EA00 + 16=EA16
:004721F3 3B442410 cmp eax, dword ptr [esp+10]
====>EAX=EA16 这是对前8位和8-16位运算得出的值
====>[esp+10]=5679 这是最后4位字符的HXE值-61后的值
呵呵，只要我们这2者相等就OK了。^-^^-^ 所以我们可以让 最后4位字符的HXE值-61后的值=EA16 就行了！
因此：简单求逆最后4位应为：okbg
:004721F7 7404 je 004721FD
====>不跳则OVER！
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004721AC(C)
|
:004721F9 33C0 xor eax, eax
====>清0则OVER！
:004721FB EB05 jmp 00472202
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004721A7(C), :004721F7(C)
|
:004721FD B801000000 mov eax, 00000001
====>置1则OK！
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004721FB(U)
|
:00472202 50 push eax
:00472203 6A01 push 00000001
:00472205 8BCF mov ecx, edi
:00472207 E8BC630300 call 004A85C8
:0047220C 8BC8 mov ecx, eax
:0047220E E892660300 call 004A88A5
:00472213 896F5C mov dword ptr [edi+5C], ebp
:00472216 895F60 mov dword ptr [edi+60], ebx
:00472219 5F pop edi
:0047221A 5E pop esi
:0047221B 5D pop ebp
:0047221C 5B pop ebx
:0047221D 83C474 add esp, 00000074
:00472220 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004720D8(C), :004720DF(C)
|
:00472100 6A00 push 00000000
:00472102 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"Thanks for registering!"
====>呵呵，胜利女神！
:00472104 6804714E00 push 004E7104