软件名称：eBook Edit Pro 3.21
PJ说明：
我也是新手，学习破解还不到两个星期，不足之处，请大家批评指正！
本文件中提到的主文件，即用于制作E书的主运行程序ebookedit.exe
本文件中提到的exe文件，即制作为成品的E书文件
这个软件的注册方式很特别! 在主文件运行过程中，注册部分只有输入用户名和注册码，但除了保存这个信息在注册表的HKEY_CURRENT_USER\Software\Cybershare\Registration位置外(错的也保存)，并不做任何检验注册码是否正确的动作。而真正的注册码检验部分是在生成的exe文件中，呵呵，很有意思吧! 如果在主文件当中输入的注册码不正确，那么生成的exe文件在运行的时候，会出现一个未注册的信息。由于exe文件可以脱离原生成程序运行，所以，我们可以判断出来，主文件在生成exe文件的过程中，已经将输入的用户名和注册码信息放入exe文件里了，那么exe文件一运行，就会将这部分信息提取出来，进行注册码正确检验。
得出的结论：要想得真正的注册码，不是研究主文件，而是研究生成的exe文件(找出这个关键，我费了2个小时)
1、先试用一下软件，运行出现欢迎画片，只有一个授权给：和注册键：，分别输入newlaos和78787878(学前辈的试用码)，然后按正常步骤生成一个exe文件(不要太大)，这里假设为crack.exe文件。
2、用fi2.5一看，exe文件加了一个aspack2.1的壳，用TRW2000可以手动脱壳，自动脱壳我选择了AspackDie 1.41(脱壳过程中，它会发现一个附加信息，选择“是”)，生成unpack.exe文件。
3、用TRW2000载入unpack.exe文件，按F10步进(因为按F12一下就出现了未注册信息)，来到下面代码段：
......
...... |
:0047C7DC A1D8F04000 mov eax, dword ptr [0040F0D8]
:0047C7E1 E8B260F9FF call 00412898
:0047C7E6 A3D40A4800 mov dword ptr [00480AD4], eax
:0047C7EB 33C0 xor eax, eax
:0047C7ED 55 push ebp
:0047C7EE 6859C84700 push 0047C859
:0047C7F3 64FF30 push dword ptr fs:[eax]
:0047C7F6 648920 mov dword ptr fs:[eax], esp
:0047C7F9 A10CE84700 mov eax, dword ptr [0047E80C]
:0047C7FE 8B00 mov eax, dword ptr [eax]
:0047C800 E8F7DBFCFF call 0044A3FC
:0047C805 A10CE84700 mov eax, dword ptr [0047E80C]
:0047C80A 8B00 mov eax, dword ptr [eax]
:0047C80C C6404B00 mov [eax+4B], 00
:0047C810 A1F0E64700 mov eax, dword ptr [0047E6F0]
:0047C815 8B15D40A4800 mov edx, dword ptr [00480AD4]
:0047C81B 8910 mov dword ptr [eax], edx
:0047C81D 8B0D34E64700 mov ecx, dword ptr [0047E634]
:0047C823 A10CE84700 mov eax, dword ptr [0047E80C]
:0047C828 8B00 mov eax, dword ptr [eax]
* Possible StringData Ref from Code Obj ->"?C"
|
:0047C82A 8B15F0964700 mov edx, dword ptr [004796F0]
:0047C830 E8DFDBFCFF call 0044A414 <===因为一过这里就出现了未注册信息，所以F8进入(后面很多是这种情况)
:0047C835 A10CE84700 mov eax, dword ptr [0047E80C]
:0047C83A 8B00 mov eax, dword ptr [eax]
:0047C83C E853DCFCFF call 0044A494
:0047C841 33C0 xor eax, eax
:0047C843 5A pop edx
:0047C844 59 pop ecx
:0047C845 59 pop ecx
:0047C846 648910 mov dword ptr fs:[eax], edx
:0047C849 6860C84700 push 0047C860
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C85E(U)
|
:0047C84E A1D40A4800 mov eax, dword ptr [00480AD4]
:0047C853 E86866F8FF call 00402EC0
:0047C858 C3 ret
......
......
_______________________________F8来到下面代码段_______________________________________________
:0044A414 55 push ebp
:0044A415 8BEC mov ebp, esp
:0044A417 51 push ecx
:0044A418 53 push ebx
:0044A419 56 push esi
:0044A41A 57 push edi
:0044A41B 894DFC mov dword ptr [ebp-04], ecx
:0044A41E 8BDA mov ebx, edx
:0044A420 8BF0 mov esi, eax
:0044A422 8BC3 mov eax, ebx
:0044A424 FF50F4 call [eax-0C]
:0044A427 8BD8 mov ebx, eax
:0044A429 8B45FC mov eax, dword ptr [ebp-04]
:0044A42C 8918 mov dword ptr [eax], ebx
:0044A42E 33C0 xor eax, eax
:0044A430 55 push ebp
:0044A431 6852A44400 push 0044A452
:0044A436 64FF30 push dword ptr fs:[eax]
:0044A439 648920 mov dword ptr fs:[eax], esp
:0044A43C 8BCE mov ecx, esi
:0044A43E 83CAFF or edx, FFFFFFFF
:0044A441 8BC3 mov eax, ebx
:0044A443 8B38 mov edi, dword ptr [eax]
:0044A445 FF572C call [edi+2C] <===因为一过这里就出现了未注册信息，所以F8再进入
:0044A448 33C0 xor eax, eax
:0044A44A 5A pop edx
:0044A44B 59 pop ecx
:0044A44C 59 pop ecx
:0044A44D 648910 mov dword ptr fs:[eax], edx
:0044A450 EB16 jmp 0044A468
:0044A452 E9158FFBFF jmp 0040336C
:0044A457 8B45FC mov eax, dword ptr [ebp-04]
:0044A45A 33D2 xor edx, edx
:0044A45C 8910 mov dword ptr [eax], edx
:0044A45E E81192FBFF call 00403674
:0044A463 E86092FBFF call 004036C8
......
......
_______________________________F8来到下面代码段_______________________________________________
:0047C448 53 push ebx
:0047C449 56 push esi
:0047C44A 84D2 test dl, dl
:0047C44C 7408 je 0047C456 <===不跳
:0047C44E 83C4F0 add esp, FFFFFFF0
:0047C451 E8AA6DF8FF call 00403200
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C44C(C)
|
:0047C456 8BDA mov ebx, edx
:0047C458 8BF0 mov esi, eax
:0047C45A 33D2 xor edx, edx
:0047C45C 8BC6 mov eax, esi
:0047C45E E80571FCFF call 00443568
:0047C463 8BC6 mov eax, esi
:0047C465 84DB test bl, bl
:0047C467 740F je 0047C478 <===不跳
:0047C469 E8EA6DF8FF call 00403258 <===因为一过这里就出现了未注册信息，所以F8第三次进入(不要晕!胜利就在前方)
:0047C46E 648F0500000000 pop dword ptr fs:[00000000]
:0047C475 83C40C add esp, 0000000C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C467(C)
|
:0047C478 8BC6 mov eax, esi
:0047C47A 5E pop esi
:0047C47B 5B pop ebx
:0047C47C C3 ret
......
......
_______________________________F8来到下面代码段_______________________________________________
:00403258 50 push eax
:00403259 8B10 mov edx, dword ptr [eax]
:0040325B FF52E4 call [edx-1C]
:0040325E 58 pop eax
:0040325F C3 ret
......
_______________________________程序进到402EA5_______________________________________________
:00402EA5 648F0500000000 pop dword ptr fs:[00000000]
:00402EAC 83C40C add esp, 0000000C
:00402EAF C3 ret
......
_______________________________程序进到47AA21_______________________________________________
:0047AA21 89832C030000 mov dword ptr [ebx+0000032C], eax
:0047AA27 33C0 xor eax, eax
:0047AA29 898330030000 mov dword ptr [ebx+00000330], eax
:0047AA2F 8BCB mov ecx, ebx
:0047AA31 B201 mov dl, 01
* Possible StringData Ref from Code Obj ->"?C"
|
:0047AA33 A194614700 mov eax, dword ptr [00476194]
:0047AA38 E82B8BFCFF call 00443568
:0047AA3D 8BF0 mov esi, eax
:0047AA3F 89B338030000 mov dword ptr [ebx+00000338], esi
:0047AA45 8BC6 mov eax, esi
:0047AA47 E844C8FCFF call 00447290
:0047AA4C 8B8338030000 mov eax, dword ptr [ebx+00000338]
:0047AA52 8998EC020000 mov dword ptr [eax+000002EC], ebx
* Possible StringData Ref from Code Obj ->"U嬱j"
|
:0047AA58 C780E8020000A8C14700 mov dword ptr [ebx+000002E8], 0047C1A8
:0047AA62 E8F1B1FFFF call 00475C58
:0047AA67 833DCC0A480000 cmp dword ptr [00480ACC], 00000000
:0047AA6E 740D je 0047AA7D
:0047AA70 8B15CC0A4800 mov edx, dword ptr [00480ACC]
:0047AA76 8BC3 mov eax, ebx
:0047AA78 E893FDFFFF call 0047A810 <===因为一过这里就出现了未注册信息，所以F8第四次进入(呵呵!)
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AA6E(C)
|
:0047AA7D A1F4E74700 mov eax, dword ptr [0047E7F4]
:0047AA82 C60000 mov byte ptr [eax], 00
:0047AA85 8BC3 mov eax, ebx
:0047AA87 E860140000 call 0047BEEC
:0047AA8C A1F4E74700 mov eax, dword ptr [0047E7F4]
:0047AA91 C60001 mov byte ptr [eax], 01
:0047AA94 8BC3 mov eax, ebx
:0047AA96 E849140000 call 0047BEE4
:0047AA9B 8BC3 mov eax, ebx
:0047AA9D E832160000 call 0047C0D4
:0047AAA2 A1CC0A4800 mov eax, dword ptr [00480ACC]
......
......