:0047A810 55 push ebp
:0047A811 8BEC mov ebp, esp
:0047A813 83C4E8 add esp, FFFFFFE8
:0047A816 53 push ebx
:0047A817 56 push esi
:0047A818 57 push edi
:0047A819 33C9 xor ecx, ecx
:0047A81B 894DEC mov dword ptr [ebp-14], ecx
:0047A81E 894DE8 mov dword ptr [ebp-18], ecx
:0047A821 8BDA mov ebx, edx
:0047A823 8BF0 mov esi, eax
:0047A825 33C0 xor eax, eax
:0047A827 55 push ebp
:0047A828 684AA94700 push 0047A94A
:0047A82D 64FF30 push dword ptr fs:[eax]
:0047A830 648920 mov dword ptr fs:[eax], esp
:0047A833 8BC3 mov eax, ebx
:0047A835 E8F27DF9FF call 0041262C
:0047A83A 8BD0 mov edx, eax
:0047A83C 83EA10 sub edx, 00000010
:0047A83F 33C9 xor ecx, ecx
:0047A841 8BC3 mov eax, ebx
:0047A843 8B38 mov edi, dword ptr [eax]
:0047A845 FF570C call [edi+0C]
:0047A848 8D55F0 lea edx, dword ptr [ebp-10]
:0047A84B B910000000 mov ecx, 00000010
:0047A850 8BC3 mov eax, ebx
:0047A852 8B38 mov edi, dword ptr [eax]
:0047A854 FF5704 call [edi+04]
:0047A857 8B7DFC mov edi, dword ptr [ebp-04]
:0047A85A 81FF97130000 cmp edi, 00001397
:0047A860 7440 je 0047A8A2 <===跳转了，不然就进看下面:-)
:0047A862 6A00 push 00000000
:0047A864 8D4DE8 lea ecx, dword ptr [ebp-18]
:0047A867 33D2 xor edx, edx
:0047A869 8BC7 mov eax, edi
:0047A86B E8C0E0F8FF call 00408930
:0047A870 8B4DE8 mov ecx, dword ptr [ebp-18]
:0047A873 8D45EC lea eax, dword ptr [ebp-14]
* Possible StringData Ref from Code Obj ->"这本 eBook 具有一个错误的签名. "
->"这个程序将被终止.
签名: "
|
:0047A876 BA60A94700 mov edx, 0047A960
:0047A87B E8F095F8FF call 00403E70
:0047A880 8B45EC mov eax, dword ptr [ebp-14]
:0047A883 668B0DB4A94700 mov cx, word ptr [0047A9B4]
:0047A88A B201 mov dl, 01
:0047A88C E8D337FDFF call 0044E064
:0047A891 A10CE84700 mov eax, dword ptr [0047E80C]
:0047A896 8B00 mov eax, dword ptr [eax]
:0047A898 E8ABFCFCFF call 0044A548
:0047A89D E98D000000 jmp 0047A92F
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A860(C)
|
:0047A8A2 8BC3 mov eax, ebx <===程序跳到这里，继续往下走
:0047A8A4 E8837DF9FF call 0041262C
:0047A8A9 8BF8 mov edi, eax
:0047A8AB 2B7DF0 sub edi, dword ptr [ebp-10]
:0047A8AE 89BE1C030000 mov dword ptr [esi+0000031C], edi
:0047A8B4 33C9 xor ecx, ecx
:0047A8B6 8BD7 mov edx, edi
:0047A8B8 8BC3 mov eax, ebx
:0047A8BA 8B38 mov edi, dword ptr [eax]
:0047A8BC FF570C call [edi+0C]
:0047A8BF 8BD3 mov edx, ebx
:0047A8C1 8BC6 mov eax, esi
:0047A8C3 E858030000 call 0047AC20
:0047A8C8 8BD3 mov edx, ebx
:0047A8CA 8BC6 mov eax, esi
:0047A8CC E807F5FFFF call 00479DD8 <===因为一过这里就出现了未注册信息，所以F8第五次进入(555555~~~~还要进)
:0047A8D1 8BD3 mov edx, ebx
:0047A8D3 8BC6 mov eax, esi
:0047A8D5 E816FAFFFF call 0047A2F0
:0047A8DA 8BD3 mov edx, ebx
:0047A8DC 8BC6 mov eax, esi
:0047A8DE E8C9F5FFFF call 00479EAC
:0047A8E3 80BE6C03000000 cmp byte ptr [esi+0000036C], 00
:0047A8EA 7509 jne 0047A8F5
:0047A8EC 8BD3 mov edx, ebx
:0047A8EE 8BC6 mov eax, esi
:0047A8F0 E83BFAFFFF call 0047A330
......
......
_______________________________F8来到下面代码段_______________________________________________
:00479DD8 55 push ebp
:00479DD9 8BEC mov ebp, esp
:00479DDB 51 push ecx
:00479DDC 53 push ebx
:00479DDD 56 push esi
:00479DDE 8BF2 mov esi, edx
:00479DE0 8BD8 mov ebx, eax
:00479DE2 8D9320030000 lea edx, dword ptr [ebx+00000320]
:00479DE8 8BC6 mov eax, esi
:00479DEA E83DE5FFFF call 0047832C
:00479DEF 8D9324030000 lea edx, dword ptr [ebx+00000324]
:00479DF5 8BC6 mov eax, esi
:00479DF7 E830E5FFFF call 0047832C
:00479DFC 8D9328030000 lea edx, dword ptr [ebx+00000328]
:00479E02 8BC6 mov eax, esi
:00479E04 E823E5FFFF call 0047832C
:00479E09 6A00 push 00000000
:00479E0B 8B9324030000 mov edx, dword ptr [ebx+00000324]
:00479E11 8B8320030000 mov eax, dword ptr [ebx+00000320]
* Possible StringData Ref from Code Obj ->"~TurnIde@$IntoProfit$w/eBook$!>>YouC@n$ucceed!"
->"<<"
|
:00479E17 B9789E4700 mov ecx, 00479E78
:00479E1C E83BE2FFFF call 0047805C <===算法CALL了，最后一次F8进入，看个究竟
:00479E21 84C0 test al, al
:00479E23 7544 jne 00479E69 <===关键跳转(终于到了)，爆破只针对每个exe文件，所以没多大意思
:00479E25 8BCB mov ecx, ebx
:00479E27 B201 mov dl, 01
* Possible StringData Ref from Code Obj ->"?C"
|
:00479E29 A1B4744700 mov eax, dword ptr [004774B4]
:00479E2E E83597FCFF call 00443568
:00479E33 8945FC mov dword ptr [ebp-04], eax
:00479E36 33C0 xor eax, eax
:00479E38 55 push ebp
:00479E39 68629E4700 push 00479E62
:00479E3E 64FF30 push dword ptr fs:[eax]
:00479E41 648920 mov dword ptr fs:[eax], esp
:00479E44 8B45FC mov eax, dword ptr [ebp-04]
:00479E47 E88CD8FFFF call 004776D8
:00479E4C 33C0 xor eax, eax
:00479E4E 5A pop edx
:00479E4F 59 pop ecx
:00479E50 59 pop ecx
:00479E51 648910 mov dword ptr fs:[eax], edx
:00479E54 68699E4700 push 00479E69
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479E67(U)
|
:00479E59 8B45FC mov eax, dword ptr [ebp-04]
:00479E5C E85F90F8FF call 00402EC0
:00479E61 C3 ret
:00479E62 E9B997F8FF jmp 00403620
:00479E67 EBF0 jmp 00479E59
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479E23(C)
|
:00479E69 5E pop esi
:00479E6A 5B pop ebx
:00479E6B 59 pop ecx
:00479E6C 5D pop ebp
:00479E6D C3 ret
_______________________________F8来到下面代码段_______________________________________________
:0047805C 55 push ebp <===此处下D EAX发现EAX=newlaos，下D EDX发现EDX＝78787878
:0047805D 8BEC mov ebp, esp
:0047805F 81C4FCFEFFFF add esp, FFFFFEFC
:00478065 53 push ebx
:00478066 56 push esi
:00478067 57 push edi
:00478068 33DB xor ebx, ebx
:0047806A 895DFC mov dword ptr [ebp-04], ebx
:0047806D 8BF9 mov edi, ecx
:0047806F 8BF2 mov esi, edx
:00478071 8BD8 mov ebx, eax
:00478073 8B4508 mov eax, dword ptr [ebp+08]
:00478076 E85DBFF8FF call 00403FD8
:0047807B 33C0 xor eax, eax
:0047807D 55 push ebp
:0047807E 68D7804700 push 004780D7
:00478083 64FF30 push dword ptr fs:[eax]
:00478086 648920 mov dword ptr fs:[eax], esp
:00478089 8D85FCFEFFFF lea eax, dword ptr [ebp+FFFFFEFC]
:0047808F 50 push eax
:00478090 8B4D08 mov ecx, dword ptr [ebp+08]
:00478093 8BD7 mov edx, edi
:00478095 8BC3 mov eax, ebx
:00478097 E810FEFFFF call 00477EAC <===此CALL算出与用户名相对应的注册码
:0047809C 8D95FCFEFFFF lea edx, dword ptr [ebp+FFFFFEFC]
:004780A2 8D45FC lea eax, dword ptr [ebp-04] <===此处下D EAX发现注册码，但位置不正确
:004780A5 E81EBDF8FF call 00403DC8
:004780AA 8B45FC mov eax, dword ptr [ebp-04] <===此处将真码放入EAX
:004780AD 8BD6 mov edx, esi <===将假码78787878放入EDX，在这下命令D EAX可以看见注册码
:004780AF E880BEF8FF call 00403F34
:004780B4 0F94C0 sete al
:004780B7 8BD8 mov ebx, eax
:004780B9 33C0 xor eax, eax
:004780BB 5A pop edx
:004780BC 59 pop ecx
:004780BD 59 pop ecx
:004780BE 648910 mov dword ptr fs:[eax], edx
:004780C1 68DE804700 push 004780DE
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004780DC(U)
|
:004780C6 8D45FC lea eax, dword ptr [ebp-04]
:004780C9 E8D6BAF8FF call 00403BA4
:004780CE 8D4508 lea eax, dword ptr [ebp+08]
:004780D1 E8CEBAF8FF call 00403BA4
:004780D6 C3 ret
4、制作内存注册机：(keymake 1.73)
一、选择F8 → 另类注册机！
程序名称：crack.exe
添加数据：
中断地址：004780AD
中断次数：1
第一字节：8B
指令长度：2
保存下列信息为注册码 → 内存方式 → 寄存器 → EAX
二、选择内存方式：内存地址 → BF693C → 点生成，就有你乐的了(这一句是学老师的;)
三、内存注册机的使用：由于是针对生成的exe文件，如果要用注册机，就必须将exe文件改名为在制作注册机时定义的程序名称（本例制作出的注册机，使用时就应把exe文件改名为crack.exe），否则不能完成找注册码的工作。找到注册码，只取前面16字符就可以了！
5、我的注册信息
受权给：newlaos
注册键：EDwKZK84BuzRTYQ2