用户名：36382052zc4661586
假注册码：787878787878
softice 下bpx hmemcpy
点注册，拦截，下bd *，按F12键7下，再按F10键到
:0048402B 837DFC00 cmp dword ptr [ebp-04], 00000000 //停在这里
:0048402F 750F jne 00484040
* Possible StringData Ref from Code Obj ->"You must have Register Name"
|
:00484031 B844434800 mov eax, 00484344
:00484036 E8CDFAFCFF call 00453B08
:0048403B E9AA020000 jmp 004842EA
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048402F(C)
|
:00484040 8D55F8 lea edx, dword ptr [ebp-08]
:00484043 8B8308030000 mov eax, dword ptr [ebx+00000308]
:00484049 E8A6A6FAFF call 0042E6F4
:0048404E 837DF800 cmp dword ptr [ebp-08], 00000000
:00484052 750F jne 00484063
* Possible StringData Ref from Code Obj ->"You can't leave the Register Number "
->"blank"
|
:00484054 B868434800 mov eax, 00484368
:00484059 E8AAFAFCFF call 00453B08 //注册用户名不能为空
:0048405E E987020000 jmp 004842EA
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484052(C)
|
:00484063 8D55F4 lea edx, dword ptr [ebp-0C]
:00484066 8B8308030000 mov eax, dword ptr [ebx+00000308]
:0048406C E883A6FAFF call 0042E6F4
:00484071 8B45F4 mov eax, dword ptr [ebp-0C]
:00484074 50 push eax
:00484075 8D4DF0 lea ecx, dword ptr [ebp-10]
:00484078 A10CF34900 mov eax, dword ptr [0049F30C]
:0048407D 8B00 mov eax, dword ptr [eax]
:0048407F 8B15F40D4A00 mov edx, dword ptr [004A0DF4]
:00484085 E8AE470100 call 00498838 //关键的计算注册码的call
:0048408A 8B55F0 mov edx, dword ptr [ebp-10] //将注册码给edx
:0048408D 58 pop eax //d edx 可得到真的注册码
:0048408E E8A1FDF7FF call 00403E34
:00484093 0F85F0000000 jne 00484189
:00484099 8D55EC lea edx, dword ptr [ebp-14]
:0048409C 8B8304030000 mov eax, dword ptr [ebx+00000304]
:004840A2 E84DA6FAFF call 0042E6F4
:004840A7 8B55EC mov edx, dword ptr [ebp-14]
:004840AA A1F40D4A00 mov eax, dword ptr [004A0DF4]
:004840AF E880FDF7FF call 00403E34
:004840B4 0F85CF000000 jne 00484189 //爆破地点
* Possible StringData Ref from Code Obj ->"Registed Passed, Thanks!"
|
:004840BA B89C434800 mov eax, 0048439C
:004840BF E844FAFCFF call 00453B08
注册码存放在注册表的HKEY_CURRENT_USER\WYABDC Registry\setup分支下RegInfoRegNum=""里 我的真注册码为:111126994009268