PCMedik - version 3.9.2.2002 (系统优化)

时间:2005-12-20 来源: 作者: 点击:
直接用PE-Scan脱壳,用w32dasm反汇编 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:004A903C(C)--------------------------跟进 | :004A9087 6A10 push 00000010 * Possible StringData Ref from Code Obj -"PCMedik Registration" | :004A9
  直接用PE-Scan脱壳,用w32dasm反汇编

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A903C(C)--------------------------跟进
|
:004A9087 6A10                    push 00000010

* Possible StringData Ref from Code Obj ->"PCMedik Registration"
                                 |
:004A9089 68E4904A00              push 004A90E4

* Possible StringData Ref from Code Obj ->"Sorry Invalid Key File!"
********************
到这儿
:004A903C 7449                    je 004A9087------------jne
:004A903E A1BC8D4C00              mov eax, dword ptr [004C8DBC]
:004A9043 E8708BFBFF              call 00461BB8
:004A9048 A1B0784C00              mov eax, dword ptr [004C78B0]
:004A904D 8B00                    mov eax, dword ptr [eax]
:004A904F 8B8014030000            mov eax, dword ptr [eax+00000314]
:004A9055 E8CEA6F5FF              call 00403728
:004A905A A1B0784C00              mov eax, dword ptr [004C78B0]
:004A905F 8B00                    mov eax, dword ptr [eax]
:004A9061 8B8018030000            mov eax, dword ptr [eax+00000318]
:004A9067 E8BCA6F5FF              call 00403728
:004A906C 6A40                    push 00000040

* Possible StringData Ref from Code Obj ->"PCMedik Registration"
                                 |
:004A906E 68E4904A00              push 004A90E4

* Possible StringData Ref from Code Obj ->"Thank You For Registering PCMedik!"
*****************
:004AC475 E8EA050000              call 004ACA64
:004AC47A 84C0                    test al, al
:004AC47C 0F846C010000            je 004AC5EE----------跳到这儿
:004AC482 6A40                    push 00000040

* Possible StringData Ref from Code Obj ->"PCMedik Registration"
                                 |
:004AC484 68C8C64A00              push 004AC6C8

* Possible StringData Ref from Code Obj ->"Thank You For Registering PCMedik!"

***********
跳到这儿
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004AC47C(C), :004AC4BB(U), :004AC51A(C), :004AC540(U), :004AC59F(C)
|:004AC5C1(U), :004AC5CC(C)------------修改相应跳转(je-jne,jmp不变)
|
:004AC5EE 8BC3                    mov eax, ebx
:004AC5F0 E8D3F1FBFF              call 0046B7C8
:004AC5F5 8BC3                    mov eax, ebx
:004AC5F7 E82C71F5FF              call 00403728
:004AC5FC 33C0                    xor eax, eax
:004AC5FE 5A                      pop edx
:004AC5FF 59                      pop ecx
:004AC600 59                      pop ecx
:004AC601 648910                  mov dword ptr fs:[eax], edx
:004AC604 EB0A                    jmp 004AC610
:004AC606 E9FD75F5FF              jmp 00403C08
:004AC60B E86079F5FF              call 00403F70

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

Throttle - version 3.9.2.2002 (网络加速)
SuperRam - version 2.8.14.2002(内存优化)可用同样的方法破解

------分隔线----------------------------
顶一下
(0)
0%
踩一下
(0)
0%
------分隔线----------------------------
最新评论 查看所有评论
发表评论 查看所有评论
请自觉遵守互联网相关的政策法规,严禁发布色情、暴力、反动的言论。
评价:
表情:
用户名: 密码: 验证码:
推荐内容