------------------------------------------------------------------
上面004148E1的CALL来到这里:
* Referenced by a CALL at Address:
|:004148E1
|
:00414C60 51 push ecx
:00414C61 56 push esi
:00414C62 57 push edi
:00414C63 8BF1 mov esi, ecx
:00414C65 6A05 push 00000005
:00414C67 8D44240C lea eax, dword ptr [esp 0C]
:00414C6B 6A05 push 00000005
:00414C6D 50 push eax
:00414C6E 8D8EF4010000 lea ecx, dword ptr [esi 000001F4]
:00414C74 E820850100 call 0042D199
:00414C79 8B00 mov eax, dword ptr [eax]
:00414C7B 50 push eax
:00414C7C E8709A0000 call 0041E6F1
:00414C81 83C404 add esp, 00000004
:00414C84 8D4C2408 lea ecx, dword ptr [esp 08]
:00414C88 8BF8 mov edi, eax
:00414C8A E8FAE10100 call 00432E89
:00414C8F 8B8EEC010000 mov ecx, dword ptr [esi 000001EC]
:00414C95 51 push ecx
:00414C96 E8B5030000 call 00415050
:00414C9B 83C404 add esp, 00000004
:00414C9E 3BF8 cmp edi, eax
//和上面相同,关键比较...
//EDI和EAX寄存器分别存着真假注册码的前五位数的十六进制值!
:00414CA0 8986EC010000 mov dword ptr [esi 000001EC], eax
:00414CA6 7509 jne 00414CB1
:00414CA8 6A02 push 00000002
:00414CAA 8BCE mov ecx, esi
:00414CAC E80FFFFFFF call 00414BC0
//和上面相同
//这里进去有三个跳转,这三个跳转不跳的话就出现注册成功窗口!
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414CA6(C)
|
:00414CB1 5F pop edi
:00414CB2 5E pop esi
:00414CB3 59 pop ecx
:00414CB4 C3 ret
------------------------------------------------------------------
这里就是00414CAC和00414D0A的CALL来到的地方:
* Referenced by a CALL at Addresses:
|:00414586 , :00414CAC , :00414D0A
|
:00414BC0 56 push esi
:00414BC1 8BF1 mov esi, ecx
:00414BC3 E8CCA20200 call 0043EE94
:00414BC8 8B5004 mov edx, dword ptr [eax 04]
:00414BCB 8B442408 mov eax, dword ptr [esp 08]
:00414BCF 48 dec eax
:00414BD0 7452 je 00414C24
:00414BD2 48 dec eax
:00414BD3 7436 je 00414C0B
//我追出来的正确注册码和"安靖"的注册码在这里都跳走了!
:00414BD5 48 dec eax
:00414BD6 0F8580000000 jne 00414C5C
:00414BDC 6A00 push 00000000
:00414BDE 6A01 push 00000001
:00414BE0 8BCA mov ecx, edx
:00414BE2 C7825802000001000000 mov dword ptr [ebx 00000258], 00000001
:00414BEC E8AFFFFEFF call 00404BA0
:00414BF1 6A00 push 00000000
:00414BF3 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"注册成功, 请重新启动程式!"
|
:00414BF5 68C05B4500 push 00455BC0
:00414BFA E8B43D0200 call 004389B3
:00414BFF 6A00 push 00000000
* Reference To: USER32.PostQuitMessage, Ord:01E0h
|
:00414C01 FF1564644400 Call dword ptr [00446464]
:00414C07 5E pop esi
:00414C08 C20400 ret 0004
------------------------------------------------------------------
【总 结】：
我追出的注册码(邮箱不填也能够):
Yock196
KHSC-3518239909*****(后面五位随便)
安靖兄的注册码:
anjing
KHSC-351821842415032
注册信息保存在C:/WINDOWS/SYSTEM/SysXCasterDrv.sys
用我追出来的注册码按注册后没有反应(但也能成功!)
用安靖兄的注册码按注册后会弹出"注册成功, 请重新启动程式!"的框!
我想可能是我没有追到核心,所以想和大家探讨一下!
我问过安靖了,可是没有解决问题!好没头绪,希望又朋友能帮我看看!
最后在这里真心感谢您花了那么多时间看这篇文章!谢谢了...
