Picture To Icon 2.4爆破分析&附赠美女图，哈哈

zaas · 发表于 2010-5-25 15:54:07

本帖最后由 zaas 于 2010-5-25 17:29 编辑

【文章标题】: Picture To Icon 2.4爆破分析
【文章作者】: zaas
【下载地址】: http://www.exeicon.com/picture-to-icon/
【加壳方式】: ASPack 2.001 -> Alexey Solodovnikov
【编写语言】: Borland C++ DLL Method 1
【使用工具】: PEID/OD/dede
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
【软件介绍】能将图片或屏幕的一部分转化为ICON图标，调整图标大小以及从资源库中提取icon。支持BMP, JPEG, GIF, CUR, WMF。
Picture To Icon can convert images or any part on your screen into icons, extract icons from libraries, modify the icon and convert icon to png or bmp .
Picture To Icon converts PNG, BMP, JPEG, GIF, CUR, WMF formats into multi-resolution Windows icons. You can capture your screen part and convert it to icon. You can easily create, edit, read and save icons with transparency. With color similarity adjustment, icon creation is made easy. You can extract icons from Windows resource files such as EXE, DLL, OCX file.
【详细过程】
按照N大的要求，遂有了这篇。最近不怎么写爆破文章，算法为主。嘿嘿。
ASPack esp脱之，不多说。
启动时弹出Nag要求注册，输入
注册名：zaas
假码：1334567890123456789012345678901234567890P2I4
下GetWindowTextA断点，成功断下。
返回发现已经在注册错误对话框了：
004AFC7E  |.  8BF8       mov    edi, eax
004AFC80  |.  8B45 F4    mov    eax, dword ptr [ebp-C]
004AFC83  |.  89B8 F0020000 mov    dword ptr [eax+2F0], edi
004AFC89  |.  BA 88FE4A00 mov    edx, 004AFE88                   ;  ASCII "Message"
004AFC8E  |.  8BC7       mov    eax, edi
004AFC90  |.  8B08       mov    ecx, dword ptr [eax]
004AFC92  |.  FF51 18    call dword ptr [ecx+18]
004AFC95  |.  8B55 F4    mov    edx, dword ptr [ebp-C]
004AFC98  |.  8BC7       mov    eax, edi
004AFC9A  |.  8B08       mov    ecx, dword ptr [eax]
004AFC9C  |.  FF51 68    call dword ptr [ecx+68]
004AFC9F  |.  B2 01       mov    dl, 1
004AFCA1  |.  8BC7       mov    eax, edi
004AFCA3  |.  E8 E8E2FCFF call 0047DF90
004AFCA8  |.  8B55 FC    mov    edx, dword ptr [ebp-4]          ;  ASCII "Your registration code is invalid.",LF,"If you have purchased this software and get the wrong code, maybe you have not downloaded and installed the latest version. Or please send email to: support@exeicon.com ",LF

继续返回。。。直到：
00424BCC  /.  55          push ebp                            ;  注册按钮事件
00424BCD  |.  8BEC       mov    ebp, esp
00424BCF  |.  83C4 9C    add    esp, -64
00424BD2  |.  8955 A0    mov    dword ptr [ebp-60], edx
00424BD5  |.  8945 A4    mov    dword ptr [ebp-5C], eax
00424BD8  |.  B8 180E5000 mov    eax, 00500E18
00424BDD  |.  E8 EA7C0B00 call 004DC8CC
00424BE2  |.  8B15 64D15000 mov    edx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
00424BE8  |.  8B0A       mov    ecx, dword ptr [edx]
00424BEA    80B9 F8030000>cmp    byte ptr [ecx+3F8], 0          ;  注意这个全局变量
00424BF1    0F85 3A030000 jnz    00424F31                      ;  jnz说明已经注册，可以直接跳过注册检测
00424BF7  |.  66:C745 B8 08>mov    word ptr [ebp-48], 8
00424BFD  |.  8D45 FC    lea    eax, dword ptr [ebp-4]
00424C00  |.  E8 CBDEFDFF call 00402AD0
00424C05  |.  8BD0       mov    edx, eax
00424C07  |.  FF45 C4    inc    dword ptr [ebp-3C]
00424C0A  |.  8B4D A4    mov    ecx, dword ptr [ebp-5C]
00424C0D  |.  8B81 00030000 mov    eax, dword ptr [ecx+300]
00424C13  |.  E8 C80C0900 call 004B58E0                      ;  取出注册名
00424C18  |.  8D45 FC    lea    eax, dword ptr [ebp-4]
00424C1B  |.  E8 FC27FEFF call 0040741C                      ;  注册名长度
00424C20  |.  83F8 03    cmp    eax, 3                         ;  要大于三位
00424C23  |.  0F9CC2       setl dl
00424C26  |.  83E2 01    and    edx, 1
00424C29  |.  52          push edx
00424C2A  |.  FF4D C4    dec    dword ptr [ebp-3C]
00424C2D  |.  8D45 FC    lea    eax, dword ptr [ebp-4]
00424C30  |.  BA 02000000 mov    edx, 2
00424C35  |.  E8 9E2E0C00 call 004E7AD8
00424C3A  |.  59          pop    ecx
00424C3B  |.  84C9       test cl, cl
00424C3D  |.  74 3C       je    short 00424C7B                ;  否则弹出输入注册名对话框
00424C3F  |.  66:C745 B8 14>mov    word ptr [ebp-48], 14
00424C45  |.  BA C8035000 mov    edx, 005003C8                   ;  ASCII "Please input your Full Name!"
00424C4A  |.  8D45 F8    lea    eax, dword ptr [ebp-8]
00424C4D  |.  E8 262D0C00 call 004E7978
00424C52  |.  FF45 C4    inc    dword ptr [ebp-3C]
00424C55  |.  8B00       mov    eax, dword ptr [eax]
00424C57  |.  E8 0CB30800 call 004AFF68
00424C5C  |.  FF4D C4    dec    dword ptr [ebp-3C]
00424C5F  |.  8D45 F8    lea    eax, dword ptr [ebp-8]
00424C62  |.  BA 02000000 mov    edx, 2
00424C67  |.  E8 6C2E0C00 call 004E7AD8
00424C6C  |.  8B4D A8    mov    ecx, dword ptr [ebp-58]
00424C6F  |.  64:890D 00000>mov    dword ptr fs:[0], ecx
00424C76  |.  E9 C8020000 jmp    00424F43
00424C7B  |>  68 F4010000 push 1F4                            ; /Timeout = 500. ms
00424C80  |.  E8 5F680D00 call <jmp.&kernel32.Sleep>          ; \Sleep
00424C85  |.  66:C745 B8 20>mov    word ptr [ebp-48], 20          ;  睡会儿
00424C8B  |.  8D45 F4    lea    eax, dword ptr [ebp-C]
00424C8E  |.  E8 3DDEFDFF call 00402AD0
00424C93  |.  8BD0       mov    edx, eax
00424C95  |.  FF45 C4    inc    dword ptr [ebp-3C]
00424C98  |.  8B4D A4    mov    ecx, dword ptr [ebp-5C]
00424C9B  |.  8B81 04030000 mov    eax, dword ptr [ecx+304]
00424CA1  |.  E8 3A0C0900 call 004B58E0                      ;  假码的取出
00424CA6  |.  8D55 F4    lea    edx, dword ptr [ebp-C]
00424CA9  |.  FF32       push dword ptr [edx]                ;  假码的长度
00424CAB  |.  E8 08E3FFFF call 00422FB8                      ;  算法call
00424CB0  |.  59          pop    ecx
00424CB1  |.  8B0D 64D15000 mov    ecx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
00424CB7  |.  8B11       mov    edx, dword ptr [ecx]
00424CB9  |.  8882 F8030000 mov    byte ptr [edx+3F8], al          ;  给全局变量赋值
00424CBF  |.  FF4D C4    dec    dword ptr [ebp-3C]
00424CC2  |.  8D45 F4    lea    eax, dword ptr [ebp-C]
00424CC5  |.  BA 02000000 mov    edx, 2
00424CCA  |.  E8 092E0C00 call 004E7AD8
00424CCF  |.  A1 64D15000 mov    eax, dword ptr [50D164]
00424CD4  |.  8B08       mov    ecx, dword ptr [eax]
00424CD6  |.  80B9 F8030000>cmp    byte ptr [ecx+3F8], 0          ;  比较全局变量
00424CDD    0F84 1F020000 je    00424F02                      ;  跳向死亡
00424CE3  |.  66:C745 B8 2C>mov    word ptr [ebp-48], 2C
00424CE9  |.  8D45 F0    lea    eax, dword ptr [ebp-10]
00424CEC  |.  E8 DFDDFDFF call 00402AD0
00424CF1  |.  8BD0       mov    edx, eax
00424CF3  |.  FF45 C4    inc    dword ptr [ebp-3C]
00424CF6  |.  8B4D A4    mov    ecx, dword ptr [ebp-5C]
00424CF9  |.  8B81 04030000 mov    eax, dword ptr [ecx+304]
00424CFF  |.  E8 DC0B0900 call 004B58E0
00424D04  |.  8D55 F0    lea    edx, dword ptr [ebp-10]
00424D07  |.  8B45 A4    mov    eax, dword ptr [ebp-5C]
00424D0A  |.  05 1C030000 add    eax, 31C
00424D0F  |.  E8 F42D0C00 call 004E7B08
00424D14  |.  FF4D C4    dec    dword ptr [ebp-3C]
00424D17  |.  8D45 F0    lea    eax, dword ptr [ebp-10]
00424D1A  |.  BA 02000000 mov    edx, 2
00424D1F  |.  E8 B42D0C00 call 004E7AD8
00424D24  |.  8B45 A4    mov    eax, dword ptr [ebp-5C]
00424D27  |.  05 1C030000 add    eax, 31C
00424D2C  |.  E8 D3D0FDFF call 00401E04
00424D31  |.  0FBE50 17    movsx edx, byte ptr [eax+17]
00424D35  |.  83FA 30    cmp    edx, 30
00424D38  |.  7C 16       jl    short 00424D50
00424D3A  |.  8B45 A4    mov    eax, dword ptr [ebp-5C]
00424D3D  |.  05 1C030000 add    eax, 31C
00424D42  |.  E8 BDD0FDFF call 00401E04
00424D47  |.  0FBE50 17    movsx edx, byte ptr [eax+17]          ;  假码第24位
00424D4B  |.  83FA 39    cmp    edx, 39
00424D4E  |.  7E 0F       jle    short 00424D5F                ;  应小于等于9
00424D50  |>  8B0D 64D15000 mov    ecx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
00424D56  |.  8B01       mov    eax, dword ptr [ecx]
00424D58  |.  C680 F8030000>mov    byte ptr [eax+3F8], 0          ;  又一个验证
00424D5F  |>  B2 01       mov    dl, 1
00424D61  |.  A1 2CDA4500 mov    eax, dword ptr [45DA2C]
00424D66  |.  E8 C18D0300 call 0045DB2C
00424D6B  |.  8945 9C    mov    dword ptr [ebp-64], eax
00424D6E  |.  BA 01000080 mov    edx, 80000001
00424D73  |.  8B45 9C    mov    eax, dword ptr [ebp-64]
00424D76  |.  E8 692B0C00 call 004E78E4
00424D7B  |.  8B15 64D15000 mov    edx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
00424D81  |.  8B0A       mov    ecx, dword ptr [edx]
00424D83    80B9 F8030000>cmp    byte ptr [ecx+3F8], 0          ;  全局变量的再次比较
00424D8A    0F84 06010000 je    00424E96                      ;  跳了就死
00424D90  |.  66:C745 B8 38>mov    word ptr [ebp-48], 38
00424D96  |.  BA E5035000 mov    edx, 005003E5                   ;  ASCII "Software\XTZY\Pic2Ico"
00424D9B  |.  8D45 EC    lea    eax, dword ptr [ebp-14]
00424D9E  |.  E8 D52B0C00 call 004E7978                      ;  写注册表了
00424DA3  |.  FF45 C4    inc    dword ptr [ebp-3C]
00424DA6  |.  8B10       mov    edx, dword ptr [eax]
00424DA8  |.  B1 01       mov    cl, 1
00424DAA  |.  8B45 9C    mov    eax, dword ptr [ebp-64]
00424DAD  |.  E8 7E8E0300 call 0045DC30
00424DB2  |.  84C0       test al, al
00424DB4  |.  0F95C0       setne al
00424DB7  |.  83E0 01    and    eax, 1
00424DBA  |.  50          push eax
00424DBB  |.  FF4D C4    dec    dword ptr [ebp-3C]
00424DBE  |.  8D45 EC    lea    eax, dword ptr [ebp-14]
00424DC1  |.  BA 02000000 mov    edx, 2
00424DC6  |.  E8 0D2D0C00 call 004E7AD8                      ;  又一次验证，**的作者
00424DCB  |.  59          pop    ecx
00424DCC  |.  85C9       test ecx, ecx
00424DCE  |.  0F84 C2000000 je    00424E96                      ;  跳了还是死
00424DD4  |.  8D45 E4    lea    eax, dword ptr [ebp-1C]
00424DD7  |.  E8 F4DCFDFF call 00402AD0
00424DDC  |.  8BD0       mov    edx, eax
00424DDE  |.  FF45 C4    inc    dword ptr [ebp-3C]
00424DE1  |.  8B4D A4    mov    ecx, dword ptr [ebp-5C]
00424DE4  |.  8B81 04030000 mov    eax, dword ptr [ecx+304]
00424DEA  |.  E8 F10A0900 call 004B58E0
00424DEF  |.  8D55 E4    lea    edx, dword ptr [ebp-1C]
00424DF2  |.  FF32       push dword ptr [edx]
00424DF4  |.  66:C745 B8 44>mov    word ptr [ebp-48], 44
00424DFA  |.  BA FB035000 mov    edx, 005003FB                   ;  ASCII "NO"
00424DFF  |.  8D45 E8    lea    eax, dword ptr [ebp-18]
00424E02  |.  E8 712B0C00 call 004E7978
00424E07  |.  FF45 C4    inc    dword ptr [ebp-3C]
00424E0A  |.  8B10       mov    edx, dword ptr [eax]
00424E0C  |.  8B45 9C    mov    eax, dword ptr [ebp-64]
00424E0F  |.  59          pop    ecx
00424E10  |.  E8 B78F0300 call 0045DDCC
00424E15  |.  FF4D C4    dec    dword ptr [ebp-3C]
00424E18  |.  8D45 E4    lea    eax, dword ptr [ebp-1C]
00424E1B  |.  BA 02000000 mov    edx, 2
00424E20  |.  E8 B32C0C00 call 004E7AD8
00424E25  |.  FF4D C4    dec    dword ptr [ebp-3C]
00424E28  |.  8D45 E8    lea    eax, dword ptr [ebp-18]
00424E2B  |.  BA 02000000 mov    edx, 2
00424E30  |.  E8 A32C0C00 call 004E7AD8
00424E35  |.  8D45 DC    lea    eax, dword ptr [ebp-24]
00424E38  |.  E8 93DCFDFF call 00402AD0
00424E3D  |.  8BD0       mov    edx, eax
00424E3F  |.  FF45 C4    inc    dword ptr [ebp-3C]
00424E42  |.  8B4D A4    mov    ecx, dword ptr [ebp-5C]
00424E45  |.  8B81 00030000 mov    eax, dword ptr [ecx+300]
00424E4B  |.  E8 900A0900 call 004B58E0
00424E50  |.  8D55 DC    lea    edx, dword ptr [ebp-24]
00424E53  |.  FF32       push dword ptr [edx]
00424E55  |.  66:C745 B8 50>mov    word ptr [ebp-48], 50
00424E5B  |.  BA FE035000 mov    edx, 005003FE                   ;  ASCII "Name"
00424E60  |.  8D45 E0    lea    eax, dword ptr [ebp-20]
00424E63  |.  E8 102B0C00 call 004E7978
00424E68  |.  FF45 C4    inc    dword ptr [ebp-3C]
00424E6B  |.  8B10       mov    edx, dword ptr [eax]
00424E6D  |.  8B45 9C    mov    eax, dword ptr [ebp-64]
00424E70  |.  59          pop    ecx
00424E71  |.  E8 568F0300 call 0045DDCC
00424E76  |.  FF4D C4    dec    dword ptr [ebp-3C]
00424E79  |.  8D45 DC    lea    eax, dword ptr [ebp-24]
00424E7C  |.  BA 02000000 mov    edx, 2
00424E81  |.  E8 522C0C00 call 004E7AD8
00424E86  |.  FF4D C4    dec    dword ptr [ebp-3C]
00424E89  |.  8D45 E0    lea    eax, dword ptr [ebp-20]
00424E8C  |.  BA 02000000 mov    edx, 2
00424E91  |.  E8 422C0C00 call 004E7AD8
00424E96  |>  8B45 9C    mov    eax, dword ptr [ebp-64]
00424E99  |.  E8 FE8C0300 call 0045DB9C                      ;  close regkey
00424E9E  |.  8B55 9C    mov    edx, dword ptr [ebp-64]
00424EA1  |.  8955 D4    mov    dword ptr [ebp-2C], edx
00424EA4  |.  837D D4 00 cmp    dword ptr [ebp-2C], 0
00424EA8  |.  74 21       je    short 00424ECB
00424EAA  |.  8B4D D4    mov    ecx, dword ptr [ebp-2C]
00424EAD  |.  8B01       mov    eax, dword ptr [ecx]
00424EAF  |.  8945 D8    mov    dword ptr [ebp-28], eax
00424EB2  |.  66:C745 B8 68>mov    word ptr [ebp-48], 68
00424EB8  |.  BA 03000000 mov    edx, 3
00424EBD  |.  8B45 D4    mov    eax, dword ptr [ebp-2C]
00424EC0  |.  8B08       mov    ecx, dword ptr [eax]
00424EC2  |.  FF51 FC    call dword ptr [ecx-4]
00424EC5  |.  66:C745 B8 5C>mov    word ptr [ebp-48], 5C
00424ECB  |>  66:C745 B8 74>mov    word ptr [ebp-48], 74
00424ED1  |.  BA 03045000 mov    edx, 00500403                   ;  ASCII "Register successfully!",LF,"Thank you."
00424ED6  |.  8D45 D0    lea    eax, dword ptr [ebp-30]
00424ED9  |.  E8 9A2A0C00 call 004E7978
00424EDE  |.  FF45 C4    inc    dword ptr [ebp-3C]
00424EE1  |.  8B00       mov    eax, dword ptr [eax]
00424EE3  |.  E8 80B00800 call 004AFF68                      ;  注册成功对话框
00424EE8  |.  FF4D C4    dec    dword ptr [ebp-3C]
00424EEB  |.  8D45 D0    lea    eax, dword ptr [ebp-30]
00424EEE  |.  BA 02000000 mov    edx, 2
00424EF3  |.  E8 E02B0C00 call 004E7AD8
00424EF8  |.  8B45 A4    mov    eax, dword ptr [ebp-5C]
00424EFB  |.  E8 F0010800 call 004A50F0
00424F00  |.  EB 37       jmp    short 00424F39
00424F02  |>  66:C745 B8 80>mov    word ptr [ebp-48], 80
00424F08  |.  BA 25045000 mov    edx, 00500425                   ;  ASCII "Your registration code is invalid.",LF,"If you have purchased this software and get the wrong code, maybe you have not downloaded and installed the latest version. Or please send email to: support@exeicon.com ",LF
00424F0D  |.  8D45 CC    lea    eax, dword ptr [ebp-34]
00424F10  |.  E8 632A0C00 call 004E7978
00424F15  |.  FF45 C4    inc    dword ptr [ebp-3C]
00424F18  |.  8B00       mov    eax, dword ptr [eax]
00424F1A  |.  E8 49B00800 call 004AFF68
00424F1F  |.  FF4D C4    dec    dword ptr [ebp-3C]
00424F22  |.  8D45 CC    lea    eax, dword ptr [ebp-34]
00424F25  |.  BA 02000000 mov    edx, 2
00424F2A  |.  E8 A92B0C00 call 004E7AD8
00424F2F  |.  EB 08       jmp    short 00424F39
00424F31  |>  8B45 A4    mov    eax, dword ptr [ebp-5C]
00424F34  |.  E8 B7010800 call 004A50F0
00424F39  |>  8B55 A8    mov    edx, dword ptr [ebp-58]
00424F3C  |.  64:8915 00000>mov    dword ptr fs:[0], edx
00424F43  |>  8BE5       mov    esp, ebp
00424F45  |.  5D          pop    ebp
00424F46  \.  C3          retn

这里有明确的注册成功或失败提示信息。在段首下断再来一次。
跟进算法call看看：
00422FB8  /$  55          push ebp
00422FB9  |.  8BEC       mov    ebp, esp
00422FBB  |.  81C4 70FFFFFF add    esp, -90
00422FC1  |.  56          push esi
00422FC2  |.  57          push edi
00422FC3  |.  B8 74055000 mov    eax, 00500574
00422FC8  |.  E8 FF980B00 call 004DC8CC
00422FCD  |.  C745 F4 01000>mov    dword ptr [ebp-C], 1
00422FD4  |.  8D55 08    lea    edx, dword ptr [ebp+8]
00422FD7  |.  8D45 08    lea    eax, dword ptr [ebp+8]
00422FDA  |.  E8 D1490C00 call 004E79B0
00422FDF  |.  FF45 F4    inc    dword ptr [ebp-C]
00422FE2  |.  66:C745 E8 08>mov    word ptr [ebp-18], 8
00422FE8  |.  C645 D7 00 mov    byte ptr [ebp-29], 0
00422FEC  |.  66:C745 E8 14>mov    word ptr [ebp-18], 14
00422FF2  |.  8D45 FC    lea    eax, dword ptr [ebp-4]
00422FF5  |.  E8 D6FAFDFF call 00402AD0
00422FFA  |.  8BD0       mov    edx, eax
00422FFC  |.  FF45 F4    inc    dword ptr [ebp-C]
00422FFF  |.  8D45 08    lea    eax, dword ptr [ebp+8]
00423002  |.  E8 194E0C00 call 004E7E20
00423007  |.  8D55 FC    lea    edx, dword ptr [ebp-4]
0042300A  |.  8D45 08    lea    eax, dword ptr [ebp+8]
0042300D  |.  E8 F64A0C00 call 004E7B08                      ;  假码的取出
00423012  |.  FF4D F4    dec    dword ptr [ebp-C]
00423015  |.  8D45 FC    lea    eax, dword ptr [ebp-4]
00423018  |.  BA 02000000 mov    edx, 2
0042301D  |.  E8 B64A0C00 call 004E7AD8
00423022  |.  8D45 08    lea    eax, dword ptr [ebp+8]
00423025  |.  E8 F243FEFF call 0040741C                      ; 假码长度
0042302A  |.  83F8 2C    cmp    eax, 2C                         ;  =2c
0042302D  |.  0F85 44020000 jnz    00423277                      ;  不等跳死
00423033  |.  BE B4FF4F00 mov    esi, 004FFFB4                   ;  ASCII "1z1h+2a0n-0g8y*9a1n|"
00423038  |.  8D7D 84    lea    edi, dword ptr [ebp-7C]
0042303B  |.  B9 05000000 mov    ecx, 5
00423040  |.  F3:A5       rep    movs dword ptr es:[edi], dword p>
00423042  |.  A4          movs byte ptr es:[edi], byte ptr [esi>
00423043  |.  66:C745 E8 08>mov    word ptr [ebp-18], 8
00423049  |.  8D45 08    lea    eax, dword ptr [ebp+8]
0042304C  |.  E8 B3EDFDFF call 00401E04
00423051  |.  0FBE50 28    movsx edx, byte ptr [eax+28]          ;  取假码倒数第4个字符
00423055  |.  83FA 50    cmp    edx, 50                         ;  应等于“P”
00423058  |.  74 23       je    short 0042307D
0042305A  |.  33C0       xor    eax, eax
0042305C  |.  50          push eax
0042305D  |.  FF4D F4    dec    dword ptr [ebp-C]
00423060  |.  8D45 08    lea    eax, dword ptr [ebp+8]
00423063  |.  BA 02000000 mov    edx, 2
00423068  |.  E8 6B4A0C00 call 004E7AD8
0042306D  |.  58          pop    eax
0042306E  |.  8B55 D8    mov    edx, dword ptr [ebp-28]
00423071  |.  64:8915 00000>mov    dword ptr fs:[0], edx
00423078  |.  E9 19020000 jmp    00423296
0042307D  |>  8D45 08    lea    eax, dword ptr [ebp+8]
00423080  |.  E8 7FEDFDFF call 00401E04
00423085  |.  0FBE50 29    movsx edx, byte ptr [eax+29]          ;  倒数第三个字符
00423089  |.  83FA 32    cmp    edx, 32                         ;  应等于2
0042308C  |.  74 23       je    short 004230B1
0042308E  |.  33C0       xor    eax, eax
00423090  |.  50          push eax
00423091  |.  FF4D F4    dec    dword ptr [ebp-C]
00423094  |.  8D45 08    lea    eax, dword ptr [ebp+8]
00423097  |.  BA 02000000 mov    edx, 2
0042309C  |.  E8 374A0C00 call 004E7AD8
004230A1  |.  58          pop    eax
004230A2  |.  8B55 D8    mov    edx, dword ptr [ebp-28]
004230A5  |.  64:8915 00000>mov    dword ptr fs:[0], edx
004230AC  |.  E9 E5010000 jmp    00423296
004230B1  |>  8D45 08    lea    eax, dword ptr [ebp+8]
004230B4  |.  E8 4BEDFDFF call 00401E04
004230B9  |.  0FBE50 2A    movsx edx, byte ptr [eax+2A]          ;  倒数第二个应等于I
004230BD  |.  83FA 49    cmp    edx, 49
004230C0  |.  74 23       je    short 004230E5
004230C2  |.  33C0       xor    eax, eax
004230C4  |.  50          push eax
004230C5  |.  FF4D F4    dec    dword ptr [ebp-C]
004230C8  |.  8D45 08    lea    eax, dword ptr [ebp+8]
004230CB  |.  BA 02000000 mov    edx, 2
004230D0  |.  E8 034A0C00 call 004E7AD8
004230D5  |.  58          pop    eax
004230D6  |.  8B55 D8    mov    edx, dword ptr [ebp-28]
004230D9  |.  64:8915 00000>mov    dword ptr fs:[0], edx
004230E0  |.  E9 B1010000 jmp    00423296
004230E5  |>  8D45 08    lea    eax, dword ptr [ebp+8]
004230E8  |.  E8 17EDFDFF call 00401E04
004230ED  |.  0FBE50 2B    movsx edx, byte ptr [eax+2B]          ;  最后一个应等于4
004230F1  |.  83FA 34    cmp    edx, 34
004230F4  |.  74 23       je    short 00423119
004230F6  |.  33C0       xor    eax, eax
004230F8  |.  50          push eax
004230F9  |.  FF4D F4    dec    dword ptr [ebp-C]
004230FC  |.  8D45 08    lea    eax, dword ptr [ebp+8]
004230FF  |.  BA 02000000 mov    edx, 2
00423104  |.  E8 CF490C00 call 004E7AD8
00423109  |.  58          pop    eax
0042310A  |.  8B55 D8    mov    edx, dword ptr [ebp-28]
0042310D  |.  64:8915 00000>mov    dword ptr fs:[0], edx
00423114  |.  E9 7D010000 jmp    00423296
00423119  |>  8D45 08    lea    eax, dword ptr [ebp+8]
0042311C  |.  E8 E3ECFDFF call 00401E04
00423121  |.  50          push eax
00423122  |.  8D55 9C    lea    edx, dword ptr [ebp-64]
00423125  |.  52          push edx
00423126  |.  E8 FD940B00 call 004DC628
0042312B  |.  83C4 08    add    esp, 8
0042312E  |.  0FBE4D 9D    movsx ecx, byte ptr [ebp-63]          ;  第二个应等于3
00423132  |.  83F9 33    cmp    ecx, 33
00423135  |.  0F85 3C010000 jnz    00423277
0042313B  |.  C645 9D 23 mov    byte ptr [ebp-63], 23
0042313F  |.  C645 D7 01 mov    byte ptr [ebp-29], 1
00423143  |.  C745 D0 02000>mov    dword ptr [ebp-30], 2
0042314A  |>  8B45 D0    /mov    eax, dword ptr [ebp-30]
0042314D  |.  0FBE5405 84 |movsx edx, byte ptr [ebp+eax-7C]    ;  取固定字符串字符
00423152  |.  8B4D D0    |mov    ecx, dword ptr [ebp-30]
00423155  |.  0FBE440D 9B |movsx eax, byte ptr [ebp+ecx-65]    ;  变化后的假码第二位
0042315A  |.  03D0       |add    edx, eax
0042315C  |.  8B4D D0    |mov    ecx, dword ptr [ebp-30]
0042315F  |.  0FBE440D 9C |movsx eax, byte ptr [ebp+ecx-64]
00423164  |.  33D0       |xor    edx, eax
00423166  |.  8B4D D0    |mov    ecx, dword ptr [ebp-30]
00423169  |.  0FBE440D 84 |movsx eax, byte ptr [ebp+ecx-7C]
0042316E  |.  33D0       |xor    edx, eax
00423170  |.  52          |push edx
00423171  |.  E8 A275FEFF |call 0040A718
00423176  |.  59          |pop    ecx
00423177  |.  B9 1A000000 |mov    ecx, 1A
0042317C  |.  99          |cdq
0042317D  |.  F7F9       |idiv ecx
0042317F  |.  83C2 41    |add    edx, 41
00423182  |.  8B45 D0    |mov    eax, dword ptr [ebp-30]
00423185  |.  0FBE4C05 A5 |movsx ecx, byte ptr [ebp+eax-5B]
0042318A  |.  3BD1       |cmp    edx, ecx
0042318C  |.  74 06       |je    short 00423194
0042318E  |.  C645 D7 00 |mov    byte ptr [ebp-29], 0
00423192  |.  EB 09       |jmp    short 0042319D
00423194  |>  FF45 D0    |inc    dword ptr [ebp-30]
00423197  |.  837D D0 0A |cmp    dword ptr [ebp-30], 0A
0042319B  |.^ 7C AD       \jl    short 0042314A
0042319D  |>  807D D7 00 cmp    byte ptr [ebp-29], 0
004231A1  |.  0F84 C3000000 je    0042326A
004231A7  |.  C745 CC 18000>mov    dword ptr [ebp-34], 18
004231AE  |.  66:C745 E8 08>mov    word ptr [ebp-18], 8
004231B4  |.  837D CC 28 cmp    dword ptr [ebp-34], 28
004231B8  |.  7D 4B       jge    short 00423205
004231BA  |>  8B55 CC    /mov    edx, dword ptr [ebp-34]
004231BD  |.  0FBE4415 85 |movsx eax, byte ptr [ebp+edx-7B]
004231C2  |.  B9 06000000 |mov    ecx, 6
004231C7  |.  99          |cdq
004231C8  |.  F7F9       |idiv ecx
004231CA  |.  8BCA       |mov    ecx, edx
004231CC  |.  8B45 CC    |mov    eax, dword ptr [ebp-34]
004231CF  |.  0FBE5405 86 |movsx edx, byte ptr [ebp+eax-7A]
004231D4  |.  D3E2       |shl    edx, cl
004231D6  |.  8B45 CC    |mov    eax, dword ptr [ebp-34]
004231D9  |.  0FBE4C05 87 |movsx ecx, byte ptr [ebp+eax-79]
004231DE  |.  0BD1       |or    edx, ecx
004231E0  |.  52          |push edx
004231E1  |.  E8 3275FEFF |call 0040A718
004231E6  |.  59          |pop    ecx
004231E7  |.  B9 1A000000 |mov    ecx, 1A
004231EC  |.  99          |cdq
004231ED  |.  F7F9       |idiv ecx
004231EF  |.  80C2 61    |add    dl, 61
004231F2  |.  8B45 CC    |mov    eax, dword ptr [ebp-34]
004231F5  |.  889405 58FFFF>|mov    byte ptr [ebp+eax-A8], dl
004231FC  |.  FF45 CC    |inc    dword ptr [ebp-34]
004231FF  |.  837D CC 28 |cmp    dword ptr [ebp-34], 28
00423203  |.^ 7C B5       \jl    short 004231BA
00423205  |>  C645 80 5A mov    byte ptr [ebp-80], 5A
00423209  |.  C645 81 59 mov    byte ptr [ebp-7F], 59
0042320D  |.  C745 C8 18000>mov    dword ptr [ebp-38], 18
00423214  |.  66:C745 E8 08>mov    word ptr [ebp-18], 8
0042321A  |.  837D C8 28 cmp    dword ptr [ebp-38], 28
0042321E  |.  7D 4A       jge    short 0042326A
00423220  |>  8B55 C8    /mov    edx, dword ptr [ebp-38]
00423223  |.  0FBE8415 58FF>|movsx eax, byte ptr [ebp+edx-A8]
0042322B  |.  C1E0 04    |shl    eax, 4
0042322E  |.  8B55 C8    |mov    edx, dword ptr [ebp-38]
00423231  |.  0FBE8C15 59FF>|movsx ecx, byte ptr [ebp+edx-A7]
00423239  |.  D1F9       |sar    ecx, 1
0042323B  |.  33C1       |xor    eax, ecx
0042323D  |.  50          |push eax
0042323E  |.  E8 D574FEFF |call 0040A718
00423243  |.  59          |pop    ecx
00423244  |.  B9 1A000000 |mov    ecx, 1A
00423249  |.  99          |cdq
0042324A  |.  F7F9       |idiv ecx
0042324C  |.  83C2 41    |add    edx, 41
0042324F  |.  8B45 C8    |mov    eax, dword ptr [ebp-38]
00423252  |.  0FBE4405 9C |movsx eax, byte ptr [ebp+eax-64]
00423257  |.  3BD0       |cmp    edx, eax
00423259  |.  74 06       |je    short 00423261
0042325B  |.  C645 D7 00 |mov    byte ptr [ebp-29], 0
0042325F  |.  EB 09       |jmp    short 0042326A
00423261  |>  FF45 C8    |inc    dword ptr [ebp-38]
00423264  |.  837D C8 28 |cmp    dword ptr [ebp-38], 28
00423268  |.^ 7C B6       \jl    short 00423220
0042326A  |>  0FBE55 A6    movsx edx, byte ptr [ebp-5A]
0042326E  |.  83FA 59    cmp    edx, 59
00423271  |.  74 04       je    short 00423277
00423273  |.  C645 D7 00 mov    byte ptr [ebp-29], 0
00423277  |>  8A45 D7    mov    al, byte ptr [ebp-29]
0042327A  |.  50          push eax
0042327B  |.  FF4D F4    dec    dword ptr [ebp-C]
0042327E  |.  8D45 08    lea    eax, dword ptr [ebp+8]
00423281  |.  BA 02000000 mov    edx, 2
00423286  |.  E8 4D480C00 call 004E7AD8
0042328B  |.  58          pop    eax
0042328C  |.  8B55 D8    mov    edx, dword ptr [ebp-28]
0042328F  |.  64:8915 00000>mov    dword ptr fs:[0], edx
00423296  |>  5F          pop    edi
00423297  |.  5E          pop    esi
00423298  |.  8BE5       mov    esp, ebp
0042329A  |.  5D          pop    ebp
0042329B  \.  C3          retn

打住，跑题了。本文是爆破分析不是算法分析。不过看起来作者并没有使用什么高深的加密算法，应该不难搞定。这个留着以后有空了再玩。
爆破有时候比算法还难，本软件就是。嘿嘿。。。。
还是修改返回值后继续爆破吧。返回后看到还有验证，嘿嘿。。。恶心。
修改上边的关键点后，显示注册成功，about对话框也显示注册给zaas了。但是还没有完。。。再看看启动验证吧。
算法里有检测注册码长度0x2C，启动验证自然也有。查找常量2C,并不是太多，一一下断。重新运行后断到了：
0042329C .  55          push ebp
0042329D .  8BEC       mov    ebp, esp
0042329F .  81C4 88FDFFFF add    esp, -278
004232A5 .  53          push ebx
004232A6 .  56          push esi
004232A7 .  57          push edi
004232A8 .  8995 F4FEFFFF mov    dword ptr [ebp-10C], edx
004232AE .  8985 F8FEFFFF mov    dword ptr [ebp-108], eax
004232B4 .  B8 98095000 mov    eax, 00500998
004232B9 .  E8 0E960B00 call 004DC8CC
004232BE .  8B85 F8FEFFFF mov    eax, dword ptr [ebp-108]
004232C4 .  E8 97FA0700 call 004A2D60
004232C9 .  8BC8       mov    ecx, eax
004232CB .  BA 60000000 mov    edx, 60
004232D0 .  8B85 F8FEFFFF mov    eax, dword ptr [ebp-108]
004232D6 .  E8 298A0900 call 004BBD04
004232DB .  8B85 F8FEFFFF mov    eax, dword ptr [ebp-108]
004232E1 .  E8 7AFA0700 call 004A2D60
004232E6 .  50          push eax
004232E7 .  B8 E0040000 mov    eax, 4E0
004232EC .  5A          pop    edx
004232ED .  8BCA       mov    ecx, edx
004232EF .  99          cdq
004232F0 .  F7F9       idiv ecx
004232F2 .  8BD0       mov    edx, eax
004232F4 .  8B85 F8FEFFFF mov    eax, dword ptr [ebp-108]
004232FA .  8B40 68    mov    eax, dword ptr [eax+68]
004232FD .  E8 FA120700 call 004945FC
00423302 .  8B85 F8FEFFFF mov    eax, dword ptr [ebp-108]
00423308 .  E8 53FA0700 call 004A2D60
0042330D .  83F8 60    cmp    eax, 60
00423310 .  7E 13       jle    short 00423325
00423312 .  8B95 F8FEFFFF mov    edx, dword ptr [ebp-108]
00423318 .  8B82 18030000 mov    eax, dword ptr [edx+318]
0042331E .  B2 02       mov    dl, 2
00423320 .  E8 2FBE0500 call 0047F154
00423325 >  8B0D 64D15000 mov    ecx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
0042332B .  8B01       mov    eax, dword ptr [ecx]
0042332D .  C680 F9030000>mov    byte ptr [eax+3F9], 0
00423334 .  8B15 64D15000 mov    edx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
0042333A .  8B0A       mov    ecx, dword ptr [edx]
0042333C .  33C0       xor    eax, eax
0042333E .  8981 F0030000 mov    dword ptr [ecx+3F0], eax
00423344 .  8B15 64D15000 mov    edx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
0042334A .  8B0A       mov    ecx, dword ptr [edx]
0042334C .  33C0       xor    eax, eax
0042334E .  8981 F4030000 mov    dword ptr [ecx+3F4], eax
00423354 .  B2 01       mov    dl, 1
00423356 .  A1 2CDA4500 mov    eax, dword ptr [45DA2C]
0042335B .  E8 CCA70300 call 0045DB2C
00423360 .  8985 F0FEFFFF mov    dword ptr [ebp-110], eax
00423366 .  BA 01000080 mov    edx, 80000001
0042336B .  8B85 F0FEFFFF mov    eax, dword ptr [ebp-110]
00423371 .  E8 6E450C00 call 004E78E4
00423376 .  66:C785 0CFFF>mov    word ptr [ebp-F4], 8
0042337F .  BA CDFF4F00 mov    edx, 004FFFCD                   ;  ASCII "Software\XTZY\Pic2Ico"
00423384 .  8D45 EC    lea    eax, dword ptr [ebp-14]
00423387 .  E8 EC450C00 call 004E7978
0042338C .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
00423392 .  8B10       mov    edx, dword ptr [eax]
00423394 .  B1 01       mov    cl, 1
00423396 .  8B85 F0FEFFFF mov    eax, dword ptr [ebp-110]
0042339C .  E8 8FA80300 call 0045DC30
004233A1 .  50          push eax
004233A2 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
004233A8 .  8D45 EC    lea    eax, dword ptr [ebp-14]
004233AB .  BA 02000000 mov    edx, 2
004233B0 .  E8 23470C00 call 004E7AD8
004233B5 .  59          pop    ecx
004233B6 .  84C9       test cl, cl
004233B8 .  0F84 57040000 je    00423815
004233BE .  66:C785 0CFFF>mov    word ptr [ebp-F4], 14
004233C7 .  BA E3FF4F00 mov    edx, 004FFFE3                   ;  ASCII "NO"
004233CC .  8D45 E8    lea    eax, dword ptr [ebp-18]
004233CF .  E8 A4450C00 call 004E7978
004233D4 .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
004233DA .  8B10       mov    edx, dword ptr [eax]
004233DC .  8B85 F0FEFFFF mov    eax, dword ptr [ebp-110]
004233E2 .  E8 A9AB0300 call 0045DF90
004233E7 .  50          push eax
004233E8 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
004233EE .  8D45 E8    lea    eax, dword ptr [ebp-18]
004233F1 .  BA 02000000 mov    edx, 2
004233F6 .  E8 DD460C00 call 004E7AD8
004233FB .  59          pop    ecx
004233FC .  84C9       test cl, cl
004233FE .  74 72       je    short 00423472
00423400 .  66:C785 0CFFF>mov    word ptr [ebp-F4], 20
00423409 .  8D45 E0    lea    eax, dword ptr [ebp-20]
0042340C .  E8 BFF6FDFF call 00402AD0
00423411 .  50          push eax
00423412 .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
00423418 .  BA E6FF4F00 mov    edx, 004FFFE6                   ;  ASCII "NO"
0042341D .  8D45 E4    lea    eax, dword ptr [ebp-1C]
00423420 .  E8 53450C00 call 004E7978
00423425 .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
0042342B .  8B10       mov    edx, dword ptr [eax]
0042342D .  8B85 F0FEFFFF mov    eax, dword ptr [ebp-110]
00423433 .  59          pop    ecx
00423434 .  E8 BFA90300 call 0045DDF8                      ;  假码的取出
00423439 .  8D55 E0    lea    edx, dword ptr [ebp-20]
0042343C .  8B85 F8FEFFFF mov    eax, dword ptr [ebp-108]
00423442 .  05 1C030000 add    eax, 31C
00423447 .  E8 BC460C00 call 004E7B08
0042344C .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
00423452 .  8D45 E0    lea    eax, dword ptr [ebp-20]
00423455 .  BA 02000000 mov    edx, 2
0042345A .  E8 79460C00 call 004E7AD8
0042345F .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
00423465 .  8D45 E4    lea    eax, dword ptr [ebp-1C]
00423468 .  BA 02000000 mov    edx, 2
0042346D .  E8 66460C00 call 004E7AD8
00423472 >  8B8D F8FEFFFF mov    ecx, dword ptr [ebp-108]
00423478 .  8B91 1C030000 mov    edx, dword ptr [ecx+31C]
0042347E .  8B85 F8FEFFFF mov    eax, dword ptr [ebp-108]
00423484 .  8B80 04030000 mov    eax, dword ptr [eax+304]
0042348A .  E8 81240900 call 004B5910
0042348F .  66:C785 0CFFF>mov    word ptr [ebp-F4], 2C          ;  要取2C长度的东东了
00423498 .  BA E9FF4F00 mov    edx, 004FFFE9                   ;  ASCII "Name"
0042349D .  8D45 DC    lea    eax, dword ptr [ebp-24]
004234A0 .  E8 D3440C00 call 004E7978
004234A5 .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
004234AB .  8B10       mov    edx, dword ptr [eax]
004234AD .  8B85 F0FEFFFF mov    eax, dword ptr [ebp-110]
004234B3 .  E8 D8AA0300 call 0045DF90
004234B8 .  50          push eax
004234B9 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
004234BF .  8D45 DC    lea    eax, dword ptr [ebp-24]
004234C2 .  BA 02000000 mov    edx, 2
004234C7 .  E8 0C460C00 call 004E7AD8
004234CC .  59          pop    ecx
004234CD .  84C9       test cl, cl
004234CF .  74 75       je    short 00423546
004234D1 .  66:C785 0CFFF>mov    word ptr [ebp-F4], 38
004234DA .  8D45 D4    lea    eax, dword ptr [ebp-2C]
004234DD .  E8 EEF5FDFF call 00402AD0
004234E2 .  50          push eax
004234E3 .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
004234E9 .  BA EEFF4F00 mov    edx, 004FFFEE                   ;  ASCII "Name"
004234EE .  8D45 D8    lea    eax, dword ptr [ebp-28]
004234F1 .  E8 82440C00 call 004E7978
004234F6 .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
004234FC .  8B10       mov    edx, dword ptr [eax]
004234FE .  8B85 F0FEFFFF mov    eax, dword ptr [ebp-110]
00423504 .  59          pop    ecx
00423505 .  E8 EEA80300 call 0045DDF8                      ;  注册名的取出
0042350A .  8D55 D4    lea    edx, dword ptr [ebp-2C]
0042350D .  8B12       mov    edx, dword ptr [edx]
0042350F .  8B85 F8FEFFFF mov    eax, dword ptr [ebp-108]
00423515 .  8B80 00030000 mov    eax, dword ptr [eax+300]
0042351B .  E8 F0230900 call 004B5910
00423520 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
00423526 .  8D45 D4    lea    eax, dword ptr [ebp-2C]
00423529 .  BA 02000000 mov    edx, 2
0042352E .  E8 A5450C00 call 004E7AD8
00423533 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
00423539 .  8D45 D8    lea    eax, dword ptr [ebp-28]
0042353C .  BA 02000000 mov    edx, 2
00423541 .  E8 92450C00 call 004E7AD8
........................................................
00424380 > \8B15 64D15000 mov    edx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
00424386 .  8B02       mov    eax, dword ptr [edx]
00424388    80B8 F8030000>cmp    byte ptr [eax+3F8], 0          ;  又来关键点了
0042438F    0F85 3B020000 jnz    004245D0
00424395 .  8B15 64D15000 mov    edx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
0042439B .  8B0A       mov    ecx, dword ptr [edx]
0042439D .  80B9 F9030000>cmp    byte ptr [ecx+3F9], 0
004243A4 .  0F85 E2010000 jnz    0042458C
004243AA .  66:C785 0CFFF>mov    word ptr [ebp-F4], 1F4
004243B3 .  8D85 34FFFFFF lea    eax, dword ptr [ebp-CC]
004243B9 .  E8 12E7FDFF call 00402AD0
004243BE .  8BD0       mov    edx, eax
004243C0 .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
004243C6 .  8B0D 64D15000 mov    ecx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
004243CC .  8B01       mov    eax, dword ptr [ecx]
004243CE .  8B80 F4030000 mov    eax, dword ptr [eax+3F4]
004243D4 .  E8 5BB50300 call 0045F934
004243D9 .  8D95 34FFFFFF lea    edx, dword ptr [ebp-CC]
004243DF .  52          push edx
004243E0 .  8D85 44FFFFFF lea    eax, dword ptr [ebp-BC]
004243E6 .  E8 E5E6FDFF call 00402AD0
004243EB .  8BD0       mov    edx, eax
004243ED .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
004243F3 .  8B0D 64D15000 mov    ecx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
004243F9 .  8B01       mov    eax, dword ptr [ecx]
004243FB .  8B80 F0030000 mov    eax, dword ptr [eax+3F0]
00424401 .  E8 2EB50300 call 0045F934
00424406 .  8D95 44FFFFFF lea    edx, dword ptr [ebp-BC]
0042440C .  52          push edx
0042440D .  8D85 40FFFFFF lea    eax, dword ptr [ebp-C0]
00424413 .  E8 B8E6FDFF call 00402AD0
00424418 .  8BC8       mov    ecx, eax
0042441A .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
00424420 .  B8 03025000 mov    eax, 00500203
00424425 .  5A          pop    edx
00424426 .  E8 CD3C0C00 call 004E80F8
0042442B .  8D8D 40FFFFFF lea    ecx, dword ptr [ebp-C0]
00424431 .  51          push ecx
00424432 .  8D85 38FFFFFF lea    eax, dword ptr [ebp-C8]
00424438 .  E8 93E6FDFF call 00402AD0
0042443D .  50          push eax
0042443E .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
00424444 .  BA 05025000 mov    edx, 00500205                   ;  ASCII "/21 Uses, "
00424449 .  8D85 3CFFFFFF lea    eax, dword ptr [ebp-C4]
0042444F .  E8 24350C00 call 004E7978
00424454 .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
0042445A .  8D95 3CFFFFFF lea    edx, dword ptr [ebp-C4]
00424460 .  59          pop    ecx
00424461 .  58          pop    eax
00424462 .  E8 C9360C00 call 004E7B30
00424467 .  8D95 38FFFFFF lea    edx, dword ptr [ebp-C8]
0042446D .  52          push edx
0042446E .  8D85 30FFFFFF lea    eax, dword ptr [ebp-D0]
00424474 .  E8 57E6FDFF call 00402AD0
00424479 .  8BC8       mov    ecx, eax
0042447B .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
00424481 .  58          pop    eax
00424482 .  5A          pop    edx
00424483 .  E8 A8360C00 call 004E7B30
00424488 .  8D8D 30FFFFFF lea    ecx, dword ptr [ebp-D0]
0042448E .  51          push ecx
0042448F .  8D85 28FFFFFF lea    eax, dword ptr [ebp-D8]
00424495 .  E8 36E6FDFF call 00402AD0
0042449A .  50          push eax
0042449B .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
004244A1 .  BA 10025000 mov    edx, 00500210                   ;  ASCII "/15 Days) Picture To Icon ( Unregistered )"
004244A6 .  8D85 2CFFFFFF lea    eax, dword ptr [ebp-D4]
004244AC .  E8 C7340C00 call 004E7978
004244B1 .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
004244B7 .  8D95 2CFFFFFF lea    edx, dword ptr [ebp-D4]
004244BD .  59          pop    ecx
004244BE .  58          pop    eax
004244BF .  E8 6C360C00 call 004E7B30
004244C4 .  8D95 28FFFFFF lea    edx, dword ptr [ebp-D8]
004244CA .  8B12       mov    edx, dword ptr [edx]
004244CC .  8B85 F8FEFFFF mov    eax, dword ptr [ebp-108]
004244D2 .  E8 39140900 call 004B5910
004244D7 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
004244DD .  8D85 28FFFFFF lea    eax, dword ptr [ebp-D8]
004244E3 .  BA 02000000 mov    edx, 2
004244E8 .  E8 EB350C00 call 004E7AD8
004244ED .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
004244F3 .  8D85 2CFFFFFF lea    eax, dword ptr [ebp-D4]
004244F9 .  BA 02000000 mov    edx, 2
004244FE .  E8 D5350C00 call 004E7AD8
00424503 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
00424509 .  8D85 30FFFFFF lea    eax, dword ptr [ebp-D0]
0042450F .  BA 02000000 mov    edx, 2
00424514 .  E8 BF350C00 call 004E7AD8
00424519 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
0042451F .  8D85 34FFFFFF lea    eax, dword ptr [ebp-CC]
00424525 .  BA 02000000 mov    edx, 2
0042452A .  E8 A9350C00 call 004E7AD8
0042452F .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
00424535 .  8D85 38FFFFFF lea    eax, dword ptr [ebp-C8]
0042453B .  BA 02000000 mov    edx, 2
00424540 .  E8 93350C00 call 004E7AD8
00424545 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
0042454B .  8D85 3CFFFFFF lea    eax, dword ptr [ebp-C4]
00424551 .  BA 02000000 mov    edx, 2
00424556 .  E8 7D350C00 call 004E7AD8
0042455B .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
00424561 .  8D85 40FFFFFF lea    eax, dword ptr [ebp-C0]
00424567 .  BA 02000000 mov    edx, 2
0042456C .  E8 67350C00 call 004E7AD8
00424571 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
00424577 .  8D85 44FFFFFF lea    eax, dword ptr [ebp-BC]
0042457D .  BA 02000000 mov    edx, 2
00424582 .  E8 51350C00 call 004E7AD8
00424587 .  E9 8C000000 jmp    00424618
0042458C >  66:C785 0CFFF>mov    word ptr [ebp-F4], 200
00424595 .  BA 3B025000 mov    edx, 0050023B                   ;  ASCII "Picture To Icon ( Expired )"
0042459A .  8D85 24FFFFFF lea    eax, dword ptr [ebp-DC]
004245A0 .  E8 D3330C00 call 004E7978
004245A5 .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
004245AB .  8B10       mov    edx, dword ptr [eax]
004245AD .  8B85 F8FEFFFF mov    eax, dword ptr [ebp-108]
004245B3 .  E8 58130900 call 004B5910
004245B8 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
004245BE .  8D85 24FFFFFF lea    eax, dword ptr [ebp-DC]
004245C4 .  BA 02000000 mov    edx, 2
004245C9 .  E8 0A350C00 call 004E7AD8
004245CE .  EB 48       jmp    short 00424618
004245D0 >  66:C785 0CFFF>mov    word ptr [ebp-F4], 20C
004245D9 .  BA 57025000 mov    edx, 00500257                   ;  ASCII "**************************************************"
004245DE .  8D85 20FFFFFF lea    eax, dword ptr [ebp-E0]
004245E4 .  E8 8F330C00 call 004E7978
004245E9 .  FF85 18FFFFFF inc    dword ptr [ebp-E8]
004245EF .  8B10       mov    edx, dword ptr [eax]
004245F1 .  8B85 F8FEFFFF mov    eax, dword ptr [ebp-108]
004245F7 .  8B80 04030000 mov    eax, dword ptr [eax+304]
004245FD .  E8 0E130900 call 004B5910
00424602 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
00424608 .  8D85 20FFFFFF lea    eax, dword ptr [ebp-E0]
0042460E .  BA 02000000 mov    edx, 2
00424613 .  E8 C0340C00 call 004E7AD8
00424618 >  8385 18FFFFFF>add    dword ptr [ebp-E8], -3
0042461F .  68 D87A4E00 push 004E7AD8                      ;  入口地址
00424624 .  6A 03       push 3
00424626 .  6A 03       push 3
00424628 .  6A 04       push 4
0042462A .  8D4D F0    lea    ecx, dword ptr [ebp-10]
0042462D .  51          push ecx
0042462E .  E8 7D730B00 call 004DB9B0
00424633 .  83C4 14    add    esp, 14
00424636 .  FF8D 18FFFFFF dec    dword ptr [ebp-E8]
0042463C .  8D45 FC    lea    eax, dword ptr [ebp-4]
0042463F .  BA 02000000 mov    edx, 2
00424644 .  E8 8F340C00 call 004E7AD8
00424649 .  8B8D FCFEFFFF mov    ecx, dword ptr [ebp-104]
0042464F .  64:890D 00000>mov    dword ptr fs:[0], ecx
00424656 .  5F          pop    edi
00424657 .  5E          pop    esi
00424658 .  5B          pop    ebx
00424659 .  8BE5       mov    esp, ebp
0042465B .  5D          pop    ebp
0042465C .  C3          retn

看到了熟悉的全局变量。。。。
00424380 > \8B15 64D15000 mov    edx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
00424386 .  8B02       mov    eax, dword ptr [edx]
00424388    80B8 F8030000>cmp    byte ptr [eax+3F8], 0          ;  又来关键点了
0042438F    0F85 3B020000 jnz    004245D0
修改：
cmp byte ptr [eax+3F8], 0为mov byte ptr [eax+3F8], 1
jmp    004245D0
跳过了NAG。。。about窗口显示完美。
但是事情还是没有完。。。实验下软件的功能，发现取出的图标，modify icon后，会在图标上打上一个大大的X。。。。暗桩闪现~~~
怎么办？怎么办？
思考下，有暗桩说明软件还有验证，验证应该还是要检测注册码，会不会依然和全局变量有关联？
中学时的数学老师说的好：大胆假设，小心求证。验证下看看再说。查找所有常量[50D164]，统统下断。修改图标。。。断下来了。。。wahhhhh。。。
004381CC  /.  55          push ebp
004381CD  |.  8BEC       mov    ebp, esp
004381CF  |.  83C4 A4    add    esp, -5C
004381D2  |.  8955 B8    mov    dword ptr [ebp-48], edx
004381D5  |.  8945 BC    mov    dword ptr [ebp-44], eax
004381D8  |.  B8 0C3E5000 mov    eax, 00503E0C
004381DD  |.  E8 EA460A00 call 004DC8CC                      ;  去掉x
004381E2  |.  8B15 64D15000 mov    edx, dword ptr [50D164]       ;  Pic2Ico2._IconConverter
004381E8  |.  8B0A       mov    ecx, dword ptr [edx]
004381EA    8A81 F9030000 mov    al, byte ptr [ecx+3F9]          ;  这次是[ecx+3F9]
004381F0    8845 B7    mov    byte ptr [ebp-49], al          ;  这个。。。又是一个关键变量。。。
004381F3    8B15 70D15000 mov    edx, dword ptr [50D170]       ;  Pic2Ico2._Form3
004381F9  |.  8B02       mov    eax, dword ptr [edx]
004381FB  |.  05 1C030000 add    eax, 31C
00438200  |.  E8 17F2FCFF call 0040741C
00438205  |.  48          dec    eax
00438206    7E 53       jle    short 0043825B
00438208  |.  66:C745 D0 08>mov    word ptr [ebp-30], 8
0043820E  |.  BA 20355000 mov    edx, 00503520                   ;  ASCII "FPJUNT"
00438213  |.  8D45 FC    lea    eax, dword ptr [ebp-4]
00438216  |.  E8 5DF70A00 call 004E7978
0043821B  |.  FF45 DC    inc    dword ptr [ebp-24]
0043821E  |.  8D55 FC    lea    edx, dword ptr [ebp-4]
00438221  |.  8B0D 70D15000 mov    ecx, dword ptr [50D170]       ;  Pic2Ico2._Form3
00438227  |.  8B01       mov    eax, dword ptr [ecx]
00438229  |.  05 1C030000 add    eax, 31C
0043822E  |.  E8 B9FA0A00 call 004E7CEC
00438233  |.  85C0       test eax, eax
00438235  |.  0F95C2       setne dl
00438238  |.  83E2 01    and    edx, 1
0043823B  |.  52          push edx
0043823C  |.  FF4D DC    dec    dword ptr [ebp-24]
0043823F  |.  8D45 FC    lea    eax, dword ptr [ebp-4]
00438242  |.  BA 02000000 mov    edx, 2
00438247  |.  E8 8CF80A00 call 004E7AD8
0043824C  |.  59          pop    ecx
0043824D  |.  84C9       test cl, cl                         ;  cl是关键啦
0043824F  |.  74 06       je    short 00438257
00438251  |.  C645 B7 00 mov    byte ptr [ebp-49], 0
00438255  |.  EB 04       jmp    short 0043825B
00438257    C645 B7 01 mov    byte ptr [ebp-49], 1          ;  这次的变量应该赋值为0才行
0043825B  |>  807D B7 00 cmp    byte ptr [ebp-49], 0
0043825F    0F84 DD000000 je    00438342                      ;  不跳就要打X了，0分，跳了100分
00438265  |.  8B45 BC    mov    eax, dword ptr [ebp-44]
00438268  |.  8B80 DC040000 mov    eax, dword ptr [eax+4DC]
0043826E  |.  8B10       mov    edx, dword ptr [eax]
00438270  |.  FF52 2C    call dword ptr [edx+2C]
00438273  |.  85C0       test eax, eax
00438275  |.  79 03       jns    short 0043827A

具体怎么验证的，我没有管。。直接修改：
mov    byte ptr [ebp-49], 1  为mov    byte ptr [ebp-49], 0就OK了。

但是事情还是没有完。。。（画外音：这位讲故事的水平不高，老是“但是事情还是没有完”这一句。）
修改完图标，保存。这时，没有任何提示，但是你会发现什么都没有保存！星星还是那个星星，月亮还是那个月亮。。。崩溃。。。
祭出DEDE**，查找保存的按钮事件，来到：
00408838 $  55          push ebp
00408839 .  8BEC       mov    ebp, esp
0040883B .  81C4 88FEFFFF add    esp, -178
00408841 .  53          push ebx
00408842 .  56          push esi
00408843 .  57          push edi
00408844 .  8995 FCFEFFFF mov    dword ptr [ebp-104], edx
0040884A .  8985 00FFFFFF mov    dword ptr [ebp-100], eax
00408850 .  B8 ECE34F00 mov    eax, 004FE3EC
00408855 .  E8 72400D00 call 004DC8CC
0040885A .  8B15 E0D65000 mov    edx, dword ptr [_IconConverter]
.........................................................
00408F77 . /0F84 470B0000 je    00409AC4
00408F7D . |8B0D 70D15000 mov    ecx, dword ptr [50D170]       ;  Pic2Ico2._Form3
00408F83 . |8B01       mov    eax, dword ptr [ecx]
00408F85 . |05 1C030000 add    eax, 31C
00408F8A . |E8 8DE4FFFF call 0040741C
00408F8F . |48          dec    eax
00408F90    |7E 63       jle    short 00408FF5
00408F92 . |66:C785 14FFF>mov    word ptr [ebp-EC], 0BC
00408F9B . |BA B9C54F00 mov    edx, 004FC5B9                   ;  ASCII "DUR"
00408FA0 . |8D45 B8    lea    eax, dword ptr [ebp-48]
00408FA3 . |E8 D0E90D00 call 004E7978
00408FA8 . |FF85 20FFFFFF inc    dword ptr [ebp-E0]
00408FAE . |8D55 B8    lea    edx, dword ptr [ebp-48]
00408FB1 . |8B0D 70D15000 mov    ecx, dword ptr [50D170]       ;  Pic2Ico2._Form3
00408FB7 . |8B01       mov    eax, dword ptr [ecx]
00408FB9 . |05 1C030000 add    eax, 31C
00408FBE . |E8 29ED0D00 call 004E7CEC                      ;  假码再次现身~~~（不是献身啦）
00408FC3 . |85C0       test eax, eax
00408FC5 . |0F94C2       sete dl
00408FC8 . |83E2 01    and    edx, 1
00408FCB . |52          push edx
00408FCC . |FF8D 20FFFFFF dec    dword ptr [ebp-E0]
00408FD2 . |8D45 B8    lea    eax, dword ptr [ebp-48]
00408FD5 . |BA 02000000 mov    edx, 2
00408FDA . |E8 F9EA0D00 call 004E7AD8
00408FDF . |59          pop    ecx
00408FE0 . |84C9       test cl, cl
00408FE2 . |74 11       je    short 00408FF5                ;  那么，这个CL还是关键哦。。。，改为jmp
00408FE4 . |8B85 04FFFFFF mov    eax, dword ptr [ebp-FC]
00408FEA . |64:A3 0000000>mov    dword ptr fs:[0], eax
00408FF0 . |E9 DC0A0000 jmp    00409AD1
00408FF5 > \8B95 00FFFFFF mov    edx, dword ptr [ebp-100]
00408FFB .  8B82 F4020000 mov    eax, dword ptr [edx+2F4]
00409001 .  E8 C25E0A00 call 004AEEC8                      ;  保存的格式
00409006 .  48          dec    eax
00409007 .  0F85 00040000 jnz    0040940D
0040900D .  66:C785 14FFF>mov    word ptr [ebp-EC], 0D4
00409016 .  8D45 B0    lea    eax, dword ptr [ebp-50]
00409019 .  E8 B29AFFFF call 00402AD0
0040901E .  8BD0       mov    edx, eax
00409020 .  FF85 20FFFFFF inc    dword ptr [ebp-E0]
00409026 .  8B8D 00FFFFFF mov    ecx, dword ptr [ebp-100]
0040902C .  8B81 F4020000 mov    eax, dword ptr [ecx+2F4]
00409032 .  E8 395E0A00 call 004AEE70
00409037 .  8D55 B0    lea    edx, dword ptr [ebp-50]
0040903A .  FF32       push dword ptr [edx]
0040903C .  8D45 B4    lea    eax, dword ptr [ebp-4C]
0040903F .  E8 8C9AFFFF call 00402AD0
00409044 .  50          push eax
00409045 .  FF85 20FFFFFF inc    dword ptr [ebp-E0]
0040904B .  BA BDC54F00 mov    edx, 004FC5BD                   ;  ASCII ".ico"
00409050 .  8D45 AC    lea    eax, dword ptr [ebp-54]
00409053 .  E8 20E90D00 call 004E7978
00409058 .  FF85 20FFFFFF inc    dword ptr [ebp-E0]
0040905E .  8B10       mov    edx, dword ptr [eax]
00409060 .  59          pop    ecx
00409061 .  58          pop    eax
00409062 .  E8 6D6E0500 call 0045FED4
00409067 .  FF8D 20FFFFFF dec    dword ptr [ebp-E0]
0040906D .  8D45 AC    lea    eax, dword ptr [ebp-54]
00409070 .  BA 02000000 mov    edx, 2
00409075 .  E8 5EEA0D00 call 004E7AD8
0040907A .  FF8D 20FFFFFF dec    dword ptr [ebp-E0]
00409080 .  8D45 B0    lea    eax, dword ptr [ebp-50]
00409083 .  BA 02000000 mov    edx, 2
00409088 .  E8 4BEA0D00 call 004E7AD8
0040908D .  66:C785 14FFF>mov    word ptr [ebp-EC], 0C8
00409096 .  C685 A3FEFFFF>mov    byte ptr [ebp-15D], 0
0040909D .  8B45 B4    mov    eax, dword ptr [ebp-4C]
004090A0 .  E8 6B6C0500 call 0045FD10                      ;  图标是否已存在
004090A5 .  84C0       test al, al
004090A7 .  0F84 8C020000 je    00409339
004090AD .  6A 23       push 23
004090AF .  68 39C64F00 push 004FC639                      ;  ASCII "Insert or overwrite"
004090B4 .  66:C785 14FFF>mov    word ptr [ebp-EC], 0EC
004090BD .  8D45 A8    lea    eax, dword ptr [ebp-58]
004090C0 .  E8 0B9AFFFF call 00402AD0
004090C5 .  8BC8       mov    ecx, eax
004090C7 .  FF85 20FFFFFF inc    dword ptr [ebp-E0]
004090CD .  8D55 B4    lea    edx, dword ptr [ebp-4C]
004090D0 .  B8 C2C54F00 mov    eax, 004FC5C2                   ;  ASCII "Icon file",LF
004090D5 .  E8 1EF00D00 call 004E80F8
004090DA .  8D55 A8    lea    edx, dword ptr [ebp-58]
...........................................
00409AAF .  59          pop    ecx
00409AB0 .  83BD BCFEFFFF>cmp    dword ptr [ebp-144], 0          ;  删除图标
00409AB7    74 0B       je    short 00409AC4
00409AB9 .  FFB5 BCFEFFFF push dword ptr [ebp-144]             ; /hCursor
00409ABF .  E8 E01D0F00 call <jmp.&USER32.DestroyCursor>    ; \DestroyCursor
00409AC4 >  8B8D 04FFFFFF mov    ecx, dword ptr [ebp-FC]
00409ACA .  64:890D 00000>mov    dword ptr fs:[0], ecx
00409AD1 >  5F          pop    edi
00409AD2 .  5E          pop    esi
00409AD3 .  5B          pop    ebx
00409AD4 .  8BE5       mov    esp, ebp
00409AD6 .  5D          pop    ebp
00409AD7 .  C3          retn

最后还被摆了一道，检测[ebp-144]不通过，生成的图标还是要被删除！BTBTBTBTBT。。。。
je    short 00409AC4改为jmp。图标终于可以保存了。。。。
但是事情还是没有完。。。哈哈，我说说而已啦！破这个软件用了2小时，写这篇文章却用了一上午。。。破解过程是完了，天知道是不是还有其他暗桩，思路就是这样了，再有问题的话再说吧。。。
【经验总结】大胆假设，小心求证。
【版权声明】: 本文原创zaas, 转载请注明作者并保持文章的完整, 谢谢!

------------------------------------------------------------------------------------
【后记】
果然，还是“但是事情还是没有完。。。”检查发现保存icon时候还有一个验证。第一次保存成功，第二次就有问题，而且这时候about窗口重新显示unregister。(难道是刚刚调试的时候试用次数还没到的缘故？)
跟进：
00408CA6 > /8B15 70D15000 mov    edx, dword ptr [50D170]       ;  Pic2Ico2._Form3
00408CAC . |8B02       mov    eax, dword ptr [edx]
00408CAE . |05 1C030000 add    eax, 31C
00408CB3 . |E8 4C91FFFF call 00401E04
00408CB8 . |8B95 C0FEFFFF mov    edx, dword ptr [ebp-140]
00408CBE . |8A0C10       mov    cl, byte ptr [eax+edx]
00408CC1 . |888D C7FEFFFF mov    byte ptr [ebp-139], cl
00408CC7 . |0FBE85 C7FEFF>movsx eax, byte ptr [ebp-139]       ;  假码字符串
00408CCE . |83F8 30    cmp    eax, 30
00408CD1 . |7C 12       jl    short 00408CE5
00408CD3 . |0FBE95 C7FEFF>movsx edx, byte ptr [ebp-139]       ;  取假码字符
00408CDA . |83FA 39    cmp    edx, 39                         ;  验证假码在0-9之间的数字有几个
00408CDD . |7F 06       jg    short 00408CE5
00408CDF . |FF85 C8FEFFFF inc    dword ptr [ebp-138]
00408CE5 > |FF85 C0FEFFFF inc    dword ptr [ebp-140]
00408CEB > |8B0D 70D15000 mov    ecx, dword ptr [50D170]       ;  Pic2Ico2._Form3
00408CF1 . |8B01       mov    eax, dword ptr [ecx]
00408CF3 . |05 1C030000 add    eax, 31C
00408CF8 . |E8 1FE7FFFF call 0040741C
00408CFD . |3B85 C0FEFFFF cmp    eax, dword ptr [ebp-140]       ;  必须大于8个
00408D03 .^\7F A1       jg    short 00408CA6
00408D05 .  83BD C8FEFFFF>cmp    dword ptr [ebp-138], 8
00408D0C .  7E 0D       jle    short 00408D1B
00408D0E .  8B95 00FFFFFF mov    edx, dword ptr [ebp-100]
00408D14 .  C682 F8030000>mov    byte ptr [edx+3F8], 0
00408D1B >  8B0D E0D65000 mov    ecx, dword ptr [_IconConverter]
00408D21 .  80B9 F8030000>cmp    byte ptr [ecx+3F8], 0          ;  又见全局变量
00408D28 .  75 3A       jnz    short 00408D64
00408D2A .  A1 E0D65000 mov    eax, dword ptr [_IconConverter]
00408D2F .  80B8 F9030000>cmp    byte ptr [eax+3F9], 0          ;  也是全局变量了吗？
00408D36 .  74 2C       je    short 00408D64
00408D38 .  8B15 E0D65000 mov    edx, dword ptr [_IconConverter]
00408D3E .  C682 F9030000>mov    byte ptr [edx+3F9], 1
00408D45 .  8B0D 40D45000 mov    ecx, dword ptr [50D440]       ;  Pic2Ico2.00514CDC
00408D4B .  8B01       mov    eax, dword ptr [ecx]
00408D4D .  E8 36FB0900 call 004A8888
00408D52 .  8B95 04FFFFFF mov    edx, dword ptr [ebp-FC]
00408D58 .  64:8915 00000>mov    dword ptr fs:[0], edx
00408D5F .  E9 6D0D0000 jmp    00409AD1

修改00408D14 .  C682 F8030000>mov    byte ptr [edx+3F8], 0为mov    byte ptr [edx+3F8], 1 解决。

月之精灵 · 发表于 2010-5-25 16:06:50

好长啊，学习了，哈哈

Nisy · 发表于 2010-5-25 17:18:35

还是不加[CODE]的代码看起来更舒服些 ~

这个软件麻雀虽小五脏俱全啊感谢楼主整理分享

zaas · 发表于 2010-5-25 17:27:31

好，我编辑一下。

carson · 发表于 2010-5-25 18:01:37

佩服LZ耐心，这个软件的验证还真多，请问各位大侠“全局变量”作何解释？

yunfeng · 发表于 2010-5-25 20:45:01

爆破有时候比算法还难，本软件就是

yayazhi · 发表于 2010-5-25 21:11:36

强，学习了/:good

kelvar · 发表于 2010-5-25 21:28:22

分析的精彩。耐心更加了得。看到一次全局变量，直接搜索相同指令可以不？
直接搜索"80B8 F8030000>cmp byte ptr [eax+3F8], 0"这条指令应该能扫除一大堆的校验吧。
明天也去看看去。

诸葛日月 · 发表于 2010-5-25 22:20:10

来看美女图的！顺便学习一下算法！分析过程很详细，楼主辛苦！

言申言舌 · 发表于 2010-5-25 22:40:44

学习下，感谢分享经验

		自动登录	找回密码
密码			加入我们

[原创] Picture To Icon 2.4爆破分析&附赠美女图，哈哈

评分

相关帖子