|
|
【破解日期】 2006年11月25日
【破解作者】 冷血书生
【作者邮箱】 meiyou
【作者主页】 hxxp://www.126sohu.com/
【使用工具】 OD
【破解平台】 Win9x/NT/2000/XP
【软件名称】 happytown's crackme-01
【下载地址】 本地
【软件大小】 64k
【加壳方式】 无
【破解声明】 我是一只小菜鸟，偶得一点心得，愿与大家分享：）
------------------------------------------------------------------------
--------
【破解内容】
代码:
00407ABD cmp word ptr ss:[ebp-1C],5 ; 比较用户名
00407AC2 jl CrackMe_.004081C4
00407AC8 cmp ax,0A ; 比较注册码
00407ACC jl CrackMe_.004081C4
00407AD2 mov esi,dword ptr ds:[<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
00407AD8 lea eax,dword ptr ss:[ebp-18]
00407ADB lea ecx,dword ptr ss:[ebp-48]
00407ADE mov dword ptr ss:[ebp-80],eax
00407AE1 push ecx
00407AE2 lea edx,dword ptr ss:[ebp-88]
00407AE8 push 1
00407AEA lea eax,dword ptr ss:[ebp-58]
00407AED push edx
00407AEE push eax
00407AEF mov dword ptr ss:[ebp-40],1
00407AF6 mov dword ptr ss:[ebp-48],2
00407AFD mov dword ptr ss:[ebp-88],4008
00407B07 call esi
00407B09 mov edi,dword ptr ds:[<&MSVBVM60.__vbaStrVa>; MSVBVM60.__vbaStrVarVal
00407B0F lea ecx,dword ptr ss:[ebp-58]
00407B12 lea edx,dword ptr ss:[ebp-30]
00407B15 push ecx
00407B16 push edx
00407B17 call edi
00407B19 push eax
00407B1A call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407B20 xor ecx,ecx
00407B22 cmp ax,70 ; 与70比较
00407B26 setne cl
00407B29 neg ecx
00407B2B mov dword ptr ss:[ebp-BC],ecx
00407B31 lea ecx,dword ptr ss:[ebp-30]
00407B34 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>; MSVBVM60.__vbaFreeStr
00407B3A lea edx,dword ptr ss:[ebp-58]
00407B3D lea eax,dword ptr ss:[ebp-48]
00407B40 push edx
00407B41 push eax
00407B42 push 2
00407B44 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarL>; MSVBVM60.__vbaFreeVarList
00407B4A add esp,0C
00407B4D cmp word ptr ss:[ebp-BC],bx
00407B54 jnz CrackMe_.004081C4 ; 不相等就OVER
00407B5A lea ecx,dword ptr ss:[ebp-18]
00407B5D lea edx,dword ptr ss:[ebp-48]
00407B60 mov dword ptr ss:[ebp-80],ecx
00407B63 push edx
00407B64 lea eax,dword ptr ss:[ebp-88]
00407B6A push 2
00407B6C lea ecx,dword ptr ss:[ebp-58]
00407B6F mov ebx,1
00407B74 push eax
00407B75 push ecx
00407B76 mov dword ptr ss:[ebp-40],ebx
00407B79 mov dword ptr ss:[ebp-48],2
00407B80 mov dword ptr ss:[ebp-88],4008
00407B8A call esi
00407B8C lea edx,dword ptr ss:[ebp-2C]
00407B8F lea eax,dword ptr ss:[ebp-68]
00407B92 mov dword ptr ss:[ebp-A0],edx
00407B98 push eax
00407B99 lea ecx,dword ptr ss:[ebp-A8]
00407B9F push ebx
00407BA0 lea edx,dword ptr ss:[ebp-78]
00407BA3 push ecx
00407BA4 push edx
00407BA5 mov dword ptr ss:[ebp-60],ebx
00407BA8 mov dword ptr ss:[ebp-68],2
00407BAF mov dword ptr ss:[ebp-A8],4008
00407BB9 call esi
00407BBB lea eax,dword ptr ss:[ebp-78]
00407BBE lea ecx,dword ptr ss:[ebp-34]
00407BC1 push eax
00407BC2 push ecx
00407BC3 call edi
00407BC5 push eax
00407BC6 call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407BCC mov bx,ax ; 取用户名
00407BCF lea edx,dword ptr ss:[ebp-58]
00407BD2 lea eax,dword ptr ss:[ebp-30]
00407BD5 push edx
00407BD6 push eax
00407BD7 call edi
00407BD9 push eax
00407BDA call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407BE0 xor ecx,ecx
00407BE2 cmp ax,bx ; 用户名和注册码比较
00407BE5 lea edx,dword ptr ss:[ebp-34]
00407BE8 lea eax,dword ptr ss:[ebp-30]
00407BEB setne cl
00407BEE push edx
00407BEF push eax
00407BF0 neg ecx
00407BF2 push 2
00407BF4 mov dword ptr ss:[ebp-BC],ecx
00407BFA call dword ptr ds:[<&MSVBVM60.__vbaFreeStrL>; MSVBVM60.__vbaFreeStrList
00407C00 lea ecx,dword ptr ss:[ebp-78]
00407C03 lea edx,dword ptr ss:[ebp-68]
00407C06 push ecx
00407C07 lea eax,dword ptr ss:[ebp-58]
00407C0A push edx
00407C0B lea ecx,dword ptr ss:[ebp-48]
00407C0E push eax
00407C0F push ecx
00407C10 push 4
00407C12 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarL>; MSVBVM60.__vbaFreeVarList
00407C18 xor ebx,ebx
00407C1A add esp,20
00407C1D cmp word ptr ss:[ebp-BC],bx
00407C24 jnz CrackMe_.004081C4 ; 不相等继续OVER
00407C2A lea edx,dword ptr ss:[ebp-18]
00407C2D lea eax,dword ptr ss:[ebp-48]
00407C30 mov dword ptr ss:[ebp-80],edx
00407C33 push eax
00407C34 lea ecx,dword ptr ss:[ebp-88]
00407C3A push 3
00407C3C lea edx,dword ptr ss:[ebp-58]
00407C3F push ecx
00407C40 push edx
00407C41 mov dword ptr ss:[ebp-40],1
00407C48 mov dword ptr ss:[ebp-48],2
00407C4F mov dword ptr ss:[ebp-88],4008
00407C59 call esi
00407C5B lea eax,dword ptr ss:[ebp-58]
00407C5E lea ecx,dword ptr ss:[ebp-30]
00407C61 push eax
00407C62 push ecx
00407C63 call edi
00407C65 push eax
00407C66 call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407C6C xor edx,edx
00407C6E cmp ax,65 ; 第三位与65比较
00407C72 setne dl
00407C75 neg edx
00407C77 lea ecx,dword ptr ss:[ebp-30]
00407C7A mov dword ptr ss:[ebp-BC],edx
00407C80 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>; MSVBVM60.__vbaFreeStr
00407C86 lea eax,dword ptr ss:[ebp-58]
00407C89 lea ecx,dword ptr ss:[ebp-48]
00407C8C push eax
00407C8D push ecx
00407C8E push 2
00407C90 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarL>; MSVBVM60.__vbaFreeVarList
00407C96 add esp,0C
00407C99 cmp word ptr ss:[ebp-BC],bx
00407CA0 jnz CrackMe_.004081C4 ; 不相等继续OVER
00407CA6 lea edx,dword ptr ss:[ebp-18]
00407CA9 lea eax,dword ptr ss:[ebp-48]
00407CAC mov dword ptr ss:[ebp-80],edx
00407CAF push eax
00407CB0 lea ecx,dword ptr ss:[ebp-88]
00407CB6 push 4
00407CB8 lea edx,dword ptr ss:[ebp-58]
00407CBB mov ebx,1
00407CC0 push ecx
00407CC1 push edx
00407CC2 mov dword ptr ss:[ebp-40],ebx
00407CC5 mov dword ptr ss:[ebp-48],2
00407CCC mov dword ptr ss:[ebp-88],4008
00407CD6 call esi
00407CD8 lea eax,dword ptr ss:[ebp-2C]
00407CDB lea ecx,dword ptr ss:[ebp-68]
00407CDE mov dword ptr ss:[ebp-A0],eax
00407CE4 push ecx
00407CE5 lea edx,dword ptr ss:[ebp-A8]
00407CEB push 2
00407CED lea eax,dword ptr ss:[ebp-78]
00407CF0 push edx
00407CF1 push eax
00407CF2 mov dword ptr ss:[ebp-60],ebx
00407CF5 mov dword ptr ss:[ebp-68],2
00407CFC mov dword ptr ss:[ebp-A8],4008
00407D06 call esi
00407D08 lea ecx,dword ptr ss:[ebp-78]
00407D0B lea edx,dword ptr ss:[ebp-34]
00407D0E push ecx
00407D0F push edx
00407D10 call edi
00407D12 push eax
00407D13 call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407D19 mov bx,ax ; 用户名第二位
00407D1C lea eax,dword ptr ss:[ebp-58]
00407D1F lea ecx,dword ptr ss:[ebp-30]
00407D22 push eax
00407D23 push ecx
00407D24 call edi
00407D26 push eax
00407D27 call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407D2D xor edx,edx
00407D2F cmp ax,bx ; 与注册码第四位比较
00407D32 lea eax,dword ptr ss:[ebp-34]
00407D35 lea ecx,dword ptr ss:[ebp-30]
00407D38 setne dl
00407D3B push eax
00407D3C push ecx
00407D3D neg edx
00407D3F push 2
00407D41 mov dword ptr ss:[ebp-BC],edx
00407D47 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrL>; MSVBVM60.__vbaFreeStrList
00407D4D lea edx,dword ptr ss:[ebp-78]
00407D50 lea eax,dword ptr ss:[ebp-68]
00407D53 push edx
00407D54 lea ecx,dword ptr ss:[ebp-58]
00407D57 push eax
00407D58 lea edx,dword ptr ss:[ebp-48]
00407D5B push ecx
00407D5C push edx
00407D5D push 4
00407D5F call dword ptr ds:[<&MSVBVM60.__vbaFreeVarL>; MSVBVM60.__vbaFreeVarList
00407D65 xor ebx,ebx
00407D67 add esp,20
00407D6A cmp word ptr ss:[ebp-BC],bx
00407D71 jnz CrackMe_.004081C4 ; 不相等继续OVER
00407D77 lea eax,dword ptr ss:[ebp-18]
00407D7A lea ecx,dword ptr ss:[ebp-48]
00407D7D mov dword ptr ss:[ebp-80],eax
00407D80 push ecx
00407D81 lea edx,dword ptr ss:[ebp-88]
00407D87 push 5
00407D89 lea eax,dword ptr ss:[ebp-58]
00407D8C push edx
00407D8D push eax
00407D8E mov dword ptr ss:[ebp-40],1
00407D95 mov dword ptr ss:[ebp-48],2
00407D9C mov dword ptr ss:[ebp-88],4008
00407DA6 call esi
00407DA8 lea ecx,dword ptr ss:[ebp-58]
00407DAB lea edx,dword ptr ss:[ebp-30]
00407DAE push ecx
00407DAF push edx
00407DB0 call edi
00407DB2 push eax
00407DB3 call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407DB9 xor ecx,ecx
00407DBB cmp ax,64 ; 第五位与64比较
00407DBF setne cl
00407DC2 neg ecx
00407DC4 mov dword ptr ss:[ebp-BC],ecx
00407DCA lea ecx,dword ptr ss:[ebp-30]
00407DCD call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>; MSVBVM60.__vbaFreeStr
00407DD3 lea edx,dword ptr ss:[ebp-58]
00407DD6 lea eax,dword ptr ss:[ebp-48]
00407DD9 push edx
00407DDA push eax
00407DDB push 2
00407DDD call dword ptr ds:[<&MSVBVM60.__vbaFreeVarL>; MSVBVM60.__vbaFreeVarList
00407DE3 add esp,0C
00407DE6 cmp word ptr ss:[ebp-BC],bx
00407DED jnz CrackMe_.004081C4
00407DF3 lea ecx,dword ptr ss:[ebp-18]
00407DF6 lea edx,dword ptr ss:[ebp-48]
00407DF9 mov dword ptr ss:[ebp-80],ecx
00407DFC push edx
00407DFD lea eax,dword ptr ss:[ebp-88]
00407E03 push 6
00407E05 lea ecx,dword ptr ss:[ebp-58]
00407E08 mov ebx,1
00407E0D push eax
00407E0E push ecx
00407E0F mov dword ptr ss:[ebp-40],ebx
00407E12 mov dword ptr ss:[ebp-48],2
00407E19 mov dword ptr ss:[ebp-88],4008
00407E23 call esi
00407E25 lea edx,dword ptr ss:[ebp-2C]
00407E28 lea eax,dword ptr ss:[ebp-68]
00407E2B mov dword ptr ss:[ebp-A0],edx
00407E31 push eax
00407E32 lea ecx,dword ptr ss:[ebp-A8]
00407E38 push 3
00407E3A lea edx,dword ptr ss:[ebp-78]
00407E3D push ecx
00407E3E push edx
00407E3F mov dword ptr ss:[ebp-60],ebx
00407E42 mov dword ptr ss:[ebp-68],2
00407E49 mov dword ptr ss:[ebp-A8],4008
00407E53 call esi
00407E55 lea eax,dword ptr ss:[ebp-78]
00407E58 lea ecx,dword ptr ss:[ebp-34]
00407E5B push eax
00407E5C push ecx
00407E5D call edi
00407E5F push eax
00407E60 call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407E66 mov bx,ax ; 用户名第三位
00407E69 lea edx,dword ptr ss:[ebp-58]
00407E6C lea eax,dword ptr ss:[ebp-30]
00407E6F push edx
00407E70 push eax
00407E71 call edi
00407E73 push eax
00407E74 call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407E7A xor ecx,ecx
00407E7C cmp ax,bx ; 与注册码第六位比较
00407E7F lea edx,dword ptr ss:[ebp-34]
00407E82 lea eax,dword ptr ss:[ebp-30]
00407E85 setne cl
00407E88 push edx
00407E89 push eax
00407E8A neg ecx
00407E8C push 2
00407E8E mov dword ptr ss:[ebp-BC],ecx
00407E94 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrL>; MSVBVM60.__vbaFreeStrList
00407E9A lea ecx,dword ptr ss:[ebp-78]
00407E9D lea edx,dword ptr ss:[ebp-68]
00407EA0 push ecx
00407EA1 lea eax,dword ptr ss:[ebp-58]
00407EA4 push edx
00407EA5 lea ecx,dword ptr ss:[ebp-48]
00407EA8 push eax
00407EA9 push ecx
00407EAA push 4
00407EAC call dword ptr ds:[<&MSVBVM60.__vbaFreeVarL>; MSVBVM60.__vbaFreeVarList
00407EB2 xor ebx,ebx
00407EB4 add esp,20
00407EB7 cmp word ptr ss:[ebp-BC],bx
00407EBE jnz CrackMe_.004081C4
00407EC4 lea edx,dword ptr ss:[ebp-18]
00407EC7 lea eax,dword ptr ss:[ebp-48]
00407ECA mov dword ptr ss:[ebp-80],edx
00407ECD push eax
00407ECE lea ecx,dword ptr ss:[ebp-88]
00407ED4 push 7
00407ED6 lea edx,dword ptr ss:[ebp-58]
00407ED9 push ecx
00407EDA push edx
00407EDB mov dword ptr ss:[ebp-40],1
00407EE2 mov dword ptr ss:[ebp-48],2
00407EE9 mov dword ptr ss:[ebp-88],4008
00407EF3 call esi
00407EF5 lea eax,dword ptr ss:[ebp-58]
00407EF8 lea ecx,dword ptr ss:[ebp-30]
00407EFB push eax
00407EFC push ecx
00407EFD call edi
00407EFF push eax
00407F00 call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407F06 xor edx,edx
00407F08 cmp ax,69 ; 与69比较
00407F0C setne dl
00407F0F neg edx
00407F11 lea ecx,dword ptr ss:[ebp-30]
00407F14 mov dword ptr ss:[ebp-BC],edx
00407F1A call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>; MSVBVM60.__vbaFreeStr
00407F20 lea eax,dword ptr ss:[ebp-58]
00407F23 lea ecx,dword ptr ss:[ebp-48]
00407F26 push eax
00407F27 push ecx
00407F28 push 2
00407F2A call dword ptr ds:[<&MSVBVM60.__vbaFreeVarL>; MSVBVM60.__vbaFreeVarList
00407F30 add esp,0C
00407F33 cmp word ptr ss:[ebp-BC],bx
00407F3A jnz CrackMe_.004081C4
00407F40 lea edx,dword ptr ss:[ebp-18]
00407F43 lea eax,dword ptr ss:[ebp-48]
00407F46 mov dword ptr ss:[ebp-80],edx
00407F49 push eax
00407F4A lea ecx,dword ptr ss:[ebp-88]
00407F50 push 8
00407F52 lea edx,dword ptr ss:[ebp-58]
00407F55 mov ebx,1
00407F5A push ecx
00407F5B push edx
00407F5C mov dword ptr ss:[ebp-40],ebx
00407F5F mov dword ptr ss:[ebp-48],2
00407F66 mov dword ptr ss:[ebp-88],4008
00407F70 call esi
00407F72 lea eax,dword ptr ss:[ebp-2C]
00407F75 lea ecx,dword ptr ss:[ebp-68]
00407F78 mov dword ptr ss:[ebp-A0],eax
00407F7E push ecx
00407F7F lea edx,dword ptr ss:[ebp-A8]
00407F85 push 4
00407F87 lea eax,dword ptr ss:[ebp-78]
00407F8A push edx
00407F8B push eax
00407F8C mov dword ptr ss:[ebp-60],ebx
00407F8F mov dword ptr ss:[ebp-68],2
00407F96 mov dword ptr ss:[ebp-A8],4008
00407FA0 call esi
00407FA2 lea ecx,dword ptr ss:[ebp-78]
00407FA5 lea edx,dword ptr ss:[ebp-34]
00407FA8 push ecx
00407FA9 push edx
00407FAA call edi
00407FAC push eax
00407FAD call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407FB3 mov bx,ax ; 用户名第四位
00407FB6 lea eax,dword ptr ss:[ebp-58]
00407FB9 lea ecx,dword ptr ss:[ebp-30]
00407FBC push eax
00407FBD push ecx
00407FBE call edi
00407FC0 push eax
00407FC1 call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00407FC7 xor edx,edx
00407FC9 cmp ax,bx
00407FCC lea eax,dword ptr ss:[ebp-34]
00407FCF lea ecx,dword ptr ss:[ebp-30]
00407FD2 setne dl
00407FD5 push eax
00407FD6 push ecx
00407FD7 neg edx
00407FD9 push 2
00407FDB mov dword ptr ss:[ebp-BC],edx
00407FE1 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrL>; MSVBVM60.__vbaFreeStrList
00407FE7 lea edx,dword ptr ss:[ebp-78]
00407FEA lea eax,dword ptr ss:[ebp-68]
00407FED push edx
00407FEE lea ecx,dword ptr ss:[ebp-58]
00407FF1 push eax
00407FF2 lea edx,dword ptr ss:[ebp-48]
00407FF5 push ecx
00407FF6 push edx
00407FF7 push 4
00407FF9 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarL>; MSVBVM60.__vbaFreeVarList
00407FFF xor ebx,ebx
00408001 add esp,20
00408004 cmp word ptr ss:[ebp-BC],bx
0040800B jnz CrackMe_.004081C4
00408011 lea eax,dword ptr ss:[ebp-18]
00408014 lea ecx,dword ptr ss:[ebp-48]
00408017 mov dword ptr ss:[ebp-80],eax
0040801A push ecx
0040801B lea edx,dword ptr ss:[ebp-88]
00408021 push 9
00408023 lea eax,dword ptr ss:[ebp-58]
00408026 push edx
00408027 push eax
00408028 mov dword ptr ss:[ebp-40],1
0040802F mov dword ptr ss:[ebp-48],2
00408036 mov dword ptr ss:[ebp-88],4008
00408040 call esi
00408042 lea ecx,dword ptr ss:[ebp-58]
00408045 lea edx,dword ptr ss:[ebp-30]
00408048 push ecx
00408049 push edx
0040804A call edi
0040804C push eax
0040804D call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00408053 xor ecx,ecx
00408055 cmp ax,79 ; 与79比较
00408059 setne cl
0040805C neg ecx
0040805E mov dword ptr ss:[ebp-BC],ecx
00408064 lea ecx,dword ptr ss:[ebp-30]
00408067 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>; MSVBVM60.__vbaFreeStr
0040806D lea edx,dword ptr ss:[ebp-58]
00408070 lea eax,dword ptr ss:[ebp-48]
00408073 push edx
00408074 push eax
00408075 push 2
00408077 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarL>; MSVBVM60.__vbaFreeVarList
0040807D add esp,0C
00408080 cmp word ptr ss:[ebp-BC],bx
00408087 jnz CrackMe_.004081C4
0040808D lea ecx,dword ptr ss:[ebp-18]
00408090 lea edx,dword ptr ss:[ebp-48]
00408093 mov dword ptr ss:[ebp-80],ecx
00408096 push edx
00408097 lea eax,dword ptr ss:[ebp-88]
0040809D push 0A
0040809F lea ecx,dword ptr ss:[ebp-58]
004080A2 push eax
004080A3 push ecx
004080A4 mov dword ptr ss:[ebp-40],1
004080AB mov dword ptr ss:[ebp-48],2
004080B2 mov dword ptr ss:[ebp-88],4008
004080BC call esi
004080BE lea edx,dword ptr ss:[ebp-2C]
004080C1 lea eax,dword ptr ss:[ebp-68]
004080C4 mov dword ptr ss:[ebp-A0],edx
004080CA push eax
004080CB lea ecx,dword ptr ss:[ebp-A8]
004080D1 push 5
004080D3 lea edx,dword ptr ss:[ebp-78]
004080D6 push ecx
004080D7 push edx
004080D8 mov dword ptr ss:[ebp-60],1
004080DF mov dword ptr ss:[ebp-68],2
004080E6 mov dword ptr ss:[ebp-A8],4008
004080F0 call esi
004080F2 lea eax,dword ptr ss:[ebp-78]
004080F5 lea ecx,dword ptr ss:[ebp-34]
004080F8 push eax
004080F9 push ecx
004080FA call edi
004080FC mov esi,dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00408102 push eax
00408103 call esi
00408105 mov dx,ax
00408108 lea eax,dword ptr ss:[ebp-58]
0040810B lea ecx,dword ptr ss:[ebp-30]
0040810E push eax
0040810F push ecx
00408110 mov word ptr ss:[ebp-D2],dx ; 用户名第五位
00408117 call edi
00408119 push eax
0040811A call esi
0040811C mov cx,word ptr ss:[ebp-D2]
00408123 xor edx,edx
00408125 cmp ax,cx ; 与注册码比较
00408128 lea eax,dword ptr ss:[ebp-30]
0040812B setne dl
0040812E neg edx
00408130 mov esi,edx
00408132 lea edx,dword ptr ss:[ebp-34]
00408135 push edx
00408136 push eax
00408137 push 2
00408139 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrL>; MSVBVM60.__vbaFreeStrList
0040813F mov edi,dword ptr ds:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
00408145 lea ecx,dword ptr ss:[ebp-78]
00408148 lea edx,dword ptr ss:[ebp-68]
0040814B push ecx
0040814C lea eax,dword ptr ss:[ebp-58]
0040814F push edx
00408150 lea ecx,dword ptr ss:[ebp-48]
00408153 push eax
00408154 push ecx
00408155 push 4
00408157 call edi
00408159 add esp,20
0040815C cmp si,bx
0040815F jnz short CrackMe_.004081C4 ; 不相等继续OVER
00408161 mov eax,0A
00408166 mov ecx,80020004
0040816B mov dword ptr ss:[ebp-58],eax
0040816E mov dword ptr ss:[ebp-48],eax
00408171 lea edx,dword ptr ss:[ebp-28]
00408174 mov dword ptr ss:[ebp-50],ecx
00408177 mov dword ptr ss:[ebp-40],ecx
0040817A mov eax,4008
0040817F mov dword ptr ss:[ebp-90],edx
00408185 lea ecx,dword ptr ss:[ebp-24]
00408188 mov dword ptr ss:[ebp-98],eax
0040818E mov dword ptr ss:[ebp-88],eax
00408194 lea edx,dword ptr ss:[ebp-58]
00408197 mov dword ptr ss:[ebp-80],ecx
0040819A lea eax,dword ptr ss:[ebp-48]
0040819D push edx
0040819E lea ecx,dword ptr ss:[ebp-98]
004081A4 push eax
004081A5 push ecx
004081A6 lea edx,dword ptr ss:[ebp-88]
004081AC push 40
004081AE push edx
004081AF call dword ptr ds:[<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox /// 成功的话,自然就弹出来了
004081B5 lea eax,dword ptr ss:[ebp-58]
004081B8 lea ecx,dword ptr ss:[ebp-48]
/////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////
总结:
1, 用户名不能小于五位且注册码不能小于十位
2, 注册码1,3,5,7,9位必须为pediy
3, 注册码2,4,6,10位必须为用户名前五位
/////////////////////////////////////////////////////////////////////////
一组注册信息:
name: lengxue
code: pleednigyx
/////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////
------------------------------------------------------------------------
--------
【版权声明】 本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
|
|
