论坛: 编程破解 标题: 急需，请大家帮我！ 复制本贴地址    
作者: xiaojun [xiaojun]    剑客   登录
现急需木马克星(iparmor 5.33.40)的注册码，请大家帮忙，先谢谢了！

地主 发表时间: 04/06 15:11
回复: wwiinngd [wwiinngd]   论坛用户   登录
喜欢的人就看吧,
木马克星(iparmor) V5.33.61 
论坛里刚刚有了60版的，61版就已经出来了。 
升级很快啊！ 

昨天又是我登陆同学录200次纪念，想要找个什么东西来庆祝一下。就是它了。 

软件名称：木马克星(iparmor) V5.33.61 

软件大小：  1392 KB 
软件语言：  简体中文 
软件类别：  国产软件 / 共享版 / 网络安全 
应用平台：  Win95/98/NT/2000 
界面预览：  无 
加入时间：  2002-03-28 20:02:08 
浏览次数：  38768 
下载次数：  28198 

联 系 人：  iparmor@luosoft.com  
开 发 商：  http://www.luosoft.com/ 

软件介绍：  
    可以查杀5021种国际木马，112种电子邮件木马，保证查杀冰河类文件关联木马，oicq类寄生木马，icmp类幽灵木马,网络神偷类反弹木马。内置木马防火墙，任何黑客试图与本机建立连接，都需要Iparmor 确认，不仅可以查杀木马，更可以查黑客。 

用fi察看，是未加壳的delph的东西。好！ 
然后用w32dasm 反汇编。 
找到“软件已经被成功注册”，发现地址在：4f6c86 
在往上找，再4f6bd9除应该可以下断。 
先启动软件注册。程序要求重新启动软件完成注册。 

此时用trw载入程序。 
下命令：go 4f6bd9 回车 

走到那里。kankan ！ 


:004F6BD7 B101                    mov cl, 01 

* Possible StringData Ref from Code Obj ->".DEFAULT\Software\AngelSoft\iparmor" 
                                  | 
:004F6BD9 BAF0764F00              mov edx, 004F76F0。。下断！ 
:004F6BDE 8BC6                    mov eax, esi 
:004F6BE0 E8EB0DF7FF              call 004679D0 
:004F6BE5 8D4DFC                  lea ecx, dword ptr [ebp-04] 

* Possible StringData Ref from Code Obj ->"pass" 
                                  | 
:004F6BE8 BA1C774F00              mov edx, 004F771C 
:004F6BED 8BC6                    mov eax, esi 
:004F6BEF E8C014F7FF              call 004680B4 
:004F6BF4 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0] 

* Possible StringData Ref from Code Obj ->"name" 
                                  | 
:004F6BFA BA2C774F00              mov edx, 004F772C 
:004F6BFF 8BC6                    mov eax, esi 
:004F6C01 E8AE14F7FF              call 004680B4 
:004F6C06 8B95F0FEFFFF            mov edx, dword ptr [ebp+FFFFFEF0] 
:004F6C0C 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4] 
:004F6C12 B9FF000000              mov ecx, 000000FF 
:004F6C17 E868DEF0FF              call 00404A84 
:004F6C1C 8D95F4FEFFFF            lea edx, dword ptr [ebp+FFFFFEF4] 
:004F6C22 8B83D0020000            mov eax, dword ptr [ebx+000002D0] 
:004F6C28 E84F46FCFF              call 004BB27C 
:004F6C2D 8D95ECFEFFFF            lea edx, dword ptr [ebp+FFFFFEEC] 
:004F6C33 8B83D0020000            mov eax, dword ptr [ebx+000002D0] 
:004F6C39 8B8024020000            mov eax, dword ptr [eax+00000224] 
:004F6C3F 2D6E020000              sub eax, 0000026E 
:004F6C44 E86B31F1FF              call 00409DB4 
:004F6C49 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC] 
:004F6C4F 8B45FC                  mov eax, dword ptr [ebp-04] 
:004F6C52 E861DFF0FF              call 00404BB8 
:004F6C57 0F858F000000            jne 004F6CEC 
:004F6C5D C6050C12510001          mov byte ptr [0051120C], 01 
:004F6C64 33D2                    xor edx, edx 
:004F6C66 8B83E0020000            mov eax, dword ptr [ebx+000002E0] 
:004F6C6C E8830BF4FF              call 004377F4 

* Possible StringData Ref from Code Obj ->"Reistered successfully." 
                                  | 
:004F6C71 BA3C774F00              mov edx, 004F773C 
:004F6C76 8B83E8020000            mov eax, dword ptr [ebx+000002E8] 
:004F6C7C E8670DF4FF              call 004379E8 
:004F6C81 803F00                  cmp byte ptr [edi], 00 
:004F6C84 7410                    je 004F6C96 

* Possible StringData Ref from Code Obj ->"软件已经被 
成功注册." 
                                  | 
:004F6C86 BA5C774F00              mov edx, 004F775C 
:004F6C8B 8B83E8020000            mov eax, dword ptr [ebx+000002E8] 
:004F6C91 E8520DF4FF              call 004379E8 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F6C84(C) 
| 
:004F6C96 33D2                    xor edx, edx 
:004F6C98 8B83D4020000            mov eax, dword ptr [ebx+000002D4] 
:004F6C9E E8510BF4FF              call 004377F4 
:004F6CA3 33D2                    xor edx, edx 
:004F6CA5 8B83D8020000            mov eax, dword ptr [ebx+000002D8] 
:004F6CAB E8440BF4FF              call 004377F4 
:004F6CB0 33D2                    xor edx, edx 
:004F6CB2 8B83DC020000            mov eax, dword ptr [ebx+000002DC] 
:004F6CB8 E8370BF4FF              call 004377F4 

* Possible StringData Ref from Code Obj ->"Registered" 
                                  | 
:004F6CBD BA7C774F00              mov edx, 004F777C 
:004F6CC2 8B83E4020000            mov eax, dword ptr [ebx+000002E4] 
:004F6CC8 E81B0DF4FF              call 004379E8 
:004F6CCD B805000000              mov eax, 00000005 
:004F6CD2 E8E5C8F0FF              call 004035BC 
:004F6CD7 83F803                  cmp eax, 00000003 
:004F6CDA 0F8512080000            jne 004F74F2 
:004F6CE0 8BC3                    mov eax, ebx 
:004F6CE2 E8F10C0000              call 004F79D8 
:004F6CE7 E906080000              jmp 004F74F2 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F6C57(C) 
| 
:004F6CEC 8D55F4                  lea edx, dword ptr [ebp-0C] 
:004F6CEF 8B45FC                  mov eax, dword ptr [ebp-04] 
:004F6CF2 E855FAFFFF              call 004F674C 
:004F6CF7 8D95E4FEFFFF            lea edx, dword ptr [ebp+FFFFFEE4] 
:004F6CFD 8B83D0020000            mov eax, dword ptr [ebx+000002D0] 
:004F6D03 8B8024020000            mov eax, dword ptr [eax+00000224] 
:004F6D09 2DB6000000              sub eax, 000000B6 
:004F6D0E E8A130F1FF              call 00409DB4 
:004F6D13 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4] 
:004F6D19 8D95E8FEFFFF            lea edx, dword ptr [ebp+FFFFFEE8] 
:004F6D1F E828FAFFFF              call 004F674C 
:004F6D24 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8] 
:004F6D2A 8B45F4                  mov eax, dword ptr [ebp-0C] 
:004F6D2D E886DEF0FF              call 00404BB8 
:004F6D32 757F                    jne 004F6DB3 
:004F6D34 C6050C12510001          mov byte ptr [0051120C], 01 
:004F6D3B 33D2                    xor edx, edx 
:004F6D3D 8B83E0020000            mov eax, dword ptr [ebx+000002E0] 
:004F6D43 E8AC0AF4FF              call 004377F4 
:004F6D48 803F00                  cmp byte ptr [edi], 00 
:004F6D4B 7410                    je 004F6D5D 

* Possible StringData Ref from Code Obj ->"软件已经被 
成功注册." 
                                  | 
:004F6D4D BA5C774F00              mov edx, 004F775C 
:004F6D52 8B83E8020000            mov eax, dword ptr [ebx+000002E8] 
:004F6D58 E88B0CF4FF              call 004379E8 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F6D4B(C) 
| 
:004F6D5D 33D2                    xor edx, edx 
:004F6D5F 8B83D4020000            mov eax, dword ptr [ebx+000002D4] 
:004F6D65 E88A0AF4FF              call 004377F4 
:004F6D6A 33D2                    xor edx, edx 
:004F6D6C 8B83D8020000            mov eax, dword ptr [ebx+000002D8] 
:004F6D72 E87D0AF4FF              call 004377F4 
:004F6D77 33D2                    xor edx, edx 
:004F6D79 8B83DC020000            mov eax, dword ptr [ebx+000002DC] 
:004F6D7F E8700AF4FF              call 004377F4 

* Possible StringData Ref from Code Obj ->"Registed" 
                                  | 
:004F6D84 BA90774F00              mov edx, 004F7790 
:004F6D89 8B83E4020000            mov eax, dword ptr [ebx+000002E4] 
:004F6D8F E8540CF4FF              call 004379E8 
:004F6D94 B81E000000              mov eax, 0000001E 
:004F6D99 E81EC8F0FF              call 004035BC 
:004F6D9E 83F803                  cmp eax, 00000003 
:004F6DA1 0F854B070000            jne 004F74F2 
:004F6DA7 8BC3                    mov eax, ebx 
:004F6DA9 E82A0C0000              call 004F79D8 
:004F6DAE E93F070000              jmp 004F74F2 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F6D32(C) 
| 
:004F6DB3 8D95DCFEFFFF            lea edx, dword ptr [ebp+FFFFFEDC] 
:004F6DB9 8B83D0020000            mov eax, dword ptr [ebx+000002D0] 
:004F6DBF 8B8024020000            mov eax, dword ptr [eax+00000224] 
:004F6DC5 2D7E010000              sub eax, 0000017E 
:004F6DCA E8E52FF1FF              call 00409DB4 
:004F6DCF 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC] 
:004F6DD5 8D95E0FEFFFF            lea edx, dword ptr [ebp+FFFFFEE0] 
:004F6DDB E86CF9FFFF              call 004F674C 
:004F6DE0 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]。。。d edx 得第一个注册码！ 
:004F6DE6 8B45F4                  mov eax, dword ptr [ebp-0C] 
:004F6DE9 E8CADDF0FF              call 00404BB8 
:004F6DEE 757F                    jne 004F6E6F 
:004F6DF0 C6050C12510001          mov byte ptr [0051120C], 01 
:004F6DF7 33D2                    xor edx, edx 
:004F6DF9 8B83E0020000            mov eax, dword ptr [ebx+000002E0] 
:004F6DFF E8F009F4FF              call 004377F4 
:004F6E04 803F00                  cmp byte ptr [edi], 00 
:004F6E07 7410                    je 004F6E19 

* Possible StringData Ref from Code Obj ->"软件已经被 
成功注册." 
                                  | 
:004F6E09 BA5C774F00              mov edx, 004F775C 
:004F6E0E 8B83E8020000            mov eax, dword ptr [ebx+000002E8] 
:004F6E14 E8CF0BF4FF              call 004379E8 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F6E07(C) 
| 
:004F6E19 33D2                    xor edx, edx 
:004F6E1B 8B83D4020000            mov eax, dword ptr [ebx+000002D4] 
:004F6E21 E8CE09F4FF              call 004377F4 
:004F6E26 33D2                    xor edx, edx 
:004F6E28 8B83D8020000            mov eax, dword ptr [ebx+000002D8] 
:004F6E2E E8C109F4FF              call 004377F4 
:004F6E33 33D2                    xor edx, edx 
:004F6E35 8B83DC020000            mov eax, dword ptr [ebx+000002DC] 
:004F6E3B E8B409F4FF              call 004377F4 

* Possible StringData Ref from Code Obj ->"Registed" 
                                  | 
:004F6E40 BA90774F00              mov edx, 004F7790 
:004F6E45 8B83E4020000            mov eax, dword ptr [ebx+000002E4] 
:004F6E4B E8980BF4FF              call 004379E8 
:004F6E50 B81E000000              mov eax, 0000001E 
:004F6E55 E862C7F0FF              call 004035BC 
:004F6E5A 83F803                  cmp eax, 00000003 
:004F6E5D 0F858F060000            jne 004F74F2 
:004F6E63 8BC3                    mov eax, ebx 
:004F6E65 E86E0B0000              call 004F79D8 
:004F6E6A E983060000              jmp 004F74F2 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F6DEE(C) 
| 
:004F6E6F 8D95D4FEFFFF            lea edx, dword ptr [ebp+FFFFFED4] 
:004F6E75 8B83D0020000            mov eax, dword ptr [ebx+000002D0] 
:004F6E7B 8B8024020000            mov eax, dword ptr [eax+00000224] 
:004F6E81 2D5A020000              sub eax, 0000025A 
:004F6E86 E8292FF1FF              call 00409DB4 
:004F6E8B 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4] 
:004F6E91 8D95D8FEFFFF            lea edx, dword ptr [ebp+FFFFFED8] 
:004F6E97 E8B0F8FFFF              call 004F674C 
:004F6E9C 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]。。。。第二个！ 
:004F6EA2 8B45F4                  mov eax, dword ptr [ebp-0C] 
:004F6EA5 E80EDDF0FF              call 00404BB8 
:004F6EAA 757F                    jne 004F6F2B 
:004F6EAC C6050C12510001          mov byte ptr [0051120C], 01 
:004F6EB3 33D2                    xor edx, edx 
:004F6EB5 8B83E0020000            mov eax, dword ptr [ebx+000002E0] 
:004F6EBB E83409F4FF              call 004377F4 
:004F6EC0 803F00                  cmp byte ptr [edi], 00 
:004F6EC3 7410                    je 004F6ED5 

* Possible StringData Ref from Code Obj ->"软件已经被 
成功注册." 
                                  | 
:004F6EC5 BA5C774F00              mov edx, 004F775C 
:004F6ECA 8B83E8020000            mov eax, dword ptr [ebx+000002E8] 
:004F6ED0 E8130BF4FF              call 004379E8 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F6EC3(C) 
| 
:004F6ED5 33D2                    xor edx, edx 
:004F6ED7 8B83D4020000            mov eax, dword ptr [ebx+000002D4] 
:004F6EDD E81209F4FF              call 004377F4 
:004F6EE2 33D2                    xor edx, edx 
:004F6EE4 8B83D8020000            mov eax, dword ptr [ebx+000002D8] 
:004F6EEA E80509F4FF              call 004377F4 
:004F6EEF 33D2                    xor edx, edx 
:004F6EF1 8B83DC020000            mov eax, dword ptr [ebx+000002DC] 
:004F6EF7 E8F808F4FF              call 004377F4 

* Possible StringData Ref from Code Obj ->"Registed" 
                                  | 
:004F6EFC BA90774F00              mov edx, 004F7790 
:004F6F01 8B83E4020000            mov eax, dword ptr [ebx+000002E4] 
:004F6F07 E8DC0AF4FF              call 004379E8 
:004F6F0C B81E000000              mov eax, 0000001E 
:004F6F11 E8A6C6F0FF              call 004035BC 
:004F6F16 83F803                  cmp eax, 00000003 
:004F6F19 0F85D3050000            jne 004F74F2 
:004F6F1F 8BC3                    mov eax, ebx 
:004F6F21 E8B20A0000              call 004F79D8 
:004F6F26 E9C7050000              jmp 004F74F2 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F6EAA(C) 
| 
:004F6F2B 8D95CCFEFFFF            lea edx, dword ptr [ebp+FFFFFECC] 
:004F6F31 8B83D0020000            mov eax, dword ptr [ebx+000002D0] 
:004F6F37 8B8024020000            mov eax, dword ptr [eax+00000224] 
:004F6F3D 2D72020000              sub eax, 00000272 
:004F6F42 E86D2EF1FF              call 00409DB4 
:004F6F47 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC] 
:004F6F4D 8D95D0FEFFFF            lea edx, dword ptr [ebp+FFFFFED0] 
:004F6F53 E8F4F7FFFF              call 004F674C 
:004F6F58 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]。。。第三个！ 
:004F6F5E 8B45F4                  mov eax, dword ptr [ebp-0C] 
:004F6F61 E852DCF0FF              call 00404BB8 
:004F6F66 757F                    jne 004F6FE7 
:004F6F68 C6050C12510001          mov byte ptr [0051120C], 01 
:004F6F6F 33D2                    xor edx, edx 
:004F6F71 8B83E0020000            mov eax, dword ptr [ebx+000002E0] 
:004F6F77 E87808F4FF              call 004377F4 
:004F6F7C 803F00                  cmp byte ptr [edi], 00 
:004F6F7F 7410                    je 004F6F91 

* Possible StringData Ref from Code Obj ->"软件已经被 
成功注册." 
                                  | 
:004F6F81 BA5C774F00              mov edx, 004F775C 
:004F6F86 8B83E8020000            mov eax, dword ptr [ebx+000002E8] 
:004F6F8C E8570AF4FF              call 004379E8 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F6F7F(C) 
| 
:004F6F91 33D2                    xor edx, edx 
:004F6F93 8B83D4020000            mov eax, dword ptr [ebx+000002D4] 
:004F6F99 E85608F4FF              call 004377F4 
:004F6F9E 33D2                    xor edx, edx 
:004F6FA0 8B83D8020000            mov eax, dword ptr [ebx+000002D8] 
:004F6FA6 E84908F4FF              call 004377F4 
:004F6FAB 33D2                    xor edx, edx 
:004F6FAD 8B83DC020000            mov eax, dword ptr [ebx+000002DC] 
:004F6FB3 E83C08F4FF              call 004377F4 

* Possible StringData Ref from Code Obj ->"Registed" 
                                  | 
:004F6FB8 BA90774F00              mov edx, 004F7790 
:004F6FBD 8B83E4020000            mov eax, dword ptr [ebx+000002E4] 
:004F6FC3 E8200AF4FF              call 004379E8 
:004F6FC8 B81E000000              mov eax, 0000001E 
:004F6FCD E8EAC5F0FF              call 004035BC 
:004F6FD2 83F803                  cmp eax, 00000003 
:004F6FD5 0F8517050000            jne 004F74F2 
:004F6FDB 8BC3                    mov eax, ebx 
:004F6FDD E8F6090000              call 004F79D8 
:004F6FE2 E90B050000              jmp 004F74F2 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F6F66(C) 
| 
:004F6FE7 8D95C4FEFFFF            lea edx, dword ptr [ebp+FFFFFEC4] 
:004F6FED 8B83D0020000            mov eax, dword ptr [ebx+000002D0] 
:004F6FF3 8B8024020000            mov eax, dword ptr [eax+00000224] 
:004F6FF9 2D8C020000              sub eax, 0000028C 
:004F6FFE E8B12DF1FF              call 00409DB4 
:004F7003 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4] 
:004F7009 8D95C8FEFFFF            lea edx, dword ptr [ebp+FFFFFEC8] 
:004F700F E838F7FFFF              call 004F674C 
:004F7014 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]。。。。第四个！ 
:004F701A 8B45F4                  mov eax, dword ptr [ebp-0C] 
:004F701D E896DBF0FF              call 00404BB8 
:004F7022 757F                    jne 004F70A3 
:004F7024 C6050C12510001          mov byte ptr [0051120C], 01 
:004F702B 33D2                    xor edx, edx 
:004F702D 8B83E0020000            mov eax, dword ptr [ebx+000002E0] 
:004F7033 E8BC07F4FF              call 004377F4 
:004F7038 803F00                  cmp byte ptr [edi], 00 
:004F703B 7410                    je 004F704D 

* Possible StringData Ref from Code Obj ->"软件已经被 
成功注册." 
                                  | 
:004F703D BA5C774F00              mov edx, 004F775C 
:004F7042 8B83E8020000            mov eax, dword ptr [ebx+000002E8] 
:004F7048 E89B09F4FF              call 004379E8 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F703B(C) 
| 
:004F704D 33D2                    xor edx, edx 
:004F704F 8B83D4020000            mov eax, dword ptr [ebx+000002D4] 
:004F7055 E89A07F4FF              call 004377F4 
:004F705A 33D2                    xor edx, edx 
:004F705C 8B83D8020000            mov eax, dword ptr [ebx+000002D8] 
:004F7062 E88D07F4FF              call 004377F4 
:004F7067 33D2                    xor edx, edx 
:004F7069 8B83DC020000            mov eax, dword ptr [ebx+000002DC] 
:004F706F E88007F4FF              call 004377F4 

* Possible StringData Ref from Code Obj ->"Registed" 
                                  | 
:004F7074 BA90774F00              mov edx, 004F7790 
:004F7079 8B83E4020000            mov eax, dword ptr [ebx+000002E4] 
:004F707F E86409F4FF              call 004379E8 
:004F7084 B81E000000              mov eax, 0000001E 
:004F7089 E82EC5F0FF              call 004035BC 
:004F708E 83F803                  cmp eax, 00000003 
:004F7091 0F855B040000            jne 004F74F2 
:004F7097 8BC3                    mov eax, ebx 
:004F7099 E83A090000              call 004F79D8 
:004F709E E94F040000              jmp 004F74F2 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F7022(C) 
| 
:004F70A3 8B83D0020000            mov eax, dword ptr [ebx+000002D0] 
:004F70A9 8B8024020000            mov eax, dword ptr [eax+00000224] 
:004F70AF 05EA040000              add eax, 000004EA 
:004F70B4 99                      cdq 
:004F70B5 33C2                    xor eax, edx 
:004F70B7 2BC2                    sub eax, edx 
:004F70B9 8D95BCFEFFFF            lea edx, dword ptr [ebp+FFFFFEBC] 
:004F70BF E8F02CF1FF              call 00409DB4 
:004F70C4 8B85BCFEFFFF            mov eax, dword ptr [ebp+FFFFFEBC] 
:004F70CA 8D95C0FEFFFF            lea edx, dword ptr [ebp+FFFFFEC0] 
:004F70D0 E877F6FFFF              call 004F674C 
:004F70D5 8B95C0FEFFFF            mov edx, dword ptr [ebp+FFFFFEC0]。。。第五个！ 
:004F70DB 8B45F4                  mov eax, dword ptr [ebp-0C] 
:004F70DE E8D5DAF0FF              call 00404BB8 
:004F70E3 7578                    jne 004F715D 
:004F70E5 C6050C12510001          mov byte ptr [0051120C], 01 
:004F70EC 33D2                    xor edx, edx 
:004F70EE 8B83E0020000            mov eax, dword ptr [ebx+000002E0] 
:004F70F4 E8FB06F4FF              call 004377F4 
:004F70F9 803F00                  cmp byte ptr [edi], 00 
:004F70FC 7410                    je 004F710E 

* Possible StringData Ref from Code Obj ->"软件已经被 
成功注册." 
                                  | 
:004F70FE BA5C774F00              mov edx, 004F775C 
:004F7103 8B83E8020000            mov eax, dword ptr [ebx+000002E8] 
:004F7109 E8DA08F4FF              call 004379E8 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F70FC(C) 
| 
:004F710E 33D2                    xor edx, edx 
:004F7110 8B83D4020000            mov eax, dword ptr [ebx+000002D4] 
:004F7116 E8D906F4FF              call 004377F4 
:004F711B 33D2                    xor edx, edx 
:004F711D 8B83D8020000            mov eax, dword ptr [ebx+000002D8] 
:004F7123 E8CC06F4FF              call 004377F4 
:004F7128 33D2                    xor edx, edx 
:004F712A 8B83DC020000            mov eax, dword ptr [ebx+000002DC] 
:004F7130 E8BF06F4FF              call 004377F4 

* Possible StringData Ref from Code Obj ->"Successful registration" 
                                  | 
:004F7135 BAA4774F00              mov edx, 004F77A4 
:004F713A 8B83E4020000            mov eax, dword ptr [ebx+000002E4] 
:004F7140 E8A308F4FF              call 004379E8 
:004F7145 B81E000000              mov eax, 0000001E 
:004F714A E86DC4F0FF              call 004035BC 
:004F714F 83F803                  cmp eax, 00000003 
:004F7152 0F849A030000            je 004F74F2 
:004F7158 E995030000              jmp 004F74F2 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F70E3(C) 
| 
:004F715D 8D95B4FEFFFF            lea edx, dword ptr [ebp+FFFFFEB4] 
:004F7163 8B83D0020000            mov eax, dword ptr [ebx+000002D0] 
:004F7169 8B8024020000            mov eax, dword ptr [eax+00000224] 
:004F716F 2D78020000              sub eax, 00000278 
:004F7174 E83B2CF1FF              call 00409DB4 
:004F7179 8B85B4FEFFFF            mov eax, dword ptr [ebp+FFFFFEB4] 
:004F717F 8D95B8FEFFFF            lea edx, dword ptr [ebp+FFFFFEB8] 
:004F7185 E8C2F5FFFF              call 004F674C 
:004F718A 8B95B8FEFFFF            mov edx, dword ptr [ebp+FFFFFEB8]。。。第六个！ 
:004F7190 8B45F4                  mov eax, dword ptr [ebp-0C] 
:004F7193 E820DAF0FF              call 00404BB8 
:004F7198 757F                    jne 004F7219 
:004F719A C6050C12510001          mov byte ptr [0051120C], 01 
:004F71A1 33D2                    xor edx, edx 
:004F71A3 8B83E0020000            mov eax, dword ptr [ebx+000002E0] 
:004F71A9 E84606F4FF              call 004377F4 
:004F71AE 803F00                  cmp byte ptr [edi], 00 
:004F71B1 7410                    je 004F71C3 

* Possible StringData Ref from Code Obj ->"软件已经被 
成功注册." 
                                  | 
:004F71B3 BA5C774F00              mov edx, 004F775C 
:004F71B8 8B83E8020000            mov eax, dword ptr [ebx+000002E8] 
:004F71BE E82508F4FF              call 004379E8 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F71B1(C) 
| 
:004F71C3 33D2                    xor edx, edx 
:004F71C5 8B83D4020000            mov eax, dword ptr [ebx+000002D4] 
:004F71CB E82406F4FF              call 004377F4 
:004F71D0 33D2                    xor edx, edx 
:004F71D2 8B83D8020000            mov eax, dword ptr [ebx+000002D8] 
:004F71D8 E81706F4FF              call 004377F4 
:004F71DD 33D2                    xor edx, edx 
:004F71DF 8B83DC020000            mov eax, dword ptr [ebx+000002DC] 
:004F71E5 E80A06F4FF              call 004377F4 

* Possible StringData Ref from Code Obj ->"Registed" 
                                  | 
:004F71EA BA90774F00              mov edx, 004F7790 
:004F71EF 8B83E4020000            mov eax, dword ptr [ebx+000002E4] 
:004F71F5 E8EE07F4FF              call 004379E8 
:004F71FA B81E000000              mov eax, 0000001E 
:004F71FF E8B8C3F0FF              call 004035BC 
:004F7204 83F803                  cmp eax, 00000003 
:004F7207 0F85E5020000            jne 004F74F2 
:004F720D 8BC3                    mov eax, ebx 
:004F720F E8C4070000              call 004F79D8 
:004F7214 E9D9020000              jmp 004F74F2 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F7198(C) 
| 
:004F7219 8D95ACFEFFFF            lea edx, dword ptr [ebp+FFFFFEAC] 
:004F721F 8B83D0020000            mov eax, dword ptr [ebx+000002D0] 
:004F7225 8B8024020000            mov eax, dword ptr [eax+00000224] 
:004F722B 83E87B                  sub eax, 0000007B 
:004F722E E8812BF1FF              call 00409DB4 
:004F7233 8B85ACFEFFFF            mov eax, dword ptr [ebp+FFFFFEAC] 
:004F7239 8D95B0FEFFFF            lea edx, dword ptr [ebp+FFFFFEB0] 
:004F723F E808F5FFFF              call 004F674C 
:004F7244 8B95B0FEFFFF            mov edx, dword ptr [ebp+FFFFFEB0] 
:004F724A 8B45F4                  mov eax, dword ptr [ebp-0C] 
:004F724D E866D9F0FF              call 00404BB8 
:004F7252 757F                    jne 004F72D3 
:004F7254 C6050C12510001          mov byte ptr [0051120C], 01 
:004F725B 33D2                    xor edx, edx 
:004F725D 8B83E0020000            mov eax, dword ptr [ebx+000002E0] 
:004F7263 E88C05F4FF              call 004377F4 
:004F7268 803F00                  cmp byte ptr [edi], 00 
:004F726B 7410                    je 004F727D 

* Possible StringData Ref from Code Obj ->"软件已经被 
成功注册." 
                                  | 
:004F726D BA5C774F00              mov edx, 004F775C 
:004F7272 8B83E8020000            mov eax, dword ptr [ebx+000002E8] 
:004F7278 E86B07F4FF              call 004379E8 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F726B(C) 
| 
:004F727D 33D2                    xor edx, edx 
:004F727F 8B83D4020000            mov eax, dword ptr [ebx+000002D4] 
:004F7285 E86A05F4FF              call 004377F4 
:004F728A 33D2                    xor edx, edx 
:004F728C 8B83D8020000            mov eax, dword ptr [ebx+000002D8] 
:004F7292 E85D05F4FF              call 004377F4 
:004F7297 33D2                    xor edx, edx 
:004F7299 8B83DC020000            mov eax, dword ptr [ebx+000002DC] 
:004F729F E85005F4FF              call 004377F4 

* Possible StringData Ref from Code Obj ->"Registered" 
                                  | 
:004F72A4 BA7C774F00              mov edx, 004F777C 
:004F72A9 8B83E4020000            mov eax, dword ptr [ebx+000002E4] 
:004F72AF E83407F4FF              call 004379E8 
:004F72B4 B81E000000              mov eax, 0000001E 
:004F72B9 E8FEC2F0FF              call 004035BC 
:004F72BE 83F803                  cmp eax, 00000003 
:004F72C1 0F852B020000            jne 004F74F2 
:004F72C7 8BC3                    mov eax, ebx 
:004F72C9 E80A070000              call 004F79D8 
:004F72CE E91F020000              jmp 004F74F2 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F7252(C) 
| 
:004F72D3 8D95A4FEFFFF            lea edx, dword ptr [ebp+FFFFFEA4] 
:004F72D9 8B83D0020000            mov eax, dword ptr [ebx+000002D0] 
:004F72DF 8B8024020000            mov eax, dword ptr [eax+00000224] 
:004F72E5 2D3E0A0000              sub eax, 00000A3E 
:004F72EA E8C52AF1FF              call 00409DB4 
:004F72EF 8B85A4FEFFFF            mov eax, dword ptr [ebp+FFFFFEA4] 
:004F72F5 8D95A8FEFFFF            lea edx, dword ptr [ebp+FFFFFEA8] 
:004F72FB E84CF4FFFF              call 004F674C 
:004F7300 8B95A8FEFFFF            mov edx, dword ptr [ebp+FFFFFEA8]。。。第七个！ 
:004F7306 8B45F4                  mov eax, dword ptr [ebp-0C] 
:004F7309 E8AAD8F0FF              call 00404BB8 
:004F730E 757F                    jne 004F738F 
:004F7310 C6050C12510001          mov byte ptr [0051120C], 01 
:004F7317 33D2                    xor edx, edx 
:004F7319 8B83E0020000            mov eax, dword ptr [ebx+000002E0] 
:004F731F E8D004F4FF              call 004377F4 
:004F7324 803F00                  cmp byte ptr [edi], 00 
:004F7327 7410                    je 004F7339 

* Possible StringData Ref from Code Obj ->"软件已经被 
成功注册." 
                                  | 
:004F7329 BA5C774F00              mov edx, 004F775C 
:004F732E 8B83E8020000            mov eax, dword ptr [ebx+000002E8] 
:004F7334 E8AF06F4FF              call 004379E8 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F7327(C) 
| 
:004F7339 33D2                    xor edx, edx 
:004F733B 8B83D4020000            mov eax, dword ptr [ebx+000002D4] 
:004F7341 E8AE04F4FF              call 004377F4 
:004F7346 33D2                    xor edx, edx 
:004F7348 8B83D8020000            mov eax, dword ptr [ebx+000002D8] 
:004F734E E8A104F4FF              call 004377F4 
:004F7353 33D2                    xor edx, edx 
:004F7355 8B83DC020000            mov eax, dword ptr [ebx+000002DC] 
:004F735B E89404F4FF              call 004377F4 

* Possible StringData Ref from Code Obj ->"Registered" 
                                  | 
:004F7360 BA7C774F00              mov edx, 004F777C 
:004F7365 8B83E4020000            mov eax, dword ptr [ebx+000002E4] 
:004F736B E87806F4FF              call 004379E8 
:004F7370 B81E000000              mov eax, 0000001E 
:004F7375 E842C2F0FF              call 004035BC 
:004F737A 83F803                  cmp eax, 00000003 
:004F737D 0F856F010000            jne 004F74F2 
:004F7383 8BC3                    mov eax, ebx 
:004F7385 E84E060000              call 004F79D8 
:004F738A E963010000              jmp 004F74F2 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F730E(C) 
| 
:004F738F 8D45F4                  lea eax, dword ptr [ebp-0C] 

* Possible StringData Ref from Code Obj ->"asdf" 
                                  | 
:004F7392 BAC4774F00              mov edx, 004F77C4 
:004F7397 E8FCD4F0FF              call 00404898 
:004F739C 8D45FC                  lea eax, dword ptr [ebp-04] 

* Possible StringData Ref from Code Obj ->"asdf" 
                                  | 
:004F739F BAC4774F00              mov edx, 004F77C4 
:004F73A4 E8EFD4F0FF              call 00404898 
:004F73A9 8D4DF8                  lea ecx, dword ptr [ebp-08] 

* Possible StringData Ref from Code Obj ->"deta" 
                                  | 
:004F73AC BAD4774F00              mov edx, 004F77D4 
:004F73B1 8BC6                    mov eax, esi 
:004F73B3 E8FC0CF7FF              call 004680B4 
:004F73B8 837DF800                cmp dword ptr [ebp-08], 00000000 
:004F73BC 750D                    jne 004F73CB 
:004F73BE 8D45F8                  lea eax, dword ptr [ebp-08] 
:004F73C1 BAE4774F00              mov edx, 004F77E4 
:004F73C6 E8CDD4F0FF              call 00404898 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F73BC(C) 
| 
:004F73CB 8B45F8                  mov eax, dword ptr [ebp-08] 
:004F73CE E8E52AF1FF              call 00409EB8 
:004F73D3 85C0                    test eax, eax 
:004F73D5 0F8EA6000000            jle 004F7481 
:004F73DB 8B45F8                  mov eax, dword ptr [ebp-08] 
:004F73DE E8D52AF1FF              call 00409EB8 
:004F73E3 83F81F                  cmp eax, 0000001F 
:004F73E6 0F8D95000000            jnl 004F7481 
:004F73EC 8B45F8                  mov eax, dword ptr [ebp-08] 
:004F73EF E8C42AF1FF              call 00409EB8 
:004F73F4 48                      dec eax 
:004F73F5 8D95A0FEFFFF            lea edx, dword ptr [ebp+FFFFFEA0] 
:004F73FB E8B429F1FF              call 00409DB4 
:004F7400 8B8DA0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEA0] 

* Possible StringData Ref from Code Obj ->"deta" 
                                  | 
:004F7406 BAD4774F00              mov edx, 004F77D4 
:004F740B 8BC6                    mov eax, esi 
:004F740D E86E0CF7FF              call 00468080 
:004F7412 B803000000              mov eax, 00000003 
:004F7417 E8A0C1F0FF              call 004035BC 
:004F741C 48                      dec eax 
:004F741D 0F85C8000000            jne 004F74EB 
:004F7423 8B0D0CF64F00            mov ecx, dword ptr [004FF60C] 
:004F7429 A15CF54F00              mov eax, dword ptr [004FF55C] 
:004F742E 8B00                    mov eax, dword ptr [eax] 

* Possible StringData Ref from Code Obj ->"    D" 
                                  | 
:004F7430 8B154C9A4E00            mov edx, dword ptr [004E9A4C] 
:004F7436 E8FD55F6FF              call 0045CA38 
:004F743B 803F00                  cmp byte ptr [edi], 00 
:004F743E 7419                    je 004F7459 
:004F7440 A10CF64F00              mov eax, dword ptr [004FF60C] 
:004F7445 8B00                    mov eax, dword ptr [eax] 
:004F7447 8B80DC020000            mov eax, dword ptr [eax+000002DC] 

* Possible StringData Ref from Code Obj ->"感谢你使用本软件 
这是个未注册版本，只有注册， 
" 
                                        ->"才能够继续使用软件。" 
                                  | 
:004F744D BAF0774F00              mov edx, 004F77F0 
:004F7452 E89105F4FF              call 004379E8 
:004F7457 EB17                    jmp 004F7470 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F743E(C) 
| 
:004F7459 A10CF64F00              mov eax, dword ptr [004FF60C] 
:004F745E 8B00                    mov eax, dword ptr [eax] 
:004F7460 8B80DC020000            mov eax, dword ptr [eax+000002DC] 

* Possible StringData Ref from Code Obj ->" 

Sorry, Now it is after shareware " 
                                        ->"free period." 
                                  | 
:004F7466 BA3C784F00              mov edx, 004F783C 
:004F746B E87805F4FF              call 004379E8 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F7457(U) 
| 
:004F7470 A10CF64F00              mov eax, dword ptr [004FF60C] 
:004F7475 8B00                    mov eax, dword ptr [eax] 
:004F7477 8B10                    mov edx, dword ptr [eax] 
:004F7479 FF92D8000000            call dword ptr [edx+000000D8] 
:004F747F EB6A                    jmp 004F74EB 

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses: 
|:004F73D5(C), :004F73E6(C) 
| 
:004F7481 8B0D0CF64F00            mov ecx, dword ptr [004FF60C] 
:004F7487 A15CF54F00              mov eax, dword ptr [004FF55C] 
:004F748C 8B00                    mov eax, dword ptr [eax] 

* Possible StringData Ref from Code Obj ->"    D" 
                                  | 
:004F748E 8B154C9A4E00            mov edx, dword ptr [004E9A4C] 
:004F7494 E89F55F6FF              call 0045CA38 
:004F7499 803F00                  cmp byte ptr [edi], 00 
:004F749C 7419                    je 004F74B7 
:004F749E A10CF64F00              mov eax, dword ptr [004FF60C] 
:004F74A3 8B00                    mov eax, dword ptr [eax] 
:004F74A5 8B80DC020000            mov eax, dword ptr [eax+000002DC] 

* Possible StringData Ref from Code Obj ->"感谢你使用本软件 
这是个未注册版本，只有注册， 
" 
                                        ->"才能够继续使用软件。" 
                                  | 
:004F74AB BAF0774F00              mov edx, 004F77F0 
:004F74B0 E83305F4FF              call 004379E8 
:004F74B5 EB17                    jmp 004F74CE 

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 
|:004F749C(C) 
| 
:004F74B7 A10CF64F00              mov eax, dword ptr [004FF60C] 
:004F74BC 8B00                    mov eax, dword ptr [eax] 
:004F74BE 8B80DC020000            mov eax, dword ptr [eax+000002DC] 

* Possible StringData Ref from Code Obj ->" 

Sorry, Now it is after shareware " 
                                        ->"free period." 
                                  | 
:004F74C4 BA3C784F00              mov edx, 004F783C 
:004F74C9 E81A05F4FF              call 004379E8 



来个注册机！ 
地址：4f70d5 
中断次数：1 
首字节：8b 
命令长度：6 

内存方式,edx 

搞定！ 

就是不明白怎么会有那么多可以注册的号？ 
会不是真正的可以升级的藏在里面？？？ 


B1层 发表时间: 04/06 19:51

论坛: 编程破解

20CN网络安全小组版权所有
Copyright © 2000-2010 20CN Security Group. All Rights Reserved.
论坛程序编写：NetDemon

粤ICP备05087286号