追ekh的crackme1.0注册码

现在在家里休假，呵呵，家里的机器很老了，速度太慢，网速是33.6k呀，大的下不了，去破解乐园找了个ekh

的crackme玩。现下的工具，呵呵，就几个，trw，odbg，wdasm。

过程如下：

00427B7E |. E8 0DE2FEFF CALL EKH_1.00415D90

00427B83 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]

00427B86 |. 50 PUSH EAX

00427B87 |. 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]

00427B8A |. 8B83 DC010000 MOV EAX,DWORD PTR DS:[EBX+1DC]

00427B90 |. E8 FBE1FEFF CALL EKH_1.00415D90

00427B95 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]

00427B98 |. 5A POP EDX

00427B99 |. E8 82FEFFFF CALL EKH_1.00427A20//////关键call，跟入，这个call是如何找的呢？

告诉大家个小窍门，用odbg载入，出错后返回odbg，按f12向上看，很容易就找到了

00427B9E |. 3D 4E61BC00 CMP EAX,0BC614E

00427BA3 |. 7D 1E JGE SHORT EKH_1.00427BC3////关键跳转，如果注册码正确，跳

否则，不跳，执行下一步来显示出错信息//eb爆破

00427BA5 |> 6A 00 PUSH 0

00427BA7 |. 68 087C4200 PUSH EKH_1.00427C08 ; ASCII "ERROR"//出错信息

00427BAC |. 68 107C4200 PUSH EKH_1.00427C10 ; ASCII "Wrong Serial //出错信息Number !"

00427BB1 |. A1 44974200 MOV EAX,DWORD PTR DS:[429744]

00427BB6 |. E8 411EFFFF CALL EKH_1.004199FC

00427BBB |. 50 PUSH EAX ; |hOwner

00427BBC |. E8 4FD9FDFF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA

00427BC1 |. EB 1C JMP SHORT EKH_1.00427BDF

00427BC3 |> 6A 00 PUSH 0

00427BC5 |. 68 287C4200 PUSH EKH_1.00427C28 ; ASCII "Success"//正确信息

00427BCA |. 68 307C4200 PUSH EKH_1.00427C30 ; ASCII "Congratulation ! You've Did It.

Mail Us : ekhmail@egroups.com"//祝贺了，你可以同ekh联系成为临时成员

00427BCF |. A1 44974200 MOV EAX,DWORD PTR DS:[429744]

00427BD4 |. E8 231EFFFF CALL EKH_1.004199FC

00427BD9 |. 50 PUSH EAX ; |hOwner

00427BDA |. E8 31D9FDFF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA

00427BDF |> 33C0 XOR EAX,EAX

00427BE1 |. 5A POP EDX

00427BE2 |. 59 POP ECX

00427BE3 |. 59 POP ECX

==================================

=======================================================

00427A20 /$ 55 PUSH EBP

00427A21 |. 8BEC MOV EBP,ESP

00427A23 |. 83C4 F0 ADD ESP,-10

00427A26 |. 53 PUSH EBX

00427A27 |. 56 PUSH ESI

00427A28 |. 33C9 XOR ECX,ECX

00427A2A |. 894D F0 MOV DWORD PTR SS:[EBP-10],ECX

00427A2D |. 894D F4 MOV DWORD PTR SS:[EBP-C],ECX

00427A30 |. 8955 F8 MOV DWORD PTR SS:[EBP-8],EDX

00427A33 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX

00427A36 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]

00427A39 |. E8 26BFFDFF CALL EKH_1.00403964

00427A3E |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]

00427A41 |. E8 1EBFFDFF CALL EKH_1.00403964

00427A46 |. 33C0 XOR EAX,EAX

00427A48 |. 55 PUSH EBP

00427A49 |. 68 2A7B4200 PUSH EKH_1.00427B2A

00427A4E |. 64:FF30 PUSH DWORD PTR FS:[EAX]

00427A51 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP

00427A54 |. 33DB XOR EBX,EBX

00427A56 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]

00427A59 |. E8 52BDFDFF CALL EKH_1.004037B0

00427A5E |. 8BF0 MOV ESI,EAX

00427A60 |. 85F6 TEST ESI,ESI

00427A62 |. 7E 3C JLE SHORT EKH_1.00427AA0

00427A64 |. B8 01000000 MOV EAX,1

00427A69 |> 8BD0 MOV EDX,EAX/////////////////////////1和2之间循环对注册名进行运算

00427A6B |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]

00427A6E |. 0FB64C11 FF MOVZX ECX,BYTE PTR DS:[ECX+EDX-1]

00427A73 |. 03D9 ADD EBX,ECX

00427A75 |. 71 05 JNO SHORT EKH_1.00427A7C

00427A77 |. E8 B4AFFDFF CALL EKH_1.00402A30

00427A7C |> C1E3 08 SHL EBX,8

00427A7F |. 8B0D 80884200 MOV ECX,DWORD PTR DS:[428880] ; EKH_1.004279FC

00427A85 |. 0FB65411 FF MOVZX EDX,BYTE PTR DS:[ECX+EDX-1]

00427A8A |. 0BDA OR EBX,EDX

00427A8C |. 85DB TEST EBX,EBX

00427A8E |. 7D 0C JGE SHORT EKH_1.00427A9C

00427A90 |. 6BD3 FF IMUL EDX,EBX,-1

00427A93 |. 71 05 JNO SHORT EKH_1.00427A9A

00427A95 |. E8 96AFFDFF CALL EKH_1.00402A30

00427A9A |> 8BDA MOV EBX,EDX

00427A9C |> 40 INC EAX

00427A9D |. 4E DEC ESI

00427A9E |.^75 C9 JNZ SHORT EKH_1.00427A69///////////////2和1之间循环对注册名进行运算

00427AA0 |> 81F3 78563412 XOR EBX,12345678

00427AA6 |. 8D55 F0 LEA EDX,DWORD PTR SS:[EBP-10]

00427AA9 |. 8BC3 MOV EAX,EBX

00427AAB |. E8 44E9FDFF CALL EKH_1.004063F4

00427AB0 |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]

00427AB3 |. E8 F8BCFDFF CALL EKH_1.004037B0////////////可见注册码

00427AB8 |. 8BF0 MOV ESI,EAX

00427ABA |. 85F6 TEST ESI,ESI

00427ABC |. 7E 38 JLE SHORT EKH_1.00427AF6

00427ABE |> 8BC3 MOV EAX,EBX

00427AC0 |. B9 0A000000 MOV ECX,0A

00427AC5 |. 99 CDQ

00427AC6 |. F7F9 IDIV ECX

00427AC8 |. 6215 3C7B4200 BOUND EDX,QWORD PTR DS:[427B3C]

00427ACE |. 8A92 84884200 MOV DL,BYTE PTR DS:[EDX+428884]

00427AD4 |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]

00427AD7 |. E8 FCBBFDFF CALL EKH_1.004036D8

00427ADC |. 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10]

00427ADF |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]

00427AE2 |. E8 D1BCFDFF CALL EKH_1.004037B8

00427AE7 |. 8BC3 MOV EAX,EBX

00427AE9 |. B9 0A000000 MOV ECX,0A

00427AEE |. 99 CDQ

00427AEF |. F7F9 IDIV ECX

00427AF1 |. 8BD8 MOV EBX,EAX

00427AF3 |. 4E DEC ESI

00427AF4 |.^75 C8 JNZ SHORT EKH_1.00427ABE

00427AF6 |> 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]

00427AF9 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]

00427AFC |. E8 BFBDFDFF CALL EKH_1.004038C0

00427B01 |. 75 07 JNZ SHORT EKH_1.00427B0A

00427B03 |. BB 4E61BC00 MOV EBX,0BC614E

00427B08 |. EB 05 JMP SHORT EKH_1.00427B0F

00427B0A |> BB 91D61200 MOV EBX,12D691

00427B0F |> 33C0 XOR EAX,EAX

00427B11 |. 5A POP EDX

00427B12 |. 59 POP ECX

00427B13 |. 59 POP ECX

00427B14 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX

00427B17 |. 68 317B4200 PUSH EKH_1.00427B31

00427B1C |> 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]

00427B1F |. BA 04000000 MOV EDX,4

00427B24 |. E8 2FBAFDFF CALL EKH_1.00403558

00427B29 \. C3 RETN

00427B2A .^E9 A9B4FDFF JMP EKH_1.00402FD8

00427B2F .^EB EB JMP SHORT EKH_1.00427B1C

00427B31 . 8BC3 MOV EAX,EBX

00427B33 . 5E POP ESI

00427B34 . 5B POP EBX

00427B35 . 8BE5 MOV ESP,EBP

00427B37 . 5D POP EBP

00427B38 . C3 RETN

注册名：staray[BCG]

注册码 ：LL4N5AANN （出处：赢政天下整理收藏）

相关文章：

·彩虹狗破解工具的注册机

相关软件：

·OICQ2000密码破解工具

→ 特别推荐

→ 热点TOP10

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net