Morpher for Windows version 2.0 的中文修改版

软件保护介绍:
   用户名与注册码无关,软件没有加壳,但是进行了字符保护,无法用静态反汇编查找到有用
的提示信息,所以要从动态跟踪入手!

:00409950 E866610100              call 0041FABB
:00409955 C645FC02                mov [ebp-04], 02
:00409959 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0040995C E85A610100              call 0041FABB
:00409961 C645FC03                mov [ebp-04], 03
:00409965 8D4D80                  lea ecx, dword ptr [ebp-80]
:00409968 E8C51D0100              call 0041B732
:0040996D 83F801                  cmp eax, 00000001
:00409970 7577                    jne 004099E9
:00409972 8D45E0                  lea eax, dword ptr [ebp-20]
:00409975 8D4DEC                  lea ecx, dword ptr [ebp-14]
:00409978 50                      push eax
:00409979 E895630100              call 0041FD13
:0040997E 8D45DC                  lea eax, dword ptr [ebp-24]
:00409981 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00409984 50                      push eax
:00409985 E889630100              call 0041FD13
:0040998A 8B7DF0                  mov edi, dword ptr [ebp-10]
:0040998D 6A0A                    push 0000000A
:0040998F 56                      push esi
:00409990 FF75EC                  push [ebp-14]
:00409993 E868390000              call 0040D300--------------->将输入的SN变成十六进制
:00409998 83C40C                  add esp, 0000000C
:0040999B 8987E0000000            mov dword ptr [edi+000000E0], eax
:004099A1 50                      push eax
:004099A2 E830040000              call 00409DD7--------------->算法关键CALL
:004099A7 83C404                  add esp, 00000004
:004099AA 85C0                    test eax, eax--------------->比较EAX是否为0
:004099AC 7579                    jne 00409A27---------------->不为0则跳,跳就成功了
:004099AE 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004099B1 E805610100              call 0041FABB

* Possible Reference to String Resource ID=61218: "鑼

cn."
                                 |
:004099B6 6822EF0000              push 0000EF22
:004099BB 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004099BE C645FC04                mov [ebp-04], 04
:004099C2 E8F07D0100              call 004217B7
:004099C7 6A10                    push 00000010

* Reference To: USER32.MessageBeep, Ord:0196h
                                 |
:004099C9 FF15743D4500            Call dword ptr [00453D74]----------->发出BEEP声音
:004099CF 6A10                    push 00000010

* Possible StringData Ref from Data Obj ->"Error"---------------->错误提示
                                 |
:004099D1 68CCB54400              push 0044B5CC
:004099D6 FF75F0                  push [ebp-10]

===================================================
:00409DD7 8B4C2404                mov ecx, dword ptr [esp+04]---->ECX=输入SN的十六进制
:00409DDB 56                      push esi
:00409DDC BE971F0000              mov esi, 00001F97-------------->ESI=&H1F97
:00409DE1 8BC1                    mov eax, ecx------------------->EAX=ECX
:00409DE3 2BD2                    sub edx, edx------------------->EDX=0
:00409DE5 F7F6                    div esi------------------------>EAX=EAX/ESI----|这两句说明注册码
:00409DE7 0FAFC6                  imul eax, esi------------------>EAX=EAX*ESI----|要能被&H1F97整除
:00409DEA 3BC1                    cmp eax, ecx------------------->比较EAX和ECX
:00409DEC 750D                    jne 00409DFB------------------->不等则跳
:00409DEE B801000000              mov eax, 00000001
:00409DF3 81F9A03B0100            cmp ecx, 00013BA0
:00409DF9 7702                    ja 00409DFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409DEC(C)
|
:00409DFB 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409DF9(C)
|
:00409DFD 5E                      pop esi
:00409DFE C3                      ret

单词抓取器 V1.71：【上一篇】
破解对象：Visual CHM 3.20b：【下一篇】