【关键字】：c,程序,code
【来 源】：网络
破P-code程序心得 下
51BAE5: 00 LargeBos
51BAE7: 00 LargeBos
51BAE9: 04 FLdRfVar local_00D0
51BAEC: 21 FLdPrThis
51BAED: 0f VCallAd (object e )
51BAF0: 19 FStAdFunc local_00CC
51BAF3: 08 FLdPr local_00CC
51BAF6: 0d VCallHresult 禚d
51BAFB: 6c ILdRf local_00D0
51BAFE: 0b ImpAdCallI2
51BB03: 23 FStStrNoPop local_00D4
51BB06: 1b LitStr: wbregfilename → 存放在注册表的信息，这里放注册码！
51BB09: 1b LitStr: wbregfile → 存放在注册表的信息
51BB0C: 1b LitStr: wbreg → 存放在注册表的信息
51BB0F: 0a ImpAdCallFPR4: 衊帬
51BB14: 32 FFreeStr
51BB1B: 1a FFree1Ad local_00CC → 注册成功提示
51BB1E: 00 LargeBos
51BB20: 27 LitVar_Missing
51BB23: 27 LitVar_Missing
51BB26: 3a LitVarStr: ( local_0130 )
51BB2B: 4e FStVarCopyObj local_00F0
51BB2E: 04 FLdRfVar local_00F0
51BB31: f5 LitI4: 0x40 64 (...@)
51BB36: 3a LitVarStr: ( local_00A0 ) → “注册成功”
51BB3B: 4e FStVarCopyObj local_00B0
51BB3E: 04 FLdRfVar local_00B0
51BB41: 0a ImpAdCallFPR4:
51BB46: 36 FFreeVar
51BB51: 00 LargeBos
***************中间我略去一段汇编*********************
51C17E: 0f VCallAd (object e )
51C181: 19 FStAdFunc local_00CC
51C184: 08 FLdPr local_00CC
51C187: 0d VCallHresult 禚d
51C18C: 1a FFree1Ad local_00CC
51C18F: 00 LargeBos
51C191: 13 ExitProcHresult
Proc: 502a84
502A1C: 7f ILdI2
502A1F: f4 LitI2_Byte: 0x0 0 (.)
502A21: c6 EqI2
502A22: 1c BranchF: 502A54
502A25: f5 LitI4: 0x1 1 (....)
502A2A: f5 LitI4: 0x0 0 (....)
502A2F: f5 LitI4: 0x0 0 (....)
502A34: 1b LitStr: http://www.8ge.net
502A37: 04 FLdRfVar local_0088
502A3A: 34 CStr2Ansi
502A3B: 6c ILdRf local_0088
502A3E: f5 LitI4: 0x0 0 (....)
502A43: f5 LitI4: 0x0 0 (....)
502A48: 0a ImpAdCallFPR4: treedll.dll
502A4D: 3c SetLastSystemError
502A4E: 2f FFree1Str local_0088
502A51: 1e Branch: 502a80
502A54: f5 LitI4: 0x1 1 (....)
502A59: f5 LitI4: 0x0 0 (....)
502A5E: f5 LitI4: 0x0 0 (....)
502A63: 1b LitStr: mailto:dingganchao@163.com
502A66: 04 FLdRfVar local_0088
502A69: 34 CStr2Ansi
502A6A: 6c ILdRf local_0088
502A6D: f5 LitI4: 0x0 0 (....)
502A72: f5 LitI4: 0x0 0 (....)
502A77: 0a ImpAdCallFPR4: treedll.dll
Proc: 50441c
504314: 7f ILdI2
504317: f4 LitI2_Byte: 0x0 0 (.)
504319: c6 EqI2
50431A: 1c BranchF: 504399
50431D: f4 LitI2_Byte: 0xff -1 (.)
50431F: 21 FLdPrThis
504320: 0f VCallAd (object 1 )
***************中间我略去一段汇编*********************
5043FC: 21 FLdPrThis
5043FD: 0f VCallAd (object 2 )
504400: 19 FStAdFunc local_0088
504403: 08 FLdPr local_0088
504406: 0d VCallHresult id
50440B: 08 FLdPr local_00AC
50440E: 0d VCallHresult id
Proc: 502338
502308: f5 LitI4: 0x1 1 (....)
50230D: f5 LitI4: 0x0 0 (....)
502312: f5 LitI4: 0x0 0 (....)
502317: 1b LitStr: http://www.softreg.com/shareware_view.asp?id={9441703A-5180-4904-B533-ACD52C9A6CAC}
50231A: 04 FLdRfVar local_0088
50231D: 34 CStr2Ansi
50231E: 6c ILdRf local_0088
502321: f5 LitI4: 0x0 0 (....)
502326: f5 LitI4: 0x0 0 (....)
50232B: 0a ImpAdCallFPR4: treedll.dll
Proc: 50349c
503400: 7f ILdI2
503403: f4 LitI2_Byte: 0x0 0 (.)
503405: c6 EqI2
503406: 1c BranchF: 503420
503409: f4 LitI2_Byte: 0x0 0 (.)
50340B: 21 FLdPrThis
50340C: 0f VCallAd (object 1 )
50340F: 19 FStAdFunc local_0088
503412: 08 FLdPr local_0088
503415: 0d VCallHresult id
50341A: 1a FFree1Ad local_0088
50341D: 1e Branch: 50349b
503420: 04 FLdRfVar local_008A
503423: 21 FLdPrThis
503424: 0f VCallAd (object 4 )
503427: 19 FStAdFunc local_0088
50342A: 08 FLdPr local_0088
50342D: 0d VCallHresult id
503432: 6b FLdI2 local_008A
503435: f4 LitI2_Byte: 0xff -1 (.)
503437: c6 EqI2
503438: 1a FFree1Ad local_0088
50343B: 1c BranchF: 503449
50343E: 08 FLdPr local_param_0008
503441: 0d VCallHresult id
***************中间我略去一段汇编*********************
503473: 0d VCallHresult CVBApplication::ge88$?(id
503478: 6c ILdRf local_0090
50347B: 04 FLdRfVar local_0094
50347E: 05 ImpAdLdRf: 5257dc
503481: 24 NewIfNullPr 40c054
503484: 0d VCallHresult CVBApplication::get_Clipboard
503489: 08 FLdPr local_0094
50348C: 0d VCallHresult CVBApplication::ge94$?(id
503491: 2f FFree1Str local_0090
Proc: 50454c
504454: 28 LitVarI2: ( local_00A4 ) 0x0 (0)
504459: f5 LitI4: 0x8 8 (....)
50445E: 04 FLdRfVar local_00B4
504461: 0a ImpAdCallFPR4:
504466: 04 FLdRfVar local_00B4
504469: 60 CStrVarTmp
50446A: 23 FStStrNoPop local_00B8
50446D: 08 FLdPr local_param_0008
504470: Lead2/91 MemStStrCopy
504474: 2f FFree1Str local_00B8
504477: 36 FFreeVar
50447E: f4 LitI2_Byte: 0x0 0 (.)
***************中间我略去一段汇编*********************
504534: 4e FStVarCopyObj local_00A4
504537: 04 FLdRfVar local_00A4
50453A: 0a ImpAdCallFPR4:
50453F: 36 FFreeVar
50454A: 13 ExitProcHresult
Proc: 501f4c
501F34: 1b LitStr:
501F37: 21 FLdPrThis
501F38: 0f VCallAd (object e )
501F3B: 19 FStAdFunc local_0088
501F3E: 08 FLdPr local_0088
501F41: 0d VCallHresult id
501F46: 1a FFree1Ad local_0088
501F49: 13 ExitProcHresult
Successfully went through the program!
Now it's up to you to decipher it hehe!
Email josephco_@hotmail.com with any problems or errors
=======================================================================
另附：
一、你也可以用softice跟踪来得到注册码，用symbol loader装入程序，设置断点：bpm 51B484（51b484就是比较注册码的地址，回看上面的内容）
二、G0，帮助菜单调出注册对话框，随意输入一些数字，点<注册>按钮，softice就将程序拦下。（停在msvbvm60.dll的代码领空）
三、输入命令：d *(*esp+8)，即可得到注册码，注意是unicode格式的。
|