易网通行V1.1笔记

第第页易网通行V1.1笔记易网通行V1.1笔记

发表于：2023-05-25来源：：点击数：标签：笔记易网通行V1.1下载

【下载页面】/soft/12461.html"【软件限制】：30次【文章】：辉仔Yock[DFCG][YCG]【声明】：本人发表这篇文章只是为了学习和研究!!!请不用于商业用途或是将本文方法制作的注册机任意传播,读者看了文章后所做的事情与我无关,

【下载页面】

/soft/12461.html"

【软件限制】：30次

【文章】：辉仔Yock[DFCG][YCG]

【声明】：本人发表这篇文章只是为了学习和研究!!!请不用于商业用途或是将本文方法制作的注册机任意传播,读者看了文章后所做的事情与我无关,我也不会负责,请读者看了文章后三思而后行!最后希望大家在经济基础好的时候,支持共享软件!

【破解工具】：OllydbgW32Dasm

—————————————————————————————————

【过程】：

主程序没有加壳(呵呵,我喜欢),用MicrosoftVisual（C++）6.0写的!

用W32Dasm反之,根据参考字串很快找到关键!

用Ollydbg加载后按F9运行主程序,然后选择注册,填上注册码后,下断点00421EFD

然后按注册拦下:

*Referencedbya(U)nconditionalor(C)onditionalJumpatAddress:

|:00421F1E(C)

|

:00421EFD8B0D54F94800movecx,dwordptr[0048F954]

:00421F038B542408movedx,dwordptr[esp+08]

:00421F078B040Emoveax,dwordptr[esi+ecx]

:00421F0A50pusheax

//真码"ADTUY-65II9-UIYT8"

//这个程序是固定的注册码的!

:00421F0B52pushedx

//我输入的"987654321ABCDEF"

:00421F0CE8D4120230call004331E5

//很明显,真假注册码比较的过程

:00421F1183C408addesp,00000008

:00421F1485C0testeax,eax

//这里是注册标志比较

:00421F16744Cje00421F64

//这里就是跳向注册成功那里的!

:00421F1883C604addesi,00000004

:00421F1B83FE50cmpesi,00000050

:00421F1E7CDDjl00421EFD

:00421F208B54240Cmovedx,dwordptr[esp+0C]

:00421F2452pushedx

*ReferenceTo:ADVAPI32.RegCloseKey,Ord:015Bh

|

:00421F25FF1514004700Calldwordptr[00470014]

:00421F2B6A00push00000000

:00421F2D6A00push00000000

*PossibleStringDataReffromDataObj-"注册码不正确"

|

:00421F2F6820CA4800push0048CA20

【总结】：

注册信息和使用次数保存在:

HKEY_USERS\S-1-5-21-1771291178-2842139884-1659506921-500\Software\NetPass\NetPass\Settings\passkey

//这个是win2023操作系统的!

HKEY_CURRENT_USER\Software\NetPass\NetPass\Settings

//这个是winme操作系统的!

内存注册机:

中断地址:00421F0B

中断次数:1

字节长度:1

第一字节:52

注册码--内存方式--寄存器--eax

但有一个地方不明白,这个程序注册时,不需要用户名和机器码,但我根据W32Dasm参考字串得到一些东西,我随便也帖出来:

*Referencedbya(U)nconditionalor(C)onditionalJumpatAddress:

|:00416548(C)

|

:004163CE8B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"ADTUY-65II9-UIYT8"

|

:004163D46810C24800push0048C210

:004163D9E85FD90200call00443D3D

:004163DE8B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"XVUY7-TY965-PLOUY"

|

:004163E468FCC14800push0048C1FC

:004163E983C104addecx,00000004

:004163ECE84CD90200call00443D3D

:004163F18B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"JIURT-935GH-ILKR2"

|

:004163F768E8C14800push0048C1E8

:004163FC83C108addecx,00000008

:004163FFE839D90200call00443D3D

:004164048B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"POI87-JHTYU-LKER8"

|

:0041640A68D4C14800push0048C1D4

:0041640F83C10Caddecx,0000000C

:00416412E826D90200call00443D3D

:004164178B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"ADER6-YIEPO-98JIU"

|

:0041641D68C0C14800push0048C1C0

:0041642283C110addecx,00000010

:00416425E813D90200call00443D3D

:0041642A8B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"MKOIU-763ER-IOUTY"

|

:0041643068ACC14800push0048C1AC

:0041643583C114addecx,00000014

:00416438E800D90200call00443D3D

:0041643D8B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"LJHTY-OI76W-OIUT9"

|

:004164436898C14800push0048C198

:0041644883C118addecx,00000018

:0041644BE8EDD80200call00443D3D

:004164508B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"LKUTY-JHTRI-921FH"

|

:004164566884C14800push0048C184

:0041645B83C11Caddecx,0000001C

:0041645EE8DAD80200call00443D3D

:004164638B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"PSXCF-TYIER-POIUT"

|

:004164696870C14800push0048C170

:0041646E83C120addecx,00000020

:00416471E8C7D80200call00443D3D

:004164768B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"LKJUI-OIWER-9673T"

|

:0041647C685CC14800push0048C15C

:0041648183C124addecx,00000024

:00416484E8B4D80200call00443D3D

:004164898B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"ADOPY-65IKL-UIIUO"

|

:0041648F6848C14800push0048C148

:0041649483C128addecx,00000028

:00416497E8A1D80200call00443D3D

:0041649C8B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"XGTE7-TY997-PIUYY"

|

:004164A26834C14800push0048C134

:004164A783C12Caddecx,0000002C

:004164AAE88ED80200call00443D3D

:004164AF8B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"JIKFG-9346H-IURG2"

|

:004164B56820C14800push0048C120

:004164BA83C130addecx,00000030

:004164BDE87BD80200call00443D3D

:004164C28B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"PQWW7-JHIBU-LKXSA"

|

:004164C8680CC14800push0048C10C

:004164CD83C134addecx,00000034

:004164D0E868D80200call00443D3D

:004164D58B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"ZXCDR-YIPLK-MJHIU"

|

:004164DB68F8C04800push0048C0F8

:004164E083C138addecx,00000038

:004164E3E855D80200call00443D3D

:004164E88B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"MKERW-7YM5R-IO895"

|

:004164EE68E4C04800push0048C0E4

:004164F383C13Caddecx,0000003C

:004164F6E842D80200call00443D3D

:004164FB8B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"9WERT-LNMGW-LCDT9"

|

:0041650168D0C04800push0048C0D0

:0041650683C140addecx,00000040

:00416509E82FD80200call00443D3D

:0041650E8B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"WQASY-62TRI-92PK8"

|

:0041651468BCC04800push0048C0BC

:0041651983C144addecx,00000044

:0041651CE81CD80200call00443D3D

:004165218B8ECC040000movecx,dwordptr[esi+000004CC]

*PossibleStringDataReffromDataObj-"PHGFE-TYYTC-PBN5V"

|

:0041652768A8C04800push0048C0A8

:00416