破解第二贴---SPX Studio破解
纯技术交流，如需使用，请购买正版,原创东西禁止转载！这是一个制作图片说明文档的软件，软件下载地址http://www.moodysoft.com/studio/
此网站还有1款比较方便的截图软件，看完此贴可自行研究哦
http://chinadaforce.com/data/attachment/forum/201207/26/211810ti5wu5h5tae3tl7f.jpg 2012-7-26 21:18 上传
下载附件 (65.11 KB)
首先安装该软件，或者可用UniExtract这个软件进行解压缩
1.查壳 Borland Delphi 6.0 - 7.0
2.既然没有壳就直接破解吧，OD载入如下：
004C5E70 > $55 push ebp
004C5E71 .8BEC mov ebp,esp
004C5E73 .83C4 F0 add esp,-10
004C5E76 .B8 785B4C00 mov eax,Studio.004C5B78 ;^
004C5E7B .E8 740BF4FF call Studio.004069F4
004C5E80 .68 D45E4C00 push Studio.004C5ED4 ;SPX Studio
004C5E85 .6A FF push -1
004C5E87 .6A 00 push 0
004C5E89 .E8 7A0DF4FF call Studio.00406C08
确实无壳，那我们开始破解吧，用注册名注册，找到如下代码
004BAF58/$55 push ebp
004BAF59|.8BEC mov ebp,esp
004BAF5B|.B9 04000000 mov ecx,4
004BAF60|>6A 00 /push 0
004BAF62|.6A 00 |push 0
004BAF64|.49 |dec ecx
004BAF65|.^ 75 F9 \jnz short Studio.004BAF60
004BAF67|.51 push ecx
004BAF68|.53 push ebx
004BAF69|.8BD8 mov ebx,eax
004BAF6B|.33C0 xor eax,eax
004BAF6D|.55 push ebp
004BAF6E|.68 EAB04B00 push Studio.004BB0EA
004BAF73|.64:FF30 push dword ptr fs:
004BAF76|.64:8920 mov dword ptr fs:,esp
004BAF79|.8D55 FC lea edx,
004BAF7C|.8B83 18030000 mov eax,dword ptr ds:
004BAF82|.E8 F1BCF8FF call Studio.00446C78
004BAF87|.837D FC 00 cmp ,0
004BAF8B|.74 14 je short Studio.004BAFA1
004BAF8D|.8D55 F8 lea edx,
004BAF90|.8B83 28030000 mov eax,dword ptr ds:
004BAF96|.E8 DDBCF8FF call Studio.00446C78
004BAF9B|.837D F8 00 cmp ,0 ;
004BAF9F|.75 34 jnz short Studio.004BAFD5
004BAFA1|>6A 30 push 30
004BAFA3|.8D55 F4 lea edx,
004BAFA6|.A1 4CB24C00 mov eax,dword ptr ds:
004BAFAB|.8B00 mov eax,dword ptr ds: ;Studio.004BA2D0
004BAFAD|.E8 4EBFFAFF call Studio.00466F00
004BAFB2|.8B45 F4 mov eax,
004BAFB5|.E8 D69AF4FF call Studio.00404A90
004BAFBA|.50 push eax ; |Title = "孝K"
004BAFBB|.68 F8B04B00 push Studio.004BB0F8 ; |To obtain your UserName and Product ID please buy a licence.
004BAFC0|.A1 4CB24C00 mov eax,dword ptr ds: ; |
004BAFC5|.8B00 mov eax,dword ptr ds: ; |Studio.004BA2D0
004BAFC7|.8B40 30 mov eax,dword ptr ds: ; |
004BAFCA|.50 push eax ; |hOwner = 01398D20
004BAFCB|.E8 18C5F4FF call <jmp.&user32.MessageBoxA> ; \MessageBoxA
004BAFD0|.E9 D8000000 jmp Studio.004BB0AD
004BAFD5|>66:83BB 3A030>cmp word ptr ds:,0
004BAFDD|.0F84 CA000000 je Studio.004BB0AD
004BAFE3|.6A 01 push 1
004BAFE5|.8D55 F0 lea edx,
004BAFE8|.8B83 28030000 mov eax,dword ptr ds:
004BAFEE|.E8 85BCF8FF call Studio.00446C78 ;出假码
004BAFF3|.8B45 F0 mov eax,
004BAFF6|.50 push eax
004BAFF7|.8D55 EC lea edx,
004BAFFA|.8B83 18030000 mov eax,dword ptr ds:
004BB000|.E8 73BCF8FF call Studio.00446C78
004BB005|.8B55 EC mov edx, ;出现用户名
004BB008|.59 pop ecx
004BB009|.8B83 3C030000 mov eax,dword ptr ds: ;假码及用户名入ECX和EDX
004BB00F|.FF93 38030000 call dword ptr ds: ;关键CALL
004BB015|.84C0 test al,al
004BB017|.74 65 je short Studio.004BB07E ;跳到错误，关键跳不能跳
004BB019|.6A 30 push 30
004BB01B|.8D55 E8 lea edx,
004BB01E|.A1 4CB24C00 mov eax,dword ptr ds:
004BB023|.8B00 mov eax,dword ptr ds: ;Studio.004BA2D0
004BB025|.E8 D6BEFAFF call Studio.00466F00
004BB02A|.8B45 E8 mov eax,
004BB02D|.E8 5E9AF4FF call Studio.00404A90
004BB032|.50 push eax
004BB033|.68 40B14B00 push Studio.004BB140 ;Thank you for registering
004BB038|.8D55 E0 lea edx,
004BB03B|.A1 4CB24C00 mov eax,dword ptr ds:
004BB040|.8B00 mov eax,dword ptr ds: ;Studio.004BA2D0
004BB042|.E8 B9BEFAFF call Studio.00466F00
004BB047|.FF75 E0 push
004BB04A|.68 64B14B00 push Studio.004BB164 ;.
004BB04F|.8D45 E4 lea eax,
004BB052|.BA 03000000 mov edx,3
004BB057|.E8 FC98F4FF call Studio.00404958
004BB05C|.8B45 E4 mov eax,
004BB05F|.E8 2C9AF4FF call Studio.00404A90
004BB064|.50 push eax ; |Text = "孝K"
004BB065|.A1 4CB24C00 mov eax,dword ptr ds: ; |
004BB06A|.8B00 mov eax,dword ptr ds: ; |Studio.004BA2D0
004BB06C|.8B40 30 mov eax,dword ptr ds: ; |
004BB06F|.50 push eax ; |hOwner = 01398D20
004BB070|.E8 73C4F4FF call <jmp.&user32.MessageBoxA> ; \MessageBoxA
004BB075|.8BC3 mov eax,ebx
004BB077|.E8 208CFAFF call Studio.00463C9C
004BB07C|.EB 2F jmp short Studio.004BB0AD
004BB07E|>6A 30 push 30
004BB080|.8D55 DC lea edx,
004BB083|.A1 4CB24C00 mov eax,dword ptr ds:
004BB088|.8B00 mov eax,dword ptr ds: ;Studio.004BA2D0
004BB08A|.E8 71BEFAFF call Studio.00466F00
004BB08F|.8B45 DC mov eax,
004BB092|.E8 F999F4FF call Studio.00404A90
004BB097|.50 push eax ; |Title = "孝K"
004BB098|.68 68B14B00 push Studio.004BB168 ; |Invalid User Name or Product ID. Please try again.
004BB09D|.A1 4CB24C00 mov eax,dword ptr ds: ; |
004BB0A2|.8B00 mov eax,dword ptr ds: ; |Studio.004BA2D0
004BB0A4|.8B40 30 mov eax,dword ptr ds: ; |
004BB0A7|.50 push eax ; |hOwner = 01398D20
004BB0A8|.E8 3BC4F4FF call <jmp.&user32.MessageBoxA> ; \错误
004BB0AD|>33C0 xor eax,eax
004BB0AF|.5A pop edx
004BB0B0|.59 pop ecx
004BB0B1|.59 pop ecx
004BB0B2|.64:8910 mov dword ptr fs:,edx
004BB0B5|.68 F1B04B00 push Studio.004BB0F1
004BB0BA|>8D45 DC lea eax,
004BB0BD|.BA 04000000 mov edx,4
004BB0C2|.E8 3D95F4FF call Studio.00404604
004BB0C7|.8D45 EC lea eax,
004BB0CA|.BA 02000000 mov edx,2
004BB0CF|.E8 3095F4FF call Studio.00404604
004BB0D4|.8D45 F4 lea eax,
004BB0D7|.E8 0495F4FF call Studio.004045E0
004BB0DC|.8D45 F8 lea eax,
004BB0DF|.BA 02000000 mov edx,2
004BB0E4|.E8 1B95F4FF call Studio.00404604
004BB0E9\.C3 retn
经过分析004BB017|.74 65 je short Studio.004BB07E ;为关键跳不能跳，跳了就到错误
由此上面的CALL 004BB00F|.FF93 38030000 call dword ptr ds: ;为关键CALL
我们下断 F7跟进重新进行分析
004BA7AC/$55 push ebp
004BA7AD|.8BEC mov ebp,esp
004BA7AF|.6A 00 push 0
004BA7B1|.6A 00 push 0
004BA7B3|.6A 00 push 0
004BA7B5|.6A 00 push 0
004BA7B7|.6A 00 push 0
004BA7B9|.6A 00 push 0
004BA7BB|.6A 00 push 0
004BA7BD|.53 push ebx
004BA7BE|.56 push esi ;Studio.0046BEB8
004BA7BF|.57 push edi
004BA7C0|.894D F8 mov ,ecx
004BA7C3|.8955 FC mov ,edx
004BA7C6|.8BD8 mov ebx,eax
004BA7C8|.8B45 FC mov eax,
004BA7CB|.E8 B0A2F4FF call Studio.00404A80
004BA7D0|.8B45 F8 mov eax,
004BA7D3|.E8 A8A2F4FF call Studio.00404A80
004BA7D8|.33C0 xor eax,eax
004BA7DA|.55 push ebp
004BA7DB|.68 25A94B00 push Studio.004BA925
004BA7E0|.64:FF30 push dword ptr fs:
004BA7E3|.64:8920 mov dword ptr fs:,esp
004BA7E6|.C645 F7 00 mov byte ptr ss:,0
004BA7EA|.A0 38A94B00 mov al,byte ptr ds:
004BA7EF|.50 push eax
004BA7F0|.8D45 E4 lea eax,
004BA7F3|.50 push eax
004BA7F4|.33C9 xor ecx,ecx
004BA7F6|.BA 44A94B00 mov edx,Studio.004BA944
004BA7FB|.8B45 FC mov eax, ;出现注册名
004BA7FE|.E8 B533F5FF call Studio.0040DBB8
004BA803|.8B45 E4 mov eax,
004BA806|.8D55 E8 lea edx,
004BA809|.E8 1AE1F4FF call Studio.00408928 ;用户名算法CALL
004BA80E|.837D E8 00 cmp ,0
004BA812|.0F84 E5000000 je Studio.004BA8FD
004BA818|.837D F8 00 cmp ,0
004BA81C|.0F84 DB000000 je Studio.004BA8FD
004BA822|.8D45 F0 lea eax,
004BA825|.BA 50A94B00 mov edx,Studio.004BA950 ;life
004BA82A|.E8 499EF4FF call Studio.00404678
004BA82F|.8D45 EC lea eax,
004BA832|.BA 60A94B00 mov edx,Studio.004BA960 ;is soft and moody
004BA837|.E8 3C9EF4FF call Studio.00404678
004BA83C|.33C9 xor ecx,ecx
004BA83E|.B2 01 mov dl,1
004BA840|.A1 5C604B00 mov eax,dword ptr ds: ;您K
004BA845|.E8 FECCFFFF call Studio.004B7548
004BA84A|.8BF0 mov esi,eax
004BA84C|.8B0D D8754B00 mov ecx,dword ptr ds: ;瘤K
004BA852|.8B53 38 mov edx,dword ptr ds: ;Studio.00460B60
004BA855|.8BC6 mov eax,esi ;Studio.0046BEB8
004BA857|.E8 94E4FEFF call Studio.004A8CF0
004BA85C|.8D4D F0 lea ecx,
004BA85F|.8B55 E8 mov edx,
004BA862|.8BC6 mov eax,esi ;Studio.0046BEB8
004BA864|.8B38 mov edi,dword ptr ds: ;Studio.004024AD
004BA866|.FF57 54 call dword ptr ds: ;?????????????
004BA869|.8BC6 mov eax,esi ;Studio.0046BEB8
004BA86B|.8B10 mov edx,dword ptr ds: ;Studio.004024AD
004BA86D|.FF52 44 call dword ptr ds:
004BA870|.8BC6 mov eax,esi ;Studio.0046BEB8
004BA872|.E8 798FF4FF call Studio.004037F0
004BA877|.33C9 xor ecx,ecx
004BA879|.B2 01 mov dl,1
004BA87B|.A1 68A94A00 mov eax,dword ptr ds: ;$@
004BA880|.E8 B7E8FEFF call Studio.004A913C
004BA885|.8BF0 mov esi,eax
004BA887|.8B0D 08BA4A00 mov ecx,dword ptr ds: ;Studio.004ABA54
004BA88D|.8B53 3C mov edx,dword ptr ds:
004BA890|.8BC6 mov eax,esi ;Studio.0046BEB8
004BA892|.E8 59E4FEFF call Studio.004A8CF0
004BA897|.8D4D EC lea ecx,
004BA89A|.8B55 F8 mov edx,
004BA89D|.8BC6 mov eax,esi ;Studio.0046BEB8
004BA89F|.8B38 mov edi,dword ptr ds: ;Studio.004024AD
004BA8A1|.FF57 58 call dword ptr ds: ;假码算法在此
004BA8A4|.8BC6 mov eax,esi ;Studio.0046BEB8
004BA8A6|.8B10 mov edx,dword ptr ds: ;Studio.004024AD
004BA8A8|.FF52 44 call dword ptr ds:
004BA8AB|.8BC6 mov eax,esi ;Studio.0046BEB8
004BA8AD|.E8 3E8FF4FF call Studio.004037F0 ;？
004BA8B2|.8B45 F0 mov eax,
004BA8B5|.8B55 EC mov edx,
004BA8B8|.E8 1FA1F4FF call Studio.004049DC ;?????
004BA8BD|.0F94C0 sete al 完美破解点
004BA8C0|.8843 34 mov byte ptr ds:,al
004BA8C3|.807B 34 00 cmp byte ptr ds:,0
004BA8C7|.74 34 je short Studio.004BA8FD ;不能跳 跳了上1层就会跳到错误代码
004BA8C9|.8D43 40 lea eax,dword ptr ds:
004BA8CC|.8B55 FC mov edx,
004BA8CF|.B9 FF000000 mov ecx,0FF
004BA8D4|.E8 9B9FF4FF call Studio.00404874
004BA8D9|.8D83 40010000 lea eax,dword ptr ds:
004BA8DF|.8B55 F8 mov edx,
004BA8E2|.B9 FF000000 mov ecx,0FF
004BA8E7|.E8 889FF4FF call Studio.00404874
004BA8EC|.807D 08 00 cmp byte ptr ss:,0
004BA8F0|.74 07 je short Studio.004BA8F9
004BA8F2|.8BC3 mov eax,ebx
004BA8F4|.E8 4F020000 call Studio.004BAB48
004BA8F9|>C645 F7 01 mov byte ptr ss:,1
004BA8FD|>33C0 xor eax,eax
004BA8FF|.5A pop edx ;0012F6B8
004BA900|.59 pop ecx ;0012F6B8
004BA901|.59 pop ecx ;0012F6B8
004BA902|.64:8910 mov dword ptr fs:,edx
004BA905|.68 2CA94B00 push Studio.004BA92C
004BA90A|>8D45 E4 lea eax,
004BA90D|.BA 04000000 mov edx,4
004BA912|.E8 ED9CF4FF call Studio.00404604
004BA917|.8D45 F8 lea eax,
004BA91A|.BA 02000000 mov edx,2
004BA91F|.E8 E09CF4FF call Studio.00404604
004BA924\.C3 retn
004BA925 .^ E9 5A96F4FF jmp Studio.00403F84
004BA92A .^ EB DE jmp short Studio.004BA90A
004BA92C .8A45 F7 mov al,byte ptr ss:
004BA92F .5F pop edi ;0012F6B8
004BA930 .5E pop esi ;0012F6B8
004BA931 .5B pop ebx ;0012F6B8
004BA932 .8BE5 mov esp,ebp
004BA934 .5D pop ebp ;0012F6B8
004BA935 .C2 0400 retn 4
经过分析004BA8BD|.0F94C0 sete al 为完美破解点 改成SETNE即可，如要进一步分析，可跟进004BA8B8|.E8 1FA1F4FF call Studio.004049DC此CALL
http://chinadaforce.com/data/attachment/forum/201207/26/215659wiql05b0pb99ntzo.jpg 2012-7-26 21:56 上传
下载附件 (69.49 KB)
到此破解完成，有兴趣的可以自己追下注册码
很详细,谢谢! 谢谢楼主，正在按照楼主的思路分析中。 谢谢楼主思路 学习了 谢谢楼主，学习了！ 学习了。辛苦了~ 学习了,跟着楼主破文走 这个 004BA8BD|.0F94C0 sete al 为完美破解点 改成SETNE即可如何更改呢？ 求教。 学习了，感谢楼主的无私奉献
页:
[1]