[反汇编练习] 160个CrackMe之014
本帖最后由 44018723 于 2014-6-24 20:02 编辑[反汇编练习] 160个CrackMe之014.本系列文章的目的是从一个没有任何经验的新手的角度(其实就是我自己)，一步步尝试将160个CrackMe全部破解，如果可以，通过任何方式写出一个类似于注册机的东西。其中，文章中按照如下逻辑编排（解决如下问题）：1、使用什么环境和工具2、程序分析3、思路分析和破解流程4、注册机的探索----------------------------------提醒各位看客: 如果文章中的逻辑看不明白,那你一定是没有亲手操刀!OD中的跳转提示很强大,只要你跟踪了,不用怎么看代码就理解了!----------------------------------1、工具和环境：WinXP SP3 + 52Pojie六周年纪念版OD + PEID + 汇编金手指。160个CrackMe的打包文件。下载地址： http://pan.baidu.com/s/1xUWOY 密码: jbnq注：1、Win7系统对于模块和程序开启了随机初始地址的功能，会给分析带来很大的负担，所以不建议使用Win7进行分析。2、以上工具都是在52PoJie论坛下的原版程序，NOD32不报毒，个人承诺绝对不会进行任何和木马病毒相关内容。http://images.cnitblog.com/blog/573547/201406/192147191763366.png2、程序分析：想要破解一个程序，必须先了解这个程序。所以，在破解过程中，对最初程序的分析很重要，他可以帮助我们理解作者的目的和意图，特别是对于注册码的处理细节，从而方便我们反向跟踪和推导。和上一节一样，打开CHM，选择第14个bjanes.exe，保存下来。运行程序，程序界面如下：http://images.cnitblog.com/blog/573547/201406/231856189084980.png和之前的很多程序一样，有错误对话框。使用PEID查看：VB 5.0 – 6.0
3、思路分析和破解流程由于没壳，还有信息框，所以我们直接使用OD暂停，查看堆栈就可以跟踪到了。具体步骤：1、打开OD，将exe拖入OD中，F9运行。2、在Exe中输入伪码123456，点击Check it，信息框提示try again!3、回到OD，点击暂停按钮（Ctrl+F12）,然后点击K图标（Ctrl+K），可以看到此时的堆栈信息
选中最后一个rtcMsgBox，右键->Show Call，返回到了反汇编窗口。4、从Call xxxrtcMsgBox的位置开始，在附近浏览代码，发现很明显有提示正确和失败的文本。00403A1D .^ E9 5AFDFFFF jmp 0040377C
00403A22 >33DB xor ebx,ebx
00403A24 >8B35 A4104000 mov esi,dword ptr ds:[<&MSVBVM60.__vbaVa>;msvbvm60.__vbaVarDup
00403A2A .B9 04000280 mov ecx,0x80020004
00403A2F .894D 98 mov dword ptr ss:,ecx
00403A32 .B8 0A000000 mov eax,0xA
00403A37 .894D A8 mov dword ptr ss:,ecx
00403A3A .BF 08000000 mov edi,0x8
00403A3F .8D95 50FFFFFF lea edx,dword ptr ss:
00403A45 .8D4D B0 lea ecx,dword ptr ss:
00403A48 .8945 90 mov dword ptr ss:,eax
00403A4B .8945 A0 mov dword ptr ss:,eax
00403A4E .C785 58FFFFFF F0>mov dword ptr ss:,004022F0 ;UNICODE "Wrong serial!"
00403A58 .89BD 50FFFFFF mov dword ptr ss:,edi
00403A5E .FFD6 call esi ;<&MSVBVM60.__vbaVarDup>
00403A60 .8D95 60FFFFFF lea edx,dword ptr ss:
00403A66 .8D4D C0 lea ecx,dword ptr ss:
00403A69 .C785 68FFFFFF C8>mov dword ptr ss:,004022C8 ;UNICODE "Sorry, try again!"
00403A73 .89BD 60FFFFFF mov dword ptr ss:,edi
00403A79 .FFD6 call esi
00403A7B .8D45 90 lea eax,dword ptr ss:
00403A7E .8D4D A0 lea ecx,dword ptr ss:
00403A81 .50 push eax
00403A82 .8D55 B0 lea edx,dword ptr ss:
00403A85 .51 push ecx
00403A86 .52 push edx
00403A87 .8D45 C0 lea eax,dword ptr ss:
00403A8A .53 push ebx
00403A8B .50 push eax
00403A8C .FF15 30104000 call dword ptr ds:[<&MSVBVM60.#595>] ;msvbvm60.rtcMsgBox
00403A92 .8D4D 90 lea ecx,dword ptr ss:
00403A95 .8D55 A0 lea edx,dword ptr ss:
00403A98 .51 push ecx
00403A99 .8D45 B0 lea eax,dword ptr ss:
00403A9C .52 push edx
00403A9D .8D4D C0 lea ecx,dword ptr ss:
00403AA0 .50 push eax
00403AA1 .51 push ecx
00403AA2 .EB 7E jmp short 00403B22
00403AA4 >8B35 A4104000 mov esi,dword ptr ds:[<&MSVBVM60.__vbaVa>;msvbvm60.__vbaVarDup
00403AAA .B9 04000280 mov ecx,0x80020004
00403AAF .894D 98 mov dword ptr ss:,ecx
00403AB2 .B8 0A000000 mov eax,0xA
00403AB7 .894D A8 mov dword ptr ss:,ecx
00403ABA .BF 08000000 mov edi,0x8
00403ABF .8D95 50FFFFFF lea edx,dword ptr ss:
00403AC5 .8D4D B0 lea ecx,dword ptr ss:
00403AC8 .8945 90 mov dword ptr ss:,eax
00403ACB .8945 A0 mov dword ptr ss:,eax
00403ACE .C785 58FFFFFF A4>mov dword ptr ss:,004022A4 ;UNICODE "Correct serial!"
00403AD8 .89BD 50FFFFFF mov dword ptr ss:,edi
00403ADE .FFD6 call esi ;<&MSVBVM60.__vbaVarDup>
00403AE0 .8D95 60FFFFFF lea edx,dword ptr ss:
00403AE6 .8D4D C0 lea ecx,dword ptr ss:
00403AE9 .C785 68FFFFFF 58>mov dword ptr ss:,00402258 ;UNICODE "Good job, tell me how you do that!"
00403AF3 .89BD 60FFFFFF mov dword ptr ss:,edi
00403AF9 .FFD6 call esi
00403AFB .8D55 90 lea edx,dword ptr ss:
00403AFE .8D45 A0 lea eax,dword ptr ss:
00403B01 .52 push edx
00403B02 .8D4D B0 lea ecx,dword ptr ss:
00403B05 .50 push eax
00403B06 .51 push ecx
00403B07 .8D55 C0 lea edx,dword ptr ss:
00403B0A .53 push ebx
00403B0B .52 push edx
00403B0C .FF15 30104000 call dword ptr ds:[<&MSVBVM60.#595>] ;msvbvm60.rtcMsgBox
5、从这段代码开始，继续向上寻找，发现je/jg/jmp等跳转时选中这一行，查看跳转的位置，分析一下大概流程：00403787 0F8F 17030000 jg 00403AA4 ;// 这个直接跳到正确，关键跳转
0040378D .8B17 mov edx,dword ptr ds:
0040378F .57 push edi
00403790 .FF92 08030000 call dword ptr ds:
00403796 .50 push eax
00403797 .8D45 D4 lea eax,dword ptr ss:
0040379A .50 push eax
0040379B .FF15 2C104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;msvbvm60.__vbaObjSet
004037A1 .8BD8 mov ebx,eax
004037A3 .8D55 E4 lea edx,dword ptr ss:
004037A6 .52 push edx
004037A7 .53 push ebx
004037A8 .8B0B mov ecx,dword ptr ds:
004037AA .FF91 A0000000 call dword ptr ds:
004037B0 .85C0 test eax,eax
004037B2 .DBE2 fclex
004037B4 .7D 12 jge short 004037C8 ;// 不是
004037B6 .68 A0000000 push 0xA0
004037BB .68 44224000 push 00402244
004037C0 .53 push ebx
004037C1 .50 push eax
004037C2 .FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;msvbvm60.__vbaHresultCheckObj
004037C8 >8B07 mov eax,dword ptr ds:
004037CA .57 push edi
004037CB .FF90 08030000 call dword ptr ds:
004037D1 .8D4D D0 lea ecx,dword ptr ss:
004037D4 .50 push eax
004037D5 .51 push ecx
004037D6 .FF15 2C104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;msvbvm60.__vbaObjSet
004037DC .8BF8 mov edi,eax
004037DE .8D45 DC lea eax,dword ptr ss:
004037E1 .50 push eax
004037E2 .57 push edi
004037E3 .8B17 mov edx,dword ptr ds:
004037E5 .FF92 A0000000 call dword ptr ds:
004037EB .85C0 test eax,eax
004037ED .DBE2 fclex
004037EF .7D 12 jge short 00403803 ;// 不是
004037F1 .68 A0000000 push 0xA0
004037F6 .68 44224000 push 00402244
004037FB .57 push edi
004037FC .50 push eax
004037FD .FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;msvbvm60.__vbaHresultCheckObj
00403803 >0FBF7D E8 movsx edi,word ptr ss:
00403807 .8B55 DC mov edx,dword ptr ss:
0040380A .B9 01000000 mov ecx,0x1
0040380F .894D C8 mov dword ptr ss:,ecx
00403812 .894D B8 mov dword ptr ss:,ecx
00403815 .8D4D B0 lea ecx,dword ptr ss:
00403818 .B8 02000000 mov eax,0x2
0040381D .51 push ecx
0040381E .57 push edi
0040381F .52 push edx
00403820 .8945 C0 mov dword ptr ss:,eax
00403823 .8945 B0 mov dword ptr ss:,eax
00403826 .FF15 44104000 call dword ptr ds:[<&MSVBVM60.#631>] ;msvbvm60.rtcMidCharBstr
0040382C .8BD0 mov edx,eax
0040382E .8D4D D8 lea ecx,dword ptr ss:
00403831 .FFD6 call esi
00403833 .50 push eax
00403834 .FF15 1C104000 call dword ptr ds:[<&MSVBVM60.#516>] ;msvbvm60.rtcAnsiValueBstr
0040383A .8B4D E4 mov ecx,dword ptr ss:
0040383D .33DB xor ebx,ebx
0040383F .66:3D 3900 cmp ax,0x39
00403843 .8D45 C0 lea eax,dword ptr ss:
00403846 .50 push eax
00403847 .57 push edi
00403848 .0F9FC3 setg bl
0040384B .51 push ecx
0040384C .F7DB neg ebx
0040384E .FF15 44104000 call dword ptr ds:[<&MSVBVM60.#631>] ;msvbvm60.rtcMidCharBstr
00403854 .8BD0 mov edx,eax
00403856 .8D4D E0 lea ecx,dword ptr ss:
00403859 .FFD6 call esi
0040385B .50 push eax
0040385C .FF15 1C104000 call dword ptr ds:[<&MSVBVM60.#516>] ;msvbvm60.rtcAnsiValueBstr
00403862 .33D2 xor edx,edx
00403864 .66:3D 3000 cmp ax,0x30
00403868 .0F9CC2 setl dl
0040386B .F7DA neg edx
0040386D .8D45 D8 lea eax,dword ptr ss:
00403870 .23DA and ebx,edx
00403872 .8D4D DC lea ecx,dword ptr ss:
00403875 .50 push eax
00403876 .8D55 E0 lea edx,dword ptr ss:
00403879 .51 push ecx
0040387A .8D45 E4 lea eax,dword ptr ss:
0040387D .52 push edx
0040387E .50 push eax
0040387F .6A 04 push 0x4
00403881 .FF15 90104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;msvbvm60.__vbaFreeStrList
00403887 .8D4D D0 lea ecx,dword ptr ss:
0040388A .8D55 D4 lea edx,dword ptr ss:
0040388D .51 push ecx
0040388E .52 push edx
0040388F .6A 02 push 0x2
00403891 .FF15 18104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;msvbvm60.__vbaFreeObjList
00403897 .8D45 B0 lea eax,dword ptr ss:
0040389A .8D4D C0 lea ecx,dword ptr ss:
0040389D .50 push eax
0040389E .51 push ecx
0040389F .6A 02 push 0x2
004038A1 .FF15 0C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeV>;msvbvm60.__vbaFreeVarList
004038A7 .83C4 2C add esp,0x2C
004038AA .66:85DB test bx,bx
004038AD .0F85 6F010000 jnz 00403A22 ;// 不是
004038B3 .8B45 08 mov eax,dword ptr ss:
004038B6 .50 push eax
004038B7 .8B10 mov edx,dword ptr ds:
004038B9 .FF92 08030000 call dword ptr ds:
004038BF .50 push eax
004038C0 .8D45 D4 lea eax,dword ptr ss:
004038C3 .50 push eax
004038C4 .FF15 2C104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;msvbvm60.__vbaObjSet
004038CA .8BD8 mov ebx,eax
004038CC .8D55 E4 lea edx,dword ptr ss:
004038CF .52 push edx
004038D0 .53 push ebx
004038D1 .8B0B mov ecx,dword ptr ds:
004038D3 .FF91 A0000000 call dword ptr ds:
004038D9 .85C0 test eax,eax
004038DB .DBE2 fclex
004038DD .7D 12 jge short 004038F1 ;// 选中5，不是
004038DF .68 A0000000 push 0xA0
004038E4 .68 44224000 push 00402244
004038E9 .53 push ebx
004038EA .50 push eax
004038EB .FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;msvbvm60.__vbaHresultCheckObj
004038F1 >66:8B45 E8 mov ax,word ptr ss:
004038F5 .8B1D 74104000 mov ebx,dword ptr ds:[<&MSVBVM60.#536>];msvbvm60.rtcStrFromVar
004038FB .66:35 0200 xor ax,0x2
004038FF .8D4D A0 lea ecx,dword ptr ss:
00403902 .0F80 A4020000 jo 00403BAC ;// 选中4，不是
00403908 .51 push ecx
00403909 .66:8945 A8 mov word ptr ss:,ax
0040390D .C745 A0 02000000 mov dword ptr ss:,0x2
00403914 .FFD3 call ebx ;<&MSVBVM60.#536>
00403916 .8BD0 mov edx,eax
00403918 .8D4D D8 lea ecx,dword ptr ss:
0040391B .FFD6 call esi
0040391D .8B45 E4 mov eax,dword ptr ss:
00403920 .8D55 C0 lea edx,dword ptr ss:
00403923 .52 push edx
00403924 .57 push edi
00403925 .50 push eax
00403926 .C745 C8 01000000 mov dword ptr ss:,0x1
0040392D .C745 C0 02000000 mov dword ptr ss:,0x2
00403934 .FF15 44104000 call dword ptr ds:[<&MSVBVM60.#631>] ;msvbvm60.rtcMidCharBstr
0040393A .8BD0 mov edx,eax
0040393C .8D4D E0 lea ecx,dword ptr ss:
0040393F .FFD6 call esi
00403941 .50 push eax
00403942 .FF15 1C104000 call dword ptr ds:[<&MSVBVM60.#516>] ;msvbvm60.rtcAnsiValueBstr
00403948 .8D4D B0 lea ecx,dword ptr ss:
0040394B .66:8945 B8 mov word ptr ss:,ax
0040394F .51 push ecx
00403950 .C745 B0 02000000 mov dword ptr ss:,0x2
00403957 .FFD3 call ebx
00403959 .8BD0 mov edx,eax
0040395B .8D4D DC lea ecx,dword ptr ss:
0040395E .FFD6 call esi
00403960 .50 push eax
00403961 .FF15 84104000 call dword ptr ds:[<&MSVBVM60.__vbaR8Str>;msvbvm60.__vbaR8Str
00403967 .DC25 D8104000 fsub qword ptr ds:
0040396D .8D55 90 lea edx,dword ptr ss:
00403970 .6A 01 push 0x1
00403972 .52 push edx
00403973 .C785 30FFFFFF 05>mov dword ptr ss:,0x8005
0040397D .DD9D 38FFFFFF fstp qword ptr ss:
00403983 .DFE0 fstsw ax
00403985 .A8 0D test al,0xD
00403987 .0F85 1A020000 jnz 00403BA7 ;// 选中3，查看，也不是
0040398D .8B45 D8 mov eax,dword ptr ss:
00403990 .C745 D8 00000000 mov dword ptr ss:,0x0
00403997 .8945 98 mov dword ptr ss:,eax
0040399A .8D45 80 lea eax,dword ptr ss:
0040399D .50 push eax
0040399E .C745 90 08000000 mov dword ptr ss:,0x8
004039A5 .FF15 B0104000 call dword ptr ds:[<&MSVBVM60.#619>] ;msvbvm60.rtcRightCharVar
004039AB .8D8D 30FFFFFF lea ecx,dword ptr ss:
004039B1 .8D55 80 lea edx,dword ptr ss:
004039B4 .51 push ecx
004039B5 .52 push edx
004039B6 .FF15 A0104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTs>;msvbvm60.__vbaVarTstNe
004039BC .8BF8 mov edi,eax
004039BE .8D45 D8 lea eax,dword ptr ss:
004039C1 .8D4D DC lea ecx,dword ptr ss:
004039C4 .50 push eax
004039C5 .8D55 E0 lea edx,dword ptr ss:
004039C8 .51 push ecx
004039C9 .8D45 E4 lea eax,dword ptr ss:
004039CC .52 push edx
004039CD .50 push eax
004039CE .6A 04 push 0x4
004039D0 .FF15 90104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;msvbvm60.__vbaFreeStrList
004039D6 .83C4 14 add esp,0x14
004039D9 .8D4D D4 lea ecx,dword ptr ss:
004039DC .FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;msvbvm60.__vbaFreeObj
004039E2 .8D4D 80 lea ecx,dword ptr ss:
004039E5 .8D55 90 lea edx,dword ptr ss:
004039E8 .51 push ecx
004039E9 .8D45 A0 lea eax,dword ptr ss:
004039EC .52 push edx
004039ED .8D4D B0 lea ecx,dword ptr ss:
004039F0 .50 push eax
004039F1 .8D55 C0 lea edx,dword ptr ss:
004039F4 .51 push ecx
004039F5 .52 push edx
004039F6 .6A 05 push 0x5
004039F8 .FF15 0C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeV>;msvbvm60.__vbaFreeVarList
004039FE .83C4 18 add esp,0x18
00403A01 .66:85FF test di,di
00403A04 .75 1C jnz short 00403A22 ;// 选中2，不是
00403A06 .8B7D 08 mov edi,dword ptr ss:
00403A09 .B8 01000000 mov eax,0x1
00403A0E .66:0345 E8 add ax,word ptr ss:
00403A12 .0F80 94010000 jo 00403BAC ;// 选中1，查看跳转，不是
00403A18 .8945 E8 mov dword ptr ss:,eax
00403A1B .33DB xor ebx,ebx
00403A1D .^ E9 5AFDFFFF jmp 0040377C
到这段代码最上的位置时，发现回调到正确文本的位置，所以我么可以很肯定，这个跳转时关键跳转，改为jmp强制跳转就可以了。我们试试，选中这一行->空格键->将jg 00403AA4改为jmp 00403AA4,记得左下角的Nop填充打钩。然后回到程序，再次点击check it,发现仍然提示失败！5、继续向上看：004036D3 .FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;msvbvm60.__vbaHresultCheckObj
004036D9 >8B45 E4 mov eax,dword ptr ss:
004036DC .50 push eax ;// eax="123123"
004036DD .FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBs>;msvbvm60.__vbaLenBstr
004036E3 .33C9 xor ecx,ecx
004036E5 .83F8 09 cmp eax,0x9 ;// 比较字符串长度与0x9，否则直接失败
004036E8 .0F95C1 setne cl ;// cl=1
004036EB .F7D9 neg ecx ;// 取补，-1
004036ED .8BF1 mov esi,ecx
004036EF .8D4D E4 lea ecx,dword ptr ss:
004036F2 .FF15 C0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;msvbvm60.__vbaFreeStr
004036F8 .8D4D D4 lea ecx,dword ptr ss:
004036FB .FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;msvbvm60.__vbaFreeObj
00403701 .66:3BF3 cmp si,bx
00403704 0F85 1A030000 jnz 00403A24 ;// 这个会直接跳到失败
0040370A .8B17 mov edx,dword ptr ds:
0040370C .57 push edi
0040370D .FF92 08030000 call dword ptr ds:
到这里发现它使用cmp比较和jnz进行字符串长度判断，如果不等于9则直接跳转到失败！所以，文本的长度必须为9。我们重新输入伪码123123123，点击check it，哈哈哈！成功了！
当然，你也可以将jnz跳转也修改了！这样字符串长度也不用必须是9了。
4、注册机的探索注册码判断的内容在关键跳转的上面，我们大概分析一下：0040373F .FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;msvbvm60.__vbaHresultCheckObj
00403745 >8B45 E4 mov eax,dword ptr ss:
00403748 .50 push eax ;// "123123123"
00403749 .FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBs>;msvbvm60.__vbaLenBstr
0040374F .8BC8 mov ecx,eax ;// eax = 9
00403751 .FF15 50104000 call dword ptr ds:[<&MSVBVM60.__vbaI2I4>>;msvbvm60.__vbaI2I4
00403757 .8D4D E4 lea ecx,dword ptr ss: ;// ecx = "123123123"
0040375A .8985 14FFFFFF mov dword ptr ss:,eax ;// eax = 9
00403760 .C745 E8 01000>mov dword ptr ss:,0x1
00403767 .FF15 C0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;msvbvm60.__vbaFreeStr
0040376D .8D4D D4 lea ecx,dword ptr ss:
00403770 .FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;msvbvm60.__vbaFreeObj
00403776 .8B35 AC104000 mov esi,dword ptr ds:[<&MSVBVM60.__vbaSt>;msvbvm60.__vbaStrMove
0040377C >66:8B8D 14FFF>mov cx,word ptr ss: ;// cx =eax
00403783 .66:394D E8 cmp word ptr ss:,cx ;// cx与0x1比较
00403787 0F8F 17030000 jg 00403AA4 ;// 这个直接跳到正确，关键跳转
这块算法只进行了一个比较，将文本长度和0x1比较，大于则成功！但是，由于在这之前又进行了文本长度校验，长度必须为9，所以按照正常逻辑，这是永远不可能提示正确的！SO，这个程序没有注册码，只能爆破！
BY笨笨D幸福
本帖最后由 shuguang 于 2014-7-16 08:50 编辑
其实这个是可以弹出正确消息框的。下面有个循环。会跳到jo上面的。通过这个进行比较。相等的会eax返回0，不相等的话eax返回ffffffff. 后面会跳到错误消息框004039B4 .51 push ecx ; /var18
004039B5 .52 push edx ; |var28 = 0012F4F0
004039B6 .FF15 A0104000call dword ptr ds:[<&MSVBVM60.__vbaVa>; \__vbaVarTstNe
楼主不错，继续坚持！ 继续加以偶.0. {:17_1054:}周六周日加班去了，不得已断更了！惭愧啊！ 把00407304的jnz改为Nop 这样就不用输入9个字符了 我们可以查找跳转到错误输出的地方使其跳转到正确输入的位置 本帖最后由 狐狸三少 于 2016-7-11 10:30 编辑
shuguang 发表于 2014-7-16 08:46
其实这个是可以弹出正确消息框的。下面有个循环。会跳到jo上面的。通过这个进行比较。相等的会eax返回0， ...
直接把它改为JMP，节即使什么都不输入也会弹出正确的提示了。关键是跳到jo之前的那个JMP，绕了一大圈回来！
另外，输入注册码:301674501即可注册成功了，并非没有注册码啊!
楼主的贴太强大了支持你 楼主辛苦了。。。
页:
[1]
2