本帖最后由 lkou 于 2012-5-10 10:49 编辑
这个软件和家财宝的破解方法是一样的,大家可以举一反三,不要专注在春天里客户数据管理上面
首先可以看看软件的限制009E3DBE |. 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24]
009E3DC1 |. BA 30409E00 MOV EDX,SunCRM.009E4030 ; 测试
009E3DC6 |. E8 5D21A2FF CALL SunCRM.00405F28
009E3DCB |. 75 6C JNZ SHORT SunCRM.009E3E39
009E3DCD |. 8B83 34030000 MOV EAX,DWORD PTR DS:[EBX+334]
009E3DD3 |. E8 E0EDAEFF CALL SunCRM.004D2BB8
009E3DD8 |. 8B83 34030000 MOV EAX,DWORD PTR DS:[EBX+334]
009E3DDE |. E8 557BB0FF CALL SunCRM.004EB938
009E3DE3 |. 8B10 MOV EDX,DWORD PTR DS:[EAX]
009E3DE5 |. FF52 44 CALL DWORD PTR DS:[EDX+44]
009E3DE8 |. 8B83 34030000 MOV EAX,DWORD PTR DS:[EBX+334]
009E3DEE |. E8 457BB0FF CALL SunCRM.004EB938
009E3DF3 |. BA 40409E00 MOV EDX,SunCRM.009E4040 ; select * from s_customInfo
009E3DF8 |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
009E3DFA |. FF51 38 CALL DWORD PTR DS:[ECX+38]
009E3DFD |. 8B83 34030000 MOV EAX,DWORD PTR DS:[EBX+334]
009E3E03 |. E8 A4EDAEFF CALL SunCRM.004D2BAC
009E3E08 |. 8B83 34030000 MOV EAX,DWORD PTR DS:[EBX+334]
009E3E0E |. 8B10 MOV EDX,DWORD PTR DS:[EAX]
009E3E10 |. FF92 4C010000 CALL DWORD PTR DS:[EDX+14C]
009E3E16 |. 83F8 78 CMP EAX,78
009E3E19 |. 7E 1E JLE SHORT SunCRM.009E3E39
009E3E1B |. 6A 30 PUSH 30
009E3E1D |. 68 5C409E00 PUSH SunCRM.009E405C ; 提示
009E3E22 |. 68 64409E00 PUSH SunCRM.009E4064 ; 该版本为试用版,客户资料不能超过120条。\n\r\n\r支持民族软件业,请购买正版国产软件。\n\r\n\r具体事宜,请联系软件供应商。
可以看到,如果注册位是测试的话,那么就转到下一个验证流程
我们就按照测试来查找
最终来到00A61757 |. E8 A0AE9AFF CALL SunCRM.0040C5FC
00A6175C |. 8B55 E0 MOV EDX,DWORD PTR SS:[EBP-20]
00A6175F |. B8 8081A900 MOV EAX,SunCRM.00A98180
00A61764 |. E8 F7439AFF CALL SunCRM.00405B60
00A61769 |. 33C0 XOR EAX,EAX
00A6176B |. A3 B482A900 MOV DWORD PTR DS:[A982B4],EAX
00A61770 |. 68 A881A900 PUSH SunCRM.00A981A8
00A61775 |. B9 00C6C285 MOV ECX,85C2C600
00A6177A |. BA DD230000 MOV EDX,23DD
00A6177F |. 33C0 XOR EAX,EAX
00A61781 |. E8 FE8EF7FF CALL SunCRM.009DA684
00A61786 |. 85C0 TEST EAX,EAX
00A61788 |. 74 1A JE SHORT SunCRM.00A617A4
00A6178A |. E8 0566F7FF CALL SunCRM.009D7D94
00A6178F |. E8 2467F7FF CALL SunCRM.009D7EB8
00A61794 |. 84C0 TEST AL,AL
00A61796 |. 74 16 JE SHORT SunCRM.00A617AE
00A61798 |. C705 B482A900>MOV DWORD PTR DS:[A982B4],2 赐值为2
00A617A2 |. EB 0A JMP SHORT SunCRM.00A617AE
00A617A4 |> C705 B482A900>MOV DWORD PTR DS:[A982B4],3 赐值为3
00A617AE |> 33FF XOR EDI,EDI
00A617B0 |. 833D B482A900>CMP DWORD PTR DS:[A982B4],0
00A617B7 |. 75 11 JNZ SHORT SunCRM.00A617CA 如果A982B4不为0的话就是正式版
00A617B9 |. B8 8481A900 MOV EAX,SunCRM.00A98184
00A617BE |. BA D41EA600 MOV EDX,SunCRM.00A61ED4 ; 测试
00A617C3 |. E8 98439AFF CALL SunCRM.00405B60
00A617C8 |. EB 0F JMP SHORT SunCRM.00A617D9
00A617CA |> B8 8481A900 MOV EAX,SunCRM.00A98184
00A617CF |. BA E41EA600 MOV EDX,SunCRM.00A61EE4 ; 正式
00A617D4 |. E8 87439AFF CALL SunCRM.00405B60
00A617D9 |> A1 8481A900 MOV EAX,DWORD PTR DS:[A98184]
00A617DE |. BA D41EA600 MOV EDX,SunCRM.00A61ED4 ; 测试
00A617E3 |. E8 40479AFF CALL SunCRM.00405F28
00A617E8 |. 75 41 JNZ SHORT SunCRM.00A6182B
00A617EA |. 8BC3 MOV EAX,EBX
00A617EC |. E8 830D0000 CALL SunCRM.00A62574
00A617F1 |. 84C0 TEST AL,AL
00A617F3 |. 74 0B JE SHORT SunCRM.00A61800
00A617F5 |. 8BC3 MOV EAX,EBX
00A617F7 |. E8 60100000 CALL SunCRM.00A6285C
00A617FC |. 84C0 TEST AL,AL
00A617FE |. 75 0C JNZ SHORT SunCRM.00A6180C
00A61800 |> A1 2C9BA900 MOV EAX,DWORD PTR DS:[A99B2C] ; 缉
00A61805 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
00A61807 |. E8 6C49A5FF CALL SunCRM.004B6178
00A6180C |> B2 01 MOV DL,1
00A6180E |. 8B83 44030000 MOV EAX,DWORD PTR DS:[EBX+344]
00A61814 |. E8 EF689EFF CALL SunCRM.00448108
00A61819 |. B8 94F3A900 MOV EAX,SunCRM.00A9F394
00A6181E |. BA F41EA600 MOV EDX,SunCRM.00A61EF4 ; [试用版]
00A61823 |. E8 38439AFF CALL SunCRM.00405B60
00A61828 |. 83CF FF OR EDI,FFFFFFFF
00A6182B |> A1 8481A900 MOV EAX,DWORD PTR DS:[A98184]
00A61830 |. BA E41EA600 MOV EDX,SunCRM.00A61EE4 ; 正式
00A61835 |. E8 EE469AFF CALL SunCRM.00405F28
00A6183A |. 75 1E JNZ SHORT SunCRM.00A6185A
00A6183C |. C683 08050000>MOV BYTE PTR DS:[EBX+508],1
00A61843 |. B8 94F3A900 MOV EAX,SunCRM.00A9F394
00A61848 |. E8 BF429AFF CALL SunCRM.00405B0C
00A61781和00A6178F这2个call主要作用是给A982B4赐值,由于不知道A982B4的3和2有何区别,所以我们直接把00A61788的跳转改为JMP,这样就成功破解了
这个东西,下载的时候显示的是3.3.8,安装完显示的是3.3.6,主程序上显示的是3.3.4,唉,素质啊,要注意素质!
|