看你们玩得好嗨，我也写一个辅助收费系统。看你们能不能破~

Evil0r

[C++] 纯文本查看 复制代码

00404458    53              push ebx
00404459    E8 074A0000     call 00408E65
0040445E    83C4 04         add esp,0x4
00404461    837D F0 06      cmp dword ptr ss:[ebp-0x10],0x6          ; test key len
00404465    0F8D 3B000000   jge 004044A6
0040446B    68 04000080     push 0x80000004
00404470    6A 00           push 0x0
00404472    68 19AA4700     push 0047AA19                            ; 别逗我！
00404477    68 01030080     push 0x80000301
0040447C    6A 00           push 0x0
0040447E    68 00000000     push 0x0
00404483    68 04000080     push 0x80000004
00404488    6A 00           push 0x0
0040448A    68 22AA4700     push 0047AA22                            ; 无效账号！
0040448F    68 03000000     push 0x3
00404494    BB D0A24000     mov ebx,0040A2D0
00404499    E8 D3490000     call 00408E71
0040449E    83C4 28         add esp,0x28
004044A1    E9 DF030000     jmp 00404885
004044A6    6A FF           push -0x1
004044A8    6A 08           push 0x8
004044AA    68 DE4A0116     push 0x16014ADE
004044AF    68 A7440152     push 0x520144A7
004044B4    E8 C4490000     call 00408E7D                            ; get my key
004044B9    83C4 10         add esp,0x10
004044BC    8945 F4         mov dword ptr ss:[ebp-0xC],eax           ; [ebp-c]=mykey
004044BF    FF35 4CDC4900   push dword ptr ds:[0x49DC4C]             ; push jiqima
004044C5    68 2DAA4700     push 0047AA2D                            ; @
004044CA    FF75 F4         push dword ptr ss:[ebp-0xC]
004044CD    B9 03000000     mov ecx,0x3
004044D2    E8 8FCCFFFF     call 00401166                            ; key@jiqima
004044D7    83C4 0C         add esp,0xC
004044DA    8945 F0         mov dword ptr ss:[ebp-0x10],eax          ; [ebp-10]=key@jiqima
004044DD    8B5D F4         mov ebx,dword ptr ss:[ebp-0xC]
004044E0    85DB            test ebx,ebx
004044E2    74 09           je short 004044ED
004044E4    53              push ebx
004044E5    E8 7B490000     call 00408E65                            ; 1
004044EA    83C4 04         add esp,0x4
004044ED    68 04000080     push 0x80000004
004044F2    6A 00           push 0x0
004044F4    8B45 F0         mov eax,dword ptr ss:[ebp-0x10]
004044F7    85C0            test eax,eax
004044F9    75 05           jnz short 00404500
004044FB    B8 DEA74700     mov eax,0047A7DE
00404500    50              push eax
00404501    68 01000000     push 0x1
00404506    BB 709C4000     mov ebx,00409C70
0040450B    E8 61490000     call 00408E71                            ; 1b53d0
00404510    83C4 10         add esp,0x10
00404513    8945 EC         mov dword ptr ss:[ebp-0x14],eax          ; [ebp+14]=1b53d0
00404516    8B5D F0         mov ebx,dword ptr ss:[ebp-0x10]
00404519    85DB            test ebx,ebx
0040451B    74 09           je short 00404526
0040451D    53              push ebx
0040451E    E8 42490000     call 00408E65                            ; 1b5201
00404523    83C4 04         add esp,0x4
00404526    68 05000080     push 0x80000005
0040452B    6A 00           push 0x0
0040452D    8B45 EC         mov eax,dword ptr ss:[ebp-0x14]
00404530    85C0            test eax,eax
00404532    75 05           jnz short 00404539
00404534    B8 F1A74700     mov eax,0047A7F1
00404539    50              push eax                                 ; 1b53d0
0040453A    68 01000000     push 0x1
0040453F    B8 02000000     mov eax,0x2
00404544    BB D04A4500     mov ebx,00454AD0
00404549    E8 3B490000     call 00408E89                            ; get a md5==key@jiqima
0040454E    83C4 10         add esp,0x10
00404551    8945 E8         mov dword ptr ss:[ebp-0x18],eax          ; [ebp-18]=md5
00404554    8B5D EC         mov ebx,dword ptr ss:[ebp-0x14]
00404557    85DB            test ebx,ebx
00404559    74 09           je short 00404564
0040455B    53              push ebx
0040455C    E8 04490000     call 00408E65
00404561    83C4 04         add esp,0x4
00404564    8B45 E8         mov eax,dword ptr ss:[ebp-0x18]
00404567    50              push eax
00404568    8B5D FC         mov ebx,dword ptr ss:[ebp-0x4]
0040456B    85DB            test ebx,ebx
0040456D    74 09           je short 00404578
0040456F    53              push ebx
00404570    E8 F0480000     call 00408E65
00404575    83C4 04         add esp,0x4
00404578    58              pop eax
00404579    8945 FC         mov dword ptr ss:[ebp-0x4],eax           ; ebp-4=md5
0040457C    8B1D 48DC4900   mov ebx,dword ptr ds:[0x49DC48]          ; 瘰G
00404582    E8 D2D8FFFF     call 00401E59                            ; 1
00404587    33C9            xor ecx,ecx
00404589    50              push eax
0040458A    8D45 F8         lea eax,dword ptr ss:[ebp-0x8]
0040458D    8BD8            mov ebx,eax
0040458F    58              pop eax
00404590    41              inc ecx
00404591    51              push ecx
00404592    53              push ebx
00404593    890B            mov dword ptr ds:[ebx],ecx
00404595    50              push eax
00404596    3BC8            cmp ecx,eax
00404598    0F8F 96020000   jg 00404834
0040459E    8B1D 48DC4900   mov ebx,dword ptr ds:[0x49DC48]          ; 瘰G
004045A4    E8 95CAFFFF     call 0040103E                            ; 1
004045A9    53              push ebx
004045AA    51              push ecx
004045AB    8B45 F8         mov eax,dword ptr ss:[ebp-0x8]
004045AE    48              dec eax
004045AF    79 0D           jns short 004045BE
004045B1    68 04000000     push 0x4
004045B6    E8 BC480000     call 00408E77
004045BB    83C4 04         add esp,0x4
004045BE    59              pop ecx
004045BF    5B              pop ebx
004045C0    3BC1            cmp eax,ecx
004045C2    7C 0D           jl short 004045D1
004045C4    68 01000000     push 0x1
004045C9    E8 A9480000     call 00408E77
004045CE    83C4 04         add esp,0x4
004045D1    C1E0 02         shl eax,0x2
004045D4    03D8            add ebx,eax
004045D6    895D F4         mov dword ptr ss:[ebp-0xC],ebx
004045D9    8B5D F4         mov ebx,dword ptr ss:[ebp-0xC]
004045DC    8B03            mov eax,dword ptr ds:[ebx]
004045DE    50              push eax                                 ; md5
004045DF    FF75 FC         push dword ptr ss:[ebp-0x4]              ; web page
004045E2    E8 77CAFFFF     call 0040105E                            ; commit
004045E7    83C4 08         add esp,0x8
004045EA    83F8 00         cmp eax,0x0
004045ED    0F85 39020000   jnz 0040482C                             ; patch this
004045F3    6A 00           push 0x0
004045F5    68 01000000     push 0x1
004045FA    6A FF           push -0x1
004045FC    6A 05           push 0x5

上面是爆破点，还没找到暗桩

perfectiris

玩了下楼主的CM，爆破登陆部分和楼上的差不多，有界面有按钮，但是没法点，也无法移动窗体。
后来是PUSH了下窗体，破解的。 解压密码是tudou。

不太会易语言，看了楼主的源码，点登陆部分的验证，我是真没看出来你说的暗桩
.版本 2

    .如果真 (正确 ＝ 验证数据 [a])
        _启动窗口.可视 ＝ 真
        _启动窗口.按钮1.可视 ＝ 真
        登陆.可视 ＝ 假
爆破的话，就是设置可视都是真了。但是为什么按钮无法点，就不知道了，起码应该不是这里的暗桩导致的吧？

yAYa的表哥

加个SE壳就不要开检测OD吧！我懒得开虚拟机了！留着大牛

guozhuanggz

看看什么辅助

jy03024663

烦躁的SE壳。。。

282169268

lz 密码是哈多！！？？？

Mrsin

SE ! 就不能换个壳吗?   只能写补丁了!  在恒大那里看到了一个 CE破解SE强壳的方法! 看看了!

Evil0r

夏忧伤 发表于 2014-12-24 15:00
SE ! 就不能换个壳吗?   只能写补丁了!  在恒大那里看到了一个 CE破解SE强壳的方法 ...

求恒大那个教程地址