中国农历历法 软件破解
一、用FILEINFO侦察，发现其用ASPROTECT 1.1加壳，用CASPR脱壳。该软件防SOFT-ICE，反汇编找到出错语句，往上看……
:004B236E E879FBFFFF call 004B1EEC //NOP掉此call
:004B2373 84C0 test al, al
:004B2375 7457 je 004B23CE .
.
* Possible StringData Ref from Data Obj ->”信息：
SoftICE 正在运行！
请退出 “
->”Debug 模式后，再运行本软件。”
二、脱壳后的程序运行出错，估计它有自校验。用TRW 2000 LOAD此软件，F10直到……
:004B2402 E875BDF9FF call 0044E17C //此处出错，F8跟入……再F10单步跟踪……直到
:0044E1AD FF572C call [edi+2C] //此处出错，F8跟入……再F10单步跟踪……直到
:004472BC E87BC0FBFF call 0040333C //此处出错，F8跟入……再F10单步跟踪……直到
:004A95A1 8B45FC mov eax, dword ptr [ebp-04]
:004A95A4 3B45F8 cmp eax, dword ptr [ebp-08]
:004A95A7 740C je 004A95B5 //改为750C
* Possible StringData Ref from Data Obj ->”002FAE36″ //出错信息
|
:004A95A9 6858964A00 push 004A9658
:004A95AE 6A00 push 00000000
:004A95B0 E837D1F5FF call 004066EC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A95A7(C)
|
:004A95B5 33C0 xor eax, eax
自校验问题解决。
三、在软件“关于”处，有“未注册版本，请您注册！”的信息，在“串式参考”处找到这条信息，来到……
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004B1A68(C), :004B1A6D(C), :004B1A78(C), :004B1A7D(C) //此4处调用，进入……
|
* Possible StringData Ref from Data Obj ->”未注册版本，请您注册！”
|
:004B1ACF B83C1C4B00 mov eax, 004B1C3C
:004B1AD4 894728 mov dword ptr [edi+28], eax
来到……
:004B1A62 8B55E4 mov edx, dword ptr [ebp-1C]
:004B1A65 3B55D4 cmp edx, dword ptr [ebp-2C]
:004B1A68 7565 jne 004B1ACF //改为7465
:004B1A6A 3B45D0 cmp eax, dword ptr [ebp-30]
:004B1A6D 7560 jne 004B1ACF //改为7460
:004B1A6F 8B45D8 mov eax, dword ptr [ebp-28]
:004B1A72 8B55DC mov edx, dword ptr [ebp-24]
:004B1A75 3B55CC cmp edx, dword ptr [ebp-34]
:004B1A78 7555 jne 004B1ACF //改为7455
:004B1A7A 3B45C8 cmp eax, dword ptr [ebp-38]
:004B1A7D 7550 jne 004B1ACF //改为7450
:004B1A7F 8D55E8 lea edx, dword ptr [ebp-18]
现在在“关于”处已经显示为注册版本了，注册信息放在注册表中的……
REGEDIT4
[HKEY_CURRENT_USER\Software\Mengliao\Cool Tray\Ver 2001 (2.0.0)\Registration]
“RegName”=”用户名”
“RegCompany”=”公司”
“RegSerial”=”注册码”
你爱怎么填就怎么填吧。
四、但现在的程序在切换功能时，还有提示窗口。
此时在 TRW2000 下BPX HMEMCPY ，再切换功能，立即中断，按F12直到出现提示窗口，注册提示窗口消失时，再次中断于……
:004A98F2 C3 ret
往上看……
:004A9893 8B542404 mov edx, dword ptr [esp+04]
:004A9897 3B542414 cmp edx, dword ptr [esp+14]
:004A989B 751A jne 004A98B7 //改为741A
:004A989D 3B442410 cmp eax, dword ptr [esp+10]
:004A98A1 7514 jne 004A98B7 //改为7414
:004A98A3 8B442408 mov eax, dword ptr [esp+08]
:004A98A7 8B54240C mov edx, dword ptr [esp+0C]
:004A98AB 3B54241C cmp edx, dword ptr [esp+1C]
:004A98AF 7504 jne 004A98B5
:004A98B1 3B442418 cmp eax, dword ptr [esp+18]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A98AF(C)
|
:004A98B5 7434 je 004A98EB //改为7534
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004A989B(C), :004A98A1(C)
|
:004A98B7 80BB2508000000 cmp byte ptr [ebx+00000825], 00
:004A98BE 752B jne 004A98EB
:004A98C0 8B0D98204D00 mov ecx, dword ptr [004D2098]
:004A98C6 8B09 mov ecx, dword ptr [ecx]
:004A98C8 B201 mov dl, 01
