破解工具：trw2000
破解过程：
1、运行TRW2000后最小化
2、运行程序,弹出注册对话框,输入序列号和任意假注册码,先不要点“注册”按钮
3、Ctrl+N激活TRW2000
4、bpx hmemcpy → 这里用hmemcpy这个万能断点就OK了
5、按F5返回，点击注册按钮，程序被拦截
6、BC * → 清除所有断点
PMODULE → 直接进入程序领空
7、按F12键到死哦,回头找到关键如下:
0167:0059FA28 68EAFB5900 PUSH DWORD 0059FBEA
0167:0059FA2D 64FF30 PUSH DWORD [FS:EAX]
0167:0059FA30 648920 MOV [FS:EAX],ESP
0167:0059FA33 8D55FC LEA EDX,[EBP-04]
0167:0059FA36 A1EC6F7F00 MOV EAX,[007F6FEC] ------>序列号
0167:0059FA3B E8C4FDFFFF CALL 0059F804 ------->F8跟入关键call
0167:0059FA40 8B55FC MOV EDX,[EBP-04]
0167:0059FA43 B8F06F7F00 MOV EAX,007F6FF0
0167:0059FA48 E8BB50E6FF CALL 00404B08
0167:0059FA4D B201 MOV DL,01
0167:0059FA4F A1F0CB4700 MOV EAX,[0047CBF0]
0167:0059FA54 E8BBD3EDFF CALL 0047CE14
0167:0059FA59 8BD8 MOV EBX,EAX
0167:0059FA5B BA00000080 MOV EDX,80000000
0167:0059FA60 8BC3 MOV EAX,EBX
0167:0059FA62 E889D4EDFF CALL 0047CEF0
0167:0059FA67 33C0 XOR EAX,EAX
0167:0059FA69 55 PUSH EBP
0167:0059FA6A 68B0FB5900 PUSH DWORD 0059FBB0
0167:0059FA6F 64FF30 PUSH DWORD [FS:EAX]
0167:0059FA72 648920 MOV [FS:EAX],ESP
0167:0059FA75 33C0 XOR EAX,EAX
0167:0059FA77 89864C020000 MOV [ESI+024C],EAX
0167:0059FA7D 8D45F8 LEA EAX,[EBP-08]
0167:0059FA80 8B0DEC6F7F00 MOV ECX,[007F6FEC]
0167:0059FA86 BA00FC5900 MOV EDX,0059FC00
0167:0059FA8B E83853E6FF CALL 00404DC8
0167:0059FA90 8B55F8 MOV EDX,[EBP-08]
0167:0059FA93 33C9 XOR ECX,ECX
0167:0059FA95 8BC3 MOV EAX,EBX
0167:0059FA97 E898D5EDFF CALL 0047D034
0167:0059FA9C 84C0 TEST AL,AL
0167:0059FA9E 0F8502010000 JNZ NEAR 0059FBA6
0167:0059FAA4 8D55F4 LEA EDX,[EBP-0C]
0167:0059FAA7 8B8608030000 MOV EAX,[ESI+0308]
0167:0059FAAD E89E7FEBFF CALL 00457A50
0167:0059FAB2 8B45F4 MOV EAX,[EBP-0C] D EAX 可见假码
0167:0059FAB5 8B15F06F7F00 MOV EDX,[007F6FF0] D EDX 可见真码
0167:0059FABB E80054E6FF CALL 00404EC0
0167:0059FAC0 0F85C6000000 JNZ NEAR 0059FB8C
0167:0059FAC6 8D45F0 LEA EAX,[EBP-10]
进入关键call
0167:0059F804 55 PUSH EBP
0167:0059F805 8BEC MOV EBP,ESP
0167:0059F807 51 PUSH ECX
0167:0059F808 53 PUSH EBX
0167:0059F809 56 PUSH ESI
0167:0059F80A 8BF2 MOV ESI,EDX
0167:0059F80C 8945FC MOV [EBP-04],EAX
0167:0059F80F 8B45FC MOV EAX,[EBP-04]
0167:0059F812 E84D57E6FF CALL 00404F64
0167:0059F817 33C0 XOR EAX,EAX
0167:0059F819 55 PUSH EBP
0167:0059F81A 6871F85900 PUSH DWORD 0059F871
0167:0059F81F 64FF30 PUSH DWORD [FS:EAX]
0167:0059F822 648920 MOV [FS:EAX],ESP
0167:0059F825 33DB XOR EBX,EBX EBX=0
0167:0059F827 8B45FC MOV EAX,[EBP-04]
0167:0059F82A E84D55E6FF CALL 00404D7C
0167:0059F82F 85C0 TEST EAX,EAX 计算序列号长度
0167:0059F831 761B JNA 0059F84E
0167:0059F833 BA01000000 MOV EDX,01 EDX=01 为计数器
0167:0059F838 8B4DFC MOV ECX,[EBP-04] 软件序列号进ecx
0167:0059F83B 0FB64C11FF MOVZX ECX,BYTE [ECX+EDX-01] 逐位取序列号ASCII码到ECX
0167:0059F840 03D9 ADD EBX,ECX EBX=EBX+ECX
0167:0059F842 8D0C5B LEA ECX,[EBX+EBX*2] ECX=EBX*2
0167:0059F845 83C106 ADD ECX,BYTE +06 ECX=ECX+6
0167:0059F848 8BD9 MOV EBX,ECX 结果累加到EBX
0167:0059F84A 42 INC EDX 计数器加1
0167:0059F84B 48 DEC EAX 长度减1
0167:0059F84C 75EA JNZ 0059F838 未完继续向上取
0167:0059F84E 8BC3 MOV EAX,EBX
0167:0059F850 33D2 XOR EDX,EDX
0167:0059F852 52 PUSH EDX
0167:0059F853 50 PUSH EAX
0167:0059F854 8BC6 MOV EAX,ESI
0167:0059F856 E89DA4E6FF CALL 00409CF8
0167:0059F85B 33C0 XOR EAX,EAX
0167:0059F85D 5A POP EDX
0167:0059F85E 59 POP ECX
0167:0059F85F 59 POP ECX
0167:0059F860 648910 MOV [FS:EAX],EDX
0167:0059F863 6878F85900 PUSH DWORD 0059F878
0167:0059F868 8D45FC LEA EAX,[EBP-04]
0167:0059F86B E84452E6FF CALL 00404AB4
keymake注册机源代码:
.const
.data
szHomePage db " http://www.cn12.com",0
szEmail db " mailto:down3000@sina.com",0
szErrMess db "请输入用户名！",0
szBuffer db 50 dup (0)
szHex db "%d",0
.code
mov esi,eax
invoke lstrlen,eax
or eax,eax
jz err
xor EDX,edx
xor ecx,ecx
xor ebx,ebx
N1:
mov ecx,esi
MOVZX ECX,byte ptr [ECX+EDX]
ADD EBX,ECX
LEA ECX,[EBX+EBX*2]
ADD ECX,06
MOV EBX,ECX
INC EDX
DEC EAX
JNZ N1
invoke wsprintf,addr szBuffer,addr szHex,ebx
lea EAX,szBuffer
jmp n0
err:
lea eax,szErrMess
n0:
///////////////////////
////////VB注册机///////
///////////////////////
注册机下载：
点击浏览该文件
Private Sub Command1_Click()
Dim id, sn
Dim ebx, ecx
id = Text1.Text
If id = "" Then Exit Sub
ebx = 0
For i = 1 To Len(id)
ecx = Asc(Mid$(id, i))
ebx = ebx + ebx*2
ebx = ebx + 6
Next i
Text2.Text = ebx
End Sub
