【聲明】：純屬技術交流

【工具】：OllyDbg

PEiD無法知道他是什么殼，暈倒，試試吧。

fi查出的是ACProtect

這殼不好脫。唉，菜鳥啊。今天不脫殼破解

用OD載入，運行軟件，能運行了，OK，因為軟件注冊的時候會給出明顯的注冊碼錯誤字樣。

不過有時候是找不到的，我也不清楚是什么原因。

用OD的插件找字符串，能找，注冊碼錯誤之類的東東。

【1載入】到

00495B44 >? 60?????????? pushad
00495B45??? E8 00000000? call My_Video.00495B4A? //這用ESP，hr 12ffa4，然后F9
00495B4A??? 5B?????????? pop ebx
00495B4B??? 8D5B C6????? lea ebx,dword ptr ds:[ebx-3A]
00495B4E??? 011B???????? add dword ptr ds:[ebx],ebx
00495B50??? 8B13???????? mov edx,dword ptr ds:[ebx]
00495B52??? 8D73 14????? lea esi,dword ptr ds:[ebx+14]
00495B55??? 6A 08??????? push 8

到

00495CA6? ^/E9 99FEFFFF? jmp My_Video.<ModuleEntryPoint>
00495CAB??? 55?????????? push ebp
00495CAC??? 8BEC???????? mov ebp,esp
00495CAE??? 83EC 30????? sub esp,30
00495CB1??? 33C0???????? xor eax,eax

不管他。

再F9，到

00495CA6? ^/E9 99FEFFFF? jmp My_Video.<ModuleEntryPoint>
00495CAB??? 55?????????? push ebp
00495CAC??? 8BEC???????? mov ebp,esp
00495CAE??? 83EC 30????? sub esp,30
00495CB1??? 33C0???????? xor eax,eax

然后刪除硬件斷點。

再F9，程序運行起來了。

就是要讓他運行起來。

查找字符串，無效注冊名或注冊碼

Ultra String Reference，項目 366
?Address=0040747C
?Disassembly=push My_Video.0041B2C4
?Text String=無效注冊名或注冊碼

0040736B??? 51?????????? push ecx
0040736C??? 52?????????? push edx
0040736D??? FFD0???????? call eax
0040736F??? 83C4 08????? add esp,8
00407372??? 56?????????? push esi
00407373??? FF15 B050410>call dword ptr ds:[4150B0]????????????????????? ; My_Video.00458480
00407379??? 8D8424 88000>lea eax,dword ptr ss:[esp+88]
00407380??? 8D4C24 48??? lea ecx,dword ptr ss:[esp+48]
00407384??? 50?????????? push eax
00407385??? 51?????????? push ecx
00407386??? E8 65DFFFFF? call My_Video.004052F0
0040738B??? 83C4 08????? add esp,8
0040738E??? 85C0???????? test eax,eax
00407390??? 0F85 DF00000>jnz My_Video.00407475?????????????????????????? ; 跳轉的地方
00407396??? 8A4C04 08??? mov cl,byte ptr ss:[esp+eax+8]
0040739A??? 8888 80CB410>mov byte ptr ds:[eax+41CB80],cl
004073A0??? 40?????????? inc eax
004073A1??? 84C9???????? test cl,cl
004073A3? ^ 75 F1??????? jnz short My_Video.00407396
004073A5??? 33C0???????? xor eax,eax
004073A7??? 8A4C04 48??? mov cl,byte ptr ss:[esp+eax+48]
004073AB??? 8888 D0C3410>mov byte ptr ds:[eax+41C3D0],cl
004073B1??? 40?????????? inc eax
004073B2??? 84C9???????? test cl,cl
004073B4? ^ 75 F1??????? jnz short My_Video.004073A7
004073B6??? C705 34CF410>mov dword ptr ds:[41CF34],1
004073C0??? 8B53 64????? mov edx,dword ptr ds:[ebx+64]
004073C3??? 57?????????? push edi
004073C4??? 52?????????? push edx
004073C5??? 8D8424 D0010>lea eax,dword ptr ss:[esp+1D0]
004073CC??? 68 00B34100? push My_Video.0041B300
004073D1??? 50?????????? push eax
004073D2??? FF15 9855410>call dword ptr ds:[415598]????????????????????? ; msvcrt.sprintf
004073D8??? 83C4 0C????? add esp,0C
004073DB??? 8D8C24 CC010>lea ecx,dword ptr ss:[esp+1CC]
004073E2??? 6A 40??????? push 40
004073E4??? 68 F4B24100? push My_Video.0041B2F4
004073E9??? 51?????????? push ecx
004073EA??? 8BCB???????? mov ecx,ebx
004073EC??? E8 6FBC0000? call My_Video.00413060????????????????????????? ; jmp to MFC42.#4224
004073F1??? 8D9424 CC000>lea edx,dword ptr ss:[esp+CC]
004073F8??? 52?????????? push edx
004073F9??? E8 22C3FFFF? call My_Video.00403720
004073FE??? 8DBC24 D0000>lea edi,dword ptr ss:[esp+D0]
00407405??? 83C9 FF????? or ecx,FFFFFFFF
00407408??? 33C0???????? xor eax,eax
0040740A??? 83C4 04????? add esp,4
0040740D??? F2:AE??????? repne scas byte ptr es:[edi]
0040740F??? BA E0A84100? mov edx,My_Video.0041A8E0?????????????????????? ; ASCII "option.ini"
00407414??? 8D8424 CC000>lea eax,dword ptr ss:[esp+CC]
0040741B??? F7D1???????? not ecx
0040741D??? 49?????????? dec ecx
0040741E??? 2BC2???????? sub eax,edx
00407420??? 03C8???????? add ecx,eax
00407422??? 5F?????????? pop edi
00407423??? 8A02???????? mov al,byte ptr ds:[edx]
00407425??? 880411?????? mov byte ptr ds:[ecx+edx],al
00407428??? 42?????????? inc edx
00407429??? 84C0???????? test al,al
0040742B? ^ 75 F6??????? jnz short My_Video.00407423
0040742D??? 8B35 C050410>mov esi,dword ptr ds:[4150C0]?????????????????? ; kernel32.WritePrivateProfileStringA
00407433??? 8D8C24 C8000>lea ecx,dword ptr ss:[esp+C8]
0040743A??? 51?????????? push ecx
0040743B??? 68 80CB4100? push My_Video.0041CB80????????????????????????? ; ASCII "qingye"
00407440??? 68 04A54100? push My_Video.0041A504????????????????????????? ; ASCII "User name"
00407445??? 68 34A24100? push My_Video.0041A234
0040744A??? FFD6???????? call esi
0040744C??? 8D9424 C8000>lea edx,dword ptr ss:[esp+C8]
00407453??? 52?????????? push edx
00407454??? 68 D0C34100? push My_Video.0041C3D0????????????????????????? ; ASCII "902AA1CC"
00407459??? 68 F0A44100? push My_Video.0041A4F0????????????????????????? ; ASCII "Registration code"
0040745E??? 68 34A24100? push My_Video.0041A234
00407463??? FFD6???????? call esi
00407465??? 8BCB???????? mov ecx,ebx
00407467??? E8 80BA0000? call My_Video.00412EEC????????????????????????? ; jmp to MFC42.#4853
0040746C??? 5E?????????? pop esi
0040746D??? 5B?????????? pop ebx
0040746E??? 81C4 C002000>add esp,2C0
00407474??? C3?????????? retn
00407475??? 6A 40??????? push 40
00407477??? 68 ECB24100? push My_Video.0041B2EC
0040747C??? 68 C4B24100? push My_Video.0041B2C4????????????????????????? ; 無效注冊名注冊碼
00407481??? 8BCB???????? mov ecx,ebx
00407483??? C705 34CF410>mov dword ptr ds:[41CF34],0
0040748D??? E8 CEBB0000? call My_Video.00413060????????????????????????? ; jmp to MFC42.#4224
00407492??? 5E?????????? pop esi

在00407390?上面找個地方下斷點。

然后點輸入用戶名注冊碼，點注冊碼，單步，應該能找到注冊碼

00407373??? FF15 B050410>call dword ptr ds:[4150B0]????????????????????? ; 讀取注冊碼的地方

就著，注冊碼出現在寄存器窗口。

附個內存注冊機

下載

MyVideoConverter V1.40 漢化版