Windows文件隐藏专家 V3.5简单算法 -pc6资讯

您的位置：首页 → 精文荟萃 → 破解文章 → Windows文件隐藏专家 V3.5简单算法

Windows文件隐藏专家 V3.5简单算法 时间：2004/10/15 0:57:00来源：本站整理作者：蓝点我要评论(0)

软件介绍：
优秀的文件，文件夹，硬盘隐藏软件，隐藏速度快。支持多用户使用,全部隐藏文件及文件夹查找等清单等功能。
--------------------------------------------------------------------------------------
破解人:北极熊[DFCG]
下载地址: http://www.skycn.com/soft/11703.html
破解工具:TRW2000

破解过程:
1、运行TRW2000后最小化

2、运行程序,弹出注册对话框,输入任意假注册码,先不要点“注册”按钮

3、Ctrl+N激活TRW2000

4、bpx hmemcpy → 这里用hmemcpy这个万能断点就OK了

5、按F5返回，点击注册按钮，程序被拦截

6、BC * →　清除所有断点
PMODULE →　直接进入程序领空

7、按F12键7次按F10键来到如下代码处

:004884A2 50 push eax
:004884A3 8D55F4 lea edx, dword ptr [ebp-0C] //第一段假码
:004884A6 8B83FC020000 mov eax, dword ptr [ebx+000002FC]
:004884AC E85F51FDFF call 0045D610
:004884B1 8B45F4 mov eax, dword ptr [ebp-0C] //机器码
:004884B4 E8E317F8FF call 00409C9C
:004884B9 DB7DE8 fstp tbyte ptr [ebp-18]
:004884BC 9B wait

* Possible StringData Ref from Code Obj ->"780815205"
|
:004884BD B8B8874800 mov eax, 004887B8 //读取字串:"780815205"
:004884C2 E8D517F8FF call 00409C9C
:004884C7 DB6DE8 fld tbyte ptr [ebp-18]
:004884CA DEC1 faddp st(1), st(0) //st=机器码,st1=780815205,
两者相加为第一段注册码,为S1
:004884CC 83C4F4 add esp, FFFFFFF4
:004884CF DB3C24 fstp tbyte ptr [esp]
:004884D2 9B wait
:004884D3 8D45F8 lea eax, dword ptr [ebp-08]
:004884D6 E86117F8FF call 00409C3C
:004884DB 8B55F8 mov edx, dword ptr [ebp-08] //d edx,第一段真注册码
:004884DE 58 pop eax //第一段假注册码
:004884DF E8E0BFF7FF call 004044C4
:004884E4 0F85E4010000 jne 004886CE //比较不对就死了
:004884EA 8D55E4 lea edx, dword ptr [ebp-1C]
:004884ED 8B831C030000 mov eax, dword ptr [ebx+0000031C]
:004884F3 E81851FDFF call 0045D610
:004884F8 8B45E4 mov eax, dword ptr [ebp-1C]
:004884FB 50 push eax
:004884FC 8D55DC lea edx, dword ptr [ebp-24]
:004884FF 8B8308030000 mov eax, dword ptr [ebx+00000308]
:00488505 E80651FDFF call 0045D610
:0048850A 8B45DC mov eax, dword ptr [ebp-24]
:0048850D E88A17F8FF call 00409C9C
:00488512 DB7DE8 fstp tbyte ptr [ebp-18]
:00488515 9B wait

* Possible StringData Ref from Code Obj ->"8120543768"
|
:00488516 B8CC874800 mov eax, 004887CC //读取字串:"8120543768"
:0048851B E87C17F8FF call 00409C9C
:00488520 DB6DE8 fld tbyte ptr [ebp-18]
:00488523 DEC1 faddp st(1), st(0) st=A1,st1=8120543768,
两者相加为第二段注册码,为S2
:00488525 83C4F4 add esp, FFFFFFF4
:00488528 DB3C24 fstp tbyte ptr [esp]
:0048852B 9B wait
:0048852C 8D45E0 lea eax, dword ptr [ebp-20]
:0048852F E80817F8FF call 00409C3C
:00488534 8B55E0 mov edx, dword ptr [ebp-20] //d edx,第二段真注册码s2
:00488537 58 pop eax 第二段假注册码
:00488538 E887BFF7FF call 004044C4
:0048853D 0F858B010000 jne 004886CE 比较不对就死了
:00488543 8D55D8 lea edx, dword ptr [ebp-28]
:00488546 8B8320030000 mov eax, dword ptr [ebx+00000320]
:0048854C E8BF50FDFF call 0045D610
:00488551 8B45D8 mov eax, dword ptr [ebp-28]
:00488554 50 push eax
:00488555 8D55D0 lea edx, dword ptr [ebp-30]
:00488558 8B8308030000 mov eax, dword ptr [ebx+00000308]
:0048855E E8AD50FDFF call 0045D610
:00488563 8B45D0 mov eax, dword ptr [ebp-30]
:00488566 E83117F8FF call 00409C9C
:0048856B DB7DE8 fstp tbyte ptr [ebp-18]
:0048856E 9B wait
:0048856F 8D55CC lea edx, dword ptr [ebp-34]
:00488572 8B831C030000 mov eax, dword ptr [ebx+0000031C]
:00488578 E89350FDFF call 0045D610
:0048857D 8B45CC mov eax, dword ptr [ebp-34]
:00488580 E81717F8FF call 00409C9C
:00488585 DB6DE8 fld tbyte ptr [ebp-18]
:00488588 DEC1 faddp st(1), st(0) //这里是前2段真注册码相加
:0048858A DB7DC0 fstp tbyte ptr [ebp-40]
:0048858D 9B wait

* Possible StringData Ref from Code Obj ->"3310609"
|
:0048858E B8E0874800 mov eax, 004887E0 //读取字串:"3310609"
:00488593 E80417F8FF call 00409C9C
:00488598 DB6DC0 fld tbyte ptr [ebp-40]
:0048859B DEC1 faddp st(1), st(0) //st(0)=前2段真注册码相加,
st(1)=3310609
两者相加为第三段注册码,为S3
:0048859D 83C4F4 add esp, FFFFFFF4
:004885A0 DB3C24 fstp tbyte ptr [esp]
:004885A3 9B wait
:004885A4 8D45D4 lea eax, dword ptr [ebp-2C]
:004885A7 E89016F8FF call 00409C3C
:004885AC 8B55D4 mov edx, dword ptr [ebp-2C] //D EDX 第三段注册码
:004885AF 58 pop eax
:004885B0 E80FBFF7FF call 004044C4
:004885B5 0F8513010000 jne 004886CE 比较不对就死了
:004885BB 8D55B8 lea edx, dword ptr [ebp-48]
:004885BE 8B8308030000 mov eax, dword ptr [ebx+00000308]
:004885C4 E84750FDFF call 0045D610
:004885C9 FF75B8 push [ebp-48]
:004885CC 8D55B4 lea edx, dword ptr [ebp-4C]
:004885CF 8B831C030000 mov eax, dword ptr [ebx+0000031C]
:004885D5 E83650FDFF call 0045D610
:004885DA FF75B4 push [ebp-4C]
:004885DD 8D55B0 lea edx, dword ptr [ebp-50]
:004885E0 8B8320030000 mov eax, dword ptr [ebx+00000320]
:004885E6 E82550FDFF call 0045D610
:004885EB FF75B0 push [ebp-50]
:004885EE 8D45BC lea eax, dword ptr [ebp-44]
:004885F1 BA03000000 mov edx, 00000003
:004885F6 E83DBEF7FF call 00404438
:004885FB 8B45BC mov eax, dword ptr [ebp-44]
:004885FE 50 push eax