MP3 to EXE v 2.6破解手记

MP3 to EXE v 2.6破解手记

标 题:MP3 to EXE v 2.6破解手记 (8千字)
发信人:X man
时 间:2001-9-8 23:16:05
详细信息:

MP3 to EXE v 2.6破解手记
作者:lb[BCG]或X man
软件简介:
With MP3 to EXE you can create Selfplaying MP3 Songs. While the Song
is played you can change the Volume (Left and Right seperate), see an
VU-Meter, change the position in the MP3-Song, Loop the Song, view
the TAG’s with Information about the Song.
And you change this Information with MP3 to EXE before creating the
file.
工具:fi,trw2000,w32dasm,hiew
该软件是一年前下的,直到今天才搞定,看来我太失败了(肺腑之言)
首先用FI检测有无壳,很幸运没有。
用W32DASM反编译,查找”The Registrationinformation is wrong. Try again?”
来到* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046F1B4(C), :0046F1F9(C)———————–//从这两处跳来
|————————————————-//向上来到这两处

* Possible Reference to Dialog: DialogID_0065, CONTROL_ID:0064, “Text”
|
:0046F2D8 6A64                    push 00000064

* Reference To: kernel32.Sleep, Ord:0000h
|
:0046F2DA E8ED68F9FF              Call 00405BCC
:0046F2DF 6A04                    push 00000004

* Possible StringData Ref from Code Obj ->”Error”
|
:0046F2E1 B938F44600              mov ecx, 0046F438

* Possible StringData Ref from Code Obj ->”The Registrationinformation is ”
->”wrong. Try again?”
|
:0046F2E6 BA40F44600              mov edx, 0046F440
:0046F2EB A140144800              mov eax, dword ptr [00481440]
:0046F2F0 8B00                    mov eax, dword ptr [eax]
:0046F2F2 E80103FCFF              call 0042F5F8
:0046F2F7 83F807                  cmp eax, 00000007
:0046F2FA 750A                    jne 0046F306
:0046F2FC A1E8494800              mov eax, dword ptr [004849E8]
:0046F301 E84EE0FBFF              call 0042D354
**********
来到0046F1B4(C), :0046F1F9(C)处
* Possible StringData Ref from Code Obj ->”MP3-”
|
:0046F164 6890F34600              push 0046F390
:0046F169 8BC7                    mov eax, edi
:0046F16B E8008BF9FF              call 00407C70
:0046F170 8BC8                    mov ecx, eax
:0046F172 A108154800              mov eax, dword ptr [00481508]
:0046F177 8B00                    mov eax, dword ptr [eax]
:0046F179 8B800C030000            mov eax, dword ptr [eax+0000030C]
:0046F17F 8BD7                    mov edx, edi
:0046F181 E8AADFFFFF              call 0046D130
:0046F186 83C003                  add eax, 00000003
:0046F189 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0046F18C BA08000000              mov edx, 00000008
:0046F191 E86682F9FF              call 004073FC
:0046F196 FF75EC                  push [ebp-14]

* Possible StringData Ref from Code Obj ->”-B9″
|
:0046F199 68A0F34600              push 0046F3A0
:0046F19E 8D45F0                  lea eax, dword ptr [ebp-10]
:0046F1A1 BA03000000              mov edx, 00000003
:0046F1A6 E8654BF9FF              call 00403D10
:0046F1AB 8B55F0                  mov edx, dword ptr [ebp-10]—-你填的serial number
:0046F1AE 58                      pop eax————————正确的serial number
:0046F1AF E8AC4BF9FF              call 00403D60
:0046F1B4 0F851E010000            jne 0046F2D8————-跳到出错的地方
:0046F1BA 8D55FC                  lea edx, dword ptr [ebp-04]
:0046F1BD 8B83E0010000            mov eax, dword ptr [ebx+000001E0]
:0046F1C3 E85805FBFF              call 0041F720
:0046F1C8 8B55FC                  mov edx, dword ptr [ebp-04]
:0046F1CB 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0046F1CE A108154800              mov eax, dword ptr [00481508]
:0046F1D3 8B00                    mov eax, dword ptr [eax]
:0046F1D5 E81A7F0000              call 004770F4
:0046F1DA 8B55EC                  mov edx, dword ptr [ebp-14]
:0046F1DD 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0046F1E0 A108154800              mov eax, dword ptr [00481508]
:0046F1E5 8B00                    mov eax, dword ptr [eax]
:0046F1E7 E8087F0000              call 004770F4
:0046F1EC 8B45F0                  mov eax, dword ptr [ebp-10]——-经变换后你填的注册码

* Possible StringData Ref from Code Obj ->”巗Y窫綅鉮<=w0燔-”
|
:0046F1EF BAACF34600              mov edx, 0046F3AC———————–经变换后正确的注册码
:0046F1F4 E8674BF9FF              call 00403D60
:0046F1F9 0F85D9000000            jne 0046F2D8—————跳到出错的地方
:0046F1FF B201                    mov dl, 01
:0046F201 A118AC4500              mov eax, dword ptr [0045AC18]
:0046F206 E809BBFEFF              call 0045AD14
:0046F20B 8BF0                    mov esi, eax
:0046F20D BA02000080              mov edx, 80000002
:0046F212 8BC6                    mov eax, esi
:0046F214 E88FBBFEFF              call 0045ADA8
看到上面的地方,我想已经成功了一半了,但是当我一次次的追进CALL中,却发现离目标又远了。
(在CALL中转来转去,老是找不到注册码是如何变化的。请高手指点一二。^_^)
并且,我发现call 00403D60在两次出现后运算的结果都不同。

:0046F1AF E8AC4BF9FF              call 00403D60
:0046F1B4 0F851E010000            jne 0046F2D8—要保证call 00403D60的输出为EAX=0

:0046F1F4 E8674BF9FF              call 00403D60
:0046F1F9 0F85D9000000            jne 0046F2D8—要保证call 00403D60的输出为EAX不为0
SO,在别无它法时,我突然想到了每次打开MP3TOEXE都会有个NAG,不如查找它的关键字吧!
于是几经波折,来到了最关键的地方:
* Possible StringData Ref from Code Obj ->”MP3-”
|
:004799A8 680C9B4700              push 00479B0C
:004799AD 8BC7                    mov eax, edi
:004799AF E8BCE2F8FF              call 00407C70
:004799B4 8BC8                    mov ecx, eax
:004799B6 8BD7                    mov edx, edi
:004799B8 8B860C030000            mov eax, dword ptr [esi+0000030C]
:004799BE E86D37FFFF              call 0046D130
:004799C3 83C003                  add eax, 00000003
:004799C6 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:004799C9 BA08000000              mov edx, 00000008
:004799CE E829DAF8FF              call 004073FC
:004799D3 FF75F4                  push [ebp-0C]

* Possible StringData Ref from Code Obj ->”-B9″
|
:004799D6 681C9B4700              push 00479B1C
:004799DB 8D45F8                  lea eax, dword ptr [ebp-08]
:004799DE BA03000000              mov edx, 00000003
:004799E3 E828A3F8FF              call 00403D10
:004799E8 8B55F8                  mov edx, dword ptr [ebp-08]
:004799EB 58                      pop eax
:004799EC E86FA3F8FF              call 00403D60
:004799F1 7556                    jne 00479A49———是不是和刚才的地方很象
———-将JNE改成JE既成任意注册版!哈哈
:004799F3 8D4DFC                  lea ecx, dword ptr [ebp-04]

* Possible StringData Ref from Code Obj ->”Free”
|
:004799F6 BAEC9A4700              mov edx, 00479AEC
:004799FB 8BC3                    mov eax, ebx
:004799FD E8FA15FEFF              call 0045AFFC
:00479A02 8B55FC                  mov edx, dword ptr [ebp-04]
:00479A05 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00479A08 8BC6                    mov eax, esi
:00479A0A E8E5D6FFFF              call 004770F4
:00479A0F 8B55F8                  mov edx, dword ptr [ebp-08]
:00479A12 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00479A15 8BC6                    mov eax, esi
:00479A17 E8D8D6FFFF              call 004770F4
:00479A1C 8B45FC                  mov eax, dword ptr [ebp-04]

* Possible StringData Ref from Code Obj ->”巗Y窫綅鉮<=w0燔-”
|
:00479A1F BA289B4700              mov edx, 00479B28
:00479A24 E837A3F8FF              call 00403D60
:00479A29 751E                    jne 00479A49 ———-将JNE改成JE既成任意注册版!哈哈
:00479A2B 33D2                    xor edx, edx
:00479A2D 8B86EC010000            mov eax, dword ptr [esi+000001EC]
:00479A33 E8445CFAFF              call 0041F67C
:00479A38 B8E84C4800              mov eax, 00484CE8

* Possible StringData Ref from Code Obj ->”MP3TOEXE_2″
|
:00479A3D BA449B4700              mov edx, 00479B44
:00479A42 E8E19FF8FF              call 00403A28
:00479A47 EB0D                    jmp 00479A56
好了,由于我是BEGINNER,所以只有爆破了。高手可不要见笑哦!
PATCH:
用HIEW,打开MP3TOEXE.exe,按F4,选择第三个选项,按F5,输入78df1,将7556改成7456
在将它下面的751E改成741E,按F9,F10。OK!文件就改好了。
打开注册表编辑器来到
HKEY_LOCAL_MACHINE\Software\Oliver Buschjost\MP3TOEXE\v2.6
将其中lName、Serial改成您的大名和Seria 码(可以任意填)

END:
软件搞定了,但是注册码是如何变化的还是不明白。望高手给我指点一二。

X man or  lb[BCG]
lbcool@elong.com
2001.9.8


Leave a Reply

Your email address will not be published. Required fields are marked *