新微赢技术网

标题: 瑞星15.45.01 oem免A盘破解过程 [打印本页]

作者: 我為ぷぃ情醉 时间: 2009-11-23 01:26
标题: 瑞星15.45.01 oem免A盘破解过程
瑞星15.45.01 oem免A盘破解过程

信息来源：THYSEA
■破解软件: 瑞星15.25.01 oem(setup.exe安装文件)
■破解时间:2003-03-12
■破解工具:w32dasm8.9反汇编工具、hiew 资源修改工具!TRW调试工具!
■破解作者:绝密档案
■源文下载：自己想办法!(提示：到他的主页->注册->选择OEM->得到ID号，即可下载)
■破解分析：
  经分析，在安装SETUP.EXE 时，在没有密钥盘时，会出现：
“请插入瑞星A号盘，如果提示乃出现请与经销商联系”的出错信息!
由此：
■破解过程：
一、破解安装密钥盘的提示。
  在出现出错信息时，不要按确定，先运行trw 按CTRL+N 进入trw
再：pmodule ->F5 返回程序，按“确定”被 trw拦截! 按F10来到这里：

* Possible Reference to String Resource ID=00002: "Installation has not finished, exit now?"
                  |
:0041ABA9 BB02000000       mov ebx, 00000002
:0041ABAE 85C0          test eax, eax
:0041ABB0 0F850F010000       jne 0041ACC5 //一定要走，不出现提示窗口
:0041ABB6 8B8704010000       mov eax, dword ptr [edi+00000104]
:0041ABBC 85C0          test eax, eax
:0041ABBE 0F8501010000       jne 0041ACC5　//一定要走，不出现提示窗口
:0041ABC4 85ED          test ebp, ebp
:0041ABC6 0F84F9000000       je 0041ACC5　//一定要走，不出现提示窗口
　　
:0041ABCC 8B461C          mov eax, dword ptr [esi+1C]
:0041ABCF 8BCF          mov ecx, edi
:0041ABD1 50             push eax
:0041ABD2 E8B9E5FFFF       call 00419190
:0041ABD7 85C0          test eax, eax
:0041ABD9 0F85E6000000       jne 0041ACC5　　//一定要走，不出现提示窗口

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ACBF(C)
|
......
* Possible Reference to String Resource ID=00009: "Your current installed version will be upgraded to network v"
                  |
:0041AC48 6A09          push 00000009
:0041AC4A 51             push ecx
:0041AC4B E850A5FFFF       call 004151A0
:0041AC50 83C40C          add esp, 0000000C
:0041AC53 50             push eax
:0041AC54 8D4C2420          lea ecx, dword ptr [esp+20]
:0041AC58 C68424440B000004    mov byte ptr [esp+00000B44], 04
:0041AC60 E871B70100       call 004363D6
:0041AC65 8D4C2418          lea ecx, dword ptr [esp+18]
:0041AC69 889C24400B0000    mov byte ptr [esp+00000B40], bl
:0041AC70 E828B60100       call 0043629D
:0041AC75 8B54241C          mov edx, dword ptr [esp+1C]
:0041AC79 8B442410          mov eax, dword ptr [esp+10]
:0041AC7D 6A31          push 00000031
:0041AC7F 52             push edx
:0041AC80 50             push eax
:0041AC81 8BCE          mov ecx, esi
:0041AC83 E8079B0100       call 0043478F
:0041AC88 3BC3          cmp eax, ebx
:0041AC8A 0F8491040000       je 0041B121
:0041AC90 8D4C241C          lea ecx, dword ptr [esp+1C]
:0041AC94 C68424400B000001    mov byte ptr [esp+00000B40], 01
:0041AC9C E8FCB50100       call 0043629D
:0041ACA1 8D4C2410          lea ecx, dword ptr [esp+10]
:0041ACA5 C68424400B000000    mov byte ptr [esp+00000B40], 00
:0041ACAD E8EBB50100       call 0043629D
:0041ACB2 8B4E1C          mov ecx, dword ptr [esi+1C]
:0041ACB5 51             push ecx
:0041ACB6 8BCF          mov ecx, edi
:0041ACB8 E8D3E4FFFF       call 00419190 ////读密钥盘xxxxxxx
:0041ACBD 85C0          test eax, eax
:0041ACBF 0F841AFFFFFF       je 0041ABDF    ////往上走的，不要让它走，否则还是在读密钥盘!
/////把 0F841AFFFFFF 改为0F851AFFFFFF
////安装时出现“请插入瑞星A号盘，如果提示乃出现请与经销商联系”的出错信息!
//// 请再一次按“确定”即可!

二、破解安装注册码的提示。
////注意：如果此时你可以不要密钥盘，但下一步会出现：“请输入序列号的提示”
////我没有“序列号” 怎么办？于，再往下跟踪：

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041ABB0(C), :0041ABBE(C), :0041ABC6(C), :0041ABD9(C)　//对应前面的“一定要走”，这样就不会出现提示插入密钥盘的提示窗口
|
:0041ACC5 6A00          push 00000000
:0041ACC7 56             push esi
* Possible Reference to Dialog: DialogID_0066
                  |
* Possible Reference to String Resource ID=00102: "Rising AntiVirus Software"
                  |
:0041ACC8 6A66          push 00000066
:0041ACCA 8D4C242C          lea ecx, dword ptr [esp+2C]
:0041ACCE E8BD71FFFF       call 00411E90
:0041ACD3 8D8C248C010000    lea ecx, dword ptr [esp+0000018C]
:0041ACDA C68424400B000005    mov byte ptr [esp+00000B40], 05
:0041ACE2 E8192EFFFF       call 0040DB00
:0041ACE7 8D8C2418020000    lea ecx, dword ptr [esp+00000218]
:0041ACEE C68424400B000006    mov byte ptr [esp+00000B40], 06
:0041ACF6 E8C530FFFF       call 0040DDC0
:0041ACFB 8D8C2420040000    lea ecx, dword ptr [esp+00000420]
:0041AD02 C68424400B000007    mov byte ptr [esp+00000B40], 07
:0041AD0A E87138FFFF       call 0040E580
:0041AD0F 8D8C24C4060000    lea ecx, dword ptr [esp+000006C4]
:0041AD16 C68424400B000008    mov byte ptr [esp+00000B40], 08
:0041AD1E E84D3EFFFF       call 0040EB70
:0041AD23 8D8C2464090000    lea ecx, dword ptr [esp+00000964]
:0041AD2A C68424400B000009    mov byte ptr [esp+00000B40], 09
:0041AD32 E8A942FFFF       call 0040EFE0
:0041AD37 8D8C24CC070000    lea ecx, dword ptr [esp+000007CC]
:0041AD3E C68424400B00000A    mov byte ptr [esp+00000B40], 0A
:0041AD46 E86569FFFF       call 004116B0
:0041AD4B 8D8C2458030000    lea ecx, dword ptr [esp+00000358]
:0041AD52 C68424400B00000B    mov byte ptr [esp+00000B40], 0B
:0041AD5A E8F16CFFFF       call 00411A50
:0041AD5F 8D8C24F0050000    lea ecx, dword ptr [esp+000005F0]
:0041AD66 C68424400B00000C    mov byte ptr [esp+00000B40], 0C
:0041AD6E E89D54FFFF       call 00410210
:0041AD73 8D8C24AC020000    lea ecx, dword ptr [esp+000002AC]
:0041AD7A C68424400B00000D    mov byte ptr [esp+00000B40], 0D
:0041AD82 E8097DFEFF       call 00402A90
:0041AD87 8D84248C010000    lea eax, dword ptr [esp+0000018C]
:0041AD8E 8D4C2420          lea ecx, dword ptr [esp+20]
:0041AD92 50             push eax
:0041AD93 C68424440B00000E    mov byte ptr [esp+00000B44], 0E
:0041AD9B E8ED050200       call 0043B38D
:0041ADA0 8D8C2418020000    lea ecx, dword ptr [esp+00000218]
:0041ADA7 51             push ecx
:0041ADA8 8D4C2424          lea ecx, dword ptr [esp+24]
:0041ADAC E8DC050200       call 0043B38D
:0041ADB1 83BFA806000022    cmp dword ptr [edi+000006A8], 00000022
:0041ADB8 7411          je 0041ADCB       //// 安装程序的主界面OK!成功!
//// 安装程序的主界面OK!成功!把 7411 改为 EB11 ok!
:0041ADBA 8D9424AC020000    lea edx, dword ptr [esp+000002AC]
:0041ADC1 8D4C2420          lea ecx, dword ptr [esp+20]
:0041ADC5 52             push edx
:0041ADC6 E8C2050200       call 0043B38D

欢迎光临新微赢技术网 (http://bbs.weiying.cn/)