破解筆記 某C++Builder Component

由於該Component是收費的,試用只有30天,
怕編譯出來發布給別人用會有過期問題,於是就來破解一下。

看網路上舊版的可以直接爆破序號,這個則是直接通過驗證A__A
本文純粹做筆記,僅作為學術研究之用。

0040A9C2 - E8 65F8FFFF           - call 0040A22C ; 選擇要解鎖的元件
0040A9C7 - 83 C4 08 - add esp,08
0040A9CA - 84 C0 - test al,al
0040A9CC - 75 1F - jne 0040A9ED
0040A9CE - 68 C44E4B00 - push 004B4EC4 : ["unlockComponent internal error."]
0040A9D3 - 56 - push esi
0040A9D4 - 8B 0E - mov ecx,[esi]
0040A9D6 - FF 51 14 - call dword ptr [ecx+14]
0040A9D9 - 83 C4 08 - add esp,08
0040A9DC - 33 C0 - xor eax,eax
0040A9DE - 8B 55 D0 - mov edx,[ebp-30]
0040A9E1 - 64 89 15 00000000 - mov fs:[00000000],edx
0040A9E8 - E9 BA000000 - jmp 0040AAA7
0040A9ED - 66 C7 45 E0 0C00 - mov word ptr [ebp-20],000C
0040A9F3 - 8D 4D F4 - lea ecx,[ebp-0C]
0040A9F6 - 51 - push ecx
0040A9F7 - E8 BC6E0500 - call 004618B8
0040A9FC - 59 - pop ecx
0040A9FD - 83 45 EC 02 - add dword ptr [ebp-14],02
0040AA01 - 66 C7 45 E0 1800 - mov word ptr [ebp-20],0018
0040AA07 - 8B 45 C0 - mov eax,[ebp-40] ; [ebp-40]即為解鎖狀態 1=已解鎖 0=未解鎖
0040AA0A - 80 38 00 - cmp byte ptr [eax],00
0040AA0D - 74 30 - je 0040AA3F ; 在這裡修改就會A__A
0040AA0F - 68 E44E4B00 - push 004B4EE4 : ["Already unlocked."]
0040AA14 - 56 - push esi
0040AA15 - 8B 16 - mov edx,[esi]
0040AA17 - FF 52 18 - call dword ptr [edx+18]
0040AA1A - 83 C4 08 - add esp,08
0040AA1D - B0 01 - mov al,01
0040AA1F - 50 - push eax
0040AA20 - 83 6D EC 02 - sub dword ptr [ebp-14],02
0040AA24 - 6A 02 - push 02
0040AA26 - 8D 55 F4 - lea edx,[ebp-0C]
0040AA29 - 52 - push edx
0040AA2A - E8 E16E0500 - call 00461910
0040AA2F - 83 C4 08 - add esp,08
0040AA32 - 58 - pop eax
0040AA33 - 8B 55 D0 - mov edx,[ebp-30]
0040AA36 - 64 89 15 00000000 - mov fs:[00000000],edx
0040AA3D - EB 68 - jmp 0040AAA7
0040AA3F - 8B 4D 10 - mov ecx,[ebp+10]
0040AA42 - 51 - push ecx