【www.hzclsc.cn--工具】
目的：初学破解，属技术交流，无其它目的，请不要任意散布或用用商业用途。
工具：wktvbdebuger1.4e,exdec
假设：
机器码：818314132231985
注册码：987654321
前几天在学习破解vb的p-code的程序破解，有所体会，所以公布这篇笔记。
好了，在wktvbdebuger中，在反汇编窗口，右击，选bpx api list,找rtcLeftCharVar函数，并在上面下断，运行注册，断下来了，看一面地址51c39e，好运行反汇篇程序exdec,查找地址51c39e，向上找这一call的第一条
语句，如下：
Proc: 51d0e0
51BCD8: 00 LargeBos
51BCDA: 00 LargeBos
51BCDC: 4b onErrorGoto
51BCDF: 00 LargeBos
好了，可以在wktvbdebuger中在51BCD8处下断，运行如下：
Proc: 51d0e0
51BCD8: 00 LargeBos ＝＝＞不知这个含义
51BCDA: 00 LargeBos
51BCDC: 4b onErrorGoto
51BCDF: 00 LargeBos
51BCE1: f5 LitI4: 0xbb8 3000 (....)
51BCE6: 71 FStR4 local_008C
51BCE9: 00 LargeBos
51BCEB: 27 LitVar_Missing
51BCEE: 0a ImpAdCallFPR4:
51BCF3: 35 FFree1Var local_00B0
51BCF6: 00 LargeBos
51BCF8: 27 LitVar_Missing
51BCFB: 0a ImpAdCallFPR4:
51BD00: 73 FStFPR4
51BD03: f4 LitI2_Byte: 0x18 24 (.)==>装入一个字节值24
51BD05: eb CR8I2 ＝＞数据类型转换为double
51BD06: 6e FLdFPR4
51BD09: b3 MulR8
51BD0A: Lead0/e6 FnIntR8
51BD0C: f4 LitI2_Byte: 0x1 1 (.)
51BD0E: eb CR8I2
51BD0F: ab AddR8
51BD10: e5 CI2R8
51BD11: 70 FStI2 local_0086
51BD14: 35 FFree1Var local_00B0
51BD17: 00 LargeBos
51BD19: 6b FLdI2 local_0086
51BD1C: 70 FStI2 local_00B6
51BD1F: 00 LargeBos
51BD21: 6b FLdI2 local_00B6
51BD24: f4 LitI2_Byte: 0x1 1 (.)
51BD26: c6 EqI2
51BD27: 1c BranchF: 51BD5F==>跳到51BD5F
51BD2A: 00 LargeBos
51BD2C: 6c ILdRf local_008C
51BD2F: 71 FStR4 local_0090
51BD32: 00 LargeBos
51BD34: 6c ILdRf local_008C
51BD37: f5 LitI4: 0x168 360 (...h)
51BD3C: aa AddI4
51BD3D: 71 FStR4 local_0090
51BD40: 00 LargeBos
51BD42: 6c ILdRf local_008C
51BD45: f5 LitI4: 0x2d0 720 (....)
51BD4A: aa AddI4
51BD4B: 71 FStR4 local_0090
51BD4E: 00 LargeBos
51BD50: 6c ILdRf local_008C
51BD53: f5 LitI4: 0x438 1080 (...8)
51BD58: aa AddI4
51BD59: 71 FStR4 local_0090
51BD5C: 1e Branch: 51c31c
51BD5F: 00 LargeBos
51BD61: 6b FLdI2 local_00B6
51BD64: f4 LitI2_Byte: 0x2 2 (.)
51BD66: c6 EqI2 =>与2是否相等
51BD67: 1c BranchF: 51BD9F＝＞跳到51BD9F
51BD6A: 00 LargeBos
51BD6C: 6c ILdRf local_008C
51BD6F: 71 FStR4 local_0090
51BD72: 00 LargeBos
51BD74: 6c ILdRf local_008C
51BD77: f5 LitI4: 0x168 360 (...h)
51BD7C: aa AddI4
51BD7D: 71 FStR4 local_0090
51BD80: 00 LargeBos
51BD82: 6c ILdRf local_008C
51BD85: f5 LitI4: 0x2d0 720 (....)
51BD8A: aa AddI4
51BD8B: 71 FStR4 local_0090
51BD8E: 00 LargeBos
51BD90: 6c ILdRf local_008C
51BD93: f5 LitI4: 0x438 1080 (...8)
51BD98: aa AddI4
51BD99: 71 FStR4 local_0090
51BD9C: 1e Branch: 51c31c
51BD9F: 00 LargeBos
51BDA1: 6b FLdI2 local_00B6
51BDA4: f4 LitI2_Byte: 0x3 3 (.)
51BDA6: c6 EqI2 ＝＞3是否等于8
51BDA7: 1c BranchF: 51BDDF＝＞不等则跳到51BDDF
51BDAA: 00 LargeBos
51BDAC: 6c ILdRf local_008C
51BDAF: 71 FStR4 local_0090
51BDB2: 00 LargeBos
51BDB4: 6c ILdRf local_008C
51BDB7: f5 LitI4: 0x168 360 (...h)
51BDBC: aa AddI4
51BDBD: 71 FStR4 local_0090
51BDC0: 00 LargeBos
51BDC2: 6c ILdRf local_008C
51BDC5: f5 LitI4: 0x2d0 720 (....)
51BDCA: aa AddI4
51BDCB: 71 FStR4 local_0090
51BDCE: 00 LargeBos
51BDD0: 6c ILdRf local_008C
51BDD3: f5 LitI4: 0x438 1080 (...8)
51BDD8: aa AddI4
51BDD9: 71 FStR4 local_0090
51BDDC: 1e Branch: 51c31c
51BDDF: 00 LargeBos
51BDE1: 6b FLdI2 local_00B6
51BDE4: f4 LitI2_Byte: 0x4 4 (.)
51BDE6: c6 EqI2 ＝＞8与4是否等
51BDE7: 1c BranchF: 51BE1F＝＞不等则跳
51BDEA: 00 LargeBos
51BDEC: 6c ILdRf local_008C
51BDEF: 71 FStR4 local_0090
51BDF2: 00 LargeBos
51BDF4: 6c ILdRf local_008C
51BDF7: f5 LitI4: 0x168 360 (...h)
51BDFC: aa AddI4
51BDFD: 71 FStR4 local_0090
51BE00: 00 LargeBos
51BE02: 6c ILdRf local_008C
51BE05: f5 LitI4: 0x2d0 720 (....)
51BE0A: aa AddI4
51BE0B: 71 FStR4 local_0090
51BE0E: 00 LargeBos
51BE10: 6c ILdRf local_008C
51BE13: f5 LitI4: 0x438 1080 (...8)
51BE18: aa AddI4
51BE19: 71 FStR4 local_0090
51BE1C: 1e Branch: 51c31c
51BE1F: 00 LargeBos
51BE21: 6b FLdI2 local_00B6
51BE24: f4 LitI2_Byte: 0x5 5 (.)
51BE26: c6 EqI2 ＝＝＞是否等5
51BE27: 1c BranchF: 51BE5F＝不则跳
51BE2A: 00 LargeBos
51BE2C: 6c ILdRf local_008C
51BE2F: 71 FStR4 local_0090
51BE32: 00 LargeBos
51BE34: 6c ILdRf local_008C
51BE37: f5 LitI4: 0x168 360 (...h)
51BE3C: aa AddI4
51BE3D: 71 FStR4 local_0090
51BE40: 00 LargeBos
51BE42: 6c ILdRf local_008C
51BE45: f5 LitI4: 0x2d0 720 (....)
51BE4A: aa AddI4
51BE4B: 71 FStR4 local_0090
51BE4E: 00 LargeBos
51BE50: 6c ILdRf local_008C
51BE53: f5 LitI4: 0x438 1080 (...8)
51BE58: aa AddI4
51BE59: 71 FStR4 local_0090
51BE5C: 1e Branch: 51c31c
51BE5F: 00 LargeBos
51BE61: 6b FLdI2 local_00B6
51BE64: f4 LitI2_Byte: 0x6 6 (.)
51BE66: c6 EqI2 ＝＞等于6吗
51BE67: 1c BranchF: 51BE9F＝＞否则跳
51BE6A: 00 LargeBos
51BE6C: 6c ILdRf local_008C
51BE6F: 71 FStR4 local_0090
51BE72: 00 LargeBos
51BE74: 6c ILdRf local_008C
51BE77: f5 LitI4: 0x168 360 (...h)
51BE7C: aa AddI4
51BE7D: 71 FStR4 local_0090
51BE80: 00 LargeBos
51BE82: 6c ILdRf local_008C
51BE85: f5 LitI4: 0x2d0 720 (....)
51BE8A: aa AddI4
51BE8B: 71 FStR4 local_0090
51BE8E: 00 LargeBos
51BE90: 6c ILdRf local_008C
51BE93: f5 LitI4: 0x438 1080 (...8)
51BE98: aa AddI4
51BE99: 71 FStR4 local_0090
51BE9C: 1e Branch: 51c31c
51BE9F: 00 LargeBos
51BEA1: 6b FLdI2 local_00B6
51BEA4: f4 LitI2_Byte: 0x7 7 (.)
51BEA6: c6 EqI2 ＝＞7呢
51BEA7: 1c BranchF: 51BEDF＝＞跳
51BEAA: 00 LargeBos
51BEAC: 6c ILdRf local_008C
51BEAF: 71 FStR4 local_0090
51BEB2: 00 LargeBos
51BEB4: 6c ILdRf local_008C
51BEB7: f5 LitI4: 0x168 360 (...h)
51BEBC: aa AddI4
51BEBD: 71 FStR4 local_0090
51BEC0: 00 LargeBos
51BEC2: 6c ILdRf local_008C
51BEC5: f5 LitI4: 0x2d0 720 (....)
51BECA: aa AddI4
51BECB: 71 FStR4 local_0090
51BECE: 00 LargeBos
51BED0: 6c ILdRf local_008C
51BED3: f5 LitI4: 0x438 1080 (...8)
51BED8: aa AddI4
51BED9: 71 FStR4 local_0090
51BEDC: 1e Branch: 51c31c
51BEDF: 00 LargeBos
51BEE1: 6b FLdI2 local_00B6
51BEE4: f4 LitI2_Byte: 0x8 8 (.)
51BEE6: c6 EqI2 ＝＞8呢
51BEE7: 1c BranchF: 51BF1F
51BEEA: 00 LargeBos
51BEEC: 6c ILdRf local_008C
51BEEF: 71 FStR4 local_0090
51BEF2: 00 LargeBos
51BEF4: 6c ILdRf local_008C=>为bb8
51BEF7: f5 LitI4: 0x168 360 (...h)＝＞装入360
51BEFC: aa AddI4 =>相加
51BEFD: 71 FStR4 local_0090
51BF00: 00 LargeBos
51BF02: 6c ILdRf local_008C
51BF05: f5 LitI4: 0x2d0 720 (....)
51BF0A: aa AddI4
51BF0B: 71 FStR4 local_0090
51BF0E: 00 LargeBos
51BF10: 6c ILdRf local_008C
51BF13: f5 LitI4: 0x438 1080 (...8)
51BF18: aa AddI4
51BF19: 71 FStR4 local_0090
51BF1C: 1e Branch: 51c31c＝＞jmp 51c31c
51BF1F: 00 LargeBos
51BF21: 6b FLdI2 local_00B6
51BF24: f4 LitI2_Byte: 0x9 9 (.)
51BF26: c6 EqI2
51BF27: 1c BranchF: 51BF5F
51BF2A: 00 LargeBos
51BF2C: 6c ILdRf local_008C
51BF2F: 71 FStR4 local_0090
51BF32: 00 LargeBos
51BF34: 6c ILdRf local_008C
51BF37: f5 LitI4: 0x168 360 (...h)
..........
........
51C25F: 00 LargeBos
51C261: 6b FLdI2 local_00B6
51C264: f4 LitI2_Byte: 0x16 22 (.)
51C266: c6 EqI2
51C267: 1c BranchF: 51C29F
51C26A: 00 LargeBos
51C26C: 6c ILdRf local_008C
51C26F: 71 FStR4 local_0090
51C272: 00 LargeBos
51C274: 6c ILdRf local_008C
51C277: f5 LitI4: 0x168 360 (...h)
51C27C: aa AddI4
51C27D: 71 FStR4 local_0090
51C280: 00 LargeBos
51C282: 6c ILdRf local_008C
51C285: f5 LitI4: 0x2d0 720 (....)
51C28A: aa AddI4
51C28B: 71 FStR4 local_0090
51C28E: 00 LargeBos
51C290: 6c ILdRf local_008C
51C293: f5 LitI4: 0x438 1080 (...8)
51C298: aa AddI4
51C299: 71 FStR4 local_0090
51C29C: 1e Branch: 51c31c
51C29F: 00 LargeBos
51C2A1: 6b FLdI2 local_00B6
51C2A4: f4 LitI2_Byte: 0x17 23 (.)
51C2A6: c6 EqI2
51C2A7: 1c BranchF: 51C2DF
以上为注册码的长度－1，然后与1－23间的值比较，不知有何用，
51C2AA: 00 LargeBos
51C2AC: 6c ILdRf local_008C
51C2AF: 71 FStR4 local_0090
51C2B2: 00 LargeBos
51C2B4: 6c ILdRf local_008C
51C2B7: f5 LitI4: 0x168 360 (...h)
51C2BC: aa AddI4
51C2BD: 71 FStR4 local_0090
51C2C0: 00 LargeBos
51C2C2: 6c ILdRf local_008C
51C2C5: f5 LitI4: 0x2d0 720 (....)
51C2CA: aa AddI4
51C2CB: 71 FStR4 local_0090
51C2CE: 00 LargeBos
51C2D0: 6c ILdRf local_008C
51C2D3: f5 LitI4: 0x438 1080 (...8)
51C2D8: aa AddI4
51C2D9: 71 FStR4 local_0090
51C2DC: 1e Branch: 51c31c
51C2DF: 00 LargeBos
51C2E1: 6b FLdI2 local_00B6
51C2E4: f4 LitI2_Byte: 0x18 24 (.)
51C2E6: c6 EqI2
51C2E7: 1c BranchF: 51C31C
51C2EA: 00 LargeBos
51C2EC: 6c ILdRf local_008C
51C2EF: 71 FStR4 local_0090
51C2F2: 00 LargeBos
51C2F4: 6c ILdRf local_008C
51C2F7: f5 LitI4: 0x168 360 (...h)
51C2FC: aa AddI4
51C2FD: 71 FStR4 local_0090
51C300: 00 LargeBos
51C302: 6c ILdRf local_008C
51C305: f5 LitI4: 0x2d0 720 (....)
51C30A: aa AddI4
51C30B: 71 FStR4 local_0090
51C30E: 00 LargeBos
51C310: 6c ILdRf local_008C
51C313: f5 LitI4: 0x438 1080 (...8)
51C318: aa AddI4
51C319: 71 FStR4 local_0090
51C31C: 00 LargeBos
51C31E: 00 LargeBos
51C320: 04 FLdRfVar local_00D0
51C323: 21 FLdPrThis
51C324: 0f VCallAd menu＝＝＞取text5框中的句柄
51C327: 19 FStAdFunc local_00CC＝＞取得的内容放入到指针中
51C32A: 08 FLdPr local_00CC ＝＞地址内容
51C32D: 0d VCallHresult get__ipropMDIWINDOWMENU
51C332: 6c ILdRf local_00D0＝＞取得text5中的内容，此为41093315
51C335: 50 CI4Str
51C336: f5 LitI4: 0x3fe 1022 (....)＝＞取3fe
51C33B: c0 IDvI4 27308c3（十进制为41093315）除以3fe=9d10
51C33C: Lead0/fe CStrI4 =>转为十进制，此为40208
51C33E: 23 FStStrNoPop local_00D4＝＞保存
51C341: 0b ImpAdCallI2 ＝＞40208反倒即为80204
51C346: 46 CVarStr local_00B0
51C349: Lead1/f6 FStVar
51C34D: 32 FFreeStr
51C354: 1a FFree1Ad local_00CC
51C357: 00 LargeBos
51C359: 04 FLdRfVar local_00D0
51C35C: 21 FLdPrThis
51C35D: 0f VCallAd menu
51C360: 19 FStAdFunc local_00CC
51C363: 08 FLdPr local_00CC
51C366: 0d VCallHresult get__ipropMDIWINDOWMENU
51C36B: 04 FLdRfVar local_00D4
51C36E: 21 FLdPrThis
51C36F: 0f VCallAd menu
51C372: 19 FStAdFunc local_00D8
51C375: 08 FLdPr local_00D8
51C378: 0d VCallHresult get__ipropMDIWINDOWMENU
51C37D: 6c ILdRf local_00D4==>再次取得41093315
51C380: 50 CI4Str
51C381: f5 LitI4: 0x3fe 1022 (....)
51C386: c0 IDvI4 =>41093315除以1022＝
51C387: Lead0/fe CStrI4
51C389: 23 FStStrNoPop local_00DC
51C38C: 0b ImpAdCallI2
51C391: 23 FStStrNoPop local_00E0
51C394: 4a FnLenStr ＝＞取得长度，为5
51C395: 3e FLdZeroAd local_00D0
51C398: 46 CVarStr local_00B0＝＞取得输入的注册码
51C39B: 04 FLdRfVar local_00F0
51C39E: 0a ImpAdCallFPR4: ＝＞取得注册码左边5位数
51C3A3: 04 FLdRfVar local_00F0
51C3A6: 04 FLdRfVar local_00F8
51C3A9: 21 FLdPrThis
51C3AA: 0f VCallAd menu
51C3AD: 19 FStAdFunc local_00F4
51C3B0: 08 FLdPr local_00F4
51C3B3: 0d VCallHresult get__ipropMDIWINDOWMENU
51C3B8: 6c ILdRf local_00F8
51C3BB: 50 CI4Str
51C3BC: f5 LitI4: 0x3fe 1022 (....)
51C3C1: c0 IDvI4
51C3C2: Lead0/fe CStrI4
51C3C4: 23 FStStrNoPop local_00FC
51C3C7: 0b ImpAdCallI2
51C3CC: 46 CVarStr local_010C
51C3CF: 5d HardType
51C3D0: Lead0/33 EqVarBool
51C3D2: 32 FFreeStr
51C3DF: 29 FFreeAd:
51C3E8: 36 FFreeVar
51C3F1: 1c BranchF: 51D0C5＝＞是否跳出错地方
51C3F4: 00 LargeBos
51C3F6: f5 LitI4: 0x7530 30000 (..u0)
51C3FB: 71 FStR4 local_008C
......(省略).........
51CA38: 21 FLdPrThis
51CA39: 0f VCallAd menu
51CA3C: 19 FStAdFunc local_00CC
51CA3F: 08 FLdPr local_00CC
51CA42: 0d VCallHresult get__ipropMDIWINDOWMENU
51CA47: 6c ILdRf local_00D0＝＞取得注册码
51CA4A: 0b ImpAdCallI2 ＝＞注册码串反倒
51CA4F: 23 FStStrNoPop local_00D4
51CA52: 1b LitStr: wbregfilename
51CA55: 1b LitStr: wbregfile
51CA58: 1b LitStr: wbreg
51CA5B: 0a ImpAdCallFPR4: 衊帬＝＞写入到注册表中
51CA60: 32 FFreeStr
51CA67: 1a FFree1Ad local_00CC
51CA6A: 00 LargeBos
51CA6C: 27 LitVar_Missing
51CA6F: 27 LitVar_Missing
51CA72: 3a LitVarStr: ( local_0130 )
51CA77: 4e FStVarCopyObj local_00F0
51CA7A: 04 FLdRfVar local_00F0
51CA7D: f5 LitI4: 0x40 64 (...@)
51CA82: 3a LitVarStr: ( local_00A0 )
51CA87: 4e FStVarCopyObj local_00B0
51CA8A: 04 FLdRfVar local_00B0
51CA8D: 0a ImpAdCallFPR4: ＝＞注册成功标志框
51CA92: 36 FFreeVar
51CA9D: 00 LargeBos
51CA9F: 27 LitVar_Missing
51CAA2: 0a ImpAdCallFPR4:
51CAA7: 73 FStFPR4
51CAAA: f4 LitI2_Byte: 0x18 24 (.)
51CAAC: eb CR8I2
51CAAD: 6e FLdFPR4
........(省略)..........
51D0AC: f5 LitI4: 0x2d0 720 (....)
51D0B1: aa AddI4
51D0B2: 71 FStR4 local_0090
51D0B5: 00 LargeBos
51D0B7: 6c ILdRf local_008C
51D0BA: f5 LitI4: 0x438 1080 (...8)
51D0BF: aa AddI4
51D0C0: 71 FStR4 local_0090
51D0C3: 00 LargeBos
51D0C5: 00 LargeBos
51D0C7: 00 LargeBos
51D0C9: 21 FLdPrThis
51D0CA: 0f VCallAd menu
51D0CD: 19 FStAdFunc local_00CC
51D0D0: 08 FLdPr local_00CC
51D0D3: 0d VCallHresult
51D0D8: 1a FFree1Ad local_00CC
51D0DB: 00 LargeBos
51D0DD: 13 ExitProcHresult ＝＞注册码不正确则直接跳出
此外还还一个暗桩：
用rclmsg下断，代码如下：
Proc: 50598c
5058D0: f5 LitI4: 0x1 1 (....)
5058D5: 3a LitVarStr: ( local_0094 ) 110
5058DA: 25 PopAdLdVar
5058DB: 1b LitStr: wbregfilename
5058DE: 1b LitStr: wbregfile
5058E1: 1b LitStr: wbreg
5058E4: 0b ImpAdCallI2 衊帬＝＝＝＝＞从注册表中读取注册码
5058E9: 23 FStStrNoPop local_0098
5058EC: 0b ImpAdCallI2
5058F1: 23 FStStrNoPop local_00D0
5058F4: 05 ImpAdLdRf: 526030
5058F7: 28 LitVarI2: ( local_00A8 ) 0x3fe (1022)
5058FC: Lead0/ac IDvVar
505900: Lead1/4b FnCStrVar
505902: 23 FStStrNoPop local_00BC
505905: 0b ImpAdCallI2
50590A: 23 FStStrNoPop local_00C4
50590D: 76 ImpAdLdI4
505910: 50 CI4Str
505911: f5 LitI4: 0x7 7 (....)
505916: c0 IDvI4 ＝＞值除以7
505917: Lead0/fe CStrI4
505919: 23 FStStrNoPop local_00C0
50591C: 0b ImpAdCallI2 ＝＞反转为注册码
505921: 23 FStStrNoPop local_00C8
505924: 2a ConcatStr
505925: 23 FStStrNoPop local_00CC
505928: f5 LitI4: 0x1 1 (....)
50592D: Lead3/fd FnInStr4
50592F: f5 LitI4: 0x1 1 (....)
505934: d1 LtI4
505935: 32 FFreeStr
505946: 1c BranchF: 505988
505949: 04 FLdRfVar local_0098
50594C: f5 LitI4: 0xd3 211 (....)
505951: 05 ImpAdLdRf: 5267dc
505954: 24 NewIfNullPr 40bfe4
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
注册码总结，共为8位，分两部分，左边5位，及右边3位，在输入时先检验左边的5位，如正确则存 注册表中，在运行时，从注册表中取得右边3位进行检验。
左边5位注册码：
走到51c33e时会产生40208，反过来就是注册码左边5位了，即为：08021
右边3位注册码：
走到50591C处会得到。
总结：
机器码：818314132231985
注册码：08021716
注册信息保存在：
[HKEY_CURRENT_USER\Software\VB and VBA Program Settings\wbreg\wbregfile]
"wbregfilename"="61712080"
cracked by lordor[BCG]
本文来源：http://www.hzclsc.cn/ruanjianzixun/20089.html