IDM 6.25 build 21破解笔记
0044652D - 0F87 3B020090 ja 9044676E 强改这里！
下面是活路
004469FF . /0F85 1C050000 jnz build21_.00446F21
0045860C . 50 push eax ; 全F2
0045860D . E8 7D171900 call build21_.005E9D8F ; 全F2
00458612 . 8B40 1C mov eax,dword ptr ds:[eax+0x1C] ; 全F2
00458615 . 8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]
0045861B . 6A 30 push 0x30 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL
0045861D . 8D95 54FEFFFF lea edx,dword ptr ss:[ebp-0x1AC] ; |
00458623 . 51 push ecx ; |Title = "Internet Download Manager"
00458624 . 52 push edx ; |Text = "Internet Download Manager has been registered with a fake Serial Number. Be aware that the cracked product may work incorrectly and download files with errors. Thus we advise you to purchase the full-featured product."
00458625 . 50 push eax ; |hOwner = 00010010 (class='#32769')
00458626 . FF15 F4C76100 call dword ptr ds:[<&USER32.MessageBoxA>>; \MessageBoxA
0045862C . 8B4B 1C mov ecx,dword ptr ds:[ebx+0x1C] ; build21_.004A017E
0045862F . 56 push esi ; /lParam = 0x0
00458630 . 68 70140000 push 0x1470 ; |wParam = 0x1470
00458635 . 68 11010000 push 0x111 ; |Message = WM_COMMAND
0045863A . 51 push ecx ; |hWnd = 0xBCE274
0045863B . FF15 C0C76100 call dword ptr ds:[<&USER32.PostMessageA>; \PostMessageA
由IDA中看到的 0044FE4F . BF 00276B00 mov edi,build21_.006B2700 ; 506938841
00451ACB /E9 BA020000 jmp build21_.00451D8A（改后的）
00451DED > \B9 0D000000 mov ecx,0xD
00451DF2 . 33C0 xor eax,eax
00451DF4 . 8D7D 88 lea edi,dword ptr ss:[ebp-0x78]
00451DF7 . 8D75 88 lea esi,dword ptr ss:[ebp-0x78]
00451DFA . F3:AB rep stos dword ptr es:[edi]
00451DFC . 8BFA mov edi,edx
00451DFE . 83C9 FF or ecx,-0x1
00451E01 . F2:AE repne scas byte ptr es:[edi]
00451E03 . F7D1 not ecx
00451E05 . 2BF9 sub edi,ecx
00451E07 . 8975 08 mov dword ptr ss:[ebp+0x8],esi 这里看到了一个注册码
00451F11 . /75 13 jnz short build21_.00451F26 ; 这里未知，但在一通注册码之后的
===================================================
之后去死
0044CF2B .^\7C F0 jl short IDMan.0044CF1D
0044CF2D > 8B4C24 74 mov ecx,dword ptr ss:[esp+0x74]
0044CF31 . 8B15 C4CA6D00 mov edx,dword ptr ds:[0x6DCAC4]
0044CF37 . 8D4424 78 lea eax,dword ptr ss:[esp+0x78]
0044CF3B . 68 30100400 push 0x41030 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_SYSTEMMODAL|40000
0044CF40 . 50 push eax ; |Title = 00000001 ???
0044CF41 . 51 push ecx ; |Text = NULL
0044CF42 . 52 push edx ; |hOwner = NULL
0044CF43 . FF15 F4C76100 call dword ptr ds:[<&USER32.MessageBoxA>>; \MessageBoxA
==================
================
弄链接时的退出
004596C8 /0F87 4F030000 ja IDMan.00459A1D ; 1
004596CE . |0F84 18030000 je IDMan.004599EC ; 2
004596D4 . |8D87 63EBFFFF lea eax,dword ptr ds:[edi-0x149D] ; 3
004596DA . |83F8 08 cmp eax,0x8
004596DD . |0F87 42030000 ja IDMan.00459A25 ; 4
004596E3 . |FF2485 909C45>jmp dword ptr ds:[eax*4+0x459C90]
004596EA > |8B0D 80C96D00 mov ecx,dword ptr ds:[0x6DC980] ; Case 14A0 of switch 004537A8
004596F0 . |8D55 CC lea edx,dword ptr ss:[ebp-0x34]
004596F3 . |8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]
004596F9 . |52 push edx ; /pBufSize = 02A0B6FC
004596FA . |50 push eax ; |Buffer = IDMan.004534C3
004596FB . |56 push esi ; |pValueType = NULL
004596FC . |56 push esi ; |Reserved = NULL
004596FD . |68 14106B00 push IDMan.006B1014 ; |ValueName = "bVP9Ch"
00459702 . |51 push ecx ; |hKey = 0xBCE5E4
00459703 . |C745 CC 04000>mov dword ptr ss:[ebp-0x34],0x4 ; |
0045970A . |FF15 04C06100 call dword ptr ds:[<&ADVAPI32.RegQueryVa>; \RegQueryValueExA
00459710 . |85C0 test eax,eax ; IDMan.004534C3
====
====
假注册时的启动时的 退出
0044652D /E9 3C020000 jmp build21_.0044676E ; 能跳过 假注册码
005D52F3 |. E8 FFD9FFFF call build21_.005D2CF7 ; 好像这里 死逼退出