下載頁面：  http://www.skycn.com/soft/5977.html<;br>
【軟件限制】：NAG、功能限制<br>
【作者聲明】：初學Crack，只是感興趣，沒有其它目的。失誤之處敬請諸位大俠賜教！<br>
【破解工具】：Ollydbg1.09、PEiD、AspackDie、W32Dasm 9.0白金版<br>
————————————————————————————————— <br>
【過    程】：<br>
<br>
其實這個東東數(shù)10天前就做了，因為太忙，今天才把筆記整理出來，呵呵，作者也快升級了吧？<br>
順便看了一下同門的《英語音標大師 V1.02》，算法是一樣的，就沒必要寫了。^O^ ^O^<br>
easypad.exe 是ASPack 2.12殼，用AspackDie脫之。169K->732K。 VB 編寫。<br>
這個東東不算難，只是有些方面不好掌握。             ~Q~ ^Q^ ^v^ ^v^<br>
<br>
序列號：FLYN649065455613<br>
試煉碼：fly-12345678-fly[OCN][FCG]-E<br>
—————————————————————————————————<br>
* Reference To: MSVBVM60.rtcInputBox, Ord:0254h<br>
<br>
:004620D2 FF15FC104000            Call dword ptr [004010FC]<br>
:004620D8 8BD0                    mov edx, eax<br>
                                 ====>EDX=fly-12345678-fly[OCN][FCG]-E  試煉碼<br>
<br>
:004620DA 8D4DA8                  lea ecx, dword ptr [ebp-58]<br>
:004620DD FFD6                    call esi<br>
:004620DF 8BD0                    mov edx, eax<br>
:004620E1 8B8D78FEFFFF            mov ecx, dword ptr [ebp+FFFFFE78]<br>
<br>
* Reference To: MSVBVM60.__vbaStrCopy, Ord:0000h<br>
                                 |<br>
:004620E7 FF15D4124000            Call dword ptr [004012D4]<br>
:004620ED 8D55A4                  lea edx, dword ptr [ebp-5C]<br>
:004620F0 52                      push edx<br>
<br>
.............................................<br>
..............<br>
<br>
<br>
* Reference To: MSVBVM60.__vbaFreeVarList, Ord:0000h<br>
                                 |<br>
:00462161 FF1544104000            Call dword ptr [00401044]<br>
:00462167 83C45C                  add esp, 0000005C<br>
:0046216A 8B0B                    mov ecx, dword ptr [ebx]<br>
:0046216C 8D95C8FEFFFF            lea edx, dword ptr [ebp+FFFFFEC8]<br>
:00462172 52                      push edx<br>
:00462173 8B8578FEFFFF            mov eax, dword ptr [ebp+FFFFFE78]<br>
:00462179 50                      push eax<br>
:0046217A 53                      push ebx<br>
:0046217B FF9128070000            call dword ptr [ecx+00000728]<br>
                                 ====>關(guān)鍵CALL！進入！<br>
<br>
:00462181 85C0                    test eax, eax<br>
:00462183 7D12                    jge 00462197<br>
:00462185 6828070000              push 00000728<br>
:0046218A 688C574200              push 0042578C<br>
:0046218F 53                      push ebx<br>
:00462190 50                      push eax<br>
<br>
* Reference To: MSVBVM60.__vbaHresultCheckObj, Ord:0000h<br>
                                 |<br>
:00462191 FF15A4104000            Call dword ptr [004010A4]<br>
<br>
* Referenced by a (U)nconditional or (C)onditional Jump at Address:<br>
|:00462183(C)<br>
|<br>
:00462197 6683BDC8FEFFFF00        cmp word ptr [ebp+FFFFFEC8], 0000<br>
:0046219F 0F84C3030000            je 00462568<br>
                                 ====>跳則OVER！<br>
<br>
:004621A5 8D4D8C                  lea ecx, dword ptr [ebp-74]<br>
:004621A8 51                      push ecx<br>
<br>
* Reference To: MSVBVM60.rtcGetDateVar, Ord:0262h<br>
                                 |<br>
:004621A9 FF1524134000            Call dword ptr [00401324]<br>
:004621AF 6A00                    push 00000000<br>
:004621B1 8D558C                  lea edx, dword ptr [ebp-74]<br>
:004621B4 52                      push edx<br>
:004621B5 8D857CFFFFFF            lea eax, dword ptr [ebp+FFFFFF7C]<br>
:004621BB 50                      push eax<br>
<br>
...................................<br>
.........................<br>
<br>
:004622C3 8D856CFFFFFF            lea eax, dword ptr [ebp+FFFFFF6C]<br>
:004622C9 50                      push eax<br>
:004622CA 8D8D7CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF7C]<br>
:004622D0 51                      push ecx<br>
:004622D1 8D558C                  lea edx, dword ptr [ebp-74]<br>
:004622D4 52                      push edx<br>
<br>
* Reference To: MSVBVM60.rtcInputBox, Ord:0254h<br>
                                 |<br>
:004622D5 FF15FC104000            Call dword ptr [004010FC]<br>
                                 ====>恭喜完成！輸入確認號碼！7055<br>
<br>
:004622DB 8BD0                    mov edx, eax<br>
                                 ====>EDX=7055<br>
<br>
:004622DD 8D4DC8                  lea ecx, dword ptr [ebp-38]<br>
:004622E0 FFD6                    call esi<br>
:004622E2 50                      push eax<br>
<br>
* Reference To: MSVBVM60.__vbaR8Str, Ord:0000h<br>
                                 |<br>
:004622E3 FF15C0124000            Call dword ptr [004012C0]<br>
:004622E9 DB437C                  fild dword ptr [ebx+7C]<br>
:004622EC DD9D70FEFFFF            fstp qword ptr [ebp+FFFFFE70]<br>
:004622F2 DC9D70FEFFFF            fcomp qword ptr [ebp+FFFFFE70]<br>
                                 ====>比較 確認號碼 是否是7055？<br>
<br>
:004622F8 DFE0                    fstsw ax<br>
:004622FA F6C440                  test ah, 40<br>
:004622FD 7407                    je 00462306<br>
:004622FF B801000000              mov eax, 00000001<br>
:00462304 EB02                    jmp 00462308<br>
<br>
* Referenced by a (U)nconditional or (C)onditional Jump at Address:<br>
|:004622FD(C)<br>
|<br>
:00462306 33C0                    xor eax, eax<br>
<br>
* Referenced by a (U)nconditional or (C)onditional Jump at Address:<br>
|:00462304(U)<br>
|<br>
:00462308 F7D8                    neg eax<br>
:0046230A 668BF0                  mov si, ax<br>
:0046230D 8D45C8                  lea eax, dword ptr [ebp-38]<br>
:00462310 50                      push eax<br>
:00462311 8D4DCC                  lea ecx, dword ptr [ebp-34]<br>
:00462314 51                      push ecx<br>
:00462315 6A02                    push 00000002<br>
<br>
* Reference To: MSVBVM60.__vbaFreeStrList, Ord:0000h<br>
                                 |<br>
:00462317 FF15E4124000            Call dword ptr [004012E4]<br>
:0046231D 8D952CFFFFFF            lea edx, dword ptr [ebp+FFFFFF2C]<br>
:00462323 52                      push edx<br>
:00462324 8D853CFFFFFF            lea eax, dword ptr [ebp+FFFFFF3C]<br>
:0046232A 50                      push eax<br>
:0046232B 8D8D4CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF4C]<br>
:00462331 51                      push ecx<br>
:00462332 8D955CFFFFFF            lea edx, dword ptr [ebp+FFFFFF5C]<br>
:00462338 52                      push edx<br>
:00462339 8D856CFFFFFF            lea eax, dword ptr [ebp+FFFFFF6C]<br>
:0046233F 50                      push eax<br>
:00462340 8D8D7CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF7C]<br>
:00462346 51                      push ecx<br>
:00462347 8D558C                  lea edx, dword ptr [ebp-74]<br>
:0046234A 52                      push edx<br>
:0046234B 6A07                    push 00000007<br>
<br>
* Reference To: MSVBVM60.__vbaFreeVarList, Ord:0000h<br>
                                 |<br>
:0046234D FF1544104000            Call dword ptr [00401044]<br>
:00462353 83C42C                  add esp, 0000002C<br>
:00462356 6685F6                  test si, si<br>
:00462359 0F8409020000            je 00462568<br>
:0046235F 8B8578FEFFFF            mov eax, dword ptr [ebp+FFFFFE78]<br>
:00462365 8B08                    mov ecx, dword ptr [eax]<br>
:00462367 51                      push ecx<br>
<br>
* Possible StringData Ref from Code Obj ->"rregnumber"<br>
                                 |<br>
:00462368 6870684200              push 00426870<br>
<br>
* Possible StringData Ref from Code Obj ->"rregist"<br>
                                 |<br>
:0046236D 685C684200              push 0042685C<br>
<br>
* Possible StringData Ref from Code Obj ->"eeasypad"<br>
                                 |<br>
:00462372 68E8634200              push 004263E8<br>
<br>
* Reference To: MSVBVM60.rtcSaveSetting, Ord:02B2h<br>
                                 |<br>
:00462377 FF150C104000            Call dword ptr [0040100C]<br>
                                 ====>保存注冊信息！<br>
<br>
:0046237D E9E6010000              jmp 00462568<br>
<br>
<br>
—————————————————————————————————<br>
進入關(guān)鍵CALL：0046217B  call dword ptr [ecx+00000728]<br>
<br>
…… ……省略…… ……<br>
<br>
:004724A8 FFD3                    call ebx<br>
:004724AA 50                      push eax<br>
<br>
* Possible StringData Ref from Code Obj ->"CC:\"<br>
                                 |<br>
:004724AB 68A4974200              push 004297A4<br>
:004724B0 8D45CC                  lea eax, dword ptr [ebp-34]<br>
:004724B3 50                      push eax<br>
:004724B4 FFD3                    call ebx<br>
:004724B6 50                      push eax<br>
:004724B7 E8EC30FBFF              call 004255A8<br>
<br>
* Reference To: MSVBVM60.__vbaSetSystemError, Ord:0000h<br>
                                 |<br>
:004724BC FF1598104000            Call dword ptr [00401098]<br>
:004724C2 8B4DC8                  mov ecx, dword ptr [ebp-38]<br>
<br>
* Reference To: MSVBVM60.__vbaStrToUnicode, Ord:0000h<br>
                                 |<br>
:004724C5 8B1D38124000            mov ebx, dword ptr [00401238]<br>
:004724CB 51                      push ecx<br>
:004724CC 8D55C4                  lea edx, dword ptr [ebp-3C]<br>
:004724CF 52                      push edx<br>
:004724D0 FFD3                    call ebx<br>
:004724D2 50                      push eax<br>
:004724D3 8B45DC                  mov eax, dword ptr [ebp-24]<br>
:004724D6 50                      push eax<br>
:004724D7 57                      push edi<br>
<br>
* Reference To: MSVBVM60.__vbaLsetFixstr, Ord:0000h<br>
                                 |<br>
:004724D8 FF1594104000            Call dword ptr [00401094]<br>
:004724DE 8B4DC0                  mov ecx, dword ptr [ebp-40]<br>
:004724E1 51                      push ecx<br>
:004724E2 8D55BC                  lea edx, dword ptr [ebp-44]<br>
:004724E5 52                      push edx<br>
:004724E6 FFD3                    call ebx<br>
:004724E8 50                      push eax<br>
:004724E9 8B45D8                  mov eax, dword ptr [ebp-28]<br>
:004724EC 50                      push eax<br>
:004724ED 57                      push edi<br>
<br>
* Reference To: MSVBVM60.__vbaLsetFixstr, Ord:0000h<br>
                                 |<br>
:004724EE FF1594104000            Call dword ptr [00401094]<br>
:004724F4 8D4DBC                  lea ecx, dword ptr [ebp-44]<br>
:004724F7 51                      push ecx<br>
:004724F8 8D55C0                  lea edx, dword ptr [ebp-40]<br>
:004724FB 52                      push edx<br>
:004724FC 8D45C4                  lea eax, dword ptr [ebp-3C]<br>
:004724FF 50                      push eax<br>
:00472500 8D4DC8                  lea ecx, dword ptr [ebp-38]<br>
:00472503 51                      push ecx<br>
:00472504 8D55CC                  lea edx, dword ptr [ebp-34]<br>
:00472507 52                      push edx<br>
:00472508 6A05                    push 00000005<br>
<br>
* Reference To: MSVBVM60.__vbaFreeStrList, Ord:0000h<br>
                                 |<br>
:0047250A FF15E4124000            Call dword ptr [004012E4]<br>
:00472510 8B5D0C                  mov ebx, dword ptr [ebp+0C]<br>
:00472513 8B03                    mov eax, dword ptr [ebx]<br>
                                 ====>EAX=fly-12345678-fly[OCN][FCG]-E  試煉碼<br>
<br>
:00472515 83C418                  add esp, 00000018<br>
:00472518 6A01                    push 00000001<br>
:0047251A 6AFF                    push FFFFFFFF<br>
:0047251C 6A01                    push 00000001<br>
:0047251E 68D0654200              push 004265D0<br>
:00472523 68CC754200              push 004275CC<br>
:00472528 50                      push eax<br>
<br>
* Reference To: MSVBVM60.rtcReplace, Ord:02C8h<br>
                                 |<br>
:00472529 FF152C124000            Call dword ptr [0040122C]<br>
                                 ====>去除試煉碼中的-<br>
<br>
:0047252F 8BD0                    mov edx, eax<br>
                                 ====>EDX=fly12345678fly[OCN][FCG]E          <br>
<br>
:00472531 8D4DD4                  lea ecx, dword ptr [ebp-2C]<br>
<br>
* Reference To: MSVBVM60.__vbaStrMove, Ord:0000h<br>
                                 |<br>
:00472534 FF1578134000            Call dword ptr [00401378]<br>
:0047253A 8B0B            &