acoustica2.25的破解(1)

破解人：chp1[dfcg][fcg]
工具：trw,w32dsm
软件未加壳，用w32dsm反汇编后,寻找字符： "Your license has been registered.  Thank you for purchasing "

:0044BD5B E8A42C0200              call 0046EA04
:0044BD60 83C408                  add esp, 00000008
:0044BD63 8B85B4FCFFFF            mov eax, dword ptr [ebp+FFFFFCB4]
:0044BD69 8168FC6AFFFFFF          sub dword ptr [eax-04], FFFFFF6A
:0044BD70 83ADA8FCFFFF02          sub dword ptr [ebp+FFFFFCA8], 00000002
:0044BD77 6A00                    push 00000000
:0044BD79 8D95D9FCFFFF            lea edx, dword ptr [ebp+FFFFFCD9]
:0044BD7F 52                      push edx
:0044BD80 E8469B0100              call 004658CB
:0044BD85 8B8DB4FCFFFF            mov ecx, dword ptr [ebp+FFFFFCB4]
:0044BD8B 83C408                  add esp, 00000008
:0044BD8E 8D85D1FCFFFF            lea eax, dword ptr [ebp+FFFFFCD1]
:0044BD94 8141FC6AFFFFFF          add dword ptr [ecx-04], FFFFFF6A
:0044BD9B FF8DA8FCFFFF            dec dword ptr [ebp+FFFFFCA8]
:0044BDA1 6A00                    push 00000000
:0044BDA3 50                      push eax
:0044BDA4 E8031B0300              call 0047D8AC
:0044BDA9 83C408                  add esp, 00000008
:0044BDAC 5A                      pop edx
:0044BDAD 84D2                    test dl, dl
:0044BDAF 0F848F000000            je 0044BE44
:0044BDB5 57                      push edi
:0044BDB6 E875F3FFFF              call 0044B130　　　（关键）f8跟进
:0044BDBB 59                      pop ecx
:0044BDBC 84C0                    test al, al    a1<>0就注册成功
:0044BDBE 7444                    je 0044BE04　（跳转就game over)　　　
:0044BDC0 68C8000000              push 000000C8
:0044BDC5 8D8FB6000000            lea ecx, dword ptr [edi+000000B6]
:0044BDCB 51                      push ecx
* Possible Reference to String Resource ID=09140: "Your license has been registered.  Thank you for purchasing "
                                 |
:0044BDCC 68B4230000              push 000023B4
:0044BDD1 8D4704                  lea eax, dword ptr [edi+04]
:0044BDD4 50                      push eax
:0044BDD5 E87BB50200              call 00477355
:0044BDDA 83C410                  add esp, 00000010
:0044BDDD 8D97B6000000            lea edx, dword ptr [edi+000000B6]
:0044BDE3 8B4F66                  mov ecx, dword ptr [edi+66]
:0044BDE6 8B01                    mov eax, dword ptr [ecx]
:0044BDE8 6A00                    push 00000000

* Possible Reference to Dialog: 
                                 |
:0044BDEA 6838FE4900              push 0049FE38
:0044BDEF 52                      push edx
:0044BDF0 8B500C                  mov edx, dword ptr [eax+0C]
:0044BDF3 52                      push edx
:0044BDF4 8B4868                  mov ecx, dword ptr [eax+68]
:0044BDF7 51                      push ecx
:0044BDF8 E8B9D60100              call 004694B6
:0044BDFD 83C414                  add esp, 00000014
:0044BE00 33DB                    xor ebx, ebx
:0044BE02 EB40                    jmp 0044BE44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BDBE(C)
|
:0044BE04 68C8000000              push 000000C8　　　（跳转到这里就完了）
:0044BE09 8DB7B6000000            lea esi, dword ptr [edi+000000B6]
:0044BE0F 56                      push esi

* Possible Reference to String Resource ID=09141: "The key code does not match the license owner."
                                 |
:0044BE10 68B5230000              push 000023B5
:0044BE15 8D4704                  lea eax, dword ptr [edi+04]
:0044BE18 50                      push eax
:0044BE19 E837B50200              call 00477355
:0044BE1E 83C410                  add esp, 00000010
:0044BE21 8BD6                    mov edx, esi
:0044BE23 8B4F66                  mov ecx, dword ptr [edi+66]
:0044BE26 8B01                    mov eax, dword ptr [ecx]
:0044BE28 6A00                    push 00000000

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－