28日赛况-dac28号赛程
我的摩托罗拉ME811的MEID是 A0000022DAC3CE 3 麻烦给看一下，谢谢了！
手机型号 : ME811(Droid X) 纠错 品牌 : 摩托罗拉
IMEI : A0000022DAC3CE3 生产日期 : 2011年06月01日
MSN : K566QL2QR8 交货日期 : 2011年06月29日
TMN : CHWG2972BC 保修截止 : 2012年09月28日
客户型号 : AP106801325A 保修状态 : 在保修期内
维修次数 : 不提供 维修时间 : 不提供
生产地 : 天津 销售地 : 中国大陆
2013.03.31新买的苹果手机序列号是C3KK3DACDTC0大侠帮助我一下看看是什么时间激活的.
备信息
产品型号IPHONE 4S 16GB 黑色(可能是官翻机)
产品序列号(SN)C3KK3DACDTC0
出厂日期(参考)2013-01-22 ~ 2013-01-28
iOS版本6.0.1
保修信息
购买时间2012-07-29
过保时间2013-07-28
剩余保修时间115 天
保修状态有限保修
激活状态已激活
注册状态已注册
电话支持已过期
序 列 号：C7G C3K DYJ DQG C32 C31 C33开头为售后换机、官翻机
全新机子：购买激活 至 保修到期 是一年整
—————————————
近期购买是 翻新机
售后换机 维修后重置生产日期
激活时间比生产时间早
—————————————
版本手机——设置——通用——关于本机查看型号
最后两位
CH国行 ZP港版LL美版 KH韩版机 B英国版 C加拿大版
F法国版 J日本 Y为西班牙 DN德版 TA为台湾 FB为法国
型号的最后两位 只有自己在机子才能查到
—————————————
百度 搜索果粉查询 即可
点击 选为满意答案
请问哪位朋友，能提供个verycd的申请注册号？
VeryCD邀请~~~
您当前已经购买的注册序列号:
5CED8CFCD83344C0, C2D27989516D727A, 8CA67C1530C9D80B, D2DB7F23453C17C9, 278EB5A1184E78E8, BF52E7E6CB8AF08F, B79A84CD0E33B3FE, 4F15A178CDAC0B5A, E4B66FBA54110051, 052B5282D5A9D7F9, D80C0375F3203CE5, BA074CE13167CCF4, 4870075E5219D96A, 4B5D84D6DDB5B7E6, 428FAFE3777BF3BF, 3FBEE4A3595A7B23, A9B633632C706965, 6EA9ADCBF6B7DF38, C613643F6CD8EA40, CCA486615F797437, 46B3FE901892CADC, 0F0E7FD081A27991, 93E7ED4F2A410DFF, DD8C35E296756BFB, B6FB6AAB4CD420B3, 234A3D68CA39260E, 8A492763A94C5CBA, CEDDFF9AA2065674, EEB93CC3EB566B89, 74380B8A956274BF, 1B7330096B36648E, C8E5E4AEF47A6D9A, 3422A1735E1159ED, 1F6FE73631A315B9, F24369194B21EC22, 7DECD72B5B82A7A8, 643CD3216D958664, 69D369CD5E9D91F3, 9FA542DD52C20FD6, BB2E508EDF23B88F, AB9B6AF19AA9E4BC, 914FC007F492B469, B84200C7DC6347A9, FD8F34903B4B343C, A0373CB18B4793A8, 57908327F3A6FD68, 099129AE92C4164A, 68DF88A2D6660C79, 403F2850EBC1393D, 98C8E4D2DAB705E1, 1D72DE427788AA14, 24EB50303D455586, 603A7BA59121B674, ABB8AFAE6FB66023, 1404E0B3CB87607D, 9C316F15EE2861EC, C8F50ACE4F46C5F2, D50F00F83AB7EB14, CDB66EA9C3E12CF7, 6EF61F39CE3157A8, D3D620C3ABAC4032, EFC813132A62B5E9, CA6E26A0D013269E, B5B9B71D24C809C4, 2A60FEAEBA1CF876, 4FE580A3BA7A175A, 87441679D01C217F, DEAD1C184811C053, 3AE9CD8FB3C5C41D, 23F267AB50BB8685, CC27381C0E1784E9, FA2C7A3B2859299B, AC8D43EEABC66F36, 875C1DE7CAEF67B6, D7EAD9AC03D913EC, AFE39B085D074B51, 4C597C8B43968B1C, E9B84ABEA84E4155, 84F25095995AB45A, 42FBB628439268B3, DE823C57C65DFF18, 7061AC2C5A8F84B8, 2CC8A590A9E85F45, 60A6BD1185406D55, DD12AE7063272555, 026D4442B6E13F15, F7FCE07CFA651DEC, 0E716EB855F91BFA, 60B52EF7F5202319, 84894BCA6890686F, 959C2DDF7C3E2B8C, 5D56F37296994E19, 004BD16E026219AA, 675CEFEE42A1F268, 71EC8BA7BCFC5B46, AC0C608BBE65DBF2, BF6054D110DD19D5, B92A72A914AD74FA, 310A0ADF1D21821A, A8AD026C02571EED, 5B54E42555D73479, 770AB5CEB63726DB, F84070A1BA5DEEFA, 2850C97B536E0F49, FD86FC79007DF590, 40969CD76876531B, 057E846DBA0B762B, B6A40EDEF29B33B6, EB2C1FD876163859, 1428B9B377DE5E4E, 10BF939D33DFA117, 4273013D8D0EBC14, 1EFA946A49BE3940, 1A921346CCBF5D4A, 9E33A7FD34442104, 14711067A762D2DA, 565102AB89B4CBFE, CE66851A52327893, 902F7DD882ABFB2C, EA400CE5CC743A6C, 5E340B5ABFC1F9BD, 99F3D84D5E4F2BC2, 29DC870607DFA9C2, EF80A27806BDB6B8, 81ADC15A6F62B384, 2C9FB0FE9B5EBE85, E2A32C8C20DEBE98, 76D072AEBFDE5D65, 9DFCD7642DF7A80F, 6AF061A9DA64F275, D602AD2095F940D2, 29FA743EF811A100, 51E0AAEC78F93D06, 295860DB5F998535, 08DF1CE65E91DFAC, 9DE728292C991BA5, FB5F19DFB8A88941, 989607A2B5F9DC9A, ABEEA205577EFEF0, E2CA165408E0126A, 4B8187F3D765A58B, 78300F23D914BD32, A57A057B8AADC693, 58B460308DC84DC0, ABD501124AD41B07, AAED3982F5BF172A, 8CA2CA71C03992BE, 6DA3675AB72F2986, 4F6E7FAB9E21F4DB, C802D39CADF69A94, 0C06D4A644BACE70, D4322EA974C1E25A, A353A72839F39C41, 2FC5254368E56B2B, D4D1A7A8908750EF, 763F59ACEDF9370A, A835740048081DA0, 3A6AA44BA3579B64, 1BB6C96C072892BF, 0128C4F926AD8AF3, 6CDABF583F709E18, E5DB36E69F331911, FE4A2B40642D363E, E2D74592C9D2F7AF, 124CD8A218D5296B, 65C69C16A22617C8, C29D388E7515AA38, FB7C70A58E2DF1E6, 24B04EBBAC41C23B, 57AD28346420EB22, DC6698E7E1CC3EC1, 624F1F4A14EA413D, 433D044618BDEC73, 12A81A4F8AE2AE63, 134D16B4F76072C7, 925604AC2E115ED8, 1CC299A95EC120A2, 956FA8DEA8B90DE4, 4F7B65FFF993030A, 08BAB30E709F58B9, 028867FBA2639DAF, FC8882DEAD453600, 6A8A2808E6F08766, 2D992858129533F9, FFDAAE6677BAEC25, 3B46021AE9048D84, 3B9E480EBC87C05A, 10C8E0A8EBA3C369, 1E17E6CDCA56E72F, 2F1D802E9CEA20FB, 767AA8768D6B4E30, 568F9408CDBD79BD, DCE9BCF8418F69F2, 75A0B675EC7F869E, CF453DB2E886E789, E333C8FA69549725, E7BE0F990A17A3E4, EC4B7556C2CE7B84, D1E5BA820A3D5F6C, 6AB6048E28A11230, 6676D1D5C12A0CC7, DFA506DF8CFFA9A0, BB1AA8216D2662CC, 11BFC4899B27DE01, F22C3A4A45C15C0C, 0804C92256B20EA4, 8FC3B8E616195202, EAB1707BFA4DC46A, 77C9B08DDD50AE02, 74D4E1F1BE3934DA, 9A31074F632C2F8E, 321D06FD7E0D637C, A898CE8C5A4610FD, 2C9A007C8583FEBB, CC30837182C01C1C, DD4AC2E4B6811F79, 5794CF9229275FDA, AFC655E1B795076E, C72407CF1E45E76A, 98B51AE7A06F336D, 942C90DEE9647679, 509849A854092141, 14FEAAC1426C83F2, 33208F92B3519737, 6F4BFC37DEF9EA0F, 9C79454E50128104, 7B790FFDC828E7C7, 11FBDC97F88FDFE6, EC982B7656FAFD8B, F31026C9E51C80B0, F2C547D4174E8E36, F0F584B8F0058EFF, 8B67DAF7B63D3B7E, C1F426B39F9B32AC, A4DAF5BF36ABF18B, D1047767E9A31EFB, AE02BFFC13FAE6F6, 33713BDD6927CD31, DED024A46735DDF0, 9AE825A74F959A24, A0997D02122056F5, 25A17C15E4B77EF5, 993B39C0E2E98C31, 88474092F044960A, 80B31B2DE92FFB97, 3B28BB3C3BFCCE4E, 381E2BA2906A5736, A1610B1A7052BEE4, 5707AEE1A9DC2650, 28E98FDDC2E3C2D8, DEBAC11AB58D5D75, 8434FDC2977C89E2, 7B3C3D282AE81863, 9DD90ABCCE93174D, 8FFF9AD1FA06A840, F384853FD9BCAE4B, 3CE442B430636ABF, 93E0BC888C814BA1, 9898D0BF60E016C3, AEFE06A6B66F340E, 375833B1C1E8E2E0, 7F0FFEEC4A7405A7, 2810C4AD4DBF94CF, B2AA3658420A4363, 5AC80573BFF0AB4E, ADF9673725892429, BC4A90858F410131, 3037A012C3E60199, D0BE068BA9F0ABE9, 37E2C6C23CC85FAC, FA3C5895FC6F6FE5, 5FABF00256EC8D90, 9D5FB154D72AD26E, 059D304173A70EB1, 3EC0BCBE3454CFFE, 2C8A6CC3A90846EA, 7684B42E7EEC66A4, 727BF31AEC3AF79E, EA1DEE05DE593D23, C98934883A6F39C4, 94FB766CA9E62BE4, 0F01CFFBB729A746, BA2F96FA564F485A, 0013985C36470B7F, BB9060DBFB56E750, 5D966457298FF3B6, E59A277A92A2AFC8, BBF3BAD00BCD55DC, DD4D0ED2427D9256, F7CDB7BE10E86E32, E08EC5F210465EB9, 41EC6D85D5F08C0D, A7FCB90D2C55CDDA, DE08BA3EBFA3C31F, B468B8C1AA89D203, 394EACD3B7353190, AC9DC10AC8D5FB45, EE888116AAAD9903, AC92BE3D7712BDCB, D63FBD53FF8C725B, 76413B888AC967AD, 2FE9400C4A43DF81, 803D0EC1723FE974, 0AA29C0D41A7E373, 025FE6F2567330A0, 036AD5D7E27F4D70, C3353D63D4E9F3B6, F46BC522A027CB05, FA6E89815FB5250F, 2973D8BC5F019122, 9FBA4B28239E623E, 145D96DCC775AF90, D123A4ED541A9C8F, 7AAB6EAABE4F40EB, BD12F4AAC3D51944, FCBA8857FD6C2F4F, 10ECF0EEAF912A17, 7AA5630820FC78B7, 0FC5AEB1ADB6AC26, 47138DAA3976BC4E, 4AF4F8A96EB7AB85, 84A08B2E0CFE7F61, 31AFBEF6D6B7DB8C, DC606936CBD5372E, 0452BE315F68BD59, 61AA061ED1D3F871, 6CD1447FC5041370, 9F4F67412D285947, F7200F4D2F818295, 0D78659107CEB47D, B028CC726011D136, C10A8121430E8AE8, 76B430791197F3D1, E54CACEF33899327, 61416F2443502FA9, EDDBDEA8AC733B99, 9E377A758375BBB2, 08F6D3258433D6F4, 2EE87A656F8ED083, 4B7D3F1F728DBC42, BA8E4B4B8D55EBFD, 17235F2DEC42A033, 5FDF3ABA5D6D661D, 5059C12F6D2499E3, 0A8378C88891AAAA, 43E268B5F6B3A8F0, 8164A14F0482BCD2, A6360D1AD4562108, 1AF69BA1B431EB2E, A33219FDECD6C29F, 6B75AAD45F56A65F, B252C9E1738FE768, D89252C46E1B60A6, 7FADCCFB9902AA00, 6E525797DB82BFB3, 9C6186A355E278D1, 1BC058F023930061, 803ACFA12160C664, 0650B1FBEB1BC21B, 232812BB15A74E6B, C7D9117DE1029967, 177A8922FD704311, E96AF44A976FF977, 0BED005EE2D98BFF, DE01E8704187F2C1, 0B08B7450FCD34B8, 5C815563869D26AD, 4C83D16EC88317C8, AF99236E655DFF20, D4256CE8D9A596B6, F6667ACF29710EBC, 82CAB89CB4749A64, 73C009662A2D7D34, 4EA50ED6377E42C8, AC8353D1C06E101A, 6266FC6F52D8B18F, FAB644FDA8CD2810, 3C1CE2A47A97E62A, D235632C15FC9D5D, 2DC67E09BBDF5D2F, 83DDB76A6CCDE4F3, 1BD76FA2AAA2CC3E, C08A82F1A5DF7AFF, C97212D7174FB4F7, F1CA81A40378660D, DBB99575CCC498D9, FCF2CA3BBB431E14, 4C4832F6AC01ACD4, E522562EFA2221F1, 79D99A0466F0E3DC, 46518D64CCB6C62F, 5B4839D52EE04A99, B7E2BD7BF44C5A15, 0BCB3C46F647D4BB, 173412F22867C7B2, EE48ECA6EC67BE83, 584417EBD592A56A, 6FC4C2055921229D, 9F7C7966BC433690, D7E5ACEF4AC0F812, 5E0C1B0B2EA190CB, 61C7A814C32D80BB, E2E269650BD45E7D, 5062D62EEF59EF67, E855F866B2249BFE, A4818D7B814020F7, 363E4C7B5F4894C4, ECA1BEF0E449CE73, 96469C427489EDF5, 644D434BA2CE337D, F7495ED17091BF77, 2AB5AB0358CED50D, 3921E8299C3E7F0D, 5D160A1ABD1FC3DC, 6CB5B18D35581874, 81501A7ACD3A91D8, 170AAEA41FDF560E, D2C4E0F69F30CADF, 486084331DCD782A, BD8F43C3AD867511, C079FD0380E5986E, 172E988126767220, 183E22A18E2C4516, 6E51B4D138CB1018, 1A70485E17818CFE, 77EE7D745633799A, F6C2066E6E841816, C446BB8076E2D8CA, CDA09C529A4ED4E0, 8476B53AAEAC16F8, 9B1C28DE83C7B4DF, 31B7D16A86546898, 971C0A4B5ED3B0CC, B5B0FE89EDEED21E, 5522F7FD653C4B4B, 233FEE194B686904, 33271954682A3574, 9AB4C5215EE2AD6D, EB3780C786E32966, 9A7D9931A1A354D8, 33CF3F058000D00E, A5D755B549E4397C, 7EB69200D92ADD6C, BDB05850774FBA55, F69368C9CFE66A96, 184609783338C342, EDD616A95AB11DED, 5066F7694A4EEDA6, 585B4435C90BA3A5, B4A3AD046C7F30BE, D92A15D12122468A, 81FAA29AE70FD831, 8984F06820BB264B, A75434A26D551CDB, 3B0DF83F76C6E4FE, A4AF48CA61C7FF85, 4EA88231FB38B2B6, 0F8304C924495C42, 0D9817A19C444225, 3ED1202BDFE9B1A1, 4686D1965A71C852, 64786DBC64178CBC, B7E94946F906A953, 45B001F3064308C3, 295059F074107BAF, 3C42FA6E52E6DB71, 3D04881A42EC1C63, AD314AC0BC07B246, 1EDC98C261B4F93B, A0298A482B631AD7, DD47C15465F27CD6, 855E25112758E46D, 7FB0EEC10D193B89, D3E12B45E71BFEC5, B0A7D31083F67BCC, 175159C17EA10A96, 9856A67E4D9F9061, 28F7E5F311B23753, 98F125CAD475680D, 38EC240540A73CC9, B8D0F798B29CD9D4, 30B789180DCA72FC, A1BB9AC874EEA170, A6F67D2D2A780410, 06DC01CA7AD02924, 68959E962C9C41F4, CB389CA64D5F1E02, 0E9832CBC0F566F0, D741F883122DC9C2, EFB7F84FB37F9CB3, 28D708453A48F303, 4CFA6BBF8D5171FC, E6E8B65E03C49531, FB70C25C1994FB5F, 40E377241985C003, 5C2A22911D2E857B, 1292EE2F0095A703, 0B2C51B08E1EF6A1, 5CAF5E107C5EF41B, D0744F6D0F4DCA1C, F1BD0A31CF9E4F17, A1AF380754628E46, 2763B08846A84DD0, 00B62DCE03FEADFA, 4A248F525E349155, 2556288F231B21EB, 11003674B14DD1F1, E32758620FA5E9D6, CC5B6C639BF720B1, 0304ACAE6A7EA4E9, D15A38170BCD99C8, 1D9BC1F8874F5459, F59AC99CC3B19510, 39BDF058CE80FD71, 7CC1E2AF326B53D2, F8F1D94495A5CFDD, 72461659B7D14162, 87EC5B1E75A91695, 8A6D636A0F884F81, 16730604C1CEE230, A76BEE56C066555B, 3C16A2E812B90C49, 661E8A98DEF23BAC, 8B9DF9A273D9192F, 5BEC5CA6788E1405, C0B2ADEDEDC7565E, 8362893F290653D3, 05B48A0E84954596, DE4DD018EB3560BB, 320B0D50A428A134, F828E62909D4ABAB, 31C351CB37AEE2E1, 4E1B1E5889056292, FA5762154E1E4A82, 67628AA2B30E8094, C3E55D421A194D54, 1AA3FFF6DECDFF05, 58793A91BDEBBCE6, 1CC82EBF143ACA6B, E05BCC556FA9FB7D, D6F9976B41FE1C4E, D79DCB15BF873208, 861CB954C5457359, 07AEC35229C95E0E, E1CAAB9CE1F4EBA7, 315F3501DCA9BC99, 3775C372AE714724, 70961933723C40CB, C8669B6B7C347E62, 3CA8D20F6590A642, 47E26CA4F1D8AC33, 48316245D8DEF908, C38F2E8A72C54AFA, 285A2EAB76BCCDAD, 1BC0470F06DBA564, 25E1E62F7468F0C7, D7704987A6EC79AF, 88C52E8069524EF4, C898036CBCE65C34, F453059BB4B66DC4, 8C511D52237DCC94, 06F5CB34042C9BBE, 28641BEC01D64A2F, 41F61100347CAB45, FB6E0A0F6C468E3F, E0B7D1A04C217A73, 56BD2D97BAC4F6ED, 75C0034ED0D03EAB, 921806596AB1E188, 557B4C72263A8C10, DE9B26B70B7A5ACA, 92AE6763532B2981, EA9C5BD17D37D809, 16BB8621FB1D982A, AC4FA8AC43A5D373, 0289E021A20F1A2D, C6BF98F822EBA9B2, 274F4957ACF5A678, 7FA9A2A02A566BDC, AD3E17F6766D9BF9, 420006CCE016940B, 95C18F1A2AEC925F, 4BCA149DE33427B7, 1581804BC5959525, D4BF323311105512, 91DE388AF7F7CE9F, 10288CB5E0186364, BBF81897A2AB198D, 44D4CC5CDFA27C56, 14B1248DEC83812E, 918ABE44ED3EFD62, FF3F1F25A112CDAF, 1C778EB737E8C4A9, B121BA861364BE02, 23A3BC47A213813B, DE82E0BFE4C264B3, B78884E1831A7AFF, 15785D8289A846B7, 674D277E0391132E, CDBED3FB83FFD48D, 7A04863D9E2A8D15, 6D5CE92D72DAACDB, 170C3BF733551381, 3F677B73C523204F, BFEC988933205C8E, D4BC187FE3486091, 0D004FE946CE2D26, F41B8DFAAAC5BE2D, 2DE08C476861CB8D, 5EAABF93A4C02212, 7466AC36BAC2DC6A, F9D6D428263EA8E0, BA920A8A727D8E5F, 01592DFEC2FDDDAC, C8B9529F4734D6B3, 57499F41F6483F0C, 73DCD9DA587A936B, 055AE31DA1280344, EA8C686821A0E61C, D5CA55A750F14DA1, 89B1F7D5D1024304, EEF16D82F2D5D702, CA1E423A71BB8A19, B2298D48E7A4830F, 0C13021D9A6C58DF, 257929E97AFEEEB0, 534970862B94C8A3, 678E71842A0F2CDC, 07E7872C5CE08161, 695DCF270798DF01, C4A5C0413DB8842C, 7C220052A1D49F02, AD3D6822A8E54284, 2094380FF304802A, 58466CA3BB06B7A5, 5A0CC5CA78FA374B, 13B676D270A2033A, 7C5987199F153722, 6840CDAD3079009F, 2D111C873BA7EC56, 1120975FFDA9CA6D, E2D0D4DB6F529869, E2C4C315D7002859, CD6337F2BBF586D3, C05BDDCB7A7655D9, 48B310F53267A542, 7323B5889B70D81C, E9E3473BDED2D62C, FF29ED45C6BF2A32, 206D060869CD9EDE, 5A30DF6266924C6B, 9C16EED9B4E2EC23, 1E3D4EC98A696ECA, 80C9EF6B979B75FB, A73CDB041DAAB27C, D37C29C5C1C59040, 384D7C52EAAF4903, 84FFA124681E8A77, 88F0DB968916A8AA, 698E7BF9A87BBAAC, 8C1DE4ACEA1CE2FC, E9692D8494F7553F, 0678F704C2EC5C94, 5305CF0F6EE88E89, 6DFD78EF29202302, AA51628493A1BE27, 2F18F0DD49CFFBDE, 2976D5B980E916F1, C230AF7A5CD30D03, E6EED81FD8E4BE2F, 89E5D0EC75486962, 1FD36692E122FE92, B48C63F1B60B33E1, 8448324D5385C014, 6D2039BDAF103E83, 5129C0D08D0733F1, F742F6FFFBFC2B8E, 35DEACC04E0EF512, 7949A2AF8F1496EF, 3176754F6D3406E4, 1DD370336FBDEFA3, 9EE984ED55B0DFC7, 5A7614306BA88B2E, CDC8AE433E34BB64, B15E9F7FAC8FA7CC, 4C62EB88DB0EABE6, D48C0BFB23CFE14B, 42A04C51735F1DD2, 516D4969D7C58A51, 9CD1AB3A8D9B536A, 906A81E44EAC5F1A, BE269998D1ED2E46, 73551D0510AB784C, 4B5B05F0287BFA4A, 6C654AD31FD0CD46, 9E9059332F48A216, 0EEF0FBC7D434ADE, 4137DA576E436229, 6E69859A0DAE6066, 3C9D08D571BC1A35, 94BE97D5B42278CE, C2E10FD892C3CEDB, 5B36E4CB64C0A9B5, 96F1BF679D27FE6F, 093BE6D63AB1AE6A, 2623714E93F05F3B, 82B6084020B752C8, 076670FE7C94B365, 20652599F74FE635, 50F12774B93D234C, BC8092B70EC1D7EF, AC6D8631CAC1F837, 0F8FC0C236372795, D63EE0D39820371A, 5075516BC4C6EA05, CDD48726DEF57B48, 016FFF073E251E1F, 8FEE0E29DD8D212F, FFD76978DF57DF34, EB4AF8E1F551A059, 3864F2461ECDD468, 54A1B85435CB3D1A, B0D0E9DCDE664BE7, 7708BA23AF8561E8, 301E7C9450A94BAE, 1F5CB4A4242BCCC5, 366E3BD1DDCF783A, 42849986AFBA602F, 6B2CEAB4D628D59E, 798ACEAD2C0863AB, D928DC9718DEDCDD, DB632F4EF420E4C2, 2D93E24ED745DF9D, 42888837B0D27940, 80A6025C4D6B2E00, 7AD715D720C70E0F, 6BB060251C6F6F46, 81D8F3F83B2FD950, 0F37DA2B9E7712E8, 4795B7BE5CD84A60, 3C51C8320AEEDA9D, 56B57FD04486E562, F1A3346AF915D81F, 96DB634FB5C0D227, 51E4199B2DCC52E0, 3CE14EEAD5872B68, B52B1759A6ED0ED2, 4659F4CA3B095EFE, FE302E2208323746, BE67458D2A334FF5, 911C04E4B0D4F006, 89067B8A28F56734, 6FB4651F98C27BA2, 1AF5DD911210CCD2, A72EC6348016266E, 9E30F4CEB109CF07, 6BF6166DFE5DF720, 1ABFC087636BE7CE, E4606CFF1D95C700, 1285D797544BAF5B, 2972721FAB271F8D, DDDE3A3FE070B181, 17DCE4D409A5B71B, 7507F3101FFC3C18, 583633FC1429B4AC, 12C754398872E014, 563CA30E309A336B, EF4E7051A9724E14, 9FFD8A0A80404367, 0B7CB49E4241102E, B2E82587A3DB4BE8, 9E406BF16D288B30, DA2655BBB12FD3C1, 3D4F40A806F4FDE4, C2F011D2AB0A9FB7, 6D0C94B45565CBC8, 7C77F33ECEEA73FC, 95E76B44D50BCCDB, 4A177B17B770F3B3, 2DD74C64958A0C26, 15D188B13134A8F7, 6167A36C4DC42D1B, D65C76FCCBFDDFDB, 32BC6B1E6749B006, 7C5435AF8B7AB4C5, B5815A35A7BC84C1, 164CC5AEFA27A475, D7BEA6DF884D0A90, E5D99D34AD9C8758, 888A7DD8CC6AC87B, A445BC163B68D379, 61BE1DFE86B60CB6, 7B356881034594F8, 9A484CE22D36F863, 4876796004327EC7, 0EE10174FD9002E1, E0EA1BD6970531CF, E6164D7C278A9769, A08301C0B5845DAC, 061BCAD22B3F3831, DEA93C4B00DB49E3, C235779989BA1A67, 92CC0D1A919F0FC8, 102B567C348514A2, C83FAFD19CEB9E30, 3B6544F2B537BB15, 15532EB229D49E6B, 8423AA82B4860CF5, 18B9F38CF4CECD20, 50BA10887827E9F4, 96E9E8E3F37190D3, 27BCB348D81BA325, A24236FB4AE21245, CC743468502C29D2, A944F5D415B11F28, 2C2C77BD01533ABE, D7468159036D654C, ACA0100113E862E4, 49149C3ACF0F9F69, 4AECA84459312359, 66C9C66C32587D29, 2E9CAC050F7B29A6, BFF8A3D2B417A887, B2E11D2AA7DE6923, F810500C3011E76D, CA070B00C2D1A049, 76FBCAB06D6644F0, F9C68A486604C020, DAAB8C45DF4BD9DD, 2B30839ABE606DB7, 1BCA0A24FFD8567F, 04915947D8E79633, 3E71DF2038136E54, 81B7B8845B2B2B95, 52D176E3DD1C055F, 1B4357D6974CD536, D7DEE5DBC42573FE, 7CC63A5EB9508657, C7681A30EEB9C19F, 96E6E48C1CE242A9, FA341331A832D71E, 0AD75794BE87720B, 365CBF66F8D63769, 030131D3211AD41E, C141190EAA188947, 8995F0FB2BC37464, E412D4400C227DD2, 75995F2D027360AB, AF1D6C69EFFF87D6, 01CF35FBBA5A30D9, BF4E1F7FE1A3A32E, 8671B6D933D96EDE, ECFC69DC4F0892AF, D3F17332F1709C95, 63C4D15FE46B6E23, C0E7296BA955D921, A94FB8CBF9642997, FC08EAE407562714, E8366399AEB6CEC6, F574A6F4BCF7A0AD, A0FC2E3B2DAC4CDE, DD752BB12F161D8A, 4C20CADC099E4E44, 90A5907C82A2E06F, 51997804F65C0D35, 70F1ACD013224A85, A4BB6389B8AD694D, 2800F888CFB95241, FA4A80C06722E02F, 7F98B5AECD9868B4, 4A41FC3D00CF846F, F73EB4035A90121B, F5DD3EE84EB93B69, 4424B9F183AD2D9F, 5BFFD5F9BD766FF5, BAAE2E6DD0A8AFC9, E17DBFE1DB13B79B, D5C8C9AB4434FB45, D9D823E978C9A9B2, 636546CB724855C7, D00767EA828C02D5, BF0C3424C4A073AB, 18DD90181FBA8854, 570625F7373F8BEE, 25AD1A658D2A8EC0, 0A8863E8E6D4ED7C, 532B961C1ECDBA61, 828BA9CF9951CB31, E70CD9A75CE96F73, 66C0B2CE6923B778, D69240B2D5EC482E, 790841DDFCF527F4, FBFC6CA7D11927DA, 46988A495CABD200, B4476D5ACA0DE74B, 41A611797207EB92, 9C95CE13D8A76FA0, 6CDC3F758E2F7EE1, 6BF748A52A7C551E, D0D2586C7594B777, FFCABEC06F6D09B0, CD8D4C300394B09A, 3A4E75407960EB2A, 3589B85C381F5490, ACFC87CFA7610289, 509E4C0A4DAB0428, 62D12C433D422712, E7B94F369A3DB613, 338A36EF92914C12, F488E1AFC77A61C1, 7C94A254F7154E27, AA44510AB35C929C, A60DB30114E5BB2A, 7D60AAA6E88056CB, 1065B32958FF4CB8, 2B5254A0EA5DB0F0, CFB914553E12B53D, 524D16823EDF504A, 26F6C5577B827AB3, 43B0F021171D73DC, 457FFBD16F02223E, 85F0658C85034D53, F551777FA8ACC66C, EC4E9D7A7F637331, DAB65E3C15E43B34, 4962DCF3CD1070CF, 618C4B18FE3BCFBF, BE7E7A8476FA199E, 676C7C9A37530AF2, DEF2B7356A5EDFC0, F4C02EA9D852114A, 073AA8C2CB5BED48, C431AE937929667F, BE3C51704A576938, CA749053711F7FD2, BC4C7EBC50FEF2BC, 6815139A077D5C20, 565767543E283421, DB567673679DB0C2, 9B95D2B0CA882442, D98162D8C91F573B, 3BACD561E9E03EEB, BD7C4EA141C2B83A, A6960C08CFA14B10, C530C883C58ACF52, A370C737F2E30902, 56604B5485696381, 57D332F3E3349BCC, 08072647A6A5DE7C, BE006A83AB7518B0, 370A33C5BDFB3AFD, AD2B96FBC42E97DF, B9F446B75A1E3389, 98F3B8681E3616E7, CCD8FEBAE6999CE3, 1934B4491B6F25B3, E91B8A17DE42BE80, 4C7E8A4E48B2F5E4, 00B20F6E69D68B79, E583E15058F5508C, B8CE2EEF5372E860, C7358422F145D360, 265CBC02999EF33A, 9B2B714189848027, 12ABE5A64E6FCF5A, 8A5D72249E3F15EA, 5923718068DA8BC0, 583DE33B436D990E, 97B46789BB517D28, 498838127B6A5A98, 6711B00DC4C0BB69, 424573BA336CBC26, 24A3C28ACA8D2BB8, 1EFA63A04C74F1A6, A27FDE2B94EB89E2, 8A3DDA53A7F62C39, 14E5DF53F3F012E1, B35EE809AE739645, F3A12C29BBC46D60, EB38855AAA19191E, 57E5EF4E2E2E8140, 98A0D2432BF8364F, 997AAFDE25582865, 870B96872953686B, CEFCE6BC59718B49, A4606142EC805C49, A91EB89DA8D2A819, 119CD35F7BC6B080, DB9AB43B19442723, DE33AAF11CA1A759, 08DB493C5C5CD9B4, F403EF8B28187C3D, FC7DB5CD6AA592EA, 47514F5AF58C6AB6, D31AFB9ED78CAC24, 05B4D145D6A37B5A, 26454F1FF7F9706F, F0F006ED6961F7A3, 19EFD7D6AB5DD2A3, 083E0BFBE63C3953, 413ACDA72DDA82B9, E8DA52FCD950E43B, 97373274E3967202, 7472307CC96AB5EE, 1100CD2163ED8F2D, 29EAF589067325C5, A1D12DA161990184, DE401637D262E9A1, ECCDBC183122DE8B, 207D81697AC36873, D294BAE590ABE0C8, 45748760110F77DC, D66E8F1873DB23EC, 21D645E71CC2F3FA, 792B4837A0E02CBC, 2EAF24C357F70DCE, 49383F9DC69FF7CA, 9BDCBAB7E70772CE, A03C7B7A9E8B1BF9, 820C50770667B2D7, CC196EE47B757964, 2CB6DB7020367885, FB9854833D32495A, 6D7DA77012BCE1B1, 66AA1E57153EB7DD, 5296DD54777FBC2B, 25C8A7B4AAE0B266, 66C0E3B94B6240AB, 73E5C5CA84A8FBEE, B4C8627A0E5F9064, 079A5906F8F59B60, A3D7F8A3567D8D6B, 0303A8AE15D2CF26, 1E114613A822DAD7, 59CD2ADEC4DDFA62, F44759B077532136, C7B4FD5F24C69634, 51EB82FA12CD6060, 5DF43A5E4368DB5C, 671579B98CF91979, 504436653B618814, 4B5643A00DA4EC35, 1176C9EF26D90164, 97AD8F062927D018, 2E66FD467C31D07C, 7F61C9BC9E6AF454, 54F2B47A7D6C71A5, AF4B828546164272, 8B31197F2CEC1E34, 8FDEF9C5023AD14B, 97BEB9AC51FF3390, 8FBAC29CF6BE579C, 3739AEDDBD0F56BB, 156AE489D01E7A51, 15F6D9C55B92BA64, 2AD4D0C0C00E2964, C43F7EF64F9FB376, 0A92B754721D262D, D420AA8AB547C51A, 0C2A9950FC657E33, 575218218CB1185E, F7D286050A16907F, 29F1AB3CF6FBD7EF, B404E343DBB54D97, 392305613897F4F0, B0831EFD4D5918AD, 7CD9D70BE6146601, 7EC3921914969E64, 2A83211B02A0A9F1, E8DEB3480A17E29D, A2B13619AAAFCF49, 323539468E5367DD, 0B3E72F6394FC8C0, F6EFFC87C32AE831, F210CCA21F8C6932, 54ADCAB10344C5E6, DFF5C71A083FCCB1, 7B30D720F6A91DE4, 9F95B60B6328B75C, 1087ED1845C349F0, 1910D0FE0EEF09DE, 2037A8A640B493C4, D09D929A0AD6017E, 3D0EE831B5BA08B3, 2EF04D00B0DACC35, 3AFAA6D2B755C649, 54F86BD49527FB6C, 34D25610260748D1, F09DD29142EEBE63, 00D1EDA3F4138D33, 4722872DF181C79E, 39D0059ED5FE0770, 3DB3C40EA4374111, 13B260416A5AE4C3, A39B14A6DE8109BF, 545AB7C475BA3CD2, 5F09E5F9F1D72A60, 663728889179F155, A8FDF79EE3F3E72F, 4D3BB397DB487F68, 15879719907C9F4A, 3C2922C8E62EFBFE, 1C5A6A5533AEF255, 7DA3653A322D752F, 7BBB9C0BB59EA388, 8D749C80C7D9A8CD, 68CA52C62980C650, 120C78C1FDF6C183, 3CA29CC
请问各位大侠我的大嘴日语5.0注册号是多少？1323170516
使用工具 OllyDbg,PEid,LoadPE
破解平台 Win2K+SP4
软件名称 大嘴日语 5.0
软件简介 大嘴日语 融合了逆向学习法和疯狂英语这两种有效的英语学习方法的精髓，
并加以创新，集日语的听、说、读、写、背、查功能于一身， 解决了困扰国人的学习日语难的问题。
是一款集日语口语、日语背单词综合教育软件。
加壳方式 EXEStealth 2.75a + ASPack + UPX
开始调试前,最好把OLLYDBG.EXE改名为CMD.EXE因为壳里面有些代码是检测父进程的,如下:
0123CCA0 813F 434D442E cmp dword ptr ds:[edi],2E444D43 ; [EDI]是检测父程序名字, 0x43,0x4D,0x44,0x2E的ASCII字符是"CMD."
0123CCA6 74 3B je short BmJapane.0123CCE3 ; 父程序不是CMD.EXE,就不跳,接着就OVER了 修改ZF寄存器为1
0123CCA8 90 nop
0123CCA9 90 nop
0123CCAA 90 nop
0123CCAB 90 nop
0123CCAC 83EE 0C sub esi,0C
0123CCAF AD lods dword ptr ds:[esi]
0123CCB0 0306 add eax,dword ptr ds:[esi]
0123CCB2 0346 04 add eax,dword ptr ds:[esi+4]
0123CCB5 8BD8 mov ebx,eax
0123CCB7 8DB5 A1194100 lea esi,dword ptr ss:[ebp+4119A1]
0123CCBD AD lods dword ptr ds:[esi]
0123CCBE 0BC0 or eax,eax
0123CCC0 74 0E je short BmJapane.0123CCD0
0123CCC2 90 nop
0123CCC3 90 nop
0123CCC4 90 nop
0123CCC5 90 nop
0123CCC6 2BC3 sub eax,ebx
0123CCC8 74 19 je short BmJapane.0123CCE3
0123CCCA 90 nop
0123CCCB 90 nop
0123CCCC 90 nop
0123CCCD 90 nop
0123CCCE ^ EB ED jmp short BmJapane.0123CCBD
0123CCD0 B8 90010000 mov eax,190
0123CCD5 E8 C6EFFFFF call BmJapane.0123BCA0
0123CCDA 8DBD 69324000 lea edi,dword ptr ss:[ebp+403269]
0123CCE0 03F8 add edi,eax
0123CCE2 AB stos dword ptr es:[edi] ; 若是前面不跳的话,到这里调试器就会无法处理异常,进程退出
0123CCE3 FFB5 30FE4000 push dword ptr ss:[ebp+40FE30] ; 跳到这里
0123CCE9 50 push eax
另把同目录下的Config.ini文件备份一个,当出来说文件不完整要重新安装程序的时候
把备份文件覆盖了Config文件就行了;
---------------------------------------------------------------------------------------------------------
用OD载入程序,停在这里:(第一层壳 EXEStealth)
0124A060 > /EB 58 jmp short BmJapane.0124A0BA
0124A062 |53 push ebx
0124A063 |68 61726577 push 77657261
0124A068 |61 popad
0124A069 |72 65 jb short BmJapane.0124A0D0
忽略除内存异常外的所有异常,经过5个内存异常(按4次Shift+F9)后来到这里:
0078700D 64:8925 0000000>mov dword ptr fs:[0],esp
00787014 33C0 xor eax,eax
00787016 8908 mov dword ptr ds:[eax],ecx ; 内存异常
00787018 0000 add byte ptr ds:[eax],al
0078701A 0000 add byte ptr ds:[eax],al
此时的堆栈是:
0012FFBC FFFFFFFF End of SEH chain
0012FFC0 00D9DAA8 SE handler
0012FFC4 7C4E87F5 RETURN to kernel32.7C4E87F5
0012FFC8 005616A8 BmJapane.005616A8
在D9DAA8上下断点,按Shift+F9
00D9DAA8 B8 A7C8D9F0 mov eax,F0D9C8A7
00D9DAAD 8D88 24120010 lea ecx,dword ptr ds:[eax+10001224]
00D9DAB3 8941 01 mov dword ptr ds:[ecx+1],eax
00D9DAB6 8B5424 04 mov edx,dword ptr ss:[esp+4]
00D9DABA 8B52 0C mov edx,dword ptr ds:[edx+C]
00D9DABD C602 E9 mov byte ptr ds:[edx],0E9
00D9DAC0 83C2 05 add edx,5
00D9DAC3 2BCA sub ecx,edx
00D9DAC5 894A FC mov dword ptr ds:[edx-4],ecx
00D9DAC8 33C0 xor eax,eax
00D9DACA C3 retn
走到RETN后,看原地址的代码:
0078700D 64:8925 0000000>mov dword ptr fs:[0],esp
00787014 33C0 xor eax,eax
00787016 - E9 B06A6100 jmp BmJapane.00D9DACB ; 在这里下断点,程序断在这里,然后把标志寄存器的TP置0,继续运行
0078701B 0000 add byte ptr ds:[eax],al
0078701D 0000 add byte ptr ds:[eax],al
00D9DACA C3 retn
00D9DACB B8 A7C8D9F0 mov eax,F0D9C8A7 ; 原来跳到这里了
00D9DAD0 64:8F05 0000000>pop dword ptr fs:[0]
00D9DAD7 83C4 04 add esp,4
00D9DADA 55 push ebp
00D9DADB 53 push ebx
00D9DADC 51 push ecx
00D9DADD 57 push edi
00D9DADE 56 push esi
00D9DADF 52 push edx
00D9DAE0 8D98 DD110010 lea ebx,dword ptr ds:[eax+100011DD]
一直走到这里:
00D9DB70 5E pop esi
00D9DB71 5F pop edi
00D9DB72 59 pop ecx
00D9DB73 5B pop ebx
00D9DB74 5D pop ebp
00D9DB75 - FFE0 jmp eax ; EAX=B55001
---------------------------------------------------------------------------------------------------------
又跳到下一层去了,貌似是ASPack壳
00B55001 60 pushad
00B55002 E8 03000000 call BmJapane.00B5500A
00B55007 - E9 EB045D45 jmp 461254F7
00B5500C 55 push ebp
00B5500D C3 retn
00B5500E E8 01000000 call BmJapane.00B55014
00B55013 EB 5D jmp short BmJapane.00B55072
直接用Ctrl+S来找popad
来到这里:
00B553A9 8985 A8030000 mov dword ptr ss:[ebp+3A8],eax
00B553AF 61 popad
00B553B0 75 08 jnz short BmJapane.00B553BA
00B553B2 B8 01000000 mov eax,1
00B553B7 C2 0C00 retn 0C
00B553BA 68 00000000 push 0 ; 运行到这里会变成push 90fc10
00B553BF C3 retn
---------------------------------------------------------------------------------------------------------
到达下一层壳,是UPX壳
0090FC10 60 pushad
0090FC11 BE 00707800 mov esi,BmJapane.00787000
0090FC16 8DBE 00A0C7FF lea edi,dword ptr ds:[esi+FFC7A000]
0090FC1C 57 push edi
0090FC1D 83CD FF or ebp,FFFFFFFF
0090FC20 EB 10 jmp short BmJapane.0090FC32
0090FC22 90 nop
0090FC23 90 nop
0090FC24 90 nop
0090FC25 90 nop
0090FC26 90 nop
0090FC27 90 nop
0090FC28 8A06 mov al,byte ptr ds:[esi]
0090FC2A 46 inc esi
0090FC2B 8807 mov byte ptr ds:[edi],al
0090FC2D 47 inc edi
0090FC2E 01DB add ebx,ebx
0090FC30 75 07 jnz short BmJapane.0090FC39
同样往下找popad,找到如下:
0090FD9B 66:8B07 mov ax,word ptr ds:[edi]
0090FD9E 83C7 02 add edi,2
0090FDA1 ^ EB E2 jmp short BmJapane.0090FD85
0090FDA3 61 popad
0090FDA4 ^ E9 8B1DD7FF jmp BmJapane.00681B34
---------------------------------------------------------------------------------------------------------
到达程序的OPE了,用OllDump把程序DUMP出来,用LordPE来DUMP也行,不过要用IR修复一下IAT
00681B34 55 push ebp
00681B35 8BEC mov ebp,esp
00681B37 83C4 F0 add esp,-10
00681B3A 53 push ebx
00681B3B B8 9C146800 mov eax,BmJapane.0068149C
00681B40 E8 175DD8FF call BmJapane.0040785C
00681B45 8B1D D0906800 mov ebx,dword ptr ds:[6890D0] ; BmJapane.0068AC18
00681B4B 8B03 mov eax,dword ptr ds:[ebx]
00681B4D E8 CE22E1FF call BmJapane.00493E20
00681B52 8B03 mov eax,dword ptr ds:[ebx]
00681B54 BA 7C1E6800 mov edx,BmJapane.00681E7C
00681B59 E8 AA1EE1FF call BmJapane.00493A08
00681B5E 8B0B mov ecx,dword ptr ds:[ebx]
---------------------------------------------------------------------------------------------------------
运行一下,程序报错
"Access violation at address 1000100A. Read of address 1000100A."
用LordPE看看内存空间:
ListView的Item总数: 26
-------------------------
Path ImageBase ImageSize
-------------------------------------------------------------------------------
d:\bmjapanese\bmjapanese.exe 00400000 00001000
c:\winnt\system32\ntdll.dll 77F80000 0007B000
c:\winnt\system32\kernel32.dll 7C4E0000 000B9000
c:\winnt\system32\user32.dll 77E10000 00065000
c:\winnt\system32\gdi32.dll 77F40000 0003C000
c:\winnt\system32\imm32.dll 75E60000 0001A000
c:\winnt\system32\advapi32.dll 7C2D0000 00062000
c:\winnt\system32\rpcrt4.dll 77D30000 00071000
d:\bmjapanese\data\data.dat 10000000 00037000
c:\winnt\system32\comctl32.dll 71710000 00084000
c:\winnt\system32\comdlg32.dll 76B30000 0003E000
c:\winnt\system32\shlwapi.dll 70BD0000 00065000
c:\winnt\system32\msvcrt.dll 78000000 00045000
c:\winnt\system32\shell32.dll 782F0000 00248000
c:\winnt\system32\hhctrl.ocx 5D300000 00080000
c:\winnt\system32\ole32.dll 77A50000 000F7000
c:\winnt\system32\oleaut32.dll 779B0000 0009B000
c:\winnt\system32\msacm32.dll 77410000 00013000
c:\winnt\system32\winmm.dll 77570000 00030000
c:\winnt\system32\version.dll 77820000 00007000
c:\winnt\system32\lz32.dll 759B0000 00006000
c:\winnt\system32\winspool.drv 77800000 0001E000
c:\winnt\system32\mpr.dll 76620000 00011000
c:\winnt\system32\wsock32.dll 75050000 00008000
c:\winnt\system32\ws2_32.dll 75030000 00014000
c:\winnt\system32\ws2help.dll 75020000 00008000
地址是data.dat的空间,用PEID一查,是个ASPack壳的DLL文件,查输出表,只有两个函数,
分别是HDSerialNumRead和WEP
还差一个DLL没有LOAD进去,当然会出错了.
重新载入原文件,下LoadLibraryA断点,经过几次后,断在这里:
01240873 53 push ebx
01240874 FF95 94E24100 call dword ptr ss:[ebp+41E294] ; LoadLibraryA .dat\data\data.dat
0124087A 0BC0 or eax,eax
0124087C 75 34 jnz short BmJapane.012408B2
然后来到这里:
01240941 53 push ebx
01240942 FFB5 17FC4000 push dword ptr ss:[ebp+40FC17]
01240948 FF95 8CE24100 call dword ptr ss:[ebp+41E28C] ; kernel32.GetProcAddress
0124094E 3B9D 1FFC4000 cmp ebx,dword ptr ss:[ebp+40FC1F]
得到HDSerialNumRead的地址
用Alt+M,打开内存镜像,
在10001000处按F2下断点,取消刚才的LoadLibraryA断点,按F9,来到这里
10001003 CC int3
10001004 CC int3
10001005 E9 66010000 jmp data.10001170
1000100A > E9 310B0000 jmp data.10001B40 -|jmp
1000100F > E9 3C0C0000 jmp data.10001C50
10001014 E9 C7030000 jmp data.100013E0
10001019 E9 52000000 jmp data.10001070
1000101E E9 0D020000 jmp data.10001230
10001023 E9 78080000 jmp data.100018A0
10001028 E9 93020000 jmp data.100012C0
1000102D E9 BE040000 jmp data.100014F0
10001032 E9 89070000 jmp data.100017C0
10001037 CC int3
10001038 CC int3
----------------------------------------------------|
10001B40 55 push ebp
10001B41 8BEC mov ebp,esp
10001B43 81EC D4070000 sub esp,7D4
10001B49 53 push ebx
10001B4A 56 push esi
按CTRL+F9,然后返回主程序:
0059C567 8D45 C4 lea eax,dword ptr ss:[ebp-3C]
0059C56A E8 518AE6FF call BmJapane.00404FC0
0059C56F E8 D0F1FFFF call BmJapane.0059B744 ; jmp to data.HDSerialNumRead
0059C574 8BD0 mov edx,eax
0059C576 8D45 C4 lea eax,dword ptr ss:[ebp-3C]
原来CALL 59B744是data.HDSerialNumRead的函数的地址CALL,直接到上面看看:
0059B744 - FF25 2CCC6800 jmp dword ptr ds:[68CC2C] ; data.HDSerialNumRead
嗯,只要把68CC20填充为正确的地址就可以了
用OD载入DUMP出来的程序,下断点LoadLibraryA,程序中断后按Alt+F9返回用户代码:
0047E97B /0F85 EE000000 jnz oll.0047EA6F
0047E981 |68 ACEA4700 push oll.0047EAAC ; ASCII "imm32.dll"
0047E986 |E8 D594F8FF call <jmp.&kernel32.LoadLibraryA>
0047E98B |A3 88326800 mov dword ptr ds:[683288],eax ; IMM32.75E60000
0047E990 |833D 88326800 0>cmp dword ptr ds:[683288],0
0047E997 |0F84 D2000000 je oll.0047EA6F
往下找代码,找到出口处:
0047EA8D 5B pop ebx ; USER32.77E10000
0047EA8E 59 pop ecx
0047EA8F 5D pop ebp
0047EA90 C3 retn
0047EA91 0000 add byte ptr ds:[eax],al
找一个地方加上自己的代码:
区块ExeS已经不用了,正好用来写代码:
注:LoadLibraryA的CALL是"call 00407E60" ;GetProcAddress的CALL是"call 00407D50"
情况不同者要相应作出修改.
0047EA8D - E9 6EB5DC00 jmp oll.0124A000
0047EA92 C3 retn
0124A000 68 30A02401 push oll.0124A030 ; ASCII ".\data\Data.dat"
0124A005 E8 56DE1BFF call <jmp.&kernel32.LoadLibraryA>
0124A00A 68 40A02401 push oll.0124A040 ; ASCII "HDSerialNumRead"
0124A00F 50 push eax ; EAX是LoadLibraryA后的DLL句柄
0124A010 E8 3BDD1BFF call <jmp.&kernel32.GetProcAddress>
0124A015 A3 2CCC6800 mov dword ptr ds:[68CC2C],eax
0124A01A 5B pop ebx
0124A01B 59 pop ecx
0124A01C 5D pop ebp
0124A01D 90 nop
0124A01E - E9 6F4A23FF jmp oll.0047EA92
0124A023 90 nop
---------------------------------------------------------------------------------------------------------
去程序的ANTI代码
0067D1E9 ^\EB CE jmp short dumped.0067D1B9
0067D1EB E8 80C4E4FF call dumped.004C9670
0067D1F0 68 FFFF0000 push 0FFFF
0067D1F5 6A 0D push 0D
0067D1F7 E8 7CB2D8FF call <jmp.&user32.ExitWindowsEx> ; 关机了~
0067D1FC E9 CD060000 jmp dumped.0067D8CE
这样危险的API当然不能让程序乱用的,要它指向自己的代码,直接在IAT里面改:
0067D1F7 E8 7CB2D8FF call <jmp.&user32.ExitWindowsEx> 本来是 call 00408478
去408478上看看:
00408478 - FF25 50C96800 jmp dword ptr ds:[<&user32.ExitWindowsEx>; user32.ExitWindowsEx
自己写的代码:
0124A000 83C4 0C add esp,0C
0124A003 FF7424 F4 push dword ptr ss:[esp-C] ; 还原调用CALL以后RETN的地址
0124A007 C3 retn
更改IAT表:
00408478 - E9 831BE400 jmp exit_fix.0124A000
0040847D 90 nop
运行,程序OK,....
脱壳完成
后记,EXEStealth的IAT还原部分,比较有趣:
00FDE535 8B07 mov eax,dword ptr ds:[edi] ; EDI是加密函数名结构(可以这样说)的基地址
00FDE537 09C0 or eax,eax
00FDE539 74 3C je short BmJapane.00FDE577 ; IAT表是否填充完成,完成的话跳
00FDE53B 8B5F 04 mov ebx,dword ptr ds:[edi+4]
00FDE53E 8D8430 BC43BE00 lea eax,dword ptr ds:[eax+esi+BE43BC]
00FDE545 01F3 add ebx,esi
00FDE547 50 push eax
00FDE548 83C7 08 add edi,8 ; 函数名结构基地址+8byte,指向第3项
00FDE54B FF96 1045BE00 call dword ptr ds:[esi+BE4510] ; LoadLibraryA
00FDE551 95 xchg eax,ebp
00FDE552 8A07 mov al,byte ptr ds:[edi] ; 读取第3项数值
00FDE554 47 inc edi ; 函数名结构基地址+1,指向第4项,即函数名
00FDE555 08C0 or al,al ; 看AL(函数名第3项)是否为空
00FDE557 ^ 74 DC je short BmJapane.00FDE535
00FDE559 89F9 mov ecx,edi ; 读取函数名,放入ECX里面
00FDE55B 57 push edi ; 函数名
00FDE55C 48 dec eax
00FDE55D F2:AE repne scas byte ptr es:[edi] ; 这条指令作用实际上是计算下一个函数的基地址
00FDE55F 55 push ebp
00FDE560 FF96 1445BE00 call dword ptr ds:[esi+BE4514] ; GetProcAddress
00FDE566 09C0 or eax,eax
00FDE568 74 07 je short BmJapane.00FDE571 ; 正常情况下不会跳下去的,这里是处理无法取得函数地址的情况
00FDE56A 8903 mov dword ptr ds:[ebx],eax ; 取得地址后填充到[ebx]里面(IAT表)
00FDE56C 83C3 04 add ebx,4 ; IAT表地址+4bytes
00FDE56F ^ EB E1 jmp short BmJapane.00FDE552
以下是其中一个函数的函数结构,与上面联系的:
35 02 00 00 24 B9 99 00 01 61 63 6D 4D 65 74 72 5..$箼.acmMetr
|----1----| |----2----| 3 |----4-----
69 63 73 ics
------|
1->用lea eax,dword ptr ds:[eax+esi+BE43BC]来标志该函数是哪个DLL文件里面的,把DLL文件的地址传给EAX
2-> 这部分加上基地址(401000)后用为填充程序IAT表的地址
3->标识函数所在的DLL是否与前一个函数的DLL相同
4->函数名
问下，GBA游戏“海贼王 目标！赏金王！！”中，第86和第88号财宝 打谁能得着
很久以前的游戏了，具体宝物是几号忘了。不过我记得那时候是打出全宝物的，就是一部分就只有一个而已...
要宝物提升能力，可以通过金手指直接修改能力（金手指一关就变会正常能力）或者用金手指改全宝物（关闭金手指宝物依然存在，好像是全999个）。这些是常用金手指：
首位人物
所持金 02018220:0001869F
HP 02018228:270F
HP上限 0201822A:270F
攻击力 0201822E:FF
敏捷度 02018230:FF
人物 02018234:xx
MP 0201823E:03E7
MP上限 02018240:03E7
移动力 02018243:63
移动上限 02018245:63
满肉 0201824B:FF
首位物品 02018246:xx
5ch↓以降
HP全满
42018228 270F
00000004 005C
MP全满
4201823E 03E7
00000004 005C
人物图鉴全满
4200DA98 FFFF
00000030 0001
物品图鉴开启 0200DAC9:01
物品图鉴全满
4200D89A 00FF
00000064 0002
怎么用就不用我告诉你了吧。如果不想用这个，再给你个全人物资料：
敌方人物资料（编号 名称★ 掉落宝物 ★特殊能力）
NO.01 白猎人斯摩格★ 02麦秆饰物 50密佛格的小刀 93传说中的果实 ★每回合自动回复200点HP；攻击点数为5时使对方攻击力下降10
NO.02 达丝琪★ 40狗食 62多尔顿的马车 82传说中的刀 ★无特殊能力
NO.03 近海之主★ 19海贼夏威夷衬衫 42海贼靴 68乌南的遗书 ★无特殊能力
NO.04 亚尔丽塔★ 26海贼标志 46钻石小刀 54西尔尔克的炸弹 ★攻击点数为5时召唤出亿万长者
NO.05 亚尔丽塔**★ 44鲸鱼鱼叉 52芭拉蒂的帽子 100海贼王的金币 ★攻击点数为5时使对方MP减5
NO.06 斧手蒙卡★ 33特制饭团 76阿齐的帽子 96传说中的粉色雪 ★无特殊能力
NO.07 巴其★ 12听诊器 66咻咻的项圈 96传说中的粉色雪 ★攻击点数为5时将对方吹飞
NO.08 摩奇★ 23应援扩音器 30革制防具 66咻咻的项圈 ★无特殊能力
NO.09 卡巴吉★ 08熊猫围裙 28沙漠斗篷 67可乐克斯的茶 ★无特殊能力
NO.10 克洛船长★ 09王子眼镜 57可雅的药 87传说中的万能药 ★可回避攻击点数为1的攻击；攻击点数为5时进行全体攻击
NO.11 杰克斯★ 36圆形饰物 71阿健的风车 87传说中的万能药 ★攻击点数为5时进行全体攻击；攻击点数为6以上时使对方一回合无法行动
NO.12 山姆★ 03高级钓杆 22特制纯油 68乌南的遗书 ★攻击点数为5时偷走对方身上25%的钱
NO.13 布姆★ 24逃跑鞋 47沙巴卡西亚2号 61拉邦的蘑菇 ★无特殊能力
NO.14 克利克首领★ 01结实草鞋 53哲普的鞋 90传说中的宝剑 ★攻击点数为5时使所有对手中毒
NO.15 阿金★ 35沙漠之沙漏 52芭拉蒂的帽子 95传说中的海贼旗 ★无特殊能力
NO.16 巴拉★ 35沙漠之沙漏 70布多尔的矛 91传说中的耳环 ★无特殊能力
NO.17 恶龙★ 48玛姬的护身符 72贝尔梅尔的橘子 85传说中的菜刀 ★每回合自动回复300点HP；攻击点数为5时使对方身后（就是来的那条路）产生一个旋涡；攻击点数为10-12时攻击结束后攻击力上升10%
NO.18 小八★ 13骗人布海贼旗 67可乐克斯的茶 97传说中的龙骨 ★攻击点数为5时召唤出海牛牟姆
NO.19 克罗欧比★ 33特制饭团 69拉布的蛀牙 96传说中的粉色雪 ★无特殊能力
NO.20 啾★ 38莱姆 74波古丹的包子 95传说中的海贼旗 ★无特殊能力
NO.21 海牛牟姆★ 15强力橡皮筋 43海贼扑克牌 65西尔尔克的海贼旗 ★无特殊能力
NO.22 瓦尔波★ 32冬岛防寒具 55朵丽儿医娘的手术刀 96传说中的粉色雪 ★攻击点数为5时使对方船的移动力下降1
NO.23 杰斯★ 21水晶酒杯 32冬岛防寒具 63巨兽的牙齿 ★无特殊能力
NO.24 克罗马利蒙★ 27桶装苹果 32冬岛防寒具 65西尔尔克的海贼旗 ★无特殊能力
NO.25 克洛克达尔★ 58寇布拉国王的斗篷 59薇薇的香水 83传说中的肚兜 92传说中的绷带 98海贼王的斗篷 99海贼王的书 ★每回合自动回复1000点HP；攻击点数为5时将对方吹飞；攻击点数为7-9时使对方中毒；攻击点数为10-12时吸取对方的HP
NO.26 Mr.1★ 49杰克的海贼旗 64多托的水桶 80传说中的海图 ★无特殊能力
NO.27 Miss.双手指★ 11医疗包 52芭拉蒂的帽子 95传说中的海贼旗 ★攻击点数为5时攻击结束后攻击力上升10
NO.28 Mr.2★ 51克伊娜的坠子 61拉邦的蘑菇 81传说中的航海日志 ★攻击点数为5时变成对方的样子（没有意义……）
NO.29 Mr.3★ 75布洛基的战斧 78东利的剑 84传说中的煎锅 ★攻击点数为5时使对方无法逃跑；攻击点数为6以上时使对方一回合无法行动
NO.30 Mr.4★ 06五连杠铃 56洋葱头的武器 89传说中的工具箱 ★攻击点数为5时将对方吹飞
NO.31 Mr.5★ 10医学书 60岩藏的关东煮 94传说中的沙漠服 ★无特殊能力
NO.32 Miss.情人节★ 37黄金苹果 73梅洛伊的杂烩饭 97传说中的龙骨 ★无特殊能力
NO.33 亿万长者★ 16超级快跑鸭鞍座 35沙漠之沙漏 66咻咻的项圈 ★无特殊能力
NO.34 裘克船长★ 39项链 71阿健的风车 96传说中的粉色雪 ★无特殊能力
NO.35 艾力克★ 05三连耳环 63巨兽的牙齿 97传说中的龙骨 ★无特殊能力
NO.36 艾德拉哥★ 56洋葱头的武器 76阿齐的帽子 89传说中的工具箱 ★无特殊能力
NO.37 哥拉斯★ 04三扣衬衫 25海贼服 62多尔顿的马车 ★无特殊能力
NO.38 大熊王★ 07万能香料 60岩藏的关东煮 91传说中的耳环 ★攻击点数为5时将对方吹飞
NO.39 红心皇后★ 41怀表 77布罗德的背包 95传说中的海贼旗 ★攻击点数为5时使对方MP减7
NO.40 猪杰克★ 31钢铁头盔 44鲸鱼鱼叉 57可雅的药 ★无特殊能力
NO.41 针鬼★ 45海贼帽 55朵丽儿医娘的手术刀 76阿齐的帽子 ★攻击点数为5时使对方中毒
NO.42 臭鼬★ 29章鱼冰糕 40狗食 65西尔尔克的海贼旗 ★攻击点数为5时使所有对手生病；攻击点数为6以上时使所有对手中毒
NO.43 巴特拉伯爵★ 14开口挎包 68乌南的遗书 95传说中的海贼旗 ★无特殊能力
NO.44 毒蛇总裁★ 20气合头巾 41怀表 79卡蒙的手枪 ★无特殊能力
NO.45 热狗将军★ 43海贼扑克牌 78东利的剑 97传说中的龙骨 ★无特殊能力
NO.46 熊猫鲨鱼★ 17毛皮外套 47沙巴卡西亚2号 69拉布的蛀牙 ★无特殊能力
NO.47 乌贼王★ 18超级快跑鸭帽 45海贼帽 67可乐克斯的茶 ★无特殊能力
NO.48 冰山寄居蟹★ 无 ★无特殊能力
如果已经有一定实力，建议打生存模式，进入方法是在查看人物强度时安RRR↓RR↓RR，就可以使用当前正在查看的人物进入生存模式。内容就是将所有海贼由弱到强依次打完（不掉宝物），到最后打赢克洛克达尔可随机获得3个终极宝物。由于路上只有一个商店和一个餐厅，初期能力不是很强的时候，尽量用sanji和chopper这样可以给自己加血的角色。