Cainiao cracking example

I have been learning about cracking recently. It is best for new users to find some typical learning methods. I have a software fit in my hand, so I uploaded it for them to learn. PASS the software. Use OD to open the software. First, find the error message for registration, as shown below:
 
006DE8C7 |. E8 D868D2FF call 004051A4
006DE8CC |. 8B85 78 FFFFFF mov eax, dword ptr [ebp-88]
006DE8D2 |. 8B55 F8 mov edx, dword ptr [ebp-8]
006DE8D5 |. E8 5669D2FF call 00405230
006DE8DA 74 2B je short 006DE907; change jne short 006DE907 to achieve blasting.
006DE8DC |. 6A 40 push 40
006DE8DE |. B9 10EC6D00 mov ecx, 006DEC10; prompt
006DE8E3 |. BA 60EC6D00 mov edx, 006de602. incorrect software registration code! \ N please contact Nanjing tului Co., Ltd!
006DE8E8 |. A1 2CD96F00 mov eax, dword ptr [6FD92C]
006DE8ED |. 8B00 mov eax, dword ptr [eax]
006DE8EF |. E8 A4A3DCFF call 004A8C98
006DE8F4 |. 8B83 28030000 mov eax, dword ptr [ebx + 328]
006DE8FA |. 8B10 mov edx, dword ptr [eax]
006DE8FC |. FF92 C4000000 call dword ptr [edx + C4]
006DE902 |. E9 B2010000 jmp 006DEAB9
006DE907 |> A1 A0DC6F00 mov eax, dword ptr [6FDCA0]
 
Next, go up to the key hop. You can see the line 006DE8DA. Change je short 006DE907 to jne short 006DE907 to achieve brute-force cracking. Is it a bit too simple? This is the most classic method of cracking.
 
Next we will find out the registration code. In the key jump up line, we can see the key comparison of 006DE8D5 |. E8 5669D2FF call 00405230. The program is interrupted after any user name and registration code is entered in the row 006DE8D5. In this case, the entered false registration code and correct registration code are displayed in the register window. This clear-code comparison method is most suitable for cainiao like ours. Enter the correct registration code and register again. Everything is OK!




 
The last step is to use keymake.exe to create a registration machine. First, fill in the "6DE8D5" interrupt address. The number of disconnections is 1. The first byte is E8. The current length is 5. The correct registration code appears in EDX, select the memory mode -- register -- EDX, and save it. Place the registration machine in the cracked directory and run it. Enter the correct registration code as needed.
 


Due to the limited level, you cannot understand the Registration Algorithm for the moment. In particular, it is difficult to manually shell all the software.

Author Medical Imaging