// 最近变的异常懒惰，问GOOGLE找了许久KEY，都木有直接可以用的。
// 根據以前的破解,故查找"Forcing first launch workflow at product request"
60434CA7 |> \68 A4414C60 push 604C41A4 ; ASCII "Forcing first launch workflow at product request."
60434CAC |. EB 05 jmp short 60434CB3
60434CAE |> 68 50414C60 push 604C4150 ; ASCII "Forcing first launch workflow because product is not licensed from previous launch."
60434CB3 |> 6A 00 push 0
60434CB5 |. 6A 04 push 4
60434CB7 |. 68 58F54B60 push 604BF558 ; ASCII "AMT"
60434CBC |. E8 9FE7FDFF call 60413460
60434CC1 |. 50 push eax
60434CC2 |. E8 29290200 call 604575F0
// 发现这个地方少了个调用，找找看咯
60434D8C |> \6A 00 push 0
60434D8E |. 8BCE mov ecx, esi
60434D90 |. E8 EBE3FFFF call 60433180 ; 还是找到了进去看看
//
60433180 /nbsp; 83EC 0C sub esp, 0C
60433183 |. 55 push ebp
60433184 |. 56 push esi
60433185 |. 57 push edi
60433186 |. 8B7C24 1C mov edi, dword ptr [esp+1C]
6043318A |. 8BF1 mov esi, ecx
6043318C |. 85FF test edi, edi
6043318E |. 75 0A jnz short 6043319A
60433190 |. C74424 0C 683>mov dword ptr [esp+C], 604C3D68 ; ASCII "Obtain"
60433198 |. EB 15 jmp short 604331AF
6043319A |> C74424 0C 603>mov dword ptr [esp+C], 604C3D60 ; ASCII "ValIDAt"
604331A2 |. 83FF 02 cmp edi, 2
604331A5 |. 74 08 je short 604331AF
604331A7 |. C74424 0C 543>mov dword ptr [esp+C], 604C3D54 ; ASCII "PreValidat"
604331AF |> 8B6C24 0C mov ebp, dword ptr [esp+C]
604331B3 |. 55 push ebp
604331B4 |. 68 383D4C60 push 604C3D38 ; ASCII "AMT: %sing Product License."
604331B9 |. 68 303D4C60 push 604C3D30 ; ASCII "%sing"
604331BE |. 6A 04 push 4
604331C0 |. 68 58F54B60 push 604BF558 ; ASCII "AMT"
604331C5 |. E8 9602FEFF call 60413460
604331CA |. 50 push eax
604331CB |. E8 20440200 call 604575F0
604331D0 |. 83C4 18 add esp, 18
604331D3 |. 807E 5C 00 cmp byte ptr [esi+5C], 0
604331D7 |. 74 21 je short 604331FA
604331D9 |. 68 003D4C60 push 604C3D00 ; ASCII "Launch Workflow already done in this session."
604331DE |. 6A 00 push 0
604331E0 |. 6A 04 push 4
604331E2 |. 68 58F54B60 push 604BF558 ; ASCII "AMT"
604331E7 |. E8 7402FEFF call 60413460
604331EC |. 50 push eax
604331ED |. E8 FE430200 call 604575F0
604331F2 |. 83C4 14 add esp, 14
604331F5 |. E9 A1010000 jmp 6043339B
604331FA |> 83FF 01 cmp edi, 1
604331FD |. 75 07 jnz short 60433206
604331FF |. 68 D03C4C60 push 604C3CD0 ; ASCII "Launch Workflow not yet done in this session."
60433204 |. EB 05 jmp short 6043320B
60433206 |> 68 943C4C60 push 604C3C94 ; ASCII "Launch Workflow not yet done in foreground in this session."
6043320B |> 6A 00 push 0
6043320D |. 6A 04 push 4
6043320F |. 68 58F54B60 push 604BF558 ; ASCII "AMT"
60433214 |. E8 4702FEFF call 60413460
60433219 |. 50 push eax
6043321A |. E8 D1430200 call 604575F0
6043321F |. 83C4 14 add esp, 14
60433222 |. 57 push edi
60433223 |. 8BCE mov ecx, esi
60433225 |. E8 C6F6FFFF call 604328F0 ;---->這裡需要跟進去
6043322A |. 807E 21 00 cmp byte ptr [esi+21], 0
6043322E |. 0F85 09010000 jnz 6043333D
60433234 |. 807E 22 00 cmp byte ptr [esi+22], 0
60433238 |. 0F85 FF000000 jnz 6043333D
6043323E |. 83FF 01 cmp edi, 1
60433241 |. 0F85 F6000000 jnz 6043333D
60433247 |. 8B4E 1C mov ecx, dword ptr [esi+1C]
6043324A |. E8 8101FEFF call 604133D0
6043324F |. 84C0 test al, al
60433251 |. 0F85 E6000000 jnz 6043333D
60433257 |. 68 503C4C60 push 604C3C50 ; ASCII "Calling AUM API to create scheduler entry to be used by updater."
6043325C |. 6A 00 push 0
6043325E |. 6A 04 push 4
60433260 |. 68 58F54B60 push 604BF558 ; ASCII "AMT"
60433265 |. E8 F601FEFF call 60413460
6043326A |. 50 push eax
6043326B |. E8 80430200 call 604575F0
60433270 |. 83C4 14 add esp, 14
60433273 |. E8 B8CA0200 call 6045FD30
60433278 |. 8BE8 mov ebp, eax
6043327A |. 85ED test ebp, ebp
6043327C |. 0F84 9F000000 je 60433321
60433282 |. 8D4424 10 lea eax, dword ptr [esp+10]
60433286 |. 50 push eax
60433287 |. 8DBE B4030000 lea edi, dword ptr [esi+3B4]
6043328D |. 57 push edi
6043328E |. 55 push ebp
6043328F |. C707 01000000 mov dword ptr [edi], 1
60433295 |. C74424 1C 000>mov dword ptr [esp+1C], 0
6043329D |. E8 4ECE0200 call 604600F0
604332A2 |. 83C4 0C add esp, 0C
604332A5 |. 837C24 10 00 cmp dword ptr [esp+10], 0
604332AA |. 74 4A je short 604332F6
604332AC |. 833F 00 cmp dword ptr [edi], 0
604332AF |. 75 45 jnz short 604332F6
604332B1 |. 8D4C24 14 lea ecx, dword ptr [esp+14]
604332B5 |. 51 push ecx
604332B6 |. 57 push edi
604332B7 |. 55 push ebp
604332B8 |. C74424 20 000>mov dword ptr [esp+20], 0
604332C0 |. E8 4BCC0200 call 6045FF10
604332C5 |. 8B17 mov edx, dword ptr [edi]
604332C7 |. 83C4 0C add esp, 0C
604332CA |. 52 push edx
604332CB |. 68 283C4C60 push 604C3C28 ; ASCII "AUM GetLEID called with status =%d."
604332D0 |. 6A 00 push 0
604332D2 |. 6A 04 push 4
604332D4 |. 68 58F54B60 push 604BF558 ; ASCII "AMT"
604332D9 |. E8 8201FEFF call 60413460
604332DE |. 50 push eax
604332DF |. E8 0C430200 call 604575F0
604332E4 |. 83C4 18 add esp, 18
604332E7 |. 55 push ebp
604332E8 |. E8 130C0200 call 60453F00
604332ED |. 8B7C24 20 mov edi, dword ptr [esp+20]
604332F1 |. 83C4 04 add esp, 4
604332F4 |. EB 47 jmp short 6043333D
604332F6 |> 68 043C4C60 push 604C3C04 ; ASCII "Updater is not enabled by admin."
604332FB |. 6A 00 push 0
604332FD |. 6A 04 push 4
604332FF |. 68 58F54B60 push 604BF558 ; ASCII "AMT"
60433304 |. E8 5701FEFF call 60413460
60433309 |. 50 push eax
6043330A |. E8 E1420200 call 604575F0
6043330F |. 83C4 14 add esp, 14
60433312 |. 55 push ebp
60433313 |. E8 E80B0200 call 60453F00
60433318 |. 8B7C24 20 mov edi, dword ptr [esp+20]
6043331C |. 83C4 04 add esp, 4
6043331F |. EB 1C jmp short 6043333D
60433321 |> 68 D83B4C60 push 604C3BD8 ; ASCII "AUM Service Object failed to get created."
60433326 |. 6A 00 push 0
60433328 |. 6A 04 push 4
6043332A |. 68 58F54B60 push 604BF558 ; ASCII "AMT"
6043332F |. E8 2C01FEFF call 60413460
60433334 |. 50 push eax
60433335 |. E8 B6420200 call 604575F0
6043333A |. 83C4 14 add esp, 14
6043333D |> 837E 0C 02 cmp dword ptr [esi+C], 2
60433341 |. 75 3C jnz short 6043337F
60433343 |. 8B4E 1C mov ecx, dword ptr [esi+1C]
60433346 |. E8 B5FFFDFF call 60413300
6043334B |. 84C0 test al, al
6043334D |. 74 30 je short 6043337F
6043334F |. 8B4E 1C mov ecx, dword ptr [esi+1C]
60433352 |. E8 1901FEFF call 60413470
60433357 |. 84C0 test al, al
60433359 |. 74 24 je short 6043337F
6043335B |. 83FF 02 cmp edi, 2
6043335E |. 75 1F jnz short 6043337F
60433360 |. 57 push edi
60433361 |. 8BCE mov ecx, esi
60433363 |. C746 0C 00000>mov dword ptr [esi+C], 0
6043336A |. E8 91E4FEFF call 60421800
6043336F |. 6A 00 push 0
60433371 |. E8 3A66FFFF call 604299B0
60433376 |. 5F pop edi
60433377 |. 5E pop esi
60433378 |. 5D pop ebp
60433379 |. 83C4 0C add esp, 0C
6043337C |. C2 0400 retn 4
6043337F |> 837E 0C 00 cmp dword ptr [esi+C], 0
60433383 |. 74 12 je short 60433397
60433385 |. 6A 00 push 0
60433387 |. 8BCE mov ecx, esi
60433389 |. E8 2266FFFF call 604299B0
6043338E |. 5F pop edi
6043338F |. 5E pop esi
60433390 |. 5D pop ebp
60433391 |. 83C4 0C add esp, 0C
60433394 |. C2 0400 retn 4
60433397 |> 8B6C24 0C mov ebp, dword ptr [esp+C]
6043339B |> 57 push edi
6043339C |. 8BCE mov ecx, esi
6043339E |. E8 7DFCFEFF call 60423020
604333A3 |. 6A 00 push 0
604333A5 |. 8BCE mov ecx, esi
604333A7 |. E8 0466FFFF call 604299B0
604333AC |. 8B76 0C mov esi, dword ptr [esi+C]
604333AF |. 85F6 test esi, esi
604333B1 |. 74 14 je short 604333C7
604333B3 |. 83FE 01 cmp esi, 1
604333B6 |. 74 0F je short 604333C7
604333B8 |. 55 push ebp
604333B9 |. 68 B03B4C60 push 604C3BB0 ; ASCII "ERROR: Failure %sing Product License!"
604333BE |. 68 303D4C60 push 604C3D30 ; ASCII "%sing"
604333C3 |. 6A 02 push 2
604333C5 |. EB 0D jmp short 604333D4
604333C7 |> 55 push ebp
604333C8 |. 68 943B4C60 push 604C3B94 ; ASCII "AMT: Product License %sed."
604333CD |. 68 8C3B4C60 push 604C3B8C ; ASCII "%sed"
604333D2 |. 6A 04 push 4
604333D4 |> 68 58F54B60 push 604BF558 ; ASCII "AMT"
604333D9 |. E8 8200FEFF call 60413460
604333DE |. 50 push eax
604333DF |. E8 0C420200 call 604575F0
604333E4 |. 83C4 18 add esp, 18
604333E7 |. 5F pop edi
604333E8 |. 5E pop esi
604333E9 |. 5D pop ebp
604333EA |. 83C4 0C add esp, 0C
604333ED \. C2 0400 retn 4
//修改1:
60433397 |> \8B6C24 0C mov ebp, dword ptr [esp+C]
6043339B |> 57 push edi
6043339C |. 8BCE mov ecx, esi
6043339E |. E8 7DFCFEFF call 60423020
604333A3 |. 6A 00 push 0
604333A5 |. 8BCE mov ecx, esi
604333A7 |. E8 0466FFFF call 604299B0
604333AC C746 0C 01000>mov dword ptr [esi+C], 1 ;---->修改
604333B3 |. 83FE 01 cmp esi, 1
604333B6 EB 0F jmp short 604333C7 ;---->修改
604333B8 |. 55 push ebp
604333B9 |. 68 B03B4C60 push 604C3BB0 ; ASCII "ERROR: Failure %sing Product License!"
604333BE |. 68 303D4C60 push 604C3D30 ; ASCII "%sing"
604333C3 |. 6A 02 push 2
604333C5 |. EB 0D jmp short 604333D4
604333C7 |> 55 push ebp
604333C8 |. 68 943B4C60 push 604C3B94 ; ASCII "AMT: Product License %sed."
604333CD |. 68 8C3B4C60 push 604C3B8C ; ASCII "%sed"
604333D2 |. 6A 04 push 4
604333D4 |> 68 58F54B60 push 604BF558 ; ASCII "AMT"
604333D9 |. E8 8200FEFF call 60413460
604333DE |. 50 push eax
604333DF |. E8 0C420200 call 604575F0
604333E4 |. 83C4 18 add esp, 18
604333E7 |. 5F pop edi
604333E8 |. 5E pop esi
604333E9 |. 5D pop ebp
604333EA |. 83C4 0C add esp, 0C
604333ED \. C2 0400 retn 4
//修改2:
60432BAD |. 3BC3 cmp eax, ebx ;mov eax, ebx
60432BAF |. 0F84 AC010000 je 60432D61 ;je-> jmp
60432BB5 |. 83FD 01 cmp ebp, 1
60432BB8 |. 75 2B jnz short 60432BE5
60432BBA |. 68 60384C60 push 604C3860 ; ASCII "Prevalidation finds app not activated. Requiring foreground validate."
60432BBF |. 6A 00 push 0
60432BC1 |. 6A 04 push 4
60432BC3 |> 68 58F54B60 push 604BF558 ; ASCII "AMT"
60432BC8 |. E8 9308FEFF call 60413460
60432BCD |. 50 push eax
60432BCE |. E8 1D4A0200 call 604575F0
60432BD3 |. 83C4 14 add esp, 14
60432BD6 |. 5F pop edi
60432BD7 |. C746 0C 02000>mov dword ptr [esi+C], 2
60432BDE |. 5E pop esi
60432BDF |. 5D pop ebp
60432BE0 |. 5B pop ebx
60432BE1 |. 59 pop ecx
60432BE2 |. C2 0400 retn 4
//目标是要到这里:
60432EBA |> \8BCE mov ecx, esi
60432EBC |. E8 FF30FFFF call 60425FC0
60432EC1 |> 68 D4354C60 push 604C35D4 ; ASCII "Completed Launch Workflow successfully."
60432EC6 |. 6A 00 push 0
60432EC8 |. 6A 04 push 4
60432ECA |. 68 58F54B60 push 604BF558 ; ASCII "AMT"
60432ECF |. E8 8C05FEFF call 60413460
60432ED4 |. 50 push eax
60432ED5 |. E8 16470200 call 604575F0
60432EDA |. 83C4 14 add esp, 14
60432EDD |> 5F pop edi
60432EDE |. 5E pop esi
60432EDF |. 5D pop ebp
60432EE0 |. 5B pop ebx
60432EE1 |. 59 pop ecx
60432EE2 \. C2 0400 retn 4
发表于 2012-2-2 16:01
发表于 2012-2-2 16:16
我很无知....不知道干嘛的
