好友
阅读权限40
听众
最后登录1970-1-1
|
本帖最后由 冥界3大法王 于 2026-6-19 14:16 编辑
https://download.theinpaint.com/windows/InpaintSetup.exe
打开程序,随便用放大镜 拖动一下 需要去除 水印的地方一下,点击处理 图像按钮
按点 保存,就会出现:“This feature is available in registered version only.\nBuy it now?"
字串定位到这里
00000001400AA260 | 74 21 | je inpaint.1400AA283 近点有两个相等跳到1400AA283,显然离对话框太近,有经验的根本不用多看
00000001400AA26F | 75 12 | jne inpaint.1400AA283
按Ctrl+A分析下函数
Ctrl+Home转到函数头部
复制函数块到剪贴板就得到下面的内容:(方便吧? )
[Asm] 纯文本查看 复制代码 00000001400AA220 <inpai | 40:55 | push rbp |
00000001400AA222 | 53 | push rbx |
00000001400AA223 | 57 | push rdi |
00000001400AA224 | 48:8D6C24 B9 | lea rbp,qword ptr ss:[rsp-47] |
00000001400AA229 | 48:81EC A0000000 | sub rsp,A0 |
00000001400AA230 | 48:8BF9 | mov rdi,rcx |
00000001400AA233 | 48:8D05 3E548701 | lea rax,qword ptr ds:[14191F678] |
00000001400AA23A | 48:8945 77 | mov qword ptr ss:[rbp+77],rax |
00000001400AA23E | 4C:8D45 77 | lea r8,qword ptr ss:[rbp+77] |
00000001400AA242 | 48:8BD1 | mov rdx,rcx |
00000001400AA245 | 48:8D4D F7 | lea rcx,qword ptr ss:[rbp-9] |
00000001400AA249 | E8 E23A0000 | call <inpaint.sub_1400ADD30> |
00000001400AA24E | 90 | nop |
00000001400AA24F | 48:8B45 77 | mov rax,qword ptr ss:[rbp+77] |
00000001400AA253 | 8B08 | mov ecx,dword ptr ds:[rax] |
00000001400AA255 | BB FFFFFFFF | mov ebx,FFFFFFFF |
00000001400AA25A | 85C9 | test ecx,ecx |
00000001400AA25C | 74 13 | je inpaint.1400AA271 |
00000001400AA25E | 3BCB | cmp ecx,ebx |
00000001400AA260 | 74 21 | je inpaint.1400AA283 |
00000001400AA262 | 48:8B45 77 | mov rax,qword ptr ss:[rbp+77] |
00000001400AA266 | 8BCB | mov ecx,ebx |
00000001400AA268 | F0:0FC108 | lock xadd dword ptr ds:[rax],ecx |
00000001400AA26C | 83F9 01 | cmp ecx,1 |
00000001400AA26F | 75 12 | jne inpaint.1400AA283 |
00000001400AA271 | BA 02000000 | mov edx,2 |
00000001400AA276 | 44:8D42 06 | lea r8d,qword ptr ds:[rdx+6] |
00000001400AA27A | 48:8B4D 77 | mov rcx,qword ptr ss:[rbp+77] |
00000001400AA27E | E8 AD315200 | call <inpaint.sub_1405CD430> |
00000001400AA283 | 895C24 20 | mov dword ptr ss:[rsp+20],ebx |
00000001400AA287 | 45:33C9 | xor r9d,r9d |
00000001400AA28A | 4C:8D05 4F4FD401 | lea r8,qword ptr ds:[141DEF1E0] | 0000000141DEF1E0:"This feature is available in registered version only.\nBuy it now?"
00000001400AA291 | 48:8D55 7F | lea rdx,qword ptr ss:[rbp+7F] |
00000001400AA295 | 48:8D0D 3C6ACF01 | lea rcx,qword ptr ds:[141DA0CD8] |
00000001400AA29C | E8 8F865200 | call <inpaint.sub_1405D2930> |
00000001400AA2A1 | 90 | nop |
00000001400AA2A2 | 48:8D55 7F | lea rdx,qword ptr ss:[rbp+7F] |
00000001400AA2A6 | 48:8B4D 27 | mov rcx,qword ptr ss:[rbp+27] |
00000001400AA2AA | E8 51CE9A00 | call <inpaint.sub_140A57100> |
00000001400AA2AF | 90 | nop |
00000001400AA2B0 | 48:8B45 7F | mov rax,qword ptr ss:[rbp+7F] |
00000001400AA2B4 | 8B08 | mov ecx,dword ptr ds:[rax] |
00000001400AA2B6 | 85C9 | test ecx,ecx |
00000001400AA2B8 | 74 14 | je inpaint.1400AA2CE |
00000001400AA2BA | 83F9 FF | cmp ecx,FFFFFFFF |
00000001400AA2BD | 74 21 | je inpaint.1400AA2E0 |
00000001400AA2BF | 48:8B45 7F | mov rax,qword ptr ss:[rbp+7F] |
00000001400AA2C3 | 8BCB | mov ecx,ebx |
00000001400AA2C5 | F0:0FC108 | lock xadd dword ptr ds:[rax],ecx |
00000001400AA2C9 | 83F9 01 | cmp ecx,1 |
00000001400AA2CC | 75 12 | jne inpaint.1400AA2E0 |
00000001400AA2CE | BA 02000000 | mov edx,2 |
00000001400AA2D3 | 44:8D42 06 | lea r8d,qword ptr ds:[rdx+6] |
00000001400AA2D7 | 48:8B4D 7F | mov rcx,qword ptr ss:[rbp+7F] |
00000001400AA2DB | E8 50315200 | call <inpaint.sub_1405CD430> |
00000001400AA2E0 | 895C24 20 | mov dword ptr ss:[rsp+20],ebx |
00000001400AA2E4 | 45:33C9 | xor r9d,r9d |
00000001400AA2E7 | 4C:8D05 C618D101 | lea r8,qword ptr ds:[141DBBBB4] | 0000000141DBBBB4:"Yes"
00000001400AA2EE | 48:8D55 D7 | lea rdx,qword ptr ss:[rbp-29] |
00000001400AA2F2 | 48:8D0D DF69CF01 | lea rcx,qword ptr ds:[141DA0CD8] |
00000001400AA2F9 | E8 32865200 | call <inpaint.sub_1405D2930> |
00000001400AA2FE | 90 | nop |
00000001400AA2FF | 41:B8 05000000 | mov r8d,5 |
00000001400AA305 | 48:8D55 D7 | lea rdx,qword ptr ss:[rbp-29] |
00000001400AA309 | 48:8B4D 3F | mov rcx,qword ptr ss:[rbp+3F] |
00000001400AA30D | E8 BEC29800 | call <inpaint.sub_140A365D0> |
00000001400AA312 | 90 | nop |
00000001400AA313 | 48:8B45 D7 | mov rax,qword ptr ss:[rbp-29] |
00000001400AA317 | 8B08 | mov ecx,dword ptr ds:[rax] |
00000001400AA319 | 85C9 | test ecx,ecx |
00000001400AA31B | 74 14 | je inpaint.1400AA331 |
00000001400AA31D | 83F9 FF | cmp ecx,FFFFFFFF |
00000001400AA320 | 74 21 | je inpaint.1400AA343 |
00000001400AA322 | 48:8B45 D7 | mov rax,qword ptr ss:[rbp-29] |
00000001400AA326 | 8BCB | mov ecx,ebx |
00000001400AA328 | F0:0FC108 | lock xadd dword ptr ds:[rax],ecx |
00000001400AA32C | 83F9 01 | cmp ecx,1 |
00000001400AA32F | 75 12 | jne inpaint.1400AA343 |
00000001400AA331 | BA 02000000 | mov edx,2 |
00000001400AA336 | 44:8D42 06 | lea r8d,qword ptr ds:[rdx+6] |
00000001400AA33A | 48:8B4D D7 | mov rcx,qword ptr ss:[rbp-29] |
00000001400AA33E | E8 ED305200 | call <inpaint.sub_1405CD430> |
00000001400AA343 | 895C24 20 | mov dword ptr ss:[rsp+20],ebx |
00000001400AA347 | 45:33C9 | xor r9d,r9d |
00000001400AA34A | 4C:8D05 6718D101 | lea r8,qword ptr ds:[141DBBBB8] | 0000000141DBBBB8:"No"
00000001400AA351 | 48:8D55 DF | lea rdx,qword ptr ss:[rbp-21] |
00000001400AA355 | 48:8D0D 7C69CF01 | lea rcx,qword ptr ds:[141DA0CD8] |
00000001400AA35C | E8 CF855200 | call <inpaint.sub_1405D2930> |
00000001400AA361 | 90 | nop |
00000001400AA362 | 41:B8 06000000 | mov r8d,6 |
00000001400AA368 | 48:8D55 DF | lea rdx,qword ptr ss:[rbp-21] |
00000001400AA36C | 48:8B4D 3F | mov rcx,qword ptr ss:[rbp+3F] |
00000001400AA370 | E8 5BC29800 | call <inpaint.sub_140A365D0> |
00000001400AA375 | 90 | nop |
00000001400AA376 | 48:8B45 DF | mov rax,qword ptr ss:[rbp-21] |
00000001400AA37A | 8B08 | mov ecx,dword ptr ds:[rax] |
00000001400AA37C | 85C9 | test ecx,ecx |
00000001400AA37E | 74 14 | je inpaint.1400AA394 |
00000001400AA380 | 83F9 FF | cmp ecx,FFFFFFFF |
00000001400AA383 | 74 21 | je inpaint.1400AA3A6 |
00000001400AA385 | 48:8B45 DF | mov rax,qword ptr ss:[rbp-21] |
00000001400AA389 | 8BD3 | mov edx,ebx |
00000001400AA38B | F0:0FC110 | lock xadd dword ptr ds:[rax],edx |
00000001400AA38F | 83FA 01 | cmp edx,1 |
00000001400AA392 | 75 12 | jne inpaint.1400AA3A6 |
00000001400AA394 | BA 02000000 | mov edx,2 |
00000001400AA399 | 44:8D42 06 | lea r8d,qword ptr ds:[rdx+6] |
00000001400AA39D | 48:8B4D DF | mov rcx,qword ptr ss:[rbp-21] |
00000001400AA3A1 | E8 8A305200 | call <inpaint.sub_1405CD430> |
00000001400AA3A6 | 895C24 20 | mov dword ptr ss:[rsp+20],ebx |
00000001400AA3AA | 45:33C9 | xor r9d,r9d |
00000001400AA3AD | 4C:8D05 3441D401 | lea r8,qword ptr ds:[141DEE4E8] | 0000000141DEE4E8:"Enter the serial key"
00000001400AA3B4 | 48:8D55 E7 | lea rdx,qword ptr ss:[rbp-19] |
00000001400AA3B8 | 48:8D0D 1969CF01 | lea rcx,qword ptr ds:[141DA0CD8] |
00000001400AA3BF | E8 6C855200 | call <inpaint.sub_1405D2930> |
00000001400AA3C4 | 90 | nop |
00000001400AA3C5 | 41:B8 03000000 | mov r8d,3 |
00000001400AA3CB | 48:8D55 E7 | lea rdx,qword ptr ss:[rbp-19] |
00000001400AA3CF | 48:8B4D 3F | mov rcx,qword ptr ss:[rbp+3F] |
00000001400AA3D3 | E8 F8C19800 | call <inpaint.sub_140A365D0> |
00000001400AA3D8 | 90 | nop |
00000001400AA3D9 | 48:8B45 E7 | mov rax,qword ptr ss:[rbp-19] |
00000001400AA3DD | 8B08 | mov ecx,dword ptr ds:[rax] |
00000001400AA3DF | 85C9 | test ecx,ecx |
00000001400AA3E1 | 74 14 | je inpaint.1400AA3F7 |
00000001400AA3E3 | 83F9 FF | cmp ecx,FFFFFFFF |
00000001400AA3E6 | 74 21 | je inpaint.1400AA409 |
00000001400AA3E8 | 48:8B45 E7 | mov rax,qword ptr ss:[rbp-19] |
00000001400AA3EC | 8BCB | mov ecx,ebx |
00000001400AA3EE | F0:0FC108 | lock xadd dword ptr ds:[rax],ecx |
00000001400AA3F2 | 83F9 01 | cmp ecx,1 |
00000001400AA3F5 | 75 12 | jne inpaint.1400AA409 |
00000001400AA3F7 | BA 02000000 | mov edx,2 |
00000001400AA3FC | 44:8D42 06 | lea r8d,qword ptr ds:[rdx+6] |
00000001400AA400 | 48:8B4D E7 | mov rcx,qword ptr ss:[rbp-19] |
00000001400AA404 | E8 27305200 | call <inpaint.sub_1405CD430> |
00000001400AA409 | 48:8D4D F7 | lea rcx,qword ptr ss:[rbp-9] |
00000001400AA40D | E8 8E5F9800 | call <inpaint.sub_140A303A0> |
00000001400AA412 | 83F8 03 | cmp eax,3 |
00000001400AA415 | 74 0C | je inpaint.1400AA423 |
00000001400AA417 | 83F8 05 | cmp eax,5 |
00000001400AA41A | 75 10 | jne inpaint.1400AA42C |
00000001400AA41C | E8 5F2EFFFF | call <inpaint.sub_14009D280> |
00000001400AA421 | EB 09 | jmp inpaint.1400AA42C |
00000001400AA423 | 48:8BCF | mov rcx,rdi |
00000001400AA426 | E8 0532FFFF | call <inpaint.sub_14009D630> |
00000001400AA42B | 90 | nop |
00000001400AA42C | 48:8D05 6D50D401 | lea rax,qword ptr ds:[<&sub_14009 |
00000001400AA433 | 48:8945 F7 | mov qword ptr ss:[rbp-9],rax |
00000001400AA437 | 48:8D05 3A52D401 | lea rax,qword ptr ds:[141DEF678] |
00000001400AA43E | 48:8945 07 | mov qword ptr ss:[rbp+7],rax |
00000001400AA442 | 48:8B45 37 | mov rax,qword ptr ss:[rbp+37] |
00000001400AA446 | 8B08 | mov ecx,dword ptr ds:[rax] |
00000001400AA448 | 85C9 | test ecx,ecx |
00000001400AA44A | 74 12 | je inpaint.1400AA45E |
00000001400AA44C | 83F9 FF | cmp ecx,FFFFFFFF |
00000001400AA44F | 74 1F | je inpaint.1400AA470 |
00000001400AA451 | 48:8B45 37 | mov rax,qword ptr ss:[rbp+37] |
00000001400AA455 | F0:0FC118 | lock xadd dword ptr ds:[rax],ebx |
00000001400AA459 | 83FB 01 | cmp ebx,1 |
00000001400AA45C | 75 12 | jne inpaint.1400AA470 |
00000001400AA45E | BA 02000000 | mov edx,2 |
00000001400AA463 | 44:8D42 06 | lea r8d,qword ptr ds:[rdx+6] |
00000001400AA467 | 48:8B4D 37 | mov rcx,qword ptr ss:[rbp+37] |
00000001400AA46B | E8 C02F5200 | call <inpaint.sub_1405CD430> |
00000001400AA470 | 48:8D4D F7 | lea rcx,qword ptr ss:[rbp-9] |
00000001400AA474 | E8 07549800 | call <inpaint.sub_140A2F880> |
00000001400AA479 | 48:81C4 A0000000 | add rsp,A0 |
00000001400AA480 | 5F | pop rdi |
00000001400AA481 | 5B | pop rbx |
00000001400AA482 | 5D | pop rbp |
00000001400AA483 | C3 | ret |
选中 00000001400AA222 | 53 | push rbx | 行按Ctrl+R 查找引用
右击,如图设置断点
右击 复制=》整个表格
右击批量打补丁
全部NOP尝试,反正不费脑,试着玩,行就更好,不成也正常。
双击加个备注 失败1 失败2 失败3
右击还原补丁 或删除补丁
依次查看3个call,直接段首 返回 1
00000001400A6B00 <inpai | 40:53 | push rbx ===> mov al,1 ;ret 爆破成功
00000001400A6B02 | 56 | push rsi |
00000001400A6B03 | 57 | push rdi |
00000001400A6B04 | 48:83EC 20 | sub rsp,20 |
00000001400A6B08 | 48:8BF9 | mov rdi,rcx |
00000001400A6B0B | C74424 48 00000000 | mov dword ptr ss:[rsp+48],0 |
00000001400A6B13 | E8 A8060000 | call <inpaint.sub_1400A71C0> |
00000001400A6B18 | BB FFFFFFFF | mov ebx,FFFFFFFF |
00000001400A6B1D | 3C 01 | cmp al,1 |
00000001400A6B1F | 74 09 | je inpaint.1400A6B2A |
00000001400A6B21 | 80BF B0000000 01 | cmp byte ptr ds:[rdi+B0],1 |
00000001400A6B28 | 75 4D | jne inpaint.1400A6B77 |
00000001400A6B2A | 48:8D5424 50 | lea rdx,qword ptr ss:[rsp+50] |
00000001400A6B2F | E8 FCFEFFFF | call <inpaint.sub_1400A6A30> |
00000001400A6B34 | 90 | nop |
00000001400A6B35 | 45:33C0 | xor r8d,r8d |
00000001400A6B38 | 48:8BD0 | mov rdx,rax |
00000001400A6B3B | 48:8BCF | mov rcx,rdi |
00000001400A6B3E | E8 4D390000 | call <inpaint.sub_1400AA490> |
00000001400A6B43 | 90 | nop |
00000001400A6B44 | 48:8B4424 50 | mov rax,qword ptr ss:[rsp+50] |
00000001400A6B49 | 8B08 | mov ecx,dword ptr ds:[rax] |
00000001400A6B4B | 85C9 | test ecx,ecx |
00000001400A6B4D | 74 15 | je inpaint.1400A6B64 |
00000001400A6B4F | 83F9 FF | cmp ecx,FFFFFFFF |
00000001400A6B52 | 74 23 | je inpaint.1400A6B77 |
00000001400A6B54 | 48:8B4424 50 | mov rax,qword ptr ss:[rsp+50] |
00000001400A6B59 | 8BCB | mov ecx,ebx |
00000001400A6B5B | F0:0FC108 | lock xadd dword ptr ds:[rax],ecx |
00000001400A6B5F | 83F9 01 | cmp ecx,1 |
00000001400A6B62 | 75 13 | jne inpaint.1400A6B77 |
00000001400A6B64 | BA 02000000 | mov edx,2 |
00000001400A6B69 | 44:8D42 06 | lea r8d,qword ptr ds:[rdx+6] |
00000001400A6B6D | 48:8B4C24 50 | mov rcx,qword ptr ss:[rsp+50] |
00000001400A6B72 | E8 B9685200 | call <inpaint.sub_1405CD430> |
00000001400A6B77 | 48:8D5424 58 | lea rdx,qword ptr ss:[rsp+58] |
00000001400A6B7C | E8 AFFEFFFF | call <inpaint.sub_1400A6A30> |
00000001400A6B81 | 90 | nop |
00000001400A6B82 | C74424 48 01000000 | mov dword ptr ss:[rsp+48],1 |
00000001400A6B8A | 48:8B00 | mov rax,qword ptr ds:[rax] |
00000001400A6B8D | 8378 04 00 | cmp dword ptr ds:[rax+4],0 |
00000001400A6B91 | 74 17 | je inpaint.1400A6BAA |
00000001400A6B93 | E8 28060000 | call <inpaint.sub_1400A71C0> |
00000001400A6B98 | 3C 01 | cmp al,1 |
00000001400A6B9A | 74 0E | je inpaint.1400A6BAA |
00000001400A6B9C | 80BF B0000000 01 | cmp byte ptr ds:[rdi+B0],1 |
00000001400A6BA3 | 74 05 | je inpaint.1400A6BAA |
00000001400A6BA5 | 40:32F6 | xor sil,sil |
00000001400A6BA8 | EB 03 | jmp inpaint.1400A6BAD |
00000001400A6BAA | 40:B6 01 | mov sil,1 |
00000001400A6BAD | 48:8B4424 58 | mov rax,qword ptr ss:[rsp+58] |
00000001400A6BB2 | 8B08 | mov ecx,dword ptr ds:[rax] |
00000001400A6BB4 | 85C9 | test ecx,ecx |
00000001400A6BB6 | 74 13 | je inpaint.1400A6BCB |
00000001400A6BB8 | 83F9 FF | cmp ecx,FFFFFFFF |
00000001400A6BBB | 74 21 | je inpaint.1400A6BDE |
00000001400A6BBD | 48:8B4424 58 | mov rax,qword ptr ss:[rsp+58] |
00000001400A6BC2 | F0:0FC118 | lock xadd dword ptr ds:[rax],ebx |
00000001400A6BC6 | 83FB 01 | cmp ebx,1 |
00000001400A6BC9 | 75 13 | jne inpaint.1400A6BDE |
00000001400A6BCB | BA 02000000 | mov edx,2 |
00000001400A6BD0 | 44:8D42 06 | lea r8d,qword ptr ds:[rdx+6] |
00000001400A6BD4 | 48:8B4C24 58 | mov rcx,qword ptr ss:[rsp+58] |
00000001400A6BD9 | E8 52685200 | call <inpaint.sub_1405CD430> |
00000001400A6BDE | 40:84F6 | test sil,sil |
00000001400A6BE1 | 74 12 | je inpaint.1400A6BF5 |
00000001400A6BE3 | 48:8BCF | mov rcx,rdi |
00000001400A6BE6 | E8 35360000 | call <inpaint.sub_1400AA220> | 失败2
Ctrl+P ,选中当前模块
直接回车即可( 补丁名也不用输入了,这就叫科学)
此时程序已经爆破成功,提示消失,保存OK了。
theinpaint11.0 爆破版本就安新家了。
|
免费评分
-
查看全部评分
|