[反汇编练习] 160个CrackMe之014.
本系列文章的目的是从一个没有任何经验的新手的角度(其实就是我自己)，一步步尝试将160个CrackMe全部破解，如果可以，通过任何方式写出一个类似于注册机的东西。
其中，文章中按照如下逻辑编排（解决如下问题）：
1、使用什么环境和工具
2、程序分析
3、思路分析和破解流程
4、注册机的探索
----------------------------------
提醒各位看客: 如果文章中的逻辑看不明白,那你一定是没有亲手操刀!OD中的跳转提示很强大,只要你跟踪了,不用怎么看代码就理解了!
----------------------------------
1、工具和环境：
WinXP SP3 + 52Pojie六周年纪念版OD + PEID + 汇编金手指。
160个CrackMe的打包文件。
下载地址： http://pan.baidu.com/s/1xUWOY 密码: jbnq
注：
1、Win7系统对于模块和程序开启了随机初始地址的功能，会给分析带来很大的负担，所以不建议使用Win7进行分析。
2、以上工具都是在52PoJie论坛下的原版程序，NOD32不报毒，个人承诺绝对不会进行任何和木马病毒相关内容。
2、程序分析：
想要破解一个程序，必须先了解这个程序。所以，在破解过程中，对最初程序的分析很重要，他可以帮助我们理解作者的目的和意图，特别是对于注册码的处理细节，从而方便我们反向跟踪和推导。
和上一节一样，打开CHM，选择第14个bjanes.exe，保存下来。运行程序，程序界面如下：
和之前的很多程序一样，有错误对话框。
使用PEID查看：VB 5.0 – 6.0
3、思路分析和破解流程
由于没壳，还有信息框，所以我们直接使用OD暂停，查看堆栈就可以跟踪到了。具体步骤：
1、打开OD，将exe拖入OD中，F9运行。
2、在Exe中输入伪码123456，点击Check it，信息框提示try again!
3、回到OD，点击暂停按钮（Ctrl+F2）,然后点击K图标（Ctrl+K），可以看到此时的堆栈信息
选中最后一个rtcMsgBox，右键->Show Call，返回到了反汇编窗口。
4、从Call xxxrtcMsgBox的位置开始，在附近浏览代码，发现很明显有提示正确和失败的文本。
00403A1D .^ E9 5AFDFFFF jmp 0040377C 00403A22 > 33DB xor ebx,ebx 00403A24 > 8B35 A4104000 mov esi,dword ptr ds:[<&MSVBVM60.__vbaVa>; msvbvm60.__vbaVarDup 00403A2A . B9 04000280 mov ecx,0x80020004 00403A2F . 894D 98 mov dword ptr ss:[ebp-0x68],ecx 00403A32 . B8 0A000000 mov eax,0xA 00403A37 . 894D A8 mov dword ptr ss:[ebp-0x58],ecx 00403A3A . BF 08000000 mov edi,0x8 00403A3F . 8D95 50FFFFFF lea edx,dword ptr ss:[ebp-0xB0] 00403A45 . 8D4D B0 lea ecx,dword ptr ss:[ebp-0x50] 00403A48 . 8945 90 mov dword ptr ss:[ebp-0x70],eax 00403A4B . 8945 A0 mov dword ptr ss:[ebp-0x60],eax 00403A4E . C785 58FFFFFF F0>mov dword ptr ss:[ebp-0xA8],004022F0 ; UNICODE "Wrong serial!" 00403A58 . 89BD 50FFFFFF mov dword ptr ss:[ebp-0xB0],edi 00403A5E . FFD6 call esi ; <&MSVBVM60.__vbaVarDup> 00403A60 . 8D95 60FFFFFF lea edx,dword ptr ss:[ebp-0xA0] 00403A66 . 8D4D C0 lea ecx,dword ptr ss:[ebp-0x40] 00403A69 . C785 68FFFFFF C8>mov dword ptr ss:[ebp-0x98],004022C8 ; UNICODE "Sorry, try again!" 00403A73 . 89BD 60FFFFFF mov dword ptr ss:[ebp-0xA0],edi 00403A79 . FFD6 call esi 00403A7B . 8D45 90 lea eax,dword ptr ss:[ebp-0x70] 00403A7E . 8D4D A0 lea ecx,dword ptr ss:[ebp-0x60] 00403A81 . 50 push eax 00403A82 . 8D55 B0 lea edx,dword ptr ss:[ebp-0x50] 00403A85 . 51 push ecx 00403A86 . 52 push edx 00403A87 . 8D45 C0 lea eax,dword ptr ss:[ebp-0x40] 00403A8A . 53 push ebx 00403A8B . 50 push eax 00403A8C . FF15 30104000 call dword ptr ds:[<&MSVBVM60.#595>] ; msvbvm60.rtcMsgBox 00403A92 . 8D4D 90 lea ecx,dword ptr ss:[ebp-0x70] 00403A95 . 8D55 A0 lea edx,dword ptr ss:[ebp-0x60] 00403A98 . 51 push ecx 00403A99 . 8D45 B0 lea eax,dword ptr ss:[ebp-0x50] 00403A9C . 52 push edx 00403A9D . 8D4D C0 lea ecx,dword ptr ss:[ebp-0x40] 00403AA0 . 50 push eax 00403AA1 . 51 push ecx 00403AA2 . EB 7E jmp short 00403B22 00403AA4 > 8B35 A4104000 mov esi,dword ptr ds:[<&MSVBVM60.__vbaVa>; msvbvm60.__vbaVarDup 00403AAA . B9 04000280 mov ecx,0x80020004 00403AAF . 894D 98 mov dword ptr ss:[ebp-0x68],ecx 00403AB2 . B8 0A000000 mov eax,0xA 00403AB7 . 894D A8 mov dword ptr ss:[ebp-0x58],ecx 00403ABA . BF 08000000 mov edi,0x8 00403ABF . 8D95 50FFFFFF lea edx,dword ptr ss:[ebp-0xB0] 00403AC5 . 8D4D B0 lea ecx,dword ptr ss:[ebp-0x50] 00403AC8 . 8945 90 mov dword ptr ss:[ebp-0x70],eax 00403ACB . 8945 A0 mov dword ptr ss:[ebp-0x60],eax 00403ACE . C785 58FFFFFF A4>mov dword ptr ss:[ebp-0xA8],004022A4 ; UNICODE "Correct serial!" 00403AD8 . 89BD 50FFFFFF mov dword ptr ss:[ebp-0xB0],edi 00403ADE . FFD6 call esi ; <&MSVBVM60.__vbaVarDup> 00403AE0 . 8D95 60FFFFFF lea edx,dword ptr ss:[ebp-0xA0] 00403AE6 . 8D4D C0 lea ecx,dword ptr ss:[ebp-0x40] 00403AE9 . C785 68FFFFFF 58>mov dword ptr ss:[ebp-0x98],00402258 ; UNICODE "Good job, tell me how you do that!" 00403AF3 . 89BD 60FFFFFF mov dword ptr ss:[ebp-0xA0],edi 00403AF9 . FFD6 call esi 00403AFB . 8D55 90 lea edx,dword ptr ss:[ebp-0x70] 00403AFE . 8D45 A0 lea eax,dword ptr ss:[ebp-0x60] 00403B01 . 52 push edx 00403B02 . 8D4D B0 lea ecx,dword ptr ss:[ebp-0x50] 00403B05 . 50 push eax 00403B06 . 51 push ecx 00403B07 . 8D55 C0 lea edx,dword ptr ss:[ebp-0x40] 00403B0A . 53 push ebx 00403B0B . 52 push edx 00403B0C . FF15 30104000 call dword ptr ds:[<&MSVBVM60.#595>] ; msvbvm60.rtcMsgBox
5、从这段代码开始，继续向上寻找，发现je/jg/jmp等跳转时选中这一行，查看跳转的位置，分析一下大概流程：
00403787 0F8F 17030000 jg 00403AA4 ; // 这个直接跳到正确，关键跳转 0040378D . 8B17 mov edx,dword ptr ds:[edi] 0040378F . 57 push edi 00403790 . FF92 08030000 call dword ptr ds:[edx+0x308] 00403796 . 50 push eax 00403797 . 8D45 D4 lea eax,dword ptr ss:[ebp-0x2C] 0040379A . 50 push eax 0040379B . FF15 2C104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>; msvbvm60.__vbaObjSet 004037A1 . 8BD8 mov ebx,eax 004037A3 . 8D55 E4 lea edx,dword ptr ss:[ebp-0x1C] 004037A6 . 52 push edx 004037A7 . 53 push ebx 004037A8 . 8B0B mov ecx,dword ptr ds:[ebx] 004037AA . FF91 A0000000 call dword ptr ds:[ecx+0xA0] 004037B0 . 85C0 test eax,eax 004037B2 . DBE2 fclex 004037B4 . 7D 12 jge short 004037C8 ; // 不是 004037B6 . 68 A0000000 push 0xA0 004037BB . 68 44224000 push 00402244 004037C0 . 53 push ebx 004037C1 . 50 push eax 004037C2 . FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>; msvbvm60.__vbaHresultCheckObj 004037C8 > 8B07 mov eax,dword ptr ds:[edi] 004037CA . 57 push edi 004037CB . FF90 08030000 call dword ptr ds:[eax+0x308] 004037D1 . 8D4D D0 lea ecx,dword ptr ss:[ebp-0x30] 004037D4 . 50 push eax 004037D5 . 51 push ecx 004037D6 . FF15 2C104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>; msvbvm60.__vbaObjSet 004037DC . 8BF8 mov edi,eax 004037DE . 8D45 DC lea eax,dword ptr ss:[ebp-0x24] 004037E1 . 50 push eax 004037E2 . 57 push edi 004037E3 . 8B17 mov edx,dword ptr ds:[edi] 004037E5 . FF92 A0000000 call dword ptr ds:[edx+0xA0] 004037EB . 85C0 test eax,eax 004037ED . DBE2 fclex 004037EF . 7D 12 jge short 00403803 ; // 不是 004037F1 . 68 A0000000 push 0xA0 004037F6 . 68 44224000 push 00402244 004037FB . 57 push edi 004037FC . 50 push eax 004037FD . FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>; msvbvm60.__vbaHresultCheckObj 00403803 > 0FBF7D E8 movsx edi,word ptr ss:[ebp-0x18] 00403807 . 8B55 DC mov edx,dword ptr ss:[ebp-0x24] 0040380A . B9 01000000 mov ecx,0x1 0040380F . 894D C8 mov dword ptr ss:[ebp-0x38],ecx 00403812 . 894D B8 mov dword ptr ss:[ebp-0x48],ecx 00403815 . 8D4D B0 lea ecx,dword ptr ss:[ebp-0x50] 00403818 . B8 02000000 mov eax,0x2 0040381D . 51 push ecx 0040381E . 57 push edi 0040381F . 52 push edx 00403820 . 8945 C0 mov dword ptr ss:[ebp-0x40],eax 00403823 . 8945 B0 mov dword ptr ss:[ebp-0x50],eax 00403826 . FF15 44104000 call dword ptr ds:[<&MSVBVM60.#631>] ; msvbvm60.rtcMidCharBstr 0040382C . 8BD0 mov edx,eax 0040382E . 8D4D D8 lea ecx,dword ptr ss:[ebp-0x28] 00403831 . FFD6 call esi 00403833 . 50 push eax 00403834 . FF15 1C104000 call dword ptr ds:[<&MSVBVM60.#516>] ; msvbvm60.rtcAnsiValueBstr 0040383A . 8B4D E4 mov ecx,dword ptr ss:[ebp-0x1C] 0040383D . 33DB xor ebx,ebx 0040383F . 66:3D 3900 cmp ax,0x39 00403843 . 8D45 C0 lea eax,dword ptr ss:[ebp-0x40] 00403846 . 50 push eax 00403847 . 57 push edi 00403848 . 0F9FC3 setg bl 0040384B . 51 push ecx 0040384C . F7DB neg ebx 0040384E . FF15 44104000 call dword ptr ds:[<&MSVBVM60.#631>] ; msvbvm60.rtcMidCharBstr 00403854 . 8BD0 mov edx,eax 00403856 . 8D4D E0 lea ecx,dword ptr ss:[ebp-0x20] 00403859 . FFD6 call esi 0040385B . 50 push eax 0040385C . FF15 1C104000 call dword ptr ds:[<&MSVBVM60.#516>] ; msvbvm60.rtcAnsiValueBstr 00403862 . 33D2 xor edx,edx 00403864 . 66:3D 3000 cmp ax,0x30 00403868 . 0F9CC2 setl dl 0040386B . F7DA neg edx 0040386D . 8D45 D8 lea eax,dword ptr ss:[ebp-0x28] 00403870 . 23DA and ebx,edx 00403872 . 8D4D DC lea ecx,dword ptr ss:[ebp-0x24] 00403875 . 50 push eax 00403876 . 8D55 E0 lea edx,dword ptr ss:[ebp-0x20] 00403879 . 51 push ecx 0040387A . 8D45 E4 lea eax,dword ptr ss:[ebp-0x1C] 0040387D . 52 push edx 0040387E . 50 push eax 0040387F . 6A 04 push 0x4 00403881 . FF15 90104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>; msvbvm60.__vbaFreeStrList 00403887 . 8D4D D0 lea ecx,dword ptr ss:[ebp-0x30] 0040388A . 8D55 D4 lea edx,dword ptr ss:[ebp-0x2C] 0040388D . 51 push ecx 0040388E . 52 push edx 0040388F . 6A 02 push 0x2 00403891 . FF15 18104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>; msvbvm60.__vbaFreeObjList 00403897 . 8D45 B0 lea eax,dword ptr ss:[ebp-0x50] 0040389A . 8D4D C0 lea ecx,dword ptr ss:[ebp-0x40] 0040389D . 50 push eax 0040389E . 51 push ecx 0040389F . 6A 02 push 0x2 004038A1 . FF15 0C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeV>; msvbvm60.__vbaFreeVarList 004038A7 . 83C4 2C add esp,0x2C 004038AA . 66:85DB test bx,bx 004038AD . 0F85 6F010000 jnz 00403A22 ; // 不是 004038B3 . 8B45 08 mov eax,dword ptr ss:[ebp+0x8] 004038B6 . 50 push eax 004038B7 . 8B10 mov edx,dword ptr ds:[eax] 004038B9 . FF92 08030000 call dword ptr ds:[edx+0x308] 004038BF . 50 push eax 004038C0 . 8D45 D4 lea eax,dword ptr ss:[ebp-0x2C] 004038C3 . 50 push eax 004038C4 . FF15 2C104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>; msvbvm60.__vbaObjSet 004038CA . 8BD8 mov ebx,eax 004038CC . 8D55 E4 lea edx,dword ptr ss:[ebp-0x1C] 004038CF . 52 push edx 004038D0 . 53 push ebx 004038D1 . 8B0B mov ecx,dword ptr ds:[ebx] 004038D3 . FF91 A0000000 call dword ptr ds:[ecx+0xA0] 004038D9 . 85C0 test eax,eax 004038DB . DBE2 fclex 004038DD . 7D 12 jge short 004038F1 ; // 选中5，不是 004038DF . 68 A0000000 push 0xA0 004038E4 . 68 44224000 push 00402244 004038E9 . 53 push ebx 004038EA . 50 push eax 004038EB . FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>; msvbvm60.__vbaHresultCheckObj 004038F1 > 66:8B45 E8 mov ax,word ptr ss:[ebp-0x18] 004038F5 . 8B1D 74104000 mov ebx,dword ptr ds:[<&MSVBVM60.#536>] ; msvbvm60.rtcStrFromVar 004038FB . 66:35 0200 xor ax,0x2 004038FF . 8D4D A0 lea ecx,dword ptr ss:[ebp-0x60] 00403902 . 0F80 A4020000 jo 00403BAC ; // 选中4，不是 00403908 . 51 push ecx 00403909 . 66:8945 A8 mov word ptr ss:[ebp-0x58],ax 0040390D . C745 A0 02000000 mov dword ptr ss:[ebp-0x60],0x2 00403914 . FFD3 call ebx ; <&MSVBVM60.#536> 00403916 . 8BD0 mov edx,eax 00403918 . 8D4D D8 lea ecx,dword ptr ss:[ebp-0x28] 0040391B . FFD6 call esi 0040391D . 8B45 E4 mov eax,dword ptr ss:[ebp-0x1C] 00403920 . 8D55 C0 lea edx,dword ptr ss:[ebp-0x40] 00403923 . 52 push edx 00403924 . 57 push edi 00403925 . 50 push eax 00403926 . C745 C8 01000000 mov dword ptr ss:[ebp-0x38],0x1 0040392D . C745 C0 02000000 mov dword ptr ss:[ebp-0x40],0x2 00403934 . FF15 44104000 call dword ptr ds:[<&MSVBVM60.#631>] ; msvbvm60.rtcMidCharBstr 0040393A . 8BD0 mov edx,eax 0040393C . 8D4D E0 lea ecx,dword ptr ss:[ebp-0x20] 0040393F . FFD6 call esi 00403941 . 50 push eax 00403942 . FF15 1C104000 call dword ptr ds:[<&MSVBVM60.#516>] ; msvbvm60.rtcAnsiValueBstr 00403948 . 8D4D B0 lea ecx,dword ptr ss:[ebp-0x50] 0040394B . 66:8945 B8 mov word ptr ss:[ebp-0x48],ax 0040394F . 51 push ecx 00403950 . C745 B0 02000000 mov dword ptr ss:[ebp-0x50],0x2 00403957 . FFD3 call ebx 00403959 . 8BD0 mov edx,eax 0040395B . 8D4D DC lea ecx,dword ptr ss:[ebp-0x24] 0040395E . FFD6 call esi 00403960 . 50 push eax 00403961 . FF15 84104000 call dword ptr ds:[<&MSVBVM60.__vbaR8Str>; msvbvm60.__vbaR8Str 00403967 . DC25 D8104000 fsub qword ptr ds:[0x4010D8] 0040396D . 8D55 90 lea edx,dword ptr ss:[ebp-0x70] 00403970 . 6A 01 push 0x1 00403972 . 52 push edx 00403973 . C785 30FFFFFF 05>mov dword ptr ss:[ebp-0xD0],0x8005 0040397D . DD9D 38FFFFFF fstp qword ptr ss:[ebp-0xC8] 00403983 . DFE0 fstsw ax 00403985 . A8 0D test al,0xD 00403987 . 0F85 1A020000 jnz 00403BA7 ; // 选中3，查看，也不是 0040398D . 8B45 D8 mov eax,dword ptr ss:[ebp-0x28] 00403990 . C745 D8 00000000 mov dword ptr ss:[ebp-0x28],0x0 00403997 . 8945 98 mov dword ptr ss:[ebp-0x68],eax 0040399A . 8D45 80 lea eax,dword ptr ss:[ebp-0x80] 0040399D . 50 push eax 0040399E . C745 90 08000000 mov dword ptr ss:[ebp-0x70],0x8 004039A5 . FF15 B0104000 call dword ptr ds:[<&MSVBVM60.#619>] ; msvbvm60.rtcRightCharVar 004039AB . 8D8D 30FFFFFF lea ecx,dword ptr ss:[ebp-0xD0] 004039B1 . 8D55 80 lea edx,dword ptr ss:[ebp-0x80] 004039B4 . 51 push ecx 004039B5 . 52 push edx 004039B6 . FF15 A0104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTs>; msvbvm60.__vbaVarTstNe 004039BC . 8BF8 mov edi,eax 004039BE . 8D45 D8 lea eax,dword ptr ss:[ebp-0x28] 004039C1 . 8D4D DC lea ecx,dword ptr ss:[ebp-0x24] 004039C4 . 50 push eax 004039C5 . 8D55 E0 lea edx,dword ptr ss:[ebp-0x20] 004039C8 . 51 push ecx 004039C9 . 8D45 E4 lea eax,dword ptr ss:[ebp-0x1C] 004039CC . 52 push edx 004039CD . 50 push eax 004039CE . 6A 04 push 0x4 004039D0 . FF15 90104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>; msvbvm60.__vbaFreeStrList 004039D6 . 83C4 14 add esp,0x14 004039D9 . 8D4D D4 lea ecx,dword ptr ss:[ebp-0x2C] 004039DC . FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>; msvbvm60.__vbaFreeObj 004039E2 . 8D4D 80 lea ecx,dword ptr ss:[ebp-0x80] 004039E5 . 8D55 90 lea edx,dword ptr ss:[ebp-0x70] 004039E8 . 51 push ecx 004039E9 . 8D45 A0 lea eax,dword ptr ss:[ebp-0x60] 004039EC . 52 push edx 004039ED . 8D4D B0 lea ecx,dword ptr ss:[ebp-0x50] 004039F0 . 50 push eax 004039F1 . 8D55 C0 lea edx,dword ptr ss:[ebp-0x40] 004039F4 . 51 push ecx 004039F5 . 52 push edx 004039F6 . 6A 05 push 0x5 004039F8 . FF15 0C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeV>; msvbvm60.__vbaFreeVarList 004039FE . 83C4 18 add esp,0x18 00403A01 . 66:85FF test di,di 00403A04 . 75 1C jnz short 00403A22 ; // 选中2，不是 00403A06 . 8B7D 08 mov edi,dword ptr ss:[ebp+0x8] 00403A09 . B8 01000000 mov eax,0x1 00403A0E . 66:0345 E8 add ax,word ptr ss:[ebp-0x18] 00403A12 . 0F80 94010000 jo 00403BAC ; // 选中1，查看跳转，不是 00403A18 . 8945 E8 mov dword ptr ss:[ebp-0x18],eax 00403A1B . 33DB xor ebx,ebx 00403A1D .^ E9 5AFDFFFF jmp 0040377C
到这段代码最上的位置时，发现回调到正确文本的位置，所以我么可以很肯定，这个跳转时关键跳转，改为jmp强制跳转就可以了。我们试试，选中这一行->空格键->将jg 00403AA4改为jmp 00403AA4,记得左下角的Nop填充打钩。然后回到程序，再次点击check it,发现仍然提示失败！
5、继续向上看：
004036D3 . FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>; msvbvm60.__vbaHresultCheckObj 004036D9 > 8B45 E4 mov eax,dword ptr ss:[ebp-0x1C] 004036DC . 50 push eax ; // eax="123123" 004036DD . FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBs>; msvbvm60.__vbaLenBstr 004036E3 . 33C9 xor ecx,ecx 004036E5 . 83F8 09 cmp eax,0x9 ; // 比较字符串长度与0x9，否则直接失败 004036E8 . 0F95C1 setne cl ; // cl=1 004036EB . F7D9 neg ecx ; // 取补，-1 004036ED . 8BF1 mov esi,ecx 004036EF . 8D4D E4 lea ecx,dword ptr ss:[ebp-0x1C] 004036F2 . FF15 C0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>; msvbvm60.__vbaFreeStr 004036F8 . 8D4D D4 lea ecx,dword ptr ss:[ebp-0x2C] 004036FB . FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>; msvbvm60.__vbaFreeObj 00403701 . 66:3BF3 cmp si,bx 00403704 0F85 1A030000 jnz 00403A24 ; // 这个会直接跳到失败 0040370A . 8B17 mov edx,dword ptr ds:[edi] 0040370C . 57 push edi 0040370D . FF92 08030000 call dword ptr ds:[edx+0x308]
到这里发现它使用cmp比较和jnz进行字符串长度判断，如果不等于9则直接跳转到失败！所以，文本的长度必须为9。我们重新输入伪码123123123，点击check it，哈哈哈！成功了！
当然，你也可以将jnz跳转也修改了！这样字符串长度也不用必须是9了。
4、注册机的探索
注册码判断的内容在关键跳转的上面，我们大概分析一下：
0040373F . FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>; msvbvm60.__vbaHresultCheckObj 00403745 > 8B45 E4 mov eax,dword ptr ss:[ebp-0x1C] 00403748 . 50 push eax ; // "123123123" 00403749 . FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBs>; msvbvm60.__vbaLenBstr 0040374F . 8BC8 mov ecx,eax ; // eax = 9 00403751 . FF15 50104000 call dword ptr ds:[<&MSVBVM60.__vbaI2I4>>; msvbvm60.__vbaI2I4 00403757 . 8D4D E4 lea ecx,dword ptr ss:[ebp-0x1C] ; // ecx = "123123123" 0040375A . 8985 14FFFFFF mov dword ptr ss:[ebp-0xEC],eax ; // eax = 9 00403760 . C745 E8 01000>mov dword ptr ss:[ebp-0x18],0x1 00403767 . FF15 C0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>; msvbvm60.__vbaFreeStr 0040376D . 8D4D D4 lea ecx,dword ptr ss:[ebp-0x2C] 00403770 . FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>; msvbvm60.__vbaFreeObj 00403776 . 8B35 AC104000 mov esi,dword ptr ds:[<&MSVBVM60.__vbaSt>; msvbvm60.__vbaStrMove 0040377C > 66:8B8D 14FFF>mov cx,word ptr ss:[ebp-0xEC] ; // cx =eax 00403783 . 66:394D E8 cmp word ptr ss:[ebp-0x18],cx ; // cx与0x1比较 00403787 0F8F 17030000 jg 00403AA4 ; // 这个直接跳到正确，关键跳转
这块算法只进行了一个比较，将文本长度和0x1比较，大于则成功！但是，由于在这之前又进行了文本长度校验，长度必须为9，所以按照正常逻辑，这是永远不可能提示正确的！
SO，这个程序没有注册码，只能爆破！
BY 笨笨D幸福