由 yhl tabsstudio crack
1. Tabs Studio 使用
破解工具：
dnSpy
破解过程：
1. 使用dnSpy打开 TabStudio.dll,搜索 verify_reg_info()
// Token: 0x0600192B RID: 6443 RVA: 0x0013C9AC File Offset: 0x0013BDAC
internal unsafe static RegistrationKeyVerificationResult.Type verify_reg_info(RegInfo* reg_info)
{
Base64String base64String;
Base64String* ptr = <Module>.Base64String.{ctor}(ref base64String, ref <Module>.REG_PUBLIC_POINT2);
RegistrationKeyVerificationResult.Type result;
try
{
Base64String base64String2;
Base64String* ptr2 = <Module>.Base64String.{ctor}(ref base64String2, ref <Module>.REG_PUBLIC_POINT1);
try
{
result = (RegistrationKeyVerificationResult.Type)<Module>.RegistrationKeyVerifier.verify(ptr2, ptr, <Module>.RegInfo.get_key(reg_info), <Module>.RegInfo.get_user_name(reg_info));
}
catch
{
<Module>.___CxxCallUnwindDtor(ldftn(Base64String.{dtor}), (void*)(&base64String2));
throw;
}
<Module>.Base64String.{dtor}(ref base64String2);
}
catch
{
<Module>.___CxxCallUnwindDtor(ldftn(Base64String.{dtor}), (void*)(&base64String));
throw;
}
<Module>.Base64String.{dtor}(ref base64String);
return (RegistrationKeyVerificationResult.Type)result;
}
2. 右键编辑IL指令
0 0000 ldloca.s V_4 (4)
1 0002 ldsflda valuetype 'std.basic_string<char,std::char_traits<char>,std::allocator<char> >' modopt([mscorlib]System.Runtime.CompilerServices.IsConst) '<Module>'::REG_PUBLIC_POINT2
2 0007 call valuetype Base64String* modopt([mscorlib]System.Runtime.CompilerServices.CallConvThiscall) '<Module>'::'Base64String.{ctor}'(valuetype Base64String* modopt([mscorlib]System.Runtime.CompilerServices.IsConst) modopt([mscorlib]System.Runtime.CompilerServices.IsConst) , valuetype 'std.basic_string<char,std::char_traits<char>,std::allocator<char> >' modopt([mscorlib]System.Runtime.CompilerServices.IsConst) * modopt([mscorlib]System.Runtime.CompilerServices.IsImplicitlyDereferenced) )
3 000C stloc.2
4 000D ldloca.s V_3 (3)
5 000F ldsflda valuetype 'std.basic_string<char,std::char_traits<char>,std::allocator<char> >' modopt([mscorlib]System.Runtime.CompilerServices.IsConst) '<Module>'::REG_PUBLIC_POINT1
6 0014 call valuetype Base64String* modopt([mscorlib]System.Runtime.CompilerServices.CallConvThiscall) '<Module>'::'Base64String.{ctor}'(valuetype Base64String* modopt([mscorlib]System.Runtime.CompilerServices.IsConst) modopt([mscorlib]System.Runtime.CompilerServices.IsConst) , valuetype 'std.basic_string<char,std::char_traits<char>,std::allocator<char> >' modopt([mscorlib]System.Runtime.CompilerServices.IsConst) * modopt([mscorlib]System.Runtime.CompilerServices.IsImplicitlyDereferenced) )
7 0019 stloc.1
8 001A ldloc.1
9 001B ldloc.2
10 001C ldarg.0
11 001D call valuetype 'std.basic_string<char,std::char_traits<char>,std::allocator<char> >' modopt([mscorlib]System.Runtime.CompilerServices.IsConst) * modopt([mscorlib]System.Runtime.CompilerServices.IsImplicitlyDereferenced) modopt([mscorlib]System.Runtime.CompilerServices.CallConvThiscall) '<Module>'::RegInfo.get_key(valuetype RegInfo modopt([mscorlib]System.Runtime.CompilerServices.IsConst) * modopt([mscorlib]System.Runtime.CompilerServices.IsConst) modopt([mscorlib]System.Runtime.CompilerServices.IsConst) )
12 0022 ldarg.0
13 0023 call valuetype 'std.basic_string<char,std::char_traits<char>,std::allocator<char> >' modopt([mscorlib]System.Runtime.CompilerServices.IsConst) * modopt([mscorlib]System.Runtime.CompilerServices.IsImplicitlyDereferenced) modopt([mscorlib]System.Runtime.CompilerServices.CallConvThiscall) '<Module>'::RegInfo.get_user_name(valuetype RegInfo modopt([mscorlib]System.Runtime.CompilerServices.IsConst) * modopt([mscorlib]System.Runtime.CompilerServices.IsConst) modopt([mscorlib]System.Runtime.CompilerServices.IsConst) )
14 0028 call valuetype RegistrationKeyVerificationResult.Type modopt([mscorlib]System.Runtime.CompilerServices.CallConvCdecl) '<Module>'::RegistrationKeyVerifier.verify(valuetype Base64String modopt([mscorlib]System.Runtime.CompilerServices.IsConst) * modopt([mscorlib]System.Runtime.CompilerServices.IsImplicitlyDereferenced) , valuetype Base64String modopt([mscorlib]System.Runtime.CompilerServices.IsConst) * modopt([mscorlib]System.Runtime.CompilerServices.IsImplicitlyDereferenced) , valuetype 'std.basic_string<char,std::char_traits<char>,std::allocator<char> >' modopt([mscorlib]System.Runtime.CompilerServices.IsConst) * modopt([mscorlib]System.Runtime.CompilerServices.IsImplicitlyDereferenced) , valuetype 'std.basic_string<char,std::char_traits<char>,std::allocator<char> >' modopt([mscorlib]System.Runtime.CompilerServices.IsConst) * modopt([mscorlib]System.Runtime.CompilerServices.IsImplicitlyDereferenced) )
15 002D stloc.0
16 002E leave.s 21 (003E) ldloca.s V_3 (3)
17 0030 ldftn void modopt([mscorlib]System.Runtime.CompilerServices.CallConvThiscall) '<Module>'::'Base64String.{dtor}'(valuetype Base64String* modopt([mscorlib]System.Runtime.CompilerServices.IsConst) modopt([mscorlib]System.Runtime.CompilerServices.IsConst) )
18 0036 ldloca.s V_3 (3)
19 0038 call void '<Module>'::___CxxCallUnwindDtor(class 'method System.Void *(System.Void*)', void*)
20 003D endfinally
21 003E ldloca.s V_3 (3)
22 0040 call void modopt([mscorlib]System.Runtime.CompilerServices.CallConvThiscall) '<Module>'::'Base64String.{dtor}'(valuetype Base64String* modopt([mscorlib]System.Runtime.CompilerServices.IsConst) modopt([mscorlib]System.Runtime.CompilerServices.IsConst) )
23 0045 leave.s 28 (0055) ldloca.s V_4 (4)
24 0047 ldftn void modopt([mscorlib]System.Runtime.CompilerServices.CallConvThiscall) '<Module>'::'Base64String.{dtor}'(valuetype Base64String* modopt([mscorlib]System.Runtime.CompilerServices.IsConst) modopt([mscorlib]System.Runtime.CompilerServices.IsConst) )
25 004D ldloca.s V_4 (4)
26 004F call void '<Module>'::___CxxCallUnwindDtor(class 'method System.Void *(System.Void*)', void*)
27 0054 endfinally
28 0055 ldloca.s V_4 (4)
29 0057 call void modopt([mscorlib]System.Runtime.CompilerServices.CallConvThiscall) '<Module>'::'Base64String.{dtor}'(valuetype Base64String* modopt([mscorlib]System.Runtime.CompilerServices.IsConst) modopt([mscorlib]System.Runtime.CompilerServices.IsConst) )
30 005C ldloc.0
31 005D ret
3. 找到最后两行，将返回语句 return result改为 return 0
修改 倒数第二行的ldloc.0为ldc.i4.0
点击确定
4. 可以看到修改效果
// Token: 0x0600192B RID: 6443 RVA: 0x0013C9AC File Offset: 0x0013BDAC
internal unsafe static RegistrationKeyVerificationResult.Type verify_reg_info(RegInfo* reg_info)
{
Base64String base64String;
Base64String* ptr = <Module>.Base64String.{ctor}(ref base64String, ref <Module>.REG_PUBLIC_POINT2);
try
{
Base64String base64String2;
Base64String* ptr2 = <Module>.Base64String.{ctor}(ref base64String2, ref <Module>.REG_PUBLIC_POINT1);
try
{
RegistrationKeyVerificationResult.Type type = (RegistrationKeyVerificationResult.Type)<Module>.RegistrationKeyVerifier.verify(ptr2, ptr, <Module>.RegInfo.get_key(reg_info), <Module>.RegInfo.get_user_name(reg_info));
}
catch
{
<Module>.___CxxCallUnwindDtor(ldftn(Base64String.{dtor}), (void*)(&base64String2));
throw;
}
<Module>.Base64String.{dtor}(ref base64String2);
}
catch
{
<Module>.___CxxCallUnwindDtor(ldftn(Base64String.{dtor}), (void*)(&base64String));
throw;
}
<Module>.Base64String.{dtor}(ref base64String);
return (RegistrationKeyVerificationResult.Type)0;
}
5. 文件保存
文件--保存模块--选择保存位置
说明
使用dnSpy是因为，直接使用IlSpy, dotPeek等反编辑工具，反编辑为c#时会失败，使用dnSpy直接反编辑也会失败，只能直接编辑IL。
ContinueFormater破解：
1. 使用dnspy加载 KeyProcessor.dll
2. 找到 RegistrationKey.Verify
3. 编辑 c#代码，直接return
4. 打开vs,在插件激活窗口随便填。
- 打赏
- 分享
分享到...
请选择打赏方式
- 微信
- 支付宝