首先运行Acid burn.exe看下有没有什么可供利用的东东“：
首次出现的界面
点击确定之后出现的界面如下
而后点击Serial/Name出现界面
当输入任何值时，弹出对话框”Sorry, The serial is incorrect"
下面贴上Acid burn.exe的反汇编代码，查找Sorr。。。的所在
找到
CODE:0042FA57 cmp eax, 4
CODE:0042FA5A jge short loc_42FA79//经检测这应该是检测输入的名称的长度如果大于4才能进行进一步的检测
CODE:0042FA5C push 0 ; uType
CODE:0042FA5E mov ecx, offset dword_42FB74 ; lpCaption
CODE:0042FA63 mov edx, offset aSorryTheSerial ; "Sorry , The serial is incorect !"
CODE:0042FA68 mov eax, ds:off_430A48
CODE:0042FA6D mov eax, [eax]
CODE:0042FA6F call sub_42A170
CODE:0042FA74 jmp loc_42FB37
CODE:0042FA79 ; ---------------------------------------------------------------------------
CODE:0042FA79
CODE:0042FA79 loc_42FA79: ; CODE XREF: sub_42F998+C2j
CODE:0042FA79 lea edx, [ebp+var_10]
CODE:0042FA7C mov eax, [ebx+1DCh]
CODE:0042FA82 call sub_41AA58
CODE:0042FA87 mov eax, [ebp+var_10]
CODE:0042FA8A movzx eax, byte ptr [eax]
CODE:0042FA8D imul ds:dword_431750
CODE:0042FA93 mov ds:dword_431750, eax
CODE:0042FA98 mov eax, ds:dword_431750
CODE:0042FA9D add ds:dword_431750, eax
CODE:0042FAA3 lea eax, [ebp+var_4]
CODE:0042FAA6 mov edx, offset dword_42FBAC
CODE:0042FAAB call sub_403708
CODE:0042FAB0 lea eax, [ebp+var_8]
CODE:0042FAB3 mov edx, offset aCracked ; "CRACKED"
CODE:0042FAB8 call sub_403708
CODE:0042FABD push [ebp+var_4]
CODE:0042FAC0 push offset dword_42FBC8
还有就是
CODE:0042FAFE call sub_4039FC
CODE:0042FB03 jnz short loc_42FB1F;如果输入的是错的则输出sorry
CODE:0042FB05 push 0 ; uType
CODE:0042FB07 mov ecx, offset dword_42FBCC ; lpCaption
CODE:0042FB0C mov edx, offset aGoodJobDude ; "Good job dude =)"
CODE:0042FB11 mov eax, ds:off_430A48
CODE:0042FB16 mov eax, [eax]
CODE:0042FB18 call sub_42A170
CODE:0042FB1D jmp short loc_42FB37
CODE:0042FB1F ; ---------------------------------------------------------------------------
CODE:0042FB1F
CODE:0042FB1F loc_42FB1F: ; CODE XREF: sub_42F998+16Bj
CODE:0042FB1F push 0 ; uType
CODE:0042FB21 mov ecx, offset dword_42FB74 ; lpCaption
CODE:0042FB26 mov edx, offset aSorryTheSerial ; "Sorry , The serial is incorect !"
CODE:0042FB2B mov eax, ds:off_430A48
CODE:0042FB30 mov eax, [eax]
CODE:0042FB32 call sub_42A170
好了，下面进行破解
CODE:0042FB03 jnz short loc_42FB1F;使用hiew32 破解，将其改成两个90，,90即两个空指令
而对于CODE:0042FA5A jge short loc_42FA79//经检测这应该是检测输入的名称的长度如果大于4才能进行进一步的检测
则将其改成 jne short loc_42FA79//即可
显示如下
至此成功
