方法1:
关于TextMate的注册
这个号称The Missing Editor for Mac OS X的编辑器我就不介绍了,我就说说如何注册吧。
第一种方法:花39欧元
第二种方法:Uninstall first and Instal again, just open the TextMate unix (Apps > contens > Mac OS > TextMate) with TextEdit > search 2007 change to 2017 > save. after that using with register
user: handholder crakced you
code:
DKFTCCXCMWOX35TZKPRN5YNR2NYUTJJAY52VHWKX2H5URTUB72KW-
RCRTQJCC2ZZV5BTHSKCNQXTAOSGSLN46V3E7NIJKDBLRDY37NRVD-
IXQWZ5SVPHBN67JZDZTTAQ6MS4ROVXRCGDZGKGE2VGOGHEYMPRGY-
O5Y243GTBKPZLPP55QSBIHR6MDEUBMVQT4Q3SESPWETRG6PJM
这是我搜寻很久后发现的最好方法了,还有一种是强行破解,就失去了美感了
方法2:
转载自:http://hlinzhou.blogbus.com/logs/13746756.html
恩,这个传说中超级好用的TextMate是要注册的:
俺们且利用考试与考试的间隙来尝试一下Mac OS X下程序的破解。
首先找到TextMate主程序的所在:/Applications/TextMate.app/Contents/MacOS/TextMate,将其 copy到Win下,万能的IDA Pro大神竟然无法识别:(。Google后被告知可用Mac OS X自带的otool -tV反汇编之。
zhang-yingdediannao:~ cherry$ otool -tV /Applications/TextMate.app/Contents/MacOS/TextMate > dis.asm
查找敏感关键字
zhang-yingdediannao:~ cherry$ grep -i license dis.asm
000071c6 movl _OakRegistrationLicenseKey,%esi
-[OakRegistrationManager setLicenseKey:]:
-[OakRegistrationManager lostLicense:]:
-[OakRegistrationManager changeToLicenseInformationView:]:
-[OakRegistrationManager changeLicense:]:
00085aff cmpl $_LicenseTypes,%ebx
-[OakRegistrationManager setLicenseInfo:]:
00085bfc movl $_LicenseTypes,%esi
恩,貌似都是OakRegistrationManager类的内容,看看这个类都有些什么方法
zhang-yingdediannao:~ cherry$ grep -i OakRegistrationManager -A 1 dis.asm
-[OakRegistrationManager resetTrialPeriod:]:
000846b0 pushl %ebp
--
+[OakRegistrationManager sharedInstance]:
00084728 pushl %ebp
--
-[OakRegistrationManager init]:
00084754 pushl %ebp
--
-[OakRegistrationManager canRegister]:
00084854 pushl %ebp
--
-[OakRegistrationManager ownerPortrait]:
00084864 pushl %ebp
--
-[OakRegistrationManager setLicenseKey:]:
000848d6 pushl %ebp
--
-[OakRegistrationManager orderFrontRegistrationPanel:]:
00084912 pushl %ebp
--
-[OakRegistrationManager windowWillClose:]:
00084b58 movl 0x0022b038,%eax
--
-[OakRegistrationManager ok:]:
00084b74 pushl %ebp
--
-[OakRegistrationManager cancel:]:
00084baa pushl %ebp
--
-[OakRegistrationManager continue:]:
00084be4 pushl %ebp
--
-[OakRegistrationManager lostLicense:]:
00084c1e pushl %ebp
--
-[OakRegistrationManager buyOnline:]:
00084c90 pushl %ebp
--
-[OakRegistrationManager changeToLicenseInformationView:]:
00084e0c pushl %ebp
--
+[OakRegistrationManager initialize]:
000850f8 pushl %ebp
--
-[OakRegistrationManager changeLicense:]:
000856dc pushl %ebp
--
-[OakRegistrationManager setOwner:]:
000859c8 pushl %ebp
--
-[OakRegistrationManager setLicenseInfo:]:
00085b0e pushl %ebp
gdb调试,在最可疑的几个方法上下断点,发现canRegister方法中被调用的__Z13is_registeredv函数可能是关键:
__Z13is_registeredv:
0000715a pushl %ebp
0000715b movl %esp,%ebp
0000715d pushl %edi
0000715e pushl %esi
...
00007942 movl %ecx,%eax
00007944 popl %ebx
00007945 popl %esi
00007946 popl %edi
00007947 leave
00007948 ret
00007949 nop
尝试让其总是返回1
(gdb) b *0x00007944
Breakpoint 1 at 0x7944
(gdb) r
...
Breakpoint 1, 0x00007944 in is_registered ()
(gdb) set $eax = 1
(gdb) c
重复几次,启动完成后不跳出注册框,点TextMate/Registration显示已经注册。
恩,那么现在就直接考虑将00007942处的movl %ecx,%eax替换为mov eax, 1,爆破之。
用Win下的OllyICE试验了一下,mov eax, ecx机器码为89 C8 ,mov al, 1机器码为B0 01(mov eax, 1大于两个字节)。
由于反汇编代码所显示的地址与文件实际偏移不同,首先需将0x00007942换算为文件实际偏移。
以start为基准计算offset:
zhang-yingdediannao:~ cherry$ head dis.asm
/Applications/TextMate.app/Contents/MacOS/TextMate:
(__TEXT,__text) section
start:
00002f90 pushl $0x00
00002f92 movl %esp,%ebp
00002f94 andl $0xf0,%esp
00002f97 subl $0x10,%esp
00002f9a movl 0x04(%ebp),%ebx
00002f9d movl %ebx,0x00(%esp,1)
00002fa1 leal 0x08(%ebp),%ecx
zhang-yingdediannao:~ cherry$ otool -t /Applications/TextMate.app/Contents/MacOS/TextMate | grep 00002f90
00002f90 6a 00 89 e5 83 e4 f0 83 ec 10 8b 5d 04 89 5c 24
zhang-yingdediannao:~ cherry$ vim /Applications/TextMate.app/Contents/MacOS/TextMate
%!xxd转换为十六进制,查找6a00 89e5有
0314f90 6a 00 89 e5 83 e4 f0 83 ec 10 8b 5d 04 89 5c 24
offset = 0x0314f90 - 0x2f90 = 0x312000
所以movl %ecx,%eax在文件中的实际位置为:
0x312000 + 0x7942 = 0x319942
WinHex编辑,copy回Mac,重新运行TextMate,显示已注册。
关于TextMate的注册
这个号称The Missing Editor for Mac OS X的编辑器我就不介绍了,我就说说如何注册吧。
第一种方法:花39欧元
第二种方法:Uninstall first and Instal again, just open the TextMate unix (Apps > contens > Mac OS > TextMate) with TextEdit > search 2007 change to 2017 > save. after that using with register
user: handholder crakced you
code:
DKFTCCXCMWOX35TZKPRN5YNR2NYUTJJAY52VHWKX2H5URTUB72KW-
RCRTQJCC2ZZV5BTHSKCNQXTAOSGSLN46V3E7NIJKDBLRDY37NRVD-
IXQWZ5SVPHBN67JZDZTTAQ6MS4ROVXRCGDZGKGE2VGOGHEYMPRGY-
O5Y243GTBKPZLPP55QSBIHR6MDEUBMVQT4Q3SESPWETRG6PJM
这是我搜寻很久后发现的最好方法了,还有一种是强行破解,就失去了美感了
方法2:
转载自:http://hlinzhou.blogbus.com/logs/13746756.html
恩,这个传说中超级好用的TextMate是要注册的:
俺们且利用考试与考试的间隙来尝试一下Mac OS X下程序的破解。
首先找到TextMate主程序的所在:/Applications/TextMate.app/Contents/MacOS/TextMate,将其 copy到Win下,万能的IDA Pro大神竟然无法识别:(。Google后被告知可用Mac OS X自带的otool -tV反汇编之。
zhang-yingdediannao:~ cherry$ otool -tV /Applications/TextMate.app/Contents/MacOS/TextMate > dis.asm
查找敏感关键字
zhang-yingdediannao:~ cherry$ grep -i license dis.asm
000071c6 movl _OakRegistrationLicenseKey,%esi
-[OakRegistrationManager setLicenseKey:]:
-[OakRegistrationManager lostLicense:]:
-[OakRegistrationManager changeToLicenseInformationView:]:
-[OakRegistrationManager changeLicense:]:
00085aff cmpl $_LicenseTypes,%ebx
-[OakRegistrationManager setLicenseInfo:]:
00085bfc movl $_LicenseTypes,%esi
恩,貌似都是OakRegistrationManager类的内容,看看这个类都有些什么方法
zhang-yingdediannao:~ cherry$ grep -i OakRegistrationManager -A 1 dis.asm
-[OakRegistrationManager resetTrialPeriod:]:
000846b0 pushl %ebp
--
+[OakRegistrationManager sharedInstance]:
00084728 pushl %ebp
--
-[OakRegistrationManager init]:
00084754 pushl %ebp
--
-[OakRegistrationManager canRegister]:
00084854 pushl %ebp
--
-[OakRegistrationManager ownerPortrait]:
00084864 pushl %ebp
--
-[OakRegistrationManager setLicenseKey:]:
000848d6 pushl %ebp
--
-[OakRegistrationManager orderFrontRegistrationPanel:]:
00084912 pushl %ebp
--
-[OakRegistrationManager windowWillClose:]:
00084b58 movl 0x0022b038,%eax
--
-[OakRegistrationManager ok:]:
00084b74 pushl %ebp
--
-[OakRegistrationManager cancel:]:
00084baa pushl %ebp
--
-[OakRegistrationManager continue:]:
00084be4 pushl %ebp
--
-[OakRegistrationManager lostLicense:]:
00084c1e pushl %ebp
--
-[OakRegistrationManager buyOnline:]:
00084c90 pushl %ebp
--
-[OakRegistrationManager changeToLicenseInformationView:]:
00084e0c pushl %ebp
--
+[OakRegistrationManager initialize]:
000850f8 pushl %ebp
--
-[OakRegistrationManager changeLicense:]:
000856dc pushl %ebp
--
-[OakRegistrationManager setOwner:]:
000859c8 pushl %ebp
--
-[OakRegistrationManager setLicenseInfo:]:
00085b0e pushl %ebp
gdb调试,在最可疑的几个方法上下断点,发现canRegister方法中被调用的__Z13is_registeredv函数可能是关键:
__Z13is_registeredv:
0000715a pushl %ebp
0000715b movl %esp,%ebp
0000715d pushl %edi
0000715e pushl %esi
...
00007942 movl %ecx,%eax
00007944 popl %ebx
00007945 popl %esi
00007946 popl %edi
00007947 leave
00007948 ret
00007949 nop
尝试让其总是返回1
(gdb) b *0x00007944
Breakpoint 1 at 0x7944
(gdb) r
...
Breakpoint 1, 0x00007944 in is_registered ()
(gdb) set $eax = 1
(gdb) c
重复几次,启动完成后不跳出注册框,点TextMate/Registration显示已经注册。
恩,那么现在就直接考虑将00007942处的movl %ecx,%eax替换为mov eax, 1,爆破之。
用Win下的OllyICE试验了一下,mov eax, ecx机器码为89 C8 ,mov al, 1机器码为B0 01(mov eax, 1大于两个字节)。
由于反汇编代码所显示的地址与文件实际偏移不同,首先需将0x00007942换算为文件实际偏移。
以start为基准计算offset:
zhang-yingdediannao:~ cherry$ head dis.asm
/Applications/TextMate.app/Contents/MacOS/TextMate:
(__TEXT,__text) section
start:
00002f90 pushl $0x00
00002f92 movl %esp,%ebp
00002f94 andl $0xf0,%esp
00002f97 subl $0x10,%esp
00002f9a movl 0x04(%ebp),%ebx
00002f9d movl %ebx,0x00(%esp,1)
00002fa1 leal 0x08(%ebp),%ecx
zhang-yingdediannao:~ cherry$ otool -t /Applications/TextMate.app/Contents/MacOS/TextMate | grep 00002f90
00002f90 6a 00 89 e5 83 e4 f0 83 ec 10 8b 5d 04 89 5c 24
zhang-yingdediannao:~ cherry$ vim /Applications/TextMate.app/Contents/MacOS/TextMate
%!xxd转换为十六进制,查找6a00 89e5有
0314f90 6a 00 89 e5 83 e4 f0 83 ec 10 8b 5d 04 89 5c 24
offset = 0x0314f90 - 0x2f90 = 0x312000
所以movl %ecx,%eax在文件中的实际位置为:
0x312000 + 0x7942 = 0x319942
WinHex编辑,copy回Mac,重新运行TextMate,显示已注册。