Compare commits

...
4 Commits
Author SHA1 Message Date
specialz 6a854ac9bf fix: patch startup license check to always pass
- Patch sub_140155CC0 -> return 1 (registry has license data)
- Patch sub_1400F7F60 -> return 1 (license validation passed)
- These run at startup, before registration dialog
- 10 patches total
2026-07-31 07:48:15 +08:00
specialz aacec14d3e fix: force success path after online verify regardless of result
- Patch at 0xF90FC: replace 'test al,al; jnz' with 'mov al,1; jmp'
- Forces success path (write registry) even when server rejects
- 8 patches total: 1x return 1 + 5x NOP + 1x jz->jmp + 1x force success
2026-07-31 07:45:46 +08:00
specialz 45d16cfcde fix: restore online verify, NOP BADF3300 exit for offline path
- Restore sub_1401581D0 to original (let it run, server will reject)
- NOP jz at 0xF911A to skip BADF3300 error exit
- After online verify fails, code continues to offline registration path
- Offline path writes registry data using the product key itself
- 7 patches: 1x return 1 + 5x NOP + 1x jz->jmp
2026-07-31 07:43:46 +08:00
specialz 697e7175e8 fix: restore register and registry-write functions, fix keygen format
- Restore sub_1400F9690 (register function) to original
- Restore sub_140155E90 (registry write) to original
- Keygen now generates 26-char keys: YYYYMMDD + 18 random chars
- Matches Honeycam's regex validation: [2][0-1][0-9][0-9][0-1][0-9][0-3][0-9]
- 7 patches: 2x return 1 + 4x NOP + 1x jz->jmp
2026-07-31 07:40:58 +08:00
+27 -12
View File
@@ -69,10 +69,6 @@ BACKUP_PATH = (EXE_PATH + '.bak') if EXE_PATH else None
PATCHES = [ PATCHES = [
(0x154EB0, b'\x48\x89\x54\x24\x10\x53', b'\xB0\x01\xC3', (0x154EB0, b'\x48\x89\x54\x24\x10\x53', b'\xB0\x01\xC3',
'sub_1401558B0 (Edition read -> return 1)'), 'sub_1401558B0 (Edition read -> return 1)'),
(0x1577D0, b'\x4C\x89\x4C\x24\x20\x4C', b'\xB0\x01\xC3',
'sub_1401581D0 (online verify -> return 1)'),
(0x155490, b'\x48\x89\x5C\x24\x18\x55', b'\xB0\x01\xC3',
'sub_140155E90 (registry write -> return 1)'),
(0x0F8F09, b'\x0F\x85\x51\x05\x00\x00', b'\x90\x90\x90\x90\x90\x90', (0x0F8F09, b'\x0F\x85\x51\x05\x00\x00', b'\x90\x90\x90\x90\x90\x90',
'NOP: key length check'), 'NOP: key length check'),
(0x0F8F16, b'\x0F\x8C\x44\x05\x00\x00', b'\x90\x90\x90\x90\x90\x90', (0x0F8F16, b'\x0F\x8C\x44\x05\x00\x00', b'\x90\x90\x90\x90\x90\x90',
@@ -83,8 +79,14 @@ PATCHES = [
'NOP: @ position check'), 'NOP: @ position check'),
(0x0F8F54, b'\x74\x1B', b'\xEB\x1B', (0x0F8F54, b'\x74\x1B', b'\xEB\x1B',
'jz -> jmp (skip lm.dll key validation)'), 'jz -> jmp (skip lm.dll key validation)'),
(0x0F8C90, b'\x48\x89\x5C\x24\x20\x4C', b'\xB0\x01\xC3', (0x0F911A, b'\x0F\x84\x9A\x02\x00\x00', b'\x90\x90\x90\x90\x90\x90',
'sub_1400F9690 (register function -> return 1)'), 'NOP: BADF3300 error exit (continue offline path)'),
(0x0F90FC, b'\x84\xC0\x0F\x85\x17\x01\x00\x00', b'\xB0\x01\xE9\x18\x01\x00\x00\x90',
'Force success after online verify (mov al,1; jmp)'),
(0x1552C0, b'\x89\x4C\x24\x08\x4C\x8B', b'\xB0\x01\xC3',
'sub_140155CC0 (license data read -> return 1)'),
(0x0F7560, b'\x48\x89\x5C\x24\x08\x4C', b'\xB0\x01\xC3',
'sub_1400F7F60 (license validation -> return 1)'),
] ]
@@ -290,14 +292,27 @@ def do_restore():
def generate_keygen(email): def generate_keygen(email):
"""生成注册码""" """生成注册码
Honeycam 注册码格式: 26 字符
- 前 8 位: 日期 YYYYMMDD (正则 [2][0-1][0-9][0-9][0-1][0-9][0-3][0-9])
- 后 18 位: 任意字符
"""
import datetime
seed = int(hashlib.md5(email.encode()).hexdigest()[:8], 16) seed = int(hashlib.md5(email.encode()).hexdigest()[:8], 16)
rng = random.Random(seed) rng = random.Random(seed)
segments = []
for _ in range(4): # 前 8 位: 日期 (2019-2021 年范围, 匹配正则 [2][0-1][0-9][0-9])
seg = ''.join(rng.choices('0123456789ABCDEF', k=8)) year = rng.randint(2019, 2021)
segments.append(seg) month = rng.randint(1, 12)
return '-'.join(segments) day = rng.randint(1, 28)
date_prefix = f"{year}{month:02d}{day:02d}"
# 后 18 位: 随机字符
charset = string.ascii_letters + string.digits
suffix = ''.join(rng.choices(charset, k=18))
return date_prefix + suffix
def do_keygen(): def do_keygen():