平时很少碰加密壳的咚咚，今天这个没办法只好硬着头皮看着天书来跟，但怎么跟也不对，只好象各位请教！
参考：fly大侠1.6的脱壳
00454000 S> 60 pushad //入口
00454001 EB 01 jmp short SuperSL1.00454004
00454003 76 0F jbe short SuperSL1.00454014
00454005 8001 00 add byte ptr ds:[ecx],0
00454008 0000 add byte ptr ds:[eax],al
0045400A F9 stc
BP Process32First+1
77E9CA16 K> 55 push ebp
77E9CA17 8BEC mov ebp,esp //断在这里
77E9CA19 81EC 2C020000 sub esp,22C
77E9CA1F 53 push ebx
77E9CA20 56 push esi
77E9CA21 8B75 0C mov esi,dword ptr ss:[ebp+C]
77E9CA24 85F6 test esi,esi
77E9CA26 0F84 96000000 je KERNEL32.77E9CAC2
77E9CA2C 813E 28010000 cmp dword ptr ds:[esi],128
77E9CA32 0F82 8A000000 jb KERNEL32.77E9CAC2
77E9CA38 8D85 D4FDFFFF lea eax,dword ptr ss:[ebp-22C]
77E9CA3E C785 D4FDFFFF 2C020>mov dword ptr ss:[ebp-22C],22C
77E9CA48 50 push eax
77E9CA49 FF75 08 push dword ptr ss:[ebp+8]
77E9CA4C E8 0FFFFFFF call KERNEL32.Process32FirstW
77E9CA51 8BD8 mov ebx,eax
77E9CA53 6A 00 push 0
77E9CA55 6A 00 push 0
77E9CA57 8D46 24 lea eax,dword ptr ds:[esi+24]
77E9CA5A 68 04010000 push 104
77E9CA5F 50 push eax
77E9CA60 8D85 F8FDFFFF lea eax,dword ptr ss:[ebp-208]
77E9CA66 6A FF push -1
77E9CA68 50 push eax
77E9CA69 6A 00 push 0
77E9CA6B 6A 00 push 0
77E9CA6D E8 22DFFCFF call KERNEL32.WideCharToMultiByte
77E9CA72 8B85 D8FDFFFF mov eax,dword ptr ss:[ebp-228]
77E9CA78 8946 04 mov dword ptr ds:[esi+4],eax
77E9CA7B 8B85 DCFDFFFF mov eax,dword ptr ss:[ebp-224]
77E9CA81 8946 08 mov dword ptr ds:[esi+8],eax
77E9CA84 8B85 E0FDFFFF mov eax,dword ptr ss:[ebp-220]
77E9CA8A 8946 0C mov dword ptr ds:[esi+C],eax
77E9CA8D 8B85 E4FDFFFF mov eax,dword ptr ss:[ebp-21C]
77E9CA93 8946 10 mov dword ptr ds:[esi+10],eax
77E9CA96 8B85 E8FDFFFF mov eax,dword ptr ss:[ebp-218]
77E9CA9C 8946 14 mov dword ptr ds:[esi+14],eax
77E9CA9F 8B85 ECFDFFFF mov eax,dword ptr ss:[ebp-214]
77E9CAA5 8946 18 mov dword ptr ds:[esi+18],eax
77E9CAA8 8B85 F0FDFFFF mov eax,dword ptr ss:[ebp-210]
77E9CAAE 8946 1C mov dword ptr ds:[esi+1C],eax
77E9CAB1 8B85 F4FDFFFF mov eax,dword ptr ss:[ebp-20C]
77E9CAB7 8946 20 mov dword ptr ds:[esi+20],eax
77E9CABA 8BC3 mov eax,ebx
77E9CABC 5E pop esi
77E9CABD 5B pop ebx
77E9CABE C9 leave
77E9CABF C2 0800 retn 8 //返回到 004646C5 (SuperSL1.004646C5)
//这里好像是有两个返回地址，好像有顺序的(返回到 00464B66)
=============================004646C5=============================
004646C5 /EB 17 jmp short SuperSL1.004646DE //D ESP(0012FF58)
004646C7 |90 nop
004646C8 |90 nop
004646C9 |90 nop
004646CA |B8 E8030000 mov eax,3E8
004646CF |E8 FAF1FFFF call SuperSL1.004638CE
004646D4 |8DBD 615D4000 lea edi,dword ptr ss:[ebp+405D61]
004646DA |03F8 add edi,eax
004646DC |AB stos dword ptr es:[edi]
004646DD |58 pop eax
004646DE \0BC0 or eax,eax
004646E0 0F84 2B020000 je SuperSL1.00464911
004646E6 8B95 63FA4000 mov edx,dword ptr ss:[ebp+40FA63]
004646EC 3B95 4FFA4000 cmp edx,dword ptr ss:[ebp+40FA4F]
004646F2 74 4C je short SuperSL1.00464740
0012FF58 0F 79 46 00 29 7A 46 00 00 30 05 00 78 FF 12 00 yF.)zF..0.x?.
在0012FF58处的4个字节上下“硬件访问->Word”断点，F9运行
00464987 49 dec ecx
00464988 ^ EB E1 jmp short SuperSL1.0046496B
0046498A 61 popad
0046498B 61 popad
0046498C C3 retn //断在这里,返回到 00467A30 (SuperSL1.00467A30)
0046498D 60 pushad
0046498E E8 01000000 call SuperSL1.00464994
00464993 ^ 7C 83 jl short SuperSL1.00464918
00467A30 60 pushad
//返回到这里，请问这里又是一层壳吗？
00467A31 E8 00000000 call SuperSL1.00467A36
00467A36 5E pop esi
00467A37 83EE 06 sub esi,6
00467A3A B9 2B000000 mov ecx,2B
00467A3F 29CE sub esi,ecx
00467A41 BA ADC59D5E mov edx,5E9DC5AD
00467A46 C1E9 02 shr ecx,2
00467A49 83E9 02 sub ecx,2
00467A4C 83F9 00 cmp ecx,0
00467A4F 7C 1A jl short SuperSL1.00467A6B //F4到下边
00467A51 8B048E mov eax,dword ptr ds:[esi+ecx*4]
00467A54 8B5C8E 04 mov ebx,dword ptr ds:[esi+ecx*4+4]
00467A58 03C3 add eax,ebx
00467A5A C1C0 1C rol eax,1C
00467A5D 03C2 add eax,edx
00467A5F 81F2 9395844F xor edx,4F849593
00467A65 89048E mov dword ptr ds:[esi+ecx*4],eax
00467A68 49 dec ecx
00467A69 ^ EB E1 jmp short SuperSL1.00467A4C
00467A6B 61 popad //F4到这里
00467A6C 61 popad
00467A6D C3 retn //返回到 004699DA (SuperSL1.004699DA)
00467A6E C3 retn
004699DA /73 02 jnb short SuperSL1.004699DE
//这里难道是OEP？
004699DC |87C7 xchg edi,eax
004699DE \03F5 add esi,ebp
004699E0 E8 01000000 call SuperSL1.004699E6 //F7
004699E6 830424 06 add dword ptr ss:[esp],6
004699EA C3 retn //返回到 004699EB (SuperSL1.004699EB)
004699EB 40 inc eax
004699EC 66:8BC3 mov ax,bx
004699EF C1C6 05 rol esi,5
004699F2 EB 01 jmp short SuperSL1.004699F5 //跳
004699F5 /0F85 05000000 jnz SuperSL1.00469A00
004699FB |66:81F0 C960 xor ax,60C9
00469A00 \83E9 FC sub ecx,-4
00469A03 3331 xor esi,dword ptr ds:[ecx]
00469A05 83C1 FC add ecx,-4
00469A08 E8 01000000 call SuperSL1.00469A0E //F7
00469A0E 83C4 04 add esp,4
00469A11 40 inc eax
00469A12 8931 mov dword ptr ds:[ecx],esi
00469A14 E8 01000000 call SuperSL1.00469A1A //F7
00469A1A 830424 06 add dword ptr ss:[esp],6
00469A1E C3 retn //返回到 00469A1F (SuperSL1.00469A1F)
00469A1F 1BC7 sbb eax,edi
00469A21 81ED 76EE183B sub ebp,3B18EE76
00469A27 E8 01000000 call SuperSL1.00469A2D //F7
00469A2D 830424 06 add dword ptr ss:[esp],6
00469A31 C3 retn //返回到 00469A32 (SuperSL1.00469A32)
00469A32 4A dec edx
00469A33 03C7 add eax,edi
00469A35 83C1 04 add ecx,4
00469A38 EB 01 jmp short SuperSL1.00469A3B //跳
00469A3B /E9 0E000000 jmp SuperSL1.00469A4E //跳
00469A40 |0F84 02000000 je SuperSL1.00469A48
00469A46 |8BD3 mov edx,ebx
00469A48 |81E8 6BB8F877 sub eax,77F8B86B
00469A4E \83C3 FF add ebx,-1
004699C8 8B31 mov esi,dword ptr ds:[ecx]
004699CA E8 01000000 call SuperSL1.004699D0 //F7
004699D0 830424 06 add dword ptr ss:[esp],6
004699D4 C3 retn //返回到 004699D5 (SuperSL1.004699D5)
004699D5 E8 80DEFFFF call SuperSL1.0046785A
004699DA 73 02 jnb short SuperSL1.004699DE
004699DC 87C7 xchg edi,eax
004699DE 03F5 add esi,ebp
004699E0 E8 01000000 call SuperSL1.004699E6
004699E5 ^ 75 83 jnz short SuperSL1.0046996A
004699E7 04 24 add al,24
004699E9 06 push es
004699EA C3 retn
看了半天，晕晕的，蒙蒙的，请各位指点一下，谢谢！
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
