请教各位：
前段时间在论坛里搜索peid查壳原理，找到一个回帖，说的是可以找到可执行程序入口点在“文件偏移处”的特征码，查找peid目录下的userdb.txt，从而匹配的相关的壳或者其他类型。
我简单的实现了一下：
1、读取程序入口点OptionalHeader.AddressOfEntryPoint，然后根据罗老师win32书上的方法，找到入口点在文件中的偏移，从此偏移处读取足够长的“二进制串”作为输入（我先找出了userdb.txt中所有特征码的最大长度，保证该”二进制串“足够长）；
2、从userdb.txt中找出改”二进制串”的子串，“？？”表示任意匹配，从而输出壳类型。
虽然不知道peid是否是这样实现的，但我这样确实能简单的查出一些壳。但现在问题来了，有时候一条输入“二进制串”能匹配多条子串，从而有多种壳类型，我就不知道怎么确定了，只好选择最长匹配子串，但有时候并不准确。
举个例子：（PEiD v0.94的plugins目录下有一个动态链接库ZDRx.dll）
1、通过PEiD查壳类型为：UPX 0.80 - 1.24 DLL -> Markus & Laszlo
2、我的程序查出来总共能匹配三个串：（计算的文件偏移是00000F50，和PEid上显示的一样，输入的字符串比较长，故放在最后）
1）、[tElock V0.99-1.0 Private -> tE!]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true
2）、[UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF
ep_only = true
3）、[UPX v0.89.6 - v1.02 / v1.05 - v1.22 Modified]
signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75
ep_only = true
最长串是3），虽然都是UPX，但貌似版本不同，而且我在userdb.txt中搜索了一下，没有找到UPX 0.80 - 1.24 DLL -> Markus & Laszlo这个类型，不知PEid是怎么判断的。
小弟在这里请各位科普一下：
1）、PEid的查壳原理是否和上述查壳方法类似，或者完全是其他方法？
2）、如果类似，遇到匹配几条的时候，怎么选择最匹配的壳？如上面的UPX和tElock 。会根据长度、问号（？？）的多少、子串出现的位置等等吗？
3）、如果是从文件偏移处读取的“二进制串”，长度多少适合？如果不是，一般提取特征码是从哪里提取的？
小弟先行谢过大家了，附上我读取的“二进制串”：
80 7C 24 08 01 0F 85 7D 01 00 00 60 BE 00 60 00 10 8D BE 00 B0 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 11 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 00 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE 00 40 00 00 8B 07 09 C0 74 3C 8B 5F 04 8D 84 30 58 60 00 00 01 F3 50 83 C7 08 FF 96 A8 60 00 00 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF 96 AC 60 00 00 09 C0 74 07 89 03 83 C3 04 EB E1 61 31 C0 C2 0C 00 83 C7 04 8D 5E FC 31 C0 8A 07 47 09 C0 74 22 3C EF 77 11 01 C3 8B 03 86 C4 C1 C0 10 86 C4 01 F0 89 03 EB E2 24 0F C1 E0 10 66 8B 07 83 C7 02 EB E2 61 E9 BE B0 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 05 00 00 00 18 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 65 00 00 00 30 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 48 00 00 00 60 30 00 00 64 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C4 70 00 00 A8 70 00 00 00 00 00 00 00 00
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
