程序的查壳是：Safengine Licensor Demo v1.8.0.0；脱壳的时候发现oep应该是分成了两部分；
一：
00BB6A7A 8BFF mov edi, edi ; vc8.0
00BB6A7C 55 push ebp
00BB6A7D 8BEC mov ebp, esp
00BB6A7F 83EC 10 sub esp, 0x10
00BB6A82 A1 FC19E700 mov eax, dword ptr [0xE719FC]
00BB6A87 8365 F8 00 and dword ptr [ebp-0x8], 0x0
00BB6A8B 8365 FC 00 and dword ptr [ebp-0x4], 0x0
00BB6A8F 53 push ebx
00BB6A90 57 push edi
00BB6A91 BF 4EE640BB mov edi, 0xBB40E64E
00BB6A96 BB 0000FFFF mov ebx, 0xFFFF0000
00BB6A9B 3BC7 cmp eax, edi
00BB6A9D 74 0D je short 00BB6AAC
00BB6A9F 85C3 test ebx, eax
00BB6AA1 74 09 je short 00BB6AAC
00BB6AA3 F7D0 not eax
00BB6AA5 A3 001AE700 mov dword ptr [0xE71A00], eax
00BB6AAA EB 65 jmp short 00BB6B11
00BB6AAC 56 push esi
00BB6AAD 8D45 F8 lea eax, dword ptr [ebp-0x8]
00BB6AB0 50 push eax
00BB6AB1 FF15 E499C900 call dword ptr [0xC999E4] ; kernel32.GetSystemTimeAsFileTime
00BB6AB7 8B75 FC mov esi, dword ptr [ebp-0x4]
00BB6ABA 3375 F8 xor esi, dword ptr [ebp-0x8]
00BB6ABD FF15 3099C900 call dword ptr [0xC99930] ; kernel32.GetCurrentProcessId
00BB6AC3 33F0 xor esi, eax
00BB6AC5 FF15 E099C900 call dword ptr [0xC999E0] ; kernel32.GetCurrentThreadId
00BB6ACB 33F0 xor esi, eax
00BB6ACD FF15 AC9AC900 call dword ptr [0xC99AAC] ; kernel32.GetTickCount
00BB6AD3 33F0 xor esi, eax
00BB6AD5 8D45 F0 lea eax, dword ptr [ebp-0x10]
00BB6AD8 50 push eax
00BB6AD9 FF15 C898C900 call dword ptr [0xC998C8] ; kernel32.QueryPerformanceCounter
00BB6ADF 8B45 F4 mov eax, dword ptr [ebp-0xC]
00BB6AE2 3345 F0 xor eax, dword ptr [ebp-0x10]
00BB6AE5 33F0 xor esi, eax
00BB6AE7 3BF7 cmp esi, edi
00BB6AE9 75 07 jnz short 00BB6AF2
00BB6AEB BE 4FE640BB mov esi, 0xBB40E64F
00BB6AF0 EB 10 jmp short 00BB6B02
00BB6AF2 85F3 test ebx, esi
00BB6AF4 75 0C jnz short 00BB6B02
00BB6AF6 8BC6 mov eax, esi
00BB6AF8 0D 11470000 or eax, 0x4711
00BB6AFD C1E0 10 shl eax, 0x10
00BB6B00 0BF0 or esi, eax
00BB6B02 8935 FC19E700 mov dword ptr [0xE719FC], esi
00BB6B08 F7D6 not esi
00BB6B0A 8935 001AE700 mov dword ptr [0xE71A00], esi
00BB6B10 5E pop esi
00BB6B11 5F pop edi
00BB6B12 5B pop ebx
00BB6B13 C9 leave
00BB6B14 C3 retn
retn之后回到了壳的代码区，然后进过一系列f8，又回到了第一次跳往OEP的地方，执行如下代码：
二：
00BB6605 ^\E9 1CFDFFFF jmp 00BB6326
00BB6326 6A 5C push 0x5C
00BB6328 68 E055E100 push 00E155E0
00BB632D E8 6EFAFFFF call 00BB5DA0
00BB6332 33DB xor ebx, ebx
00BB6334 895D E4 mov dword ptr [ebp-0x1C], ebx
00BB6337 8D45 94 lea eax, dword ptr [ebp-0x6C]
00BB633A 50 push eax
00BB633B FF15 8C98C900 call dword ptr [0xC9988C] ; kernel32.GetStartupInfoW
00BB6341 391D 20931B01 cmp dword ptr [0x11B9320], ebx
00BB6347 75 0B jnz short 00BB6354
00BB6349 53 push ebx
00BB634A 53 push ebx
00BB634B 6A 01 push 0x1
00BB634D 53 push ebx
00BB634E FF15 9098C900 call dword ptr [0xC99890] ; kernel32.HeapSetInformation
00BB6354 895D FC mov dword ptr [ebp-0x4], ebx
00BB6357 64:A1 18000000 mov eax, dword ptr fs:[0x18]
00BB635D 8B70 04 mov esi, dword ptr [eax+0x4]
00BB6360 895D DC mov dword ptr [ebp-0x24], ebx
00BB6363 BF 18931B01 mov edi, 011B9318
00BB6368 53 push ebx
00BB6369 56 push esi
00BB636A 57 push edi
00BB636B FF15 9498C900 call dword ptr [0xC99894] ; kernel32.InterlockedCompareExchange
这两部分合在一起应该就是vc8.0的入口代码，只是在jmp 00BB6326之前的那个call被修改了。
请教各位大牛，有没有什么好方法来修补OEP，还有上面代码里面的固定地址该怎么处理呢
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
