这阵子在练习脱壳！今天遇到一个软件是用fsg2.0壳加的！
用OD载入后，
下面这些都就fsg2.0的入口点了！！
00400154 > 8725 145A5600 xchg [565A14], esp
0040015A 61 popad
0040015B 94 xchg eax, esp
0040015C 55 push ebp
0040015D A4 movs byte ptr es:[edi], byte ptr [esi>
0040015E B6 80 mov dh, 80
00400160 FF13 call [ebx]
00400162 ^ 73 F9 jnb short 0040015D
00400164 33C9 xor ecx, ecx
00400166 FF13 call [ebx]
00400168 73 16 jnb short 00400180
0040016A 33C0 xor eax, eax
0040016C FF13 call [ebx]
0040016E 73 1F jnb short 0040018F
00400170 B6 80 mov dh, 80
00400172 41 inc ecx
00400173 B0 10 mov al, 10
00400175 FF13 call [ebx]
00400177 12C0 adc al, al
00400179 ^ 73 FA jnb short 00400175
0040017B 75 3A jnz short 004001B7
0040017D AA stos byte ptr es:[edi]
0040017E ^ EB E0 jmp short 00400160
00400180 FF53 08 call [ebx+8]
00400183 02F6 add dh, dh
00400185 83D9 01 sbb ecx, 1
00400188 75 0E jnz short 00400198
0040018A FF53 04 call [ebx+4]
0040018D EB 24 jmp short 004001B3
0040018F AC lods byte ptr [esi]
00400190 D1E8 shr eax, 1
00400192 74 2D je short 004001C1
00400194 13C9 adc ecx, ecx
00400196 EB 18 jmp short 004001B0
00400198 91 xchg eax, ecx
00400199 48 dec eax
0040019A C1E0 08 shl eax, 8
0040019D AC lods byte ptr [esi]
0040019E FF53 04 call [ebx+4]
004001A1 3B43 F8 cmp eax, [ebx-8]
004001A4 73 0A jnb short 004001B0
004001A6 80FC 05 cmp ah, 5
004001A9 73 06 jnb short 004001B1
004001AB 83F8 7F cmp eax, 7F
004001AE 77 02 ja short 004001B2
004001B0 41 inc ecx
004001B1 41 inc ecx
004001B2 95 xchg eax, ebp
004001B3 8BC5 mov eax, ebp
004001B5 B6 00 mov dh, 0
004001B7 56 push esi
004001B8 8BF7 mov esi, edi
004001BA 2BF0 sub esi, eax
004001BC F3:A4 rep movs byte ptr es:[edi], byte ptr>
004001BE 5E pop esi
004001BF ^ EB 9F jmp short 00400160
004001C1 5E pop esi
004001C2 AD lods dword ptr [esi]
004001C3 97 xchg eax, edi
004001C4 AD lods dword ptr [esi]
004001C5 50 push eax
004001C6 FF53 10 call [ebx+10]
004001C9 95 xchg eax, ebp
004001CA 8B07 mov eax, [edi]
004001CC 40 inc eax
004001CD ^ 78 F3 js short 004001C2
004001CF 75 03 jnz short 004001D4
004001D1 FF63 0C jmp [ebx+C]
我就一步一步跟踪！来到了004001D1这地址,然后就跳到了一个很大的跳转，就
来到原程序的入口点！就是下面的代码就是了!
0047F904 55 push 这个就是原程序的入口点
0047F905 8BEC mov ebp, esp
0047F907 83C4 F0 add esp, -10
0047F90A B8 C4F54700 mov eax, 0047F5C4
0047F90F E8 9C6AF8FF call 004063B0
0047F914 A1 40194800 mov eax, [481940]
0047F919 8B00 mov eax, [eax]
0047F91B E8 AC68FEFF call 004661CC
0047F920 8B0D 5C1A4800 mov ecx,
0047F926 A1 40194800 mov eax, [481940]
0047F92B 8B00 mov eax, [eax]
0047F92D 8B15 E8F04700 mov edx,
0047F933 E8 AC68FEFF call 004661E4
0047F938 A1 40194800 mov eax, [481940]
0047F93D 8B00 mov eax, [eax]
0047F93F E8 2069FEFF call 00466264
0047F944 E8 9746F8FF call 00403FE0
然后dump下来，发现不能运行！
用ImportREC_fix_hh.exe修复一下输入表函数！
结果只找到一个kernel32.dll FThunk一个函数！
然后修复了dump出来的文件，结果一样还是不能运行！提示出错，运行不了！
这是怎么回事呢？
我所提出的问题，纯属学习，希望大吓出手相救！
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
