如果IAT加密了，此时IAT中的地址不是指向系统DLL中的API函数了，可能指向外壳。这就十分有必要找到外壳处理IAT的代码了，前面己说过，外壳加载时，会模拟Windows加载器，向IAT里填充当前操作系统API函数的实际地址。所以，在IAT里设个内存写断点，就可中断到这段代码处。重新加载notepad.upx.exe，在IAT某个地址下内存写断点，这里选择0x4062E4这个地址设内存写断点，先在数据窗口下命令：D 4062E4
[QUOTE]
这段是《脱壳基础知识入门》中的一段话，我现在正好遇到这样的问题，想请教一下，当IAT不连续怎么办？？？应该是被加密过才会这样子吧！！
样子类似下面这样子，截一段发上来给大大们看看
PS：加壳方式是ACProtect，之前发过帖的
07054DC 007BC5CD mysoft.007BC5CD
007054E0 007BC5DA mysoft.007BC5DA
007054E4 007BC5E7 mysoft.007BC5E7
007054E8 007BC5F4 mysoft.007BC5F4
007054EC 007BC601 mysoft.007BC601
007054F0 007BC60E mysoft.007BC60E
007054F4 007BC61B mysoft.007BC61B
007054F8 007BC628 mysoft.007BC628
007054FC 007BC635 mysoft.007BC635
00705500 00000000
00705504 003069CE
00705508 003069E4
0070550C 003069FE
00705510 00000000
00705514 77BD1A50 VERSION.GetFileVersionInfoA
00705518 77BD19FF VERSION.GetFileVersionInfoSizeA
0070551C 77BD18BA VERSION.VerQueryValueA
00705520 00000000
00705524 80000065
00705528 80000074
0070552C 8000006F
00705530 80000073
00705534 80000003
00705538 80000004
0070553C 80000034
00705540 80000009
00705544 8000000A
00705548 8000000C
0070554C 80000010
00705550 80000013
00705554 80000017
00705558 00000000
0070555C 71A30979 WS2_32.WSAAsyncSelect
00705560 71A24428 WS2_32.WSACleanup
00705564 71A294DC jmp 到 ntdll.RtlGetLastWin32Error
00705568 71A2664D WS2_32.WSAStartup
0070556C 71A29639 WS2_32.closesocket
00705570 71A2406A WS2_32.connect
00705574 71A24FD4 WS2_32.gethostbyname
00705578 71A22B66 WS2_32.ntohs
0070557C 71A22BF4 WS2_32.inet_addr
00705580 71A24519 WS2_32.ioctlsocket
00705584 71A42E70 WSOCK32.recv
00705588 71A2428A WS2_32.send
0070558C 71A23B91 WS2_32.socket
00705590 00000000
00705594 00306A10
。。。。//这当中都是空白段[不是全0的那种空白，都是有值的]
007055F0 00306BF0
007055F4 00306C04
007055F8 00000000
007055FC 5D1B29E3 COMCTL32.ImageList_Add
00705600 5D1B2777 COMCTL32.ImageList_BeginDrag
00705604 5D17BD2E COMCTL32.ImageList_Destroy
00705608 5D1B27BF COMCTL32.ImageList_DragEnter
0070560C 5D1B2818 COMCTL32.ImageList_DragLeave
00705610 5D1B27ED COMCTL32.ImageList_DragMove
00705614 5D1B2840 COMCTL32.ImageList_DragShowNolock
00705618 5D1891C9 COMCTL32.ImageList_Draw
0070561C 5D18129B COMCTL32.ImageList_DrawEx
00705620 5D1B2739 COMCTL32.ImageList_EndDrag
00705624 5D182F51 COMCTL32.ImageList_GetBkColor
00705628 5D1B26F4 COMCTL32.ImageList_GetDragImage
0070562C 5D1A1D6B COMCTL32.ImageList_GetIcon
00705630 5D190B2E COMCTL32.ImageList_GetIconSize
00705634 5D17E1C2 COMCTL32.ImageList_GetImageCount
00705638 5D1B2B0F COMCTL32.ImageList_GetImageInfo
0070563C 5D1B3B81 COMCTL32.ImageList_Read
00705640 5D17C035 COMCTL32.ImageList_Remove
00705644 5D1B2A2A COMCTL32.ImageList_Replace
00705648 5D17C2B8 COMCTL32.ImageList_SetBkColor
0070564C 5D1B2AC7 COMCTL32.ImageList_SetIconSize
00705650 5D1B2913 COMCTL32.ImageList_Write
00705654 5D1915DD COMCTL32.InitCommonControls
00705658 5D1902FC COMCTL32._TrackMouseEvent
0070565C 5D17BB5B COMCTL32.ImageList_Create
00705660 00000000
00705664 00306C18
00705668 00306C28
0070566C 00306C3C
00705670 00000000
00705674 7632EECE COMDLG32.ChooseColorA
00705678 7632311E COMDLG32.GetOpenFileNameA
0070567C 76337CD8 COMDLG32.GetSaveFileNameA
00705680 00000000
00705684 00306C50
00705688 00306C5A
。。。。//这当中都是空白段[不是全0的那种空白，都是有值的]
007057D8 003071E4
007057DC 003071F6
007057E0 00307204
007057E4 00000000
007057E8 77EF6DC0 GDI32.BitBlt
007057EC 77F0B662 GDI32.CloseEnhMetaFile
007057F0 77EFA208 GDI32.CombineRgn
007057F4 77F07E70 GDI32.CopyEnhMetaFileA
007057F8 77EF601F GDI32.CreateBitmap
007057FC 77EFAA29 GDI32.CreateBrushIndirect
00705800 77EF6E51 GDI32.CreateCompatibleBitmap
00705804 77EF5E10 GDI32.CreateCompatibleDC
00705808 77EF9610 GDI32.CreateDIBSection
0070580C 77EFB52C GDI32.CreateDIBitmap
00705810 77F0C556 GDI32.CreateEnhMetaFileA
00705814 77EFD10C GDI32.CreateFontIndirectA
00705818 77EFD547 GDI32.CreateHalftonePalette
0070581C 77EF8DD7 GDI32.CreatePalette
00705820 77F0E923 GDI32.CreatePenIndirect
00705824 77EF75C3 GDI32.CreateRectRgn
00705828 77EF5FD5 GDI32.CreateSolidBrush
0070582C 77EF6CA6 GDI32.DeleteDC
00705830 77EFDCC0 GDI32.DeleteEnhMetaFile
00705834 77EF6A3B GDI32.DeleteObject
00705838 77EFC83B GDI32.Ellipse
0070583C 77EF8665 GDI32.ExcludeClipRect
00705840 77EFF77C GDI32.ExtCreatePen
00705844 77EF9012 GDI32.ExtTextOutA
00705848 77EF57BE GDI32.GdiFlush
0070584C 77EF8DB8 GDI32.GetBitmapBits
00705850 77EFA6A5 GDI32.GetBrushOrgEx
00705854 77EF68E4 GDI32.GetClipBox
00705858 77EF6917 GDI32.GetClipRgn
0070585C 77F0FB94 GDI32.GetCurrentPositionEx
00705860 77EF9C31 GDI32.GetDCOrgEx
00705864 77EFA147 GDI32.GetDIBColorTable
00705868 77EF9FC5 GDI32.GetDIBits
0070586C 77EF58A2 GDI32.GetDeviceCaps
00705870 77F0EAD0 GDI32.GetEnhMetaFileBits
00705874 77F29672 GDI32.GetEnhMetaFileDescriptionA
00705878 77EFDFA3 GDI32.GetEnhMetaFileHeader
0070587C 77F29062 GDI32.GetEnhMetaFilePaletteEntries
00705880 77EF9A82 GDI32.GetObjectA
00705884 77EFCDEF GDI32.GetPaletteEntries
00705888 77EFD35B GDI32.GetPixel
0070588C 77EFA5E9 GDI32.GetRgnBox
00705890 77EF5FF1 GDI32.GetStockObject
00705894 77EFD55B GDI32.GetSystemPaletteEntries
00705898 77EF8528 GDI32.GetTextColor
0070589C 77EFD73B GDI32.GetTextExtentPoint32A
007058A0 77EFC333 GDI32.GetTextExtentPointA
007058A4 77EFA821 GDI32.GetTextMetricsA
007058A8 77F29513 GDI32.GetWinMetaFileBits
007058AC 77EFABC8 GDI32.GetWindowOrgEx
007058B0 77EF6899 GDI32.IntersectClipRect
007058B4 77EF8195 GDI32.LPtoDP
007058B8 77F22768 GDI32.LineDDA
007058BC 77EF9D07 GDI32.LineTo
007058C0 77EFA174 GDI32.MaskBlt
007058C4 77EF9C60 GDI32.MoveToEx
007058C8 77EF86B0 GDI32.PatBlt
007058CC 77F1BEA4 GDI32.Pie
007058D0 77F0453F GDI32.PlayEnhMetaFile
007058D4 77F24C75 GDI32.PolyPolyline
007058D8 77EFD1EE GDI32.Polygon
007058DC 77EFA781 GDI32.Polyline
007058E0 77EFBD89 GDI32.RealizePalette
007058E4 77EF8070 GDI32.RectVisible
007058E8 77EFBACF GDI32.Rectangle
007058EC 77EF97BE GDI32.RestoreDC
007058F0 77F1B486 GDI32.RoundRect
007058F4 77EF9884 GDI32.SaveDC
007058F8 77EF78DC GDI32.SelectClipRgn
007058FC 77EF59A0 GDI32.SelectObject
00705900 77EF82DE GDI32.SelectPalette
00705904 77EF5C59 GDI32.SetBkColor
00705908 77EF5D0B GDI32.SetBkMode
0070590C 77EF8834 GDI32.SetBrushOrgEx
00705910 77EFD6AC GDI32.SetDIBColorTable
00705914 77F07C0C GDI32.SetEnhMetaFileBits
00705918 77EFA8F7 GDI32.SetMapMode
0070591C 77EFD3E1 GDI32.SetPixel
00705920 77EFA990 GDI32.SetROP2
00705924 77EF9D5F GDI32.SetStretchBltMode
00705928 77EF5BA7 GDI32.SetTextColor
0070592C 77F0E45F GDI32.SetViewportExtEx
00705930 77EF7988 GDI32.SetViewportOrgEx
00705934 77F1B605 GDI32.SetWinMetaFileBits
00705938 77F0E3B6 GDI32.SetWindowExtEx
0070593C 77EF94AD GDI32.SetWindowOrgEx
00705940 77EFC6FC GDI32.StretchBlt
00705944 77EF89AF GDI32.UnrealizeObject
00705948 00000000
0070594C 00307216
00705950 00000000
00705954 762F1180 MSIMG32.GradientFill
00705958 00000000
0070595C 00307226
00705960 00307236
00705964 00000000
00705968 773EFE44 SHELL32.ShellExecuteA
0070596C 774189E7 SHELL32.Shell_NotifyIconA
00705970 00000000
00705974 0030724A
00705978 00307264
。。。。//这当中都是空白段[不是全0的那种空白，都是有值的]
00705C80 00307EEE
00705C84 00000000
00705C88 007BC642 mysoft.007BC642
00705C8C 007BC64F mysoft.007BC64F
00705C90 007BC65C mysoft.007BC65C
00705C94 007BC669 mysoft.007BC669
00705C98 007BC676 mysoft.007BC676
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
