使用下面的脚本  
先设置OD停在系统断点~

/*

Ollyice: Ignore all exceptions (add 0EEDFADE,C0000005,C000001E)
HideOD : Check HideNtDebugBit and ZwQueryInformationProcess(method2)
ODBGScript 1.52

*/

data:
    var hInstance
    var codeseg
    var vmseg
    var ep
    var oep
    var esptmp
    var _esp
    var iat_start
    var iat_end
    var iat_cur
    var addr
    var c_gpa
    var ibase
    var iend
    var temp
    var tmp
    var SBM
    var TOA
    var mbase
    var msize

code:
    bphwcall
    gpa "SetBkMode","GDI32.dll"
    mov SBM,$RESULT
    REV SBM
    mov SBM,$RESULT
    itoa SBM
    gpa "TextOutA","GDI32.dll"
    mov TOA,$RESULT
    REV TOA
    mov TOA,$RESULT
    itoa TOA

    gpa "VirtualFree","kernel32.dll"
    bphws $RESULT,"x"
    run
    bphwc $RESULT
    rtu
    gmi eip,MODULEBASE
    mov hInstance,$RESULT
    mov temp,$RESULT
    add temp,3c
    mov temp,[temp]
    add temp,hInstance
    add temp,28
    mov temp,[temp]
    add temp,hInstance
    mov ep,temp

    bc ep

    gmemi eip,MEMORYBASE
    mov codeseg,$RESULT

    find $RESULT,#66CC9D#
    mov [$RESULT],#66CC90#

    gpa "EnumWindows","user32.dll"
    mov [$RESULT],#8BC09C85C09D0578563412C20800#

    gpa "CreateThread","kernel32.dll"
    find $RESULT,#FF7518#
    mov [$RESULT],#6A0490#

    gpa "LdrLoadDll","ntdll.dll"
    bp $RESULT

loop1:
    esto
    cmp eip,$RESULT
    jne loop1
    bc $RESULT
    bp ep

bpep:
    esto
    cmp eip,ep
    je loop2
    jmp bpep

loop2:
    bc ep
    mov esptmp,esp
    sub esptmp,4   

    mov temp,codeseg
    sub temp,1
    gmemi temp,MEMORYBASE
    mov vmseg,$RESULT
    gmemi temp,MEMORYSIZE
    bprm vmseg,$RESULT

loop3:   
    esto
    mov tmp,eip
    mov tmp,[tmp]
    cmp tmp,992C008A
    jne loop5
    mov oep,eax
    sti
    bprm oep,1

loop4:
    esto
    cmp eip,oep
    jne loop4
    jmp iat

loop5:
    cmp esp,esptmp
    jne loop3

iat:
    bpmc
    mov oep,eip
    cmt eip,"OEP?"
    gmi eip, MODULEBASE
    mov ibase, $RESULT
    mov temp,ibase
    add temp,3C
    mov temp,[temp]
    add temp,ibase
    add temp,50
    mov iend,[temp]
    add iend,ibase
   
    mov count,0
    mov iatbase,0
    mov mbase,codeseg
   
hwloop:
    sub mbase,1
    cmp mbase,ibase
    jb regnext
    gmemi mbase,MEMORYBASE
    mov mbase,$RESULT
    gmemi msize,MEMORYSIZE
    mov msize,$RESULT
    mov temp,mbase

    cmp iatbase,0
    jne vmsegloop
    eval #{SBM}#
    find temp,$RESULT,msize
    cmp 0,$RESULT
    je findTextOutA
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT
    jmp vmsegloop

findTextOutA:
    cmp iatbase,0
    jne vmsegloop
    eval #{TOA}#
    find temp,$RESULT,msize
    cmp 0,$RESULT
    je vmsegloop
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT

vmsegloop:
    find temp,#0355FC03C28B000345FC#
    mov tmp, $RESULT
    cmp tmp,0
    je regged
    add tmp,0A
    bphws tmp,"x"
    mov temp,tmp
    mov c_gpa,tmp
    inc count
    jmp vmsegloop

regged:
    cmp count,0
    jne hwloop

regnext:
    mov mbase,codeseg

hwloop1:
    sub mbase,1
    cmp mbase,ibase
    jb @iatinit
    gmemi mbase,MEMORYBASE
    mov mbase,$RESULT
    mov temp,mbase

    cmp iatbase,0
    jne vmsegloop1
    eval #{SBM}#
    find temp,$RESULT,msize
    cmp 0,$RESULT
    je findTextOutA1
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT
    jmp vmsegloop1

findTextOutA1:
    cmp iatbase,0
    jne vmsegloop1
    eval #{TOA}#
    find temp,$RESULT,msize
    cmp 0,$RESULT
    je vmsegloop1
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT

vmsegloop1:
    find temp,#0345FC8945F48B45F4#
    mov tmp, $RESULT
    cmp tmp,0
    je hwloop1
    add tmp,3
    bphws tmp,"x"
    mov temp,tmp
    mov c_gpa,tmp
    inc count
    jmp vmsegloop1

@iatinit:
    cmp iatbase,0
    je @error
    cmp count,0
    je @error
    gmemi iatbase,MEMORYSIZE
    mov iat_end,$RESULT
    add iat_end,iatbase
    sub iat_end,4
    mov _esp,esp
    mov iat_cur,iatbase
    sub iat_cur,4
    mov count,0   

@imprec:  
    add iat_cur,4
    cmp iat_cur,iat_end
    ja @end
    mov addr,[iat_cur]
    cmp addr,0
    je @imprec
    cmp addr,ibase
    jb @imprec
    cmp count,0
    jne @next
    mov iat_start,iat_cur
    log iat_start

@next:
    cmp addr,iend
    inc count
    mov temp,iat_cur
    ja @imprec
    cmp addr,iatbase
    jae next1
    jmp next2
next1:
    cmp addr,iat_end
    jbe @end
next2:  
    mov esp,_esp
    mov eip,addr
    mov [esp],eip  
    esto   
    mov [iat_cur],eax   
    jmp @imprec

@end:
    bphwcall
    mov iat_end,temp
    log iat_end
    mov eip,oep
    eval "IAT Start Address: {iat_start}   IAT End Address: {iat_end}"
    msg $RESULT   
    msg "Script ends ok!  Find the OEP manually and dump it~"
    ret

@error:
    bphwcall
    msg "ERROR!"
    pause

XP SP2下测试通过
关键在这里：

    find $RESULT,#66CC9D#
    mov [$RESULT],#66CC90#


exec v2.39 中是 find $RESULT,#2ECC9D#

测试通过
向okdodo同学学习~~~~

难怪了……非常感谢okdodo的指点~~！已经成功~！

有高手能帮忙脱下这个壳么
QQ：46797672

大哥可以帮我下么  我也是正在为这个壳发愁啊
那位大哥愿意帮下小弟啊,不胜感激啊
我已经看了两天这个壳了

不明白为什么
小弟QQ是188890009   帮完小弟一定重谢!!!

运行那脚本出现指令错误吧?
Error on line 23
Text:bphwcall
No such command: bphwcall

请教

回楼上 OBGSCRIPT1.52版本就可以了

学习学习！从中受益

谢谢啦,不知道1.52版本在哪下的呢?

不知道怎么用，难啊这个壳

还的多多 学习

换了odbgscript1.52了，还是不行！OD载入后停在lock int1这行上！

没碰到过这样的问题1

http://bbs.pediy.com/showthread.php?t=33639&tcatid=13看下这个,