文件查壳：ASPack 2.x (without poly) -> Alexey Solodovnikov，呵呵，有谁知道这是什么壳吗？然后OLLICE载入：
004E3001 > 33C0 xor eax, eax //停在此处，继续向下
004E3003 64:8B20 mov esp, dword ptr fs:[eax]
004E3006 64:8F00 pop dword ptr fs:[eax]
004E3009 EB 02 jmp short MIR.004E300D
004E300B 78 69 js short MIR.004E3076
004E300D 60 pushad //来到入口点，此时ESP是0012FFE4
004E300E E8 00000000 call MIR.004E3013 //此时下断点 HW 0012FFE0
004E3013 5D pop ebp
004E3014 BB EDFFFFFF mov ebx, -13
004E3019 03DD add ebx, ebp
004E301B 99 cdq
004E301C 81EB 00300E00 sub ebx, 0E3000
F9后来到这里：
004E33AF 61 popad
004E33B0 75 08 jnz short MIR.004E33BA
004E33B2 B8 01000000 mov eax, 1
004E33B7 C2 0C00 retn 0C
004E33BA 68 BC214200 push MIR.004221BC
004E33BF C3 retn //此处断下
004E33C0 8B85 26040000 mov eax, dword ptr [ebp+426]
004E33C6 8D8D 3B040000 lea ecx, dword ptr [ebp+43B]
004E33CC 51 push ecx
004E33CD 50 push eax
004E33CE FF95 490F0000 call near dword ptr [ebp+F49]
据ESP定律，所断之处应该是OEP第二句，那么也就是说004e33BA处是OEP？请指教，若在断点之处继续向下跟，则跳到这里：
004221BC E8 ABAC0000 call MIR.0042CE6C //在此处单步跟入，则有下面代码
004221C1 ^ E9 16FEFFFF jmp MIR.00421FDC
004221C6 50 push eax
004221C7 64:FF35 0000000>push dword ptr fs:[0]
单步进入CALL处时出现：
0042CE6C 55 push ebp //是否此处是真正OEP？请指教
0042CE6D 8BEC mov ebp, esp
0042CE6F 83EC 10 sub esp, 10
0042CE72 A1 A4954400 mov eax, dword ptr [4495A4]
0042CE77 8365 F8 00 and dword ptr [ebp-8], 0
0042CE7B 8365 FC 00 and dword ptr [ebp-4], 0
0042CE7F 53 push ebx
0042CE80 57 push edi
0042CE81 BF 4EE640BB mov edi, BB40E64E
0042CE86 3BC7 cmp eax, edi
0042CE88 BB 0000FFFF mov ebx, FFFF0000
0042CE8D 74 0D je short MIR.0042CE9C
0042CE8F 85C3 test ebx, eax
0042CE91 74 09 je short MIR.0042CE9C
0042CE93 F7D0 not eax
0042CE95 A3 A8954400 mov dword ptr [4495A8], eax
0042CE9A EB 60 jmp short MIR.0042CEFC
0042CE9C 56 push esi
0042CE9D 8D45 F8 lea eax, dword ptr [ebp-8]
0042CEA0 50 push eax
0042CEA1 FF15 70914300 call near dword ptr [439170] ; kernel32.GetSystemTimeAsFileTime
0042CEA7 8B75 FC mov esi, dword ptr [ebp-4]
0042CEAA 3375 F8 xor esi, dword ptr [ebp-8]
0042CEAD FF15 18924300 call near dword ptr [439218] ; kernel32.GetCurrentProcessId
请问哪处才是真正OEP？我在第一中断处DUMP出来后程序可以运行，但查壳无变化，在0042CE6C处DUP出来后程序无法初使化，修复ITA找得到许多无用的指针。请哪位高手来指教下。谢谢
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
