你先提供一下目标程序的一些信息，如用peid查的结果，文件的区块名等。
见过EXECryptor，Obsidium等会这样检测OD的

用ＰＥ看了　答案是：什么也没发现．

我想很用普通的逻辑试试，所以进行了如下：

１）装入调试然后在代码段下段Ｆ２，：

２）跑起来停在：

３）Ｆ８和Ｆ７往下，看到类解压的代码：

但跑到最后出同某某内存不能写入的出错．

重复第三部，用Ｆ９，出现

上传的附件：

• 未命名-4.gif （3.18kb，682次下载）
• 未命名-6.gif （9.03kb，675次下载）
• 未命名-8.gif （9.46kb，672次下载）
• 未命名-9.gif （8.08kb，670次下载）
• 未命名-2.gif （17.43kb，672次下载）

没兴趣哟!!

明说了吧，你这是sun的客户端。注意seh的学习和使用。
如果不会，去再详细阅读置顶帖的入门100遍。

哦，原来是sun啊，我公测那天闲着没事也玩了一把，是themida的壳，
看那个fld指令下一堆FF就知道了，有个脚本自动断在oep的，脱壳不难
主要是脱壳后stolen部分和IAT的修复，
stolen可以参考那个sun.exe的开头部分，对于里面几个指针地址，在代码段下两次内存写入断点就能找到了

提供一下我的IAT修复代码

void __stdcall ReplaceMem(BYTE *pbMemAddr,const BYTE *pbMemData,int nLen)
{
        DWORD dwProtectFlag;

        VirtualProtect(pbMemAddr,nLen,PAGE_EXECUTE_READWRITE,&dwProtectFlag);
        memcpy(pbMemAddr,pbMemData,nLen);
        VirtualProtect(pbMemAddr,nLen,dwProtectFlag,NULL);

        return;
}

void __stdcall FixImport(void)
{
        int i = 0;
        HMODULE hCurrDLLHandle;
        FARPROC hCurrPROCHandle;

//        DebugBreak();

        while(stIMPORTDLL[i].dwProcAddr != 0)
        {
                hCurrDLLHandle = LoadLibrary(stIMPORTDLL[i].szDllName);
                hCurrPROCHandle = GetProcAddress(hCurrDLLHandle, stIMPORTDLL[i].szProcName);
                ReplaceMem((BYTE *)stIMPORTDLL[i].dwProcAddr, (BYTE *)&hCurrPROCHandle, 4);

                ++i;
        }

        return;
}

typedef struct tag_IMPORT_DLL_DATA
{
        int                dwProcAddr;
        char        *szDllName;
        char        *szProcName;
} IMPORT_DLL_DATA;

IMPORT_DLL_DATA stIMPORTDLL[274] = {
{0x00677000, "ADVAPI32.dll", "CryptEncrypt"},
{0x00677004, "ADVAPI32.dll", "RegQueryValueExA"},
{0x00677008, "ADVAPI32.dll", "RegOpenKeyA"},
{0x0067700C, "ADVAPI32.dll", "GetTokenInformation"},
{0x00677010, "ADVAPI32.dll", "SetEntriesInAclA"},
{0x00677014, "ADVAPI32.dll", "SetSecurityInfo"},
{0x00677018, "ADVAPI32.dll", "OpenProcessToken"},
{0x0067701C, "ADVAPI32.dll", "OpenThreadToken"},
{0x00677020, "ADVAPI32.dll", "ImpersonateSelf"},
{0x00677024, "ADVAPI32.dll", "LookupPrivilegeValueA"},
{0x00677028, "ADVAPI32.dll", "AdjustTokenPrivileges"},
{0x0067702C, "ADVAPI32.dll", "CryptAcquireContextA"},
{0x00677030, "ADVAPI32.dll", "CryptGetHashParam"},
{0x00677034, "ADVAPI32.dll", "CryptDecrypt"},
{0x00677038, "ADVAPI32.dll", "RegCloseKey"},
{0x0067703C, "ADVAPI32.dll", "CryptCreateHash"},
{0x00677040, "ADVAPI32.dll", "CryptHashData"},
{0x00677044, "ADVAPI32.dll", "CryptDeriveKey"},
{0x00677048, "ADVAPI32.dll", "CryptDestroyKey"},
{0x0067704C, "ADVAPI32.dll", "CryptDestroyHash"},
{0x00677050, "ADVAPI32.dll", "CryptReleaseContext"},
{0x00677058, "DINPUT8.dll", "DirectInput8Create"},
{0x00677060, "GDI32.dll", "GetStockObject"},
{0x00677068, "kernel32.dll", "FindNextFileA"},
{0x0067706C, "kernel32.dll", "GetFullPathNameA"},
{0x00677070, "kernel32.dll", "GetFileInformationByHandle"},
{0x00677074, "kernel32.dll", "lstrlenA"},
{0x00677078, "kernel32.dll", "GetTickCount"},
{0x0067707C, "kernel32.dll", "InterlockedExchange"},
{0x00677080, "kernel32.dll", "GetACP"},
{0x00677084, "kernel32.dll", "GetLocaleInfoA"},
{0x00677088, "kernel32.dll", "GetVersionExA"},
{0x0067708C, "kernel32.dll", "MultiByteToWideChar"},
{0x00677090, "kernel32.dll", "WideCharToMultiByte"},
{0x00677094, "kernel32.dll", "RaiseException"},
{0x00677098, "ntdll.dll", "RtlGetLastWin32Error"},
{0x0067709C, "kernel32.dll", "InitializeCriticalSection"},
{0x006770A0, "ntdll.dll", "RtlDeleteCriticalSection"},
{0x006770A4, "kernel32.dll", "CompareStringA"},
{0x006770A8, "kernel32.dll", "CompareStringW"},
{0x006770AC, "kernel32.dll", "IsBadWritePtr"},
{0x006770B0, "kernel32.dll", "IsBadReadPtr"},
{0x006770B4, "kernel32.dll", "FreeLibrary"},
{0x006770B8, "kernel32.dll", "GetProcAddress"},
{0x006770BC, "kernel32.dll", "LoadLibraryA"},
{0x006770C0, "kernel32.dll", "SetCurrentDirectoryA"},
{0x006770C4, "kernel32.dll", "OutputDebugStringA"},
{0x006770C8, "kernel32.dll", "CloseHandle"},
{0x006770CC, "kernel32.dll", "CreateSemaphoreA"},
{0x006770D0, "kernel32.dll", "Module32Next"},
{0x006770D4, "kernel32.dll", "Module32First"},
{0x006770D8, "kernel32.dll", "CreateToolhelp32Snapshot"},
{0x006770DC, "kernel32.dll", "GetCurrentProcessId"},
{0x006770E0, "kernel32.dll", "GetCurrentDirectoryA"},
{0x006770E4, "kernel32.dll", "QueryPerformanceFrequency"},
{0x006770E8, "kernel32.dll", "SetUnhandledExceptionFilter"},
{0x006770EC, "kernel32.dll", "QueryPerformanceCounter"},
{0x006770F0, "kernel32.dll", "GetNumberFormatA"},
{0x006770F4, "kernel32.dll", "GetCommandLineA"},
{0x006770F8, "kernel32.dll", "CreateFileA"},
{0x006770FC, "kernel32.dll", "GetLocalTime"},
{0x00677100, "kernel32.dll", "CreateDirectoryA"},
{0x00677104, "kernel32.dll", "lstrcpyA"},
{0x00677108, "kernel32.dll", "SizeofResource"},
{0x0067710C, "kernel32.dll", "FindResourceA"},
{0x00677110, "kernel32.dll", "GetModuleHandleA"},
{0x00677114, "kernel32.dll", "lstrcmpA"},
{0x00677118, "kernel32.dll", "WritePrivateProfileStringA"},
{0x0067711C, "kernel32.dll", "GetPrivateProfileStringA"},
{0x00677120, "kernel32.dll", "SetFileAttributesA"},
{0x00677124, "kernel32.dll", "GlobalMemoryStatus"},
{0x00677128, "kernel32.dll", "GetSystemInfo"},
{0x0067712C, "kernel32.dll", "IsProcessorFeaturePresent"},
{0x00677130, "kernel32.dll", "SetFileTime"},
{0x00677134, "kernel32.dll", "CopyFileA"},
{0x00677138, "kernel32.dll", "FindFirstFileA"},
{0x0067713C, "kernel32.dll", "FindClose"},
{0x00677140, "kernel32.dll", "RemoveDirectoryA"},
{0x00677144, "kernel32.dll", "GetLocaleInfoW"},
{0x00677148, "kernel32.dll", "SetEnvironmentVariableA"},
{0x0067714C, "kernel32.dll", "CreateProcessA"},
{0x00677150, "kernel32.dll", "GetExitCodeProcess"},
{0x00677154, "kernel32.dll", "SetEndOfFile"},
{0x00677158, "kernel32.dll", "SetStdHandle"},
{0x0067715C, "kernel32.dll", "IsBadCodePtr"},
{0x00677160, "kernel32.dll", "IsValidCodePage"},
{0x00677164, "kernel32.dll", "IsValidLocale"},
{0x00677168, "kernel32.dll", "EnumSystemLocalesA"},
{0x0067716C, "kernel32.dll", "GetUserDefaultLCID"},
{0x00677170, "kernel32.dll", "FlushFileBuffers"},
{0x00677174, "kernel32.dll", "GetFileAttributesA"},
{0x00677178, "kernel32.dll", "SetFilePointer"},
{0x0067717C, "kernel32.dll", "GetFileType"},
{0x00677180, "kernel32.dll", "SetHandleCount"},
{0x00677184, "kernel32.dll", "GetEnvironmentStringsW"},
{0x00677188, "kernel32.dll", "FreeEnvironmentStringsW"},
{0x0067718C, "kernel32.dll", "GetEnvironmentStringsA"},
{0x00677190, "kernel32.dll", "FreeEnvironmentStringsA"},
{0x00677194, "kernel32.dll", "UnhandledExceptionFilter"},
{0x00677198, "kernel32.dll", "GetStdHandle"},
{0x0067719C, "kernel32.dll", "WriteFile"},
{0x006771A0, "kernel32.dll", "GetTimeZoneInformation"},
{0x006771A4, "kernel32.dll", "VirtualFree"},
{0x006771A8, "kernel32.dll", "HeapCreate"},
{0x006771AC, "kernel32.dll", "HeapDestroy"},
{0x006771B0, "ntdll.dll", "RtlSizeHeap"},
{0x006771B4, "kernel32.dll", "GetModuleFileNameA"},
{0x006771B8, "kernel32.dll", "GetStringTypeW"},
{0x006771BC, "kernel32.dll", "GetStringTypeA"},
{0x006771C0, "kernel32.dll", "TlsGetValue"},
{0x006771C4, "kernel32.dll", "TlsSetValue"},
{0x006771C8, "kernel32.dll", "TlsFree"},
{0x006771CC, "kernel32.dll", "GetCurrentThread"},
{0x006771D0, "ntdll.dll", "RtlSetLastWin32Error"},
{0x006771D4, "kernel32.dll", "TlsAlloc"},
{0x006771D8, "kernel32.dll", "LCMapStringW"},
{0x006771DC, "kernel32.dll", "LCMapStringA"},
{0x006771E0, "kernel32.dll", "GetCurrentThreadId"},
{0x006771E4, "kernel32.dll", "CreateThread"},
{0x006771E8, "kernel32.dll", "ExitThread"},
{0x006771EC, "ntdll.dll", "RtlReAllocateHeap"},
{0x006771F0, "kernel32.dll", "GetTimeFormatA"},
{0x006771F4, "kernel32.dll", "MoveFileA"},
{0x006771F8, "kernel32.dll", "DeleteFileA"},
{0x006771FC, "kernel32.dll", "GetStartupInfoA"},
{0x00677200, "kernel32.dll", "GetCurrentProcess"},
{0x00677204, "kernel32.dll", "TerminateProcess"},
{0x00677208, "kernel32.dll", "GetSystemTimeAsFileTime"},
{0x0067720C, "kernel32.dll", "GetExitCodeThread"},
{0x00677210, "kernel32.dll", "ReadProcessMemory"},
{0x00677214, "kernel32.dll", "OpenProcess"},
{0x00677218, "kernel32.dll", "GetPriorityClass"},
{0x0067721C, "kernel32.dll", "GetSystemPowerStatus"},
{0x00677220, "kernel32.dll", "VirtualQuery"},
{0x00677224, "kernel32.dll", "VirtualAlloc"},
{0x00677228, "kernel32.dll", "VirtualProtect"},
{0x0067722C, "kernel32.dll", "Process32Next"},
{0x00677230, "kernel32.dll", "Process32First"},
{0x00677234, "ntdll.dll", "RtlFreeHeap"},
{0x00677238, "ntdll.dll", "RtlAllocateHeap"},
{0x0067723C, "kernel32.dll", "ExitProcess"},
{0x00677240, "kernel32.dll", "GetCPInfo"},
{0x00677244, "kernel32.dll", "GetOEMCP"},
{0x00677248, "ntdll.dll", "RtlUnwind"},
{0x0067724C, "kernel32.dll", "Sleep"},
{0x00677250, "kernel32.dll", "InterlockedIncrement"},
{0x00677254, "kernel32.dll", "InterlockedDecrement"},
{0x00677258, "kernel32.dll", "InitializeCriticalSectionAndSpinCount"},
{0x0067725C, "kernel32.dll", "WaitForMultipleObjects"},
{0x00677260, "kernel32.dll", "SetEvent"},
{0x00677264, "kernel32.dll", "WaitForSingleObject"},
{0x00677268, "ntdll.dll", "RtlEnterCriticalSection"},
{0x0067726C, "ntdll.dll", "RtlLeaveCriticalSection"},
{0x00677270, "kernel32.dll", "UnmapViewOfFile"},
{0x00677274, "kernel32.dll", "MapViewOfFile"},
{0x00677278, "kernel32.dll", "FormatMessageA"},
{0x0067727C, "kernel32.dll", "SearchPathA"},
{0x00677280, "kernel32.dll", "IsBadStringPtrA"},
{0x00677284, "kernel32.dll", "LocalFree"},
{0x00677288, "kernel32.dll", "DuplicateHandle"},
{0x0067728C, "kernel32.dll", "CreateEventA"},
{0x00677290, "kernel32.dll", "CreateFileMappingA"},
{0x00677294, "kernel32.dll", "GetDateFormatA"},
{0x00677298, "kernel32.dll", "GetFileSize"},
{0x0067729C, "kernel32.dll", "ReadFile"},
{0x006772A0, "kernel32.dll", "GetProcessHeap"},
{0x006772A8, "OLEAUT32.dll", "VariantTimeToSystemTime"},
{0x006772B0, "SHELL32.dll", "ShellExecuteExA"},
{0x006772B8, "USER32.dll", "RegisterClassW"},
{0x006772BC, "USER32.dll", "CreateWindowExW"},
{0x006772C0, "USER32.dll", "ValidateRect"},
{0x006772C4, "USER32.dll", "TranslateAcceleratorA"},
{0x006772C8, "USER32.dll", "PeekMessageA"},
{0x006772CC, "USER32.dll", "AdjustWindowRect"},
{0x006772D0, "USER32.dll", "wvsprintfA"},
{0x006772D4, "USER32.dll", "LoadStringA"},
{0x006772D8, "USER32.dll", "UpdateWindow"},
{0x006772DC, "USER32.dll", "EndPaint"},
{0x006772E0, "USER32.dll", "DestroyAcceleratorTable"},
{0x006772E4, "USER32.dll", "SendMessageA"},
{0x006772E8, "USER32.dll", "DefWindowProcA"},
{0x006772EC, "USER32.dll", "CreateWindowExA"},
{0x006772F0, "USER32.dll", "PostQuitMessage"},
{0x006772F4, "USER32.dll", "SetTimer"},
{0x006772F8, "USER32.dll", "SetWindowTextA"},
{0x006772FC, "USER32.dll", "EndDialog"},
{0x00677300, "USER32.dll", "MessageBoxA"},
{0x00677304, "USER32.dll", "KillTimer"},
{0x00677308, "USER32.dll", "RegisterClassExA"},
{0x0067730C, "USER32.dll", "LoadCursorA"},
{0x00677310, "USER32.dll", "LoadIconA"},
{0x00677314, "USER32.dll", "DispatchMessageA"},
{0x00677318, "USER32.dll", "TranslateMessage"},
{0x0067731C, "USER32.dll", "GetMessageA"},
{0x00677320, "USER32.dll", "DialogBoxParamA"},
{0x00677324, "USER32.dll", "SetDlgItemTextA"},
{0x00677328, "USER32.dll", "CharUpperBuffA"},
{0x0067732C, "USER32.dll", "BeginPaint"},
{0x00677330, "USER32.dll", "GetDesktopWindow"},
{0x00677334, "USER32.dll", "SetRect"},
{0x00677338, "USER32.dll", "ShowCursor"},
{0x0067733C, "USER32.dll", "CharNextA"},
{0x00677340, "USER32.dll", "InvalidateRect"},
{0x00677344, "USER32.dll", "SetScrollInfo"},
{0x00677348, "USER32.dll", "ShowWindow"},
{0x0067734C, "USER32.dll", "wsprintfA"},
{0x00677350, "USER32.dll", "GetSystemMetrics"},
{0x00677354, "USER32.dll", "SetCursor"},
{0x00677358, "USER32.dll", "DestroyIcon"},
{0x0067735C, "USER32.dll", "SetCapture"},
{0x00677360, "USER32.dll", "ReleaseCapture"},
{0x00677364, "USER32.dll", "SystemParametersInfoA"},
{0x00677368, "USER32.dll", "ScreenToClient"},
{0x0067736C, "USER32.dll", "SetCursorPos"},
{0x00677370, "USER32.dll", "GetCursorPos"},
{0x00677374, "USER32.dll", "SetRectEmpty"},
{0x00677378, "USER32.dll", "GetAsyncKeyState"},
{0x0067737C, "USER32.dll", "LoadCursorFromFileA"},
{0x00677384, "VMProxy.dll", "VMAPI_MuteSound"},
{0x00677388, "VMProxy.dll", "VMAPI_ExitSession"},
{0x0067738C, "VMProxy.dll", "VMAPI_MuteMic"},
{0x00677390, "VMProxy.dll", "VMAPI_JoinSession"},
{0x00677394, "VMProxy.dll", "VMAPI_Terminate"},
{0x00677398, "VMProxy.dll", "VMAPI_InitProxy"},
{0x0067739C, "VMProxy.dll", "VMAPI_SetCallbackFuncPointer"},
{0x006773A0, "VMProxy.dll", "VMAPI_HostSession"},
{0x006773A8, "winmm.dll", "timeGetTime"},
{0x006773B0, "WS2_32.dll", "WSAGetOverlappedResult"},
{0x006773B4, "WS2_32.dll", "WSASocketA"},
{0x006773B8, "WS2_32.dll", "inet_addr"},
{0x006773BC, "WS2_32.dll", "gethostbyname"},
{0x006773C0, "WS2_32.dll", "WSAStartup"},
{0x006773C4, "WS2_32.dll", "WSACleanup"},
{0x006773C8, "WS2_32.dll", "closesocket"},
{0x006773CC, "WS2_32.dll", "WSARecv"},
{0x006773D0, "WS2_32.dll", "connect"},
{0x006773D4, "WS2_32.dll", "WSASend"},
{0x006773D8, "WS2_32.dll", "ntohs"},
{0x006773DC, "WS2_32.dll", "WSAGetLastError"},
/*
{0x006773E4, "binkw32.dll", "BinkOpenDirectSound"},
{0x006773E8, "binkw32.dll", "BinkSetSoundSystem"},
{0x006773EC, "binkw32.dll", "BinkWait"},
{0x006773F0, "binkw32.dll", "BinkClose"},
{0x006773F4, "binkw32.dll", "BinkDoFrame"},
{0x006773F8, "binkw32.dll", "BinkCopyToBuffer"},
{0x006773FC, "binkw32.dll", "BinkNextFrame"},
{0x00677400, "binkw32.dll", "BinkOpen"},
*/
{0x00677408, "imagehlp.dll", "MapFileAndCheckSumA"},
{0x00677410, "ole32.dll", "GetRunningObjectTable"},
{0x00677418, "wzSound.dll", "wzsnd_play_ambi"},
{0x0067741C, "wzSound.dll", "wzsnd_set_loop_ambi"},
{0x00677420, "wzSound.dll", "wzsnd_play_voice"},
{0x00677424, "wzSound.dll", "wzsnd_play_ui"},
{0x00677428, "wzSound.dll", "wzsnd_play"},
{0x0067742C, "wzSound.dll", "wzsnd_stop_voice"},
{0x00677430, "wzSound.dll", "wzsnd_set_volume_all_bgm"},
{0x00677434, "wzSound.dll", "wzsnd_stop_all_bgm"},
{0x00677438, "wzSound.dll", "wzsnd_stop_bgm"},
{0x0067743C, "wzSound.dll", "wzsnd_pause_bgm"},
{0x00677440, "wzSound.dll", "wzsnd_play_bgm"},
{0x00677444, "wzSound.dll", "wzsnd_set_mic_input_vol"},
{0x00677448, "wzSound.dll", "wzsnd_get_mic_input_vol"},
{0x0067744C, "wzSound.dll", "wzsnd_get_wav_vol"},
{0x00677450, "wzSound.dll", "wzsnd_get_master_vol"},
{0x00677454, "wzSound.dll", "wzsnd_set_wav_vol"},
{0x00677458, "wzSound.dll", "wzsnd_set_master_vol"},
{0x0067745C, "wzSound.dll", "wzsnd_update_listener"},
{0x00677460, "wzSound.dll", "wzsnd_stop_all"},
{0x00677464, "wzSound.dll", "wzsnd_uninit"},
{0x00677468, "wzSound.dll", "wzsnd_init"},
{0x0067746C, "wzSound.dll", "wzsnd_load_ui"},
{0x00677470, "wzSound.dll", "wzsnd_load_gameplay"},
{0x00677474, "wzSound.dll", "wzsnd_set_mic_output_mute"},
{0x00677478, "wzSound.dll", "wzsnd_env_supported"},
{0x0067747C, "wzSound.dll", "wzsnd_play_3d"},
{0x00677480, "wzSound.dll", "wzsnd_set_volume_all_ambi"},
{0x00677484, "wzSound.dll", "wzsnd_stop_ambi"},
{0x00677488, "wzSound.dll", "wzsnd_stop_all_ambi"},
{0x0067748C, "wzSound.dll", "wzsnd_getState_voice"},
{0x00677490, "wzSound.dll", "wzsnd_update_3d_source"},
{0x00677494, "wzSound.dll", "wzsnd_stop"},
{0x00000000, "",""}
};
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－

高手就是高手，一看就知道sun，呵呵，
多谢引导，我还是第一次越到这个壳，以几脱几个都没有这么强

果然脱得很轻松,用上面的代码修复一下IAT,蛮方便,不过我还是在OD中申请了一个空间,写一段代码避开加密比较方便

这里可以发游戏的破文吧,改天也发一个处女文,感谢 ezme   xyguotao
现在有点入门了,经过一次真真的破,发觉以前破的几个国产的全是很菜的,可能全是压缩的壳比较菜
这次水平有所进步

ezme 你的代码真强,好方便
发现论坛上有个脚本,配合用真....强