参考引用：
http://www.myfaq.com.cn/2005Nov/2005-11-19/209212.html
详细阅读了以上教材，但是小菜脱ASPack 2.12 -> Alexey Solodovnikov加壳的DLL时候还是出错误。
原帖以停止回复，就起贴求教啦~~各位大侠指教指教。
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
首先尝试了下esp定律脱壳。
虽然找到OPE了。
008827FC 55 push ebp
008827FD 8BEC mov ebp, esp
008827FF 83C4 C4 add esp, -3C
00882802 B8 74278800 mov eax, 00882774
00882807 E8 1C2EFFFF call 00875628
0088280C 68 20288800 push 00882820 ; ASCII "SLAss"
00882811 E8 822FFFFF call 00875798 ; jmp 到 kernel32.GetModuleHandleA
但是关于修复的问题米有解决。参考文章中的修复方法：
=====================引用原文========================
运行ImportREC，注意：去掉“使用来自磁盘的PE部首”的选项！
选中Ollydbg的loaddll.exe的进程，然后点“选取DLL”，选择EdrLib.dll，填入RVA＝00004000、大小＝000000C8 ，点“Get Import”，得到输入表。改OEP=000011C9，FixDump！
================================================
填入RVA＝00004000、大小＝000000C8 无法获取正确输入表，但是填入OEP=000011C9，自动查找IAT却提示可能发现原始IAT.....（不解之一）暂时不管，继续按教程做。当然，继续以下工作，得到的结果是错误的。
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
按教程走一遍吧。
OD载入
0088F001 > 60 pushad //停在这里
0088F002 E8 03000000 call 0088F00A
0088F007 - E9 EB045D45 jmp 45E5F4F7
0088F00C 55 push ebp
0088F00D C3 retn
0088F00E E8 01000000 call 0088F014
Ctrl+S在“整个段块”搜索命令序列：
代码:
mov ecx,dword ptr ds:[esi+4]
sub ecx,8
shr ecx,1
找到在003B71F6处！我们在其上的003B71DA处下断，F9运行，中断。
0088F1C8 8785 35050000 xchg dword ptr [ebp+535], eax
0088F1CE 8B95 22040000 mov edx, dword ptr [ebp+422]
0088F1D4 8B85 2D050000 mov eax, dword ptr [ebp+52D]
0088F1DA 2BD0 sub edx, eax //F2,F9,F8
0088F1DC 74 79 je short 0088F257 //停在这里，修改z标志=1，F8
0088F1DE 8BC2 mov eax, edx
0088F1E0 C1E8 10 shr eax, 10
0088F1E3 33DB xor ebx, ebx
0088F1E5 8BB5 39050000 mov esi, dword ptr [ebp+539]
0088F1EB 03B5 22040000 add esi, dword ptr [ebp+422]
0088F1F1 833E 00 cmp dword ptr [esi], 0
0088F1F4 74 61 je short 0088F257
0088F1F6 8B4E 04 mov ecx, dword ptr [esi+4]
0088F1F9 83E9 08 sub ecx, 8
0088F1FC D1E9 shr ecx, 1
0088F1FE 8B3E mov edi, dword ptr [esi]
0088F200 03BD 22040000 add edi, dword ptr [ebp+422]
0088F206 83C6 08 add esi, 8
0088F209 66:8B1E mov bx, word ptr [esi]
0088F20C C1EB 0C shr ebx, 0C
0088F20F 83FB 01 cmp ebx, 1
0088F212 74 0C je short 0088F220
0088F214 83FB 02 cmp ebx, 2
0088F217 74 16 je short 0088F22F
0088F219 83FB 03 cmp ebx, 3
0088F21C 74 20 je short 0088F23E
0088F21E EB 2C jmp short 0088F24C
0088F220 66:8B1E mov bx, word ptr [esi]
0088F223 81E3 FF0F0000 and ebx, 0FFF
0088F229 66:01041F add word ptr [edi+ebx], ax
0088F22D EB 1D jmp short 0088F24C
0088F22F 66:8B1E mov bx, word ptr [esi]
0088F232 81E3 FF0F0000 and ebx, 0FFF
0088F238 66:01141F add word ptr [edi+ebx], dx
0088F23C EB 0E jmp short 0088F24C
0088F23E 66:8B1E mov bx, word ptr [esi]
0088F241 81E3 FF0F0000 and ebx, 0FFF
0088F247 01141F add dword ptr [edi+ebx], edx
0088F24A EB 00 jmp short 0088F24C
0088F24C 66:830E FF or word ptr [esi], 0FFFF
0088F250 83C6 02 add esi, 2
0088F253 ^ E2 B4 loopd short 0088F209
0088F255 ^ EB 9A jmp short 0088F1F1
0088F257 8B95 22040000 mov edx, dword ptr [ebp+422] //停在这里，F2下断，重启程序，F9运行至断点出。ESI=0088CF54,与教程不符，想必出问题了。请问问题出在那里呢？
0088F25D 8BB5 41050000 mov esi, dword ptr [ebp+541]
0088F263 0BF6 or esi, esi
0088F265 74 11 je short 0088F278
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
无果。。。不修改z标志试试。
0088F1C8 8785 35050000 xchg dword ptr [ebp+535], eax
0088F1CE 8B95 22040000 mov edx, dword ptr [ebp+422]
0088F1D4 8B85 2D050000 mov eax, dword ptr [ebp+52D]
0088F1DA 2BD0 sub edx, eax //F2,F9,停在此处，F8继续
0088F1DC 74 79 je short 0088F257
0088F1DE 8BC2 mov eax, edx
0088F1E0 C1E8 10 shr eax, 10
0088F1E3 33DB xor ebx, ebx
0088F1E5 8BB5 39050000 mov esi, dword ptr [ebp+539] //ss:[0088F54C]=0001CF54,esi=0088F5B4 (SlAss.0088F5B4) ★ 这个00006000就是重定位表的RVA！
0088F1EB 03B5 22040000 add esi, dword ptr [ebp+422]
0088F1F1 833E 00 cmp dword ptr [esi], 0
0088F1F4 74 61 je short 0088F257 //在0088F257处下断，提问：该跳转直接就跳转到0088F257,为何还要去0088F257下断点？另外教程提示找到0088F1F6，将//0088F24C NOP掉不明白，既然直接跳到他下面去了，怎么去有效的NOP掉呢？不明白，继续往下探试，直接跳到0088F257
0088F1F6 8B4E 04 mov ecx, dword ptr [esi+4]
0088F1F9 83E9 08 sub ecx, 8
0088F1FC D1E9 shr ecx, 1
0088F1FE 8B3E mov edi, dword ptr [esi]
0088F200 03BD 22040000 add edi, dword ptr [ebp+422]
0088F206 83C6 08 add esi, 8
0088F209 66:8B1E mov bx, word ptr [esi]
0088F20C C1EB 0C shr ebx, 0C
0088F20F 83FB 01 cmp ebx, 1
0088F212 74 0C je short 0088F220
0088F214 83FB 02 cmp ebx, 2
0088F217 74 16 je short 0088F22F
0088F219 83FB 03 cmp ebx, 3
0088F21C 74 20 je short 0088F23E
0088F21E EB 2C jmp short 0088F24C
0088F220 66:8B1E mov bx, word ptr [esi]
0088F223 81E3 FF0F0000 and ebx, 0FFF
0088F229 66:01041F add word ptr [edi+ebx], ax
0088F22D EB 1D jmp short 0088F24C
0088F22F 66:8B1E mov bx, word ptr [esi]
0088F232 81E3 FF0F0000 and ebx, 0FFF
0088F238 66:01141F add word ptr [edi+ebx], dx
0088F23C EB 0E jmp short 0088F24C
0088F23E 66:8B1E mov bx, word ptr [esi]
0088F241 81E3 FF0F0000 and ebx, 0FFF
0088F247 01141F add dword ptr [edi+ebx], edx
0088F24A EB 00 jmp short 0088F24C
0088F24C 66:830E FF or word ptr [esi], 0FFFF
0088F250 83C6 02 add esi, 2
0088F253 ^ E2 B4 loopd short 0088F209
0088F255 ^ EB 9A jmp short 0088F1F1
0088F257 8B95 22040000 mov edx, dword ptr [ebp+422] //来到这里,ESI=0088CF54与教程后3位值又不同.想必前面没弄清楚肯定不行了.
0088F25D 8BB5 41050000 mov esi, dword ptr [ebp+541]
0088F263 0BF6 or esi, esi
0088F265 74 11 je short 0088F278
又继续不下去了............
失败失败.请教请教,然后俺会复活复活!
附上原文件:
[注意]看雪招聘，专注安全领域的专业人才平台！
