小弟遇到这么一个改过PE头和区段表的不知道是壳的软件，想试试，但手脱的时候出了点问题，望大虾指点下~
我感觉这壳一点都没遵循ESP定律，OD载入后停在一CALL上~然后下边接一跳转，F9运行的话能检测到调试器，自己中断，所以我怀疑这CALL和跳转是不是针对调试器的，但具体不知道怎么做~能检测到调试器这个用OD自动隐藏应该可以解决，但其他的。。。。。。望高手指点~该如何入手、如何脱~3Q3Q
代码如下：
004E07BE > /6A 60 push 60 ; 回跳到这
004E07C0 . |68 38895400 push 00548938
004E07C5 . |E8 AE830000 call 004E8B78
004E07CA . |8365 FC 00 and dword ptr [ebp-4], 0
004E07CE . |8D45 90 lea eax, dword ptr [ebp-70]
004E07D1 . |50 push eax ; /pStartupinfo
004E07D2 . |FF15 30E25000 call dword ptr [<&KERNEL32.GetStartup>; \GetStartupInfoW
004E07D8 . |C745 FC FEFFF>mov dword ptr [ebp-4], -2
004E07DF . |BF 94000000 mov edi, 94
004E07E4 . |57 push edi ; /dwBytes => 94 (148.)
004E07E5 . |6A 00 push 0 ; |dwFlags = 0
004E07E7 . |8B1D 2CE25000 mov ebx, dword ptr [<&KERNEL32.GetPr>; |kernel32.GetProcessHeap
004E07ED . |FFD3 call ebx ; |[GetProcessHeap
004E07EF . |50 push eax ; |hHeap
004E07F0 . |FF15 28E25000 call dword ptr [<&KERNEL32.HeapAlloc>>; \RtlAllocateHeap
004E07F6 . |8BF0 mov esi, eax
004E07F8 . |85F6 test esi, esi
004E07FA . |75 0D jnz short 004E0809
004E07FC . |6A 12 push 12
004E07FE . |E8 56FFFFFF call 004E0759
004E0803 . |59 pop ecx
004E0804 . |E9 89010000 jmp 004E0992
004E0809 > |893E mov dword ptr [esi], edi
004E080B . |56 push esi ; /pVersionInformation
004E080C . |FF15 00E35000 call dword ptr [<&KERNEL32.GetVersion>; \GetVersionExA
004E0812 . |56 push esi
004E0813 . |6A 00 push 0
004E0815 . |85C0 test eax, eax
004E0817 . |75 0E jnz short 004E0827
004E0819 . |FFD3 call ebx
004E081B . |50 push eax ; |hHeap
004E081C . |FF15 24E25000 call dword ptr [<&KERNEL32.HeapFree>] ; \HeapFree
004E0822 . |E9 6B010000 jmp 004E0992
004E0827 > |8B46 10 mov eax, dword ptr [esi+10]
004E082A . |8945 E0 mov dword ptr [ebp-20], eax
004E082D . |8B46 04 mov eax, dword ptr [esi+4]
004E0830 . |8945 DC mov dword ptr [ebp-24], eax
004E0833 . |8B46 08 mov eax, dword ptr [esi+8]
004E0836 . |8945 D8 mov dword ptr [ebp-28], eax
004E0839 . |8B7E 0C mov edi, dword ptr [esi+C]
004E083C . |81E7 FF7F0000 and edi, 7FFF
004E0842 . |FFD3 call ebx
004E0844 . |50 push eax ; |hHeap
004E0845 . |FF15 24E25000 call dword ptr [<&KERNEL32.HeapFree>] ; \HeapFree
004E084B . |8B75 E0 mov esi, dword ptr [ebp-20]
004E084E . |83FE 02 cmp esi, 2
004E0851 . |74 06 je short 004E0859
004E0853 . |81CF 00800000 or edi, 8000
004E0859 > |8B4D DC mov ecx, dword ptr [ebp-24]
004E085C . |8BC1 mov eax, ecx
004E085E . |C1E0 08 shl eax, 8
004E0861 . |8B55 D8 mov edx, dword ptr [ebp-28]
004E0864 . |03C2 add eax, edx
004E0866 . |8935 603E5900 mov dword ptr [593E60], esi
004E086C . |A3 683E5900 mov dword ptr [593E68], eax
004E0871 . |890D 6C3E5900 mov dword ptr [593E6C], ecx
004E0877 . |8915 703E5900 mov dword ptr [593E70], edx
004E087D . |893D 643E5900 mov dword ptr [593E64], edi
004E0883 . |E8 F5FEFFFF call 004E077D
004E0888 . |8945 E0 mov dword ptr [ebp-20], eax
004E088B . |33DB xor ebx, ebx
004E088D . |43 inc ebx
004E088E . |53 push ebx
004E088F . |E8 ACA00000 call 004EA940
004E0894 . |59 pop ecx
004E0895 . |85C0 test eax, eax
004E0897 . |75 08 jnz short 004E08A1
004E0899 . |6A 1C push 1C
004E089B . |E8 B9FEFFFF call 004E0759
004E08A0 . |59 pop ecx
004E08A1 > |E8 BB9E0000 call 004EA761
004E08A6 . |85C0 test eax, eax
004E08A8 . |75 08 jnz short 004E08B2
004E08AA . |6A 10 push 10
004E08AC . |E8 A8FEFFFF call 004E0759
004E08B1 . |59 pop ecx
004E08B2 > |E8 2A9A0000 call 004EA2E1
004E08B7 . |895D FC mov dword ptr [ebp-4], ebx
004E08BA . |E8 E2970000 call 004EA0A1
004E08BF . |85C0 test eax, eax
004E08C1 . |7D 08 jge short 004E08CB
004E08C3 . |6A 1B push 1B
004E08C5 . |E8 5A840000 call 004E8D24
004E08CA . |59 pop ecx
004E08CB > |E8 32970000 call 004EA002
004E08D0 . |A3 745C5900 mov dword ptr [595C74], eax
004E08D5 . |E8 C7950000 call 004E9EA1
004E08DA . |A3 8C3D5900 mov dword ptr [593D8C], eax
004E08DF . |E8 12950000 call 004E9DF6
004E08E4 . |85C0 test eax, eax
004E08E6 . |7D 08 jge short 004E08F0
004E08E8 . |6A 08 push 8
004E08EA . |E8 35840000 call 004E8D24
004E08EF . |59 pop ecx
004E08F0 > |E8 DB920000 call 004E9BD0
004E08F5 . |85C0 test eax, eax
004E08F7 . |7D 08 jge short 004E0901
004E08F9 . |6A 09 push 9
004E08FB . |E8 24840000 call 004E8D24
004E0900 . |59 pop ecx
004E0901 > |53 push ebx
004E0902 . |E8 39850000 call 004E8E40
004E0907 . |59 pop ecx
004E0908 . |85C0 test eax, eax
004E090A . |74 07 je short 004E0913
004E090C . |50 push eax
004E090D . |E8 12840000 call 004E8D24
004E0912 . |59 pop ecx
004E0913 > |E8 72920000 call 004E9B8A
004E0918 . |845D BC test byte ptr [ebp-44], bl
004E091B . |74 06 je short 004E0923
004E091D . |0FB74D C0 movzx ecx, word ptr [ebp-40]
004E0921 . |EB 03 jmp short 004E0926
004E0923 > |6A 0A push 0A
004E0925 . |59 pop ecx
004E0926 > |51 push ecx
004E0927 . |50 push eax
004E0928 . |6A 00 push 0
004E092A . |68 00004000 push 00400000
004E092F . |E8 57170200 call 0050208B
004E0934 . |8945 E4 mov dword ptr [ebp-1C], eax
004E0937 . |837D E0 00 cmp dword ptr [ebp-20], 0
004E093B . |75 06 jnz short 004E0943
004E093D . |50 push eax
004E093E . |E8 71860000 call 004E8FB4
004E0943 > |E8 8E860000 call 004E8FD6
004E0948 . |EB 2E jmp short 004E0978
004E094A . |8B45 EC mov eax, dword ptr [ebp-14]
004E094D . |8B08 mov ecx, dword ptr [eax]
004E094F . |8B09 mov ecx, dword ptr [ecx]
004E0951 . |894D D4 mov dword ptr [ebp-2C], ecx
004E0954 . |50 push eax
004E0955 . |51 push ecx
004E0956 . |E8 D1900000 call 004E9A2C
004E095B . |59 pop ecx
004E095C . |59 pop ecx
004E095D . |C3 retn
004E095E . |8B65 E8 mov esp, dword ptr [ebp-18]
004E0961 . |8B45 D4 mov eax, dword ptr [ebp-2C]
004E0964 . |8945 E4 mov dword ptr [ebp-1C], eax
004E0967 . |837D E0 00 cmp dword ptr [ebp-20], 0
004E096B . |75 06 jnz short 004E0973
004E096D . |50 push eax
004E096E . |E8 52860000 call 004E8FC5
004E0973 > |E8 6D860000 call 004E8FE5
004E0978 > |C745 FC FEFFF>mov dword ptr [ebp-4], -2
004E097F . |8B45 E4 mov eax, dword ptr [ebp-1C]
004E0982 . |EB 13 jmp short 004E0997
004E0984 . |33C0 xor eax, eax
004E0986 . |40 inc eax
004E0987 . |C3 retn
004E0988 . |8B65 E8 mov esp, dword ptr [ebp-18]
004E098B . |C745 FC FEFFF>mov dword ptr [ebp-4], -2
004E0992 > |B8 FF000000 mov eax, 0FF
004E0997 > |E8 21820000 call 004E8BBD
004E099C . |C3 retn
004E099D > $ |E8 F89F0000 call 004EA99A ; 载入停在这
004E09A2 .^\E9 17FEFFFF jmp 004E07BE ; 回跳
004E09A7 $ 55 push ebp
004E09A8 . 8BEC mov ebp, esp
004E09AA . 51 push ecx
004E09AB . 53 push ebx
004E09AC . 8B45 0C mov eax, dword ptr [ebp+C]
004E09AF . 83C0 0C add eax, 0C
004E09B2 . 8945 FC mov dword ptr [ebp-4], eax
004E09B5 . 64:8B1D 00000>mov ebx, dword ptr fs:[0]
004E09BC . 8B03 mov eax, dword ptr [ebx]
004E09BE . 64:A3 0000000>mov dword ptr fs:[0], eax
004E09C4 . 8B45 08 mov eax, dword ptr [ebp+8]
004E09C7 . 8B5D 0C mov ebx, dword ptr [ebp+C]
004E09CA . 8B6D FC mov ebp, dword ptr [ebp-4]
004E09CD . 8B63 FC mov esp, dword ptr [ebx-4]
004E09D0 . FFE0 jmp eax
004E09D2 . 5B pop ebx
004E09D3 . C9 leave
004E09D4 . C2 0800 retn 8
004E09D7 $ 58 pop eax
004E09D8 . 59 pop ecx
004E09D9 . 870424 xchg dword ptr [esp], eax
004E09DC . FFE0 jmp eax
这是完整的一段代码，请高手赐教~谢谢
以下是进入那CALL的内容：
004EA99A /$ 55 push ebp
004EA99B |. 8BEC mov ebp, esp
004EA99D |. 83EC 10 sub esp, 10
004EA9A0 |. A1 D0CD5700 mov eax, dword ptr [57CDD0]
004EA9A5 |. 8365 F8 00 and dword ptr [ebp-8], 0
004EA9A9 |. 8365 FC 00 and dword ptr [ebp-4], 0
004EA9AD |. 53 push ebx
004EA9AE |. 57 push edi
004EA9AF |. BF 4EE640BB mov edi, BB40E64E
004EA9B4 |. 3BC7 cmp eax, edi
004EA9B6 |. BB 0000FFFF mov ebx, FFFF0000
004EA9BB 74 0D je short 004EA9CA
004EA9BD |. 85C3 test ebx, eax
004EA9BF 74 09 je short 004EA9CA
004EA9C1 |. F7D0 not eax
004EA9C3 |. A3 D4CD5700 mov dword ptr [57CDD4], eax
004EA9C8 |. EB 60 jmp short 004EAA2A
004EA9CA |> 56 push esi
004EA9CB |. 8D45 F8 lea eax, dword ptr [ebp-8]
004EA9CE |. 50 push eax ; /pFileTime
004EA9CF |. FF15 F0E25000 call dword ptr [<&KERNEL32.GetSystemT>; \GetSystemTimeAsFileTime
004EA9D5 |. 8B75 FC mov esi, dword ptr [ebp-4]
004EA9D8 |. 3375 F8 xor esi, dword ptr [ebp-8]
004EA9DB |. FF15 30E35000 call dword ptr [<&KERNEL32.GetCurrent>; [GetCurrentProcessId
004EA9E1 |. 33F0 xor esi, eax
004EA9E3 |. FF15 08E35000 call dword ptr [<&KERNEL32.GetCurrent>; [GetCurrentThreadId
004EA9E9 |. 33F0 xor esi, eax
004EA9EB |. FF15 54E45000 call dword ptr [<&KERNEL32.GetTickCou>; [GetTickCount
004EA9F1 |. 33F0 xor esi, eax
004EA9F3 |. 8D45 F0 lea eax, dword ptr [ebp-10]
004EA9F6 |. 50 push eax ; /pPerformanceCount
004EA9F7 |. FF15 8CE25000 call dword ptr [<&KERNEL32.QueryPerfo>; \QueryPerformanceCounter
004EA9FD |. 8B45 F4 mov eax, dword ptr [ebp-C]
004EAA00 |. 3345 F0 xor eax, dword ptr [ebp-10]
004EAA03 |. 33F0 xor esi, eax
004EAA05 |. 3BF7 cmp esi, edi
004EAA07 |. 75 07 jnz short 004EAA10
004EAA09 |. BE 4FE640BB mov esi, BB40E64F
004EAA0E |. EB 0B jmp short 004EAA1B
004EAA10 |> 85F3 test ebx, esi
004EAA12 |. 75 07 jnz short 004EAA1B
004EAA14 |. 8BC6 mov eax, esi
004EAA16 |. C1E0 10 shl eax, 10
004EAA19 |. 0BF0 or esi, eax
004EAA1B |> 8935 D0CD5700 mov dword ptr [57CDD0], esi
004EAA21 |. F7D6 not esi
004EAA23 |. 8935 D4CD5700 mov dword ptr [57CDD4], esi
004EAA29 |. 5E pop esi
004EAA2A |> 5F pop edi
004EAA2B |. 5B pop ebx
004EAA2C |. C9 leave
004EAA2D \. C3 retn
希望有人能帮帮我~指导我教我把这壳脱了。。。。。。。
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
