看了《重定位表中的偶数规则》这个帖子后非常感动，于是自己准备试试，找了一pklite加壳的DLL文件，可是好象有些不一样，还请各位大虾给于提示，找入口点时在哪里以及什么时候下断比较好呢？？
00932000 P> $ 68 80205A00 push 5A2080 ; /Arg3 = 005A2080
00932005 . 68 31586300 push 635831 ; |Arg2 = 00635831
0093200A . B8 00004000 mov eax,400000 ; |ASCII "MZP"
0093200F . 2B4424 0C sub eax,dword ptr ss:[esp+C] ; |
00932013 . 50 push eax ; |Arg1
00932014 . E8 18380900 call sample.009C5831 ; \sample.009C5831
00932019 .- E9 E2EFE5FF jmp sample.00791000
0093201E . 40 28 23 29 50 4B 4C>ascii "@(#)PKLITE32 Cop"
//======================================================================
00791000 /EB 10 jmp short sample.00791012
00791002 |66:623A bound di,dword ptr ds:[edx]
00791005 |43 inc ebx
00791006 |2B2B sub ebp,dword ptr ds:[ebx]
00791008 |48 dec eax
00791009 |4F dec edi
0079100A |4F dec edi
0079100B |4B dec ebx
0079100C |90 nop
0079100D -|E9 BC058900 jmp 010215CE
00791012 \A1 43058900 mov eax,dword ptr ds:[890543]
00791017 C1E0 02 shl eax,2
0079101A A3 47058900 mov dword ptr ds:[890547],eax
0079101F 8B4424 08 mov eax,dword ptr ss:[esp+8]
00791023 A3 B5058900 mov dword ptr ds:[8905B5],eax
00791028 FF1485 A5058900 call dword ptr ds:[eax*4+8905A5]
0079102F 833D B5058900 01 cmp dword ptr ds:[8905B5],1
00791036 75 5E jnz short sample.00791096
00791038 803D 4F058900 00 cmp byte ptr ds:[89054F],0
0079103F 74 24 je short sample.00791065
00791041 E8 9AD90F00 call <jmp.&KERNEL32.GetVersion>
00791046 BA 50058900 mov edx,sample.00890550 ; ASCII "Nonshared DATA segment required"
0079104B 25 00000080 and eax,80000000
00791050 74 05 je short sample.00791057
00791052 BA 70058900 mov edx,sample.00890570 ; ASCII "Cannot run multiple instances of a DLL under WIN32s"
00791057 52 push edx
00791058 E8 A7810D00 call sample.00869204
0079105D 58 pop eax
0079105E 33C0 xor eax,eax
00791060 E9 8F000000 jmp sample.007910F4
00791065 FE05 4F058900 inc byte ptr ds:[89054F]
0079106B 833D B5058900 01 cmp dword ptr ds:[8905B5],1
00791072 75 1A jnz short sample.0079108E
00791074 E8 938F0D00 call sample.0086A00C
00791079 52 push edx
0079107A 8B5424 08 mov edx,dword ptr ss:[esp+8]
0079107E E8 C1270D00 call sample.00863844
00791083 5A pop edx
00791084 E8 1F270D00 call sample.008637A8
00791089 E8 FA270D00 call sample.00863888
0079108E 6A 00 push 0
00791090 E8 973A0D00 call sample.00864B2C
00791095 59 pop ecx
00791096 68 F8048900 push sample.008904F8
0079109B 8B4424 08 mov eax,dword ptr ss:[esp+8]
0079109F A3 4B058900 mov dword ptr ds:[89054B],eax
007910A4 833D B5058900 01 cmp dword ptr ds:[8905B5],1
007910AB 74 17 je short sample.007910C4
007910AD 833D B5058900 02 cmp dword ptr ds:[8905B5],2
007910B4 74 0E je short sample.007910C4
007910B6 E8 598D0D00 call sample.00869E14
007910BB C605 A4058900 00 mov byte ptr ds:[8905A4],0
007910C2 EB 07 jmp short sample.007910CB
007910C4 C605 A4058900 01 mov byte ptr ds:[8905A4],1
007910CB 833D A4568B00 00 cmp dword ptr ds:[8B56A4],0
007910D2 74 12 je short sample.007910E6
007910D4 50 push eax
007910D5 A1 B5058900 mov eax,dword ptr ds:[8905B5]
007910DA 50 push eax
007910DB 8B4424 18 mov eax,dword ptr ss:[esp+18]
007910DF 50 push eax
007910E0 FF15 A4568B00 call dword ptr ds:[8B56A4]
007910E6 803D A4058900 00 cmp byte ptr ds:[8905A4],0
007910ED 74 05 je short sample.007910F4
007910EF E8 208D0D00 call sample.00869E14
007910F4 83C4 04 add esp,4
007910F7 833D B5058900 00 cmp dword ptr ds:[8905B5],0
007910FE 75 14 jnz short sample.00791114
00791100 E8 93260D00 call sample.00863798
00791105 E8 7A270D00 call sample.00863884
0079110A E8 018F0D00 call sample.0086A010
0079110F E8 D4000000 call sample.007911E8
00791114 C2 0C00 retn 0C
00791117 E9 5C3A0D00 jmp sample.00864B78
0079111C 33C0 xor eax,eax
0079111E A0 41058900 mov al,byte ptr ds:[890541]
00791123 C3 retn
00791124 A1 4B058900 mov eax,dword ptr ds:[89054B]
00791129 C3 retn
0079112A 60 pushad
0079112B BB 0050B0BC mov ebx,BCB05000
00791130 53 push ebx
00791131 68 AD0B0000 push 0BAD
00791136 C3 retn
00791137 B9 B4000000 mov ecx,0B4
0079113C 0BC9 or ecx,ecx
0079113E 74 51 je short sample.00791191
00791140 833D 43058900 00 cmp dword ptr ds:[890543],0
00791147 73 0A jnb short sample.00791153
00791149 B8 FE000000 mov eax,0FE
0079114E E8 D7FFFFFF call sample.0079112A
00791153 B9 B4000000 mov ecx,0B4
00791158 51 push ecx
00791159 6A 08 push 8
0079115B E8 3ED80F00 call <jmp.&KERNEL32.GetProcessHeap>
00791160 50 push eax
00791161 E8 B6D80F00 call <jmp.&KERNEL32.HeapAlloc>
00791166 0BC0 or eax,eax
00791168 75 0A jnz short sample.00791174
0079116A B8 FD000000 mov eax,0FD
0079116F E8 B6FFFFFF call sample.0079112A
00791174 57 push edi
00791175 56 push esi
00791176 50 push eax
00791177 50 push eax
00791178 FF35 43058900 push dword ptr ds:[890543]
0079117E E8 218F0D00 call sample.0086A0A4
00791183 FF35 43058900 push dword ptr ds:[890543]
00791189 E8 2A8F0D00 call sample.0086A0B8
0079118E 5F pop edi
0079118F 5E pop esi
00791190 5F pop edi
00791191 C3 retn
00791192 B9 B4000000 mov ecx,0B4
00791197 0BC9 or ecx,ecx
00791199 74 19 je short sample.007911B4
0079119B E8 DC8E0D00 call sample.0086A07C
007911A0 A3 43058900 mov dword ptr ds:[890543],eax
007911A5 83F8 00 cmp eax,0
007911A8 ^ 73 8D jnb short sample.00791137
007911AA B8 FC000000 mov eax,0FC
007911AF E8 76FFFFFF call sample.0079112A
007911B4 C3 retn
007911B5 833D 43058900 00 cmp dword ptr ds:[890543],0
007911BC 72 28 jb short sample.007911E6
007911BE FF35 43058900 push dword ptr ds:[890543]
007911C4 E8 CB8E0D00 call sample.0086A094
007911C9 0BC0 or eax,eax
007911CB 74 19 je short sample.007911E6
007911CD 50 push eax
007911CE 6A 08 push 8
007911D0 E8 C9D70F00 call <jmp.&KERNEL32.GetProcessHeap>
007911D5 50 push eax
007911D6 E8 4DD80F00 call <jmp.&KERNEL32.HeapFree>
007911DB FF35 43058900 push dword ptr ds:[890543]
007911E1 E8 DA8E0D00 call sample.0086A0C0
007911E6 C3 retn
007911E7 C3 retn
007911E8 833D 43058900 00 cmp dword ptr ds:[890543],0
007911EF 72 10 jb short sample.00791201
007911F1 E8 BFFFFFFF call sample.007911B5
007911F6 FF35 43058900 push dword ptr ds:[890543]
007911FC E8 838E0D00 call sample.0086A084
00791201 C3 retn
00791202 833D 43058900 00 cmp dword ptr ds:[890543],0
00791209 75 0A jnz short sample.00791215
0079120B E8 6C8E0D00 call sample.0086A07C
00791210 A3 43058900 mov dword ptr ds:[890543],eax
00791215 FF35 43058900 push dword ptr ds:[890543]
0079121B E8 748E0D00 call sample.0086A094
00791220 85C0 test eax,eax
00791222 74 01 je short sample.00791225
00791224 C3 retn
00791225 E8 0DFFFFFF call sample.00791137
0079122A A1 43058900 mov eax,dword ptr ds:[890543]
0079122F 50 push eax
00791230 E8 5F8E0D00 call sample.0086A094
00791235 C3 retn
00791236 90 nop
00791237 90 nop
00791238 53 push ebx
00791239 81C4 F8FEFFFF add esp,-108
0079123F 68 05010000 push 105
00791244 8D4424 04 lea eax,dword ptr ss:[esp+4]
00791248 50 push eax
00791249 A1 3C3C8B00 mov eax,dword ptr ds:[8B3C3C]
0079124E 50 push eax
0079124F E8 2CD70F00 call <jmp.&KERNEL32.GetModuleFileName>
00791254 8BC4 mov eax,esp
00791256 E8 B5150D00 call sample.00862810
0079125B 8BD8 mov ebx,eax
0079125D 891D DC058900 mov dword ptr ds:[8905DC],ebx
00791263 85DB test ebx,ebx
00791265 75 0A jnz short sample.00791271
00791267 A1 D0058900 mov eax,dword ptr ds:[8905D0]
0079126C A3 DC058900 mov dword ptr ds:[8905DC],eax
00791271 B8 CC058900 mov eax,sample.008905CC
00791276 E8 AD180D00 call sample.00862B28
0079127B 81C4 08010000 add esp,108
00791281 5B pop ebx
00791282 C3 retn
00791283 90 nop
00791284 B8 CC058900 mov eax,sample.008905CC
00791289 E8 AA180D00 call sample.00862B38
0079128E A1 DC058900 mov eax,dword ptr ds:[8905DC]
00791293 3B05 D0058900 cmp eax,dword ptr ds:[8905D0]
00791299 74 06 je short sample.007912A1
0079129B 50 push eax
0079129C E8 4FD60F00 call <jmp.&KERNEL32.FreeLibrary>
007912A1 C3 retn
007912A2 90 nop
007912A3 90 nop
007912A4 55 push ebp
007912A5 8BEC mov ebp,esp
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
