脱壳目标：加了壳的Win98记事本

PEiD查壳：UltraProtect 1.x -> RISCO Software Inc.

存在Stolen Code

OD设置：Debugging Options Exceptions，Exceptions去掉Memory access violation的勾

SOD设置(如需要)：去掉Skip Some Exceptions的勾

OD载入

0040D000 >  60              pushad                                   ; 中断在此
0040D001    F9              stc
0040D002    87D6            xchg esi,edx
0040D004    72 03           jb short notepad9.0040D009
0040D006    73 01           jnb short notepad9.0040D009
0040D008    7A 81           jpe short notepad9.0040CF8B

00415719    CD 01           int 1                                    ; 中断在此
0041571B    40              inc eax
0041571C    40              inc eax
0041571D    0BC0            or eax,eax
0041571F    75 05           jnz short notepad9.00415726

0012FF20   0012FFC4  Pointer to next SEH record
0012FF24   004156FD  SE handler           ; 在反汇编窗口跟随

004156FD    8B5C24 0C       mov ebx,dword ptr ss:[esp+C]             ; 下断，Memory,on access，Shift+F9三次
00415701    8383 B8000000 0>add dword ptr ds:[ebx+B8],2
00415708    33C0            xor eax,eax
0041570A    C3              retn
0041570B    64:67:FF36 0000 push dword ptr fs:[0]
00415711    64:67:8926 0000 mov dword ptr fs:[0],esp
00415717    33C0            xor eax,eax

00415761    89048E          mov dword ptr ds:[esi+ecx*4],eax         ; 中断在此!删除内存断点
00415764    49              dec ecx
00415765  ^ EB E1           jmp short notepad9.00415748
00415767    61              popad
00415768    61              popad
00415769    C3              retn                                     ; 定位到此，F4

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课