手工脱壳：UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo

刚在网上找了一个gh0st3.6，准备做下免杀，结果发现已经被加了一层万恶的壳子，真烦人啊。peid查壳显示：UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo


OD载入：（ESP定律法）004B5000 > $ 60 pushad
004B5001 . BE 00004700 mov esi, 00470000 //F8单步一下，走到这里记下右边寄存器窗口ESP：0012FFA4
004B5006 . 8DBE 0010F9FF lea edi, dword ptr [esi+FFF91000]
004B500C . 57 push edi
004B500D . 83CD FF or ebp, FFFFFFFF
004B5010 . EB 10 jmp short 004B5022
004B5012 90 nop
004B5013 90 nop
F8单步一下，记下右边寄存器窗口ESP：0012FFA4，在最下方 Command 里面输入：hr0012FFA4，然后回车，再按一下F9，程序跳到这里：004B51A7 . 8D4424 80 lea eax, dword ptr [esp-80]
004B51AB > 6A 00 push 0 //马上要循环了
004B51AD . 39C4 cmp esp, eax
004B51AF .^ 75 FA jnz short 004B51AB //循坏了
004B51B1 . 83EC 80 sub esp, -80 //F4跳到这里来
004B51B4 .- E9 90B1F7FF jmp 00430349 //大跳到程序入口点004B51B9 00 db 00
004B51BA 00 db 00
004B51BB 00 db 00
004B51BC 00 db 00
004B51BD 00 db 00
004B51BE 00 db 00继续F8,注意红色的那两行，构成一个循环了，江光标定位在 004b51b1 ，连续按2次F4，再按两次F8到入口点00430349 55 push ebp //程序入口点
0043034A 8BEC mov ebp, esp
0043034C 6A FF push -1
0043034E 68 E8764600 push 004676E8
00430353 68 3C014300 push 0043013C
00430358 64:A1 00000000 mov eax, dword ptr fs:[0]
0043035E 50 push eax
0043035F 64:8925 0000000>mov dword ptr fs:[0], esp
00430366 83EC 58 sub esp, 58
00430369 53 push ebx
0043036A 56 push esi
0043036B 57 push edi

OD载入：（堆栈平衡法）004B5000 > $ 60 pushad //壳的入口那么就必然会有 POPAD 与之对称右键－查找－命令－popad

查找之后来到这里：
004B51A6 . 61 popad //F2下断点，shift+F9重新运行程序
004B51A7 . 8D4424 80 lea eax, dword ptr [esp-80]
004B51AB > 6A 00 push 0
004B51AD . 39C4 cmp esp, eax
004B51AF .^ 75 FA jnz short 004B51AB
004B51B1 . 83EC 80 sub esp, -80
004B51B4 .- E9 90B1F7FF jmp 00430349004B51B9 00 db 00
004B51BA 00 db 00
004B51BB 00 db 00
004B51BC 00 db 00
004B51BD 00 db 00
004B51BE 00 db 00呵呵，和上面的ESP脱的一样了吧，照着上面的继续脱掉.