手脱PEtite v2.1

1.载入PEID

PEtitev2.1

2.载入OD，先F8跟一下

0042C10F>B800C04200moveax,跑跑排行.0042C000;//程序入口点
0042C1146A00push0x0
0042C11668E5E84000push跑跑排行.0040E8E5
0042C11B64:FF350000000>pushdwordptrfs:[0]
0042C12264:89250000000>movdwordptrfs:[0],esp

3.一直到这里，看到一个pushad入栈，下一行使用ESP定律一次，下硬件访问断点，然后shift+F9运行一次

0042C12264:89250000000>movdwordptrfs:[0],esp
0042C12966:9Cpushfw
0042C12B60pushad
0042C12C50pusheax;//这里ESP定律
0042C12D8BD8movebx,eax
0042C12F0300addeax,dwordptrds:[eax]
0042C1316810D80000push0xD810

4.来到ESP的落脚点，然后继续单步就可以到OEP了

0042C10A66:9Dpopfw;//ESP落脚点
0042C10C83C40Caddesp,0xC
0042C10F>-E90AE3FDFFjmp跑跑排行.0040A41E;//指向OEP的关键跳
0042C114-E957163E77jmpmsvcrt._except_handler3
0042C119-E9B0663C77jmpmsvcrt.__p__fmode
0042C11E-E972733D77jmpmsvcrt.__CxxFrameHandler3

5.来到OEP，可以脱壳了

0040A41E55pushebp;//来到OEP
0040A41F8BECmovebp,esp
0040A4216AFFpush-0x1
0040A42368C8CB4000push跑跑排行.0040CBC8
0040A42868A4A54000push跑跑排行.0040A5A4
0040A42D64:A100000000moveax,dwordptrfs:[0]
0040A43350pusheax
0040A43464:89250000000>movdwordptrfs:[0],esp
0040A43B83EC68subesp,0x68

6.运行，查壳

运行OK，查壳：MicrosoftVisualC++v6.0