用PE 查壳的类型为
Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks [Overlay]
关于Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks的壳论坛有帖子！
我就直接OD载入程序到了
00656999 M>/$ 55 push ebp
0065699A |. 8BEC mov ebp,esp
0065699C |. 6A FF push -1
0065699E |. 68 506C6700 push M2Server.00676C50
006569A3 |. 68 80636500 push M2Server.00656380 ; SE handler installation
006569A8 |. 64:A1 00000>mov eax,dword ptr fs:[0]
006569AE |. 50 push eax
006569AF |. 64:8925 000>mov dword ptr fs:[0],esp
006569B6 |. 83EC 58 sub esp,58
006569B9 |. 53 push ebx
006569BA |. 56 push esi
006569BB |. 57 push edi
006569BC |. 8965 E8 mov dword ptr ss:[ebp-18],esp
下了BP OpenMutexA命令，然后F9运行
程序断在 7C80EC1B k> 8BFF mov edi,edi
7C80EC1D 55 push ebp
7C80EC1E 8BEC mov ebp,esp
7C80EC20 51 push ecx
7C80EC21 51 push ecx
7C80EC22 837D 10 00 cmp dword ptr ss:[ebp+10],0
7C80EC26 56 push esi
7C80EC27 0F84 7A500300 je kernel32.7C843CA7
我查看了调用堆栈 应该压的地方是0012FBDC
根据各位老大提供的经验得：Ctrl+G定位到00401000处：
00401000 0000 add byte ptr ds:[eax],al
00401002 0000 add byte ptr ds:[eax],al
00401004 0000 add byte ptr ds:[eax],al
00401006 0000 add byte ptr ds:[eax],al
00401008 0000 add byte ptr ds:[eax],al
0040100A 0000 add byte ptr ds:[eax],al
0040100C 0000 add byte ptr ds:[eax],al
0040100E 0000 add byte ptr ds:[eax],al
以上全是空码，在00401000处Ctrl+E贴上以下代码，这些是根据老大们的经验得来的 ：
00401000 60 pushad
00401001 9C pushfd
00401002 68 F0FB1200 push 12FBDC *这是堆栈中看到的
00401007 33C0 xor eax,eax
00401009 50 push eax
0040100A 50 push eax
0040100B E8 2FDB407C call kernel32.CreateMutexA
00401010 9D popfd
00401011 61 popad
00401012 - E9 04DC407C jmp kernel32.OpenMutexA
然的天00401000处单击右键，在弹出的菜单上选”在此处新建EIP“，确正。然后F9运行
断在
7C80EC1B k> 8BFF mov edi,edi *F2 取消
7C80EC1D 55 push ebp
7C80EC1E 8BEC mov ebp,esp
7C80EC20 51 push ecx
7C80EC21 51 push ecx
7C80EC22 837D 10 00 cmp dword ptr ss:[ebp+10],0
7C80EC26 56 push esi
7C80EC27 0F84 7A500300 je kernel32.7C843CA7
Ctrl+G定位到00401000处，右键取消的修改。之后下断点：BP GetModuleHandleA ，F9运行
断在
7C80B529 k> 8BFF mov edi,edi *F2 取消开始调试
7C80B52B 55 push ebp
7C80B52C 8BEC mov ebp,esp
7C80B52E 837D 08 00 cmp dword ptr ss:[ebp+8],0
7C80B532 74 18 je short kernel32.7C80B54C 点右键改在硬件执行；F9大概3次后又忽略一处异常后删除硬件断点 CTRL+F9 一路到
00DB799B 8B0D E011DE00 mov ecx,dword ptr ds:[DE11E0]
00DB79A1 89040E mov dword ptr ds:[esi+ecx],eax
00DB79A4 A1 E011DE00 mov eax,dword ptr ds:[DE11E0]
00DB79A9 393C06 cmp dword ptr ds:[esi+eax],edi
00DB79AC 75 16 jnz short 00DB79C4
00DB79AE 8D85 B4FEFFFF lea eax,dword ptr ss:[ebp-14C]
00DB79B4 50 push eax
00DB79B5 FF15 CC80DD00 call dword ptr ds:[DD80CC] ; kernel32.LoadLibraryA
00DB79BB 8B0D E011DE00 mov ecx,dword ptr ds:[DE11E0]
00DB79C1 89040E mov dword ptr ds:[esi+ecx],eax
00DB79C4 A1 E011DE00 mov eax,dword ptr ds:[DE11E0]
00DB79C9 393C06 cmp dword ptr ds:[esi+eax],edi
00DB79CC 0F84 AD000000 je 00DB7A7F *改为 jmp 00DB7A7F
00DB79D2 33C9 xor ecx,ecx
00DB79D4 8B03 mov eax,dword ptr ds:[ebx]
00DB79D6 3938 cmp dword ptr ds:[eax],edi
00DB79D8 74 06 je short 00DB79E0
00DB79DA 41 inc ecx
00DB79DB 83C0 0C add eax,0C
00DB79DE ^ EB F6 jmp short 00DB79D6
后下断点 BP GetCurrentThreadId，F9运行。中断后 查看堆栈 大概2次F9 后返回在
00DD456C A3 AC56DE00 mov dword ptr ds:[DE56AC],eax
00DD4571 E8 1537FEFF call 00DB7C8B
00DD4576 6A 00 push 0
00DD4578 E8 648FFEFF call 00DBD4E1
00DD457D 6A 00 push 0
00DD457F C705 DCDBDD00>mov dword ptr ds:[DDDBDC],0DDE6E8 ; ASCII "RC"
00DD4589 E8 7231FEFF call 00DB7700
00DD458E 59 pop ecx
00DD458F 59 pop ecx
00DD4590 E8 4A11FFFF call 00DC56DF
00DD4595 8BF8 mov edi,eax
00DD4597 A1 9455DE00 mov eax,dword ptr ds:[DE5594]
00DD459C 8B48 70 mov ecx,dword ptr ds:[eax+70]
00DD459F 3348 40 xor ecx,dword ptr ds:[eax+40]
00DD45A2 3348 08 xor ecx,dword ptr ds:[eax+8]
00DD45A5 03F9 add edi,ecx
00DD45A7 8B0E mov ecx,dword ptr ds:[esi]
00DD45A9 85C9 test ecx,ecx
00DD45AB 75 2F jnz short 00DD45DC
00DD45AD 8B78 70 mov edi,dword ptr ds:[eax+70]
00DD45B0 E8 2A11FFFF call 00DC56DF
00DD45B5 8B0D 9455DE00 mov ecx,dword ptr ds:[DE5594] ; M2Server.00671260
00DD45BB FF76 14 push dword ptr ds:[esi+14]
00DD45BE 8B51 40 mov edx,dword ptr ds:[ecx+40]
00DD45C1 FF76 10 push dword ptr ds:[esi+10]
00DD45C4 3351 08 xor edx,dword ptr ds:[ecx+8]
00DD45C7 FF76 0C push dword ptr ds:[esi+C]
00DD45CA 33D7 xor edx,edi
00DD45CC 03C2 add eax,edx
00DD45CE 8B51 68 mov edx,dword ptr ds:[ecx+68]
00DD45D1 3351 04 xor edx,dword ptr ds:[ecx+4]
00DD45D4 33D7 xor edx,edi
00DD45D6 2BC2 sub eax,edx
00DD45D8 FFD0 call eax
00DD45DA EB 25 jmp short 00DD4601
00DD45DC 83F9 01 cmp ecx,1
00DD45DF 75 22 jnz short 00DD4603
00DD45E1 FF76 04 push dword ptr ds:[esi+4]
00DD45E4 FF76 08 push dword ptr ds:[esi+8]
00DD45E7 6A 00 push 0
00DD45E9 E8 F110FFFF call 00DC56DF
00DD45EE 50 push eax
00DD45EF A1 9455DE00 mov eax,dword ptr ds:[DE5594]
00DD45F4 8B48 70 mov ecx,dword ptr ds:[eax+70]
00DD45F7 3348 68 xor ecx,dword ptr ds:[eax+68]
00DD45FA 3348 04 xor ecx,dword ptr ds:[eax+4]
00DD45FD 2BF9 sub edi,ecx
00DD45FF FFD7 call edi
00DD4601 8BD8 mov ebx,eax
00DD4603 5F pop edi
00DD4604 8BC3 mov eax,ebx
00DD4606 5E pop esi
00DD4607 5B pop ebx
00DD4608 C3 retn
继续调试到：；005E4AF0 55 push ebp
005E4AF1 8BEC mov ebp,esp
005E4AF3 83C4 F0 add esp,-10
005E4AF6 B8 E8465E00 mov eax,M2Server.005E46E8
005E4AFB E8 2C22E2FF call M2Server.00406D2C
005E4B00 74 03 je short M2Server.005E4B05
005E4B02 75 01 jnz short M2Server.005E4B05
005E4B04 E8 8D054C45 call 45AA5096
005E4B09 5E pop esi
005E4B0A 00FF add bh,bh
005E4B0C D07404 75 sal byte ptr ss:[esp+eax+75],1
005E4B10 02F4 add dh,ah
005E4B12 FFE8 jmp far eax ; 非法使用寄存器
005E4B14 1C FB sbb al,0FB
005E4B16 E1 FF loopde short M2Server.005E4B17
这里的字体全是红色的 ！ 也就是程序的入口了！这里就可以直接DUMP了：
用Import Reconstructor 1.4.2+ 修复 后程序不能正常运行！因为个别指针无效！・
虽然解决了 Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks 的问题但是[Overlay] 问题还没有 解决！之后我又查阅了大量的关于[Overlay]在本论坛的帖子！仍未解决！ 请高手帮忙写完
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
