文件太大不好上传，只能贴入口的一段代码，怎么找到真正的入口点啊，文件头被伪装Microsoft Visual C++成了！这个软件是黑洞2004，加壳的方法好像很高啊！而且反调试！
00D5C000 > 55 PUSH EBP
00D5C001 8BEC MOV EBP,ESP
00D5C003 6A FF PUSH -1
00D5C005 68 1D321305 PUSH 513321D
00D5C00A 68 88888808 PUSH 8888888
00D5C00F 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
00D5C015 50 PUSH EAX
00D5C016 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
00D5C01D 58 POP EAX
00D5C01E 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
00D5C024 58 POP EAX
00D5C025 58 POP EAX
00D5C026 58 POP EAX
00D5C027 58 POP EAX
00D5C028 8BE8 MOV EBP,EAX
00D5C02A E8 3B000000 CALL Client.00D5C06A
00D5C02F E8 01000000 CALL Client.00D5C035
00D5C034 FF58 05 CALL FAR FWORD PTR DS:[EAX+5] ; 远距呼叫
00D5C037 53 PUSH EBX
00D5C038 0000 ADD BYTE PTR DS:[EAX],AL
00D5C03A 0051 8B ADD BYTE PTR DS:[ECX-75],DL
00D5C03D 4C DEC ESP
00D5C03E 24 10 AND AL,10
00D5C040 8981 B8000000 MOV DWORD PTR DS:[ECX+B8],EAX
00D5C046 B8 55010000 MOV EAX,155
00D5C04B 8941 20 MOV DWORD PTR DS:[ECX+20],EAX
00D5C04E 33C0 XOR EAX,EAX
00D5C050 8941 04 MOV DWORD PTR DS:[ECX+4],EAX
00D5C053 8941 08 MOV DWORD PTR DS:[ECX+8],EAX
00D5C056 8941 0C MOV DWORD PTR DS:[ECX+C],EAX
00D5C059 8941 10 MOV DWORD PTR DS:[ECX+10],EAX
00D5C05C 59 POP ECX
00D5C05D C3 RETN
00D5C05E C3 RETN
00D5C05F C3 RETN
00D5C060 C3 RETN
00D5C061 C3 RETN
00D5C062 C3 RETN
00D5C063 C3 RETN
00D5C064 C3 RETN
00D5C065 C3 RETN
00D5C066 C3 RETN
00D5C067 C3 RETN
00D5C068 C3 RETN
00D5C069 C3 RETN
00D5C06A 33C0 XOR EAX,EAX
00D5C06C 64:FF30 PUSH DWORD PTR FS:[EAX]
00D5C06F 64:8920 MOV DWORD PTR FS:[EAX],ESP
00D5C072 9C PUSHFD
00D5C073 804C24 01 01 OR BYTE PTR SS:[ESP+1],1
00D5C078 9D POPFD
00D5C079 90 NOP
00D5C07A 90 NOP
00D5C07B C3 RETN
00D5C07C C3 RETN
00D5C07D C3 RETN
00D5C07E C3 RETN
00D5C07F C3 RETN
00D5C080 C3 RETN
00D5C081 C3 RETN
00D5C082 C3 RETN
00D5C083 C3 RETN
00D5C084 C3 RETN
00D5C085 C3 RETN
00D5C086 C3 RETN
00D5C087 64:8F00 POP DWORD PTR FS:[EAX]
00D5C08A 58 POP EAX
00D5C08B 74 07 JE SHORT Client.00D5C094
00D5C08D 75 05 JNZ SHORT Client.00D5C094
00D5C08F 1932 SBB DWORD PTR DS:[EDX],ESI
00D5C091 67:E8 E8742775 CALL 75FD357F ; 多余的前缀
00D5C097 25 EB00EBFC AND EAX,FCEB00EB
00D5C09C 68 3944CD00 PUSH Client.00CD4439
00D5C0A1 59 POP ECX
00D5C0A2 9C PUSHFD
00D5C0A3 50 PUSH EAX
00D5C0A4 74 0F JE SHORT Client.00D5C0B5
00D5C0A6 75 0D JNZ SHORT Client.00D5C0B5
00D5C0A8 E8 59C20400 CALL 00DA8306
00D5C0AD 55 PUSH EBP
00D5C0AE 8BEC MOV EBP,ESP
00D5C0B0 -E9 FAFFFF0E JMP 0FD5C0AF
00D5C0B5 E8 EFFFFFFF CALL Client.00D5C0A9
00D5C0BA 56 PUSH ESI
00D5C0BB 57 PUSH EDI
00D5C0BC 53 PUSH EBX
00D5C0BD 78 03 JS SHORT Client.00D5C0C2
00D5C0BF 79 01 JNS SHORT Client.00D5C0C2
00D5C0C1 E8 68A2AF47 CALL 4885632E
00D5C0C6 0159 E8 ADD DWORD PTR DS:[ECX-18],EBX
00D5C0C9 0100 ADD DWORD PTR DS:[EAX],EAX
00D5C0CB 0000 ADD BYTE PTR DS:[EAX],AL
00D5C0CD FF58 05 CALL FAR FWORD PTR DS:[EAX+5] ; 远距呼叫
00D5C0D0 7B 03 JPO SHORT Client.00D5C0D5
00D5C0D2 0000 ADD BYTE PTR DS:[EAX],AL
00D5C0D4 03C8 ADD ECX,EAX
00D5C0D6 ^74 C4 JE SHORT Client.00D5C09C
00D5C0D8 ^75 C2 JNZ SHORT Client.00D5C09C
00D5C0DA E8 00000000 CALL Client.00D5C0DF
00D5C0DF 0000 ADD BYTE PTR DS:[EAX],AL
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
