脱壳后软件无法运行的原因分析及对策（Cause analysis and Countermeasures of software running after shelling）.docVIP

脱壳后软件无法运行的原因分析及对策（Cause analysis and Countermeasures of software running after shelling） First, whether the success of shelling signs Generally speaking, software shelling does not change the operating mechanism of the original software. It simply returns the encrypted IAT address to the address of the string name of the API function before loading and displays it in plain code. The sign of the success of the shell is that the icon before the software runs in accordance with the pre shelling, and the windows is not issued at runtime...... Initialization failed...... Warning, then shelling is generally successful. If an initialization failure warning occurs, one hundred percent is the IID table or the IAT table is wrong. Two 、 when OD loads exception or direct run, windows pops up send error report message. Reason： (1) OEP entry address error; (2) in the manual shelling , a function of the wrong person address to write another function address up. Three, software runs out 1. reasons: (1) if the software before the shelling can (direct) operation, the software after shelling flash, indicating that the software has file verification. The biggest change is the file size software shell before and after the change, then the software checksum must be changed, when it found that checksum changed, you know the software moving the hands and feet, it will not hesitate to quit. If you want to find the check position, is to look for a needle in the ocean! (2) if you can run directly after unpacking, you can exit or have an exception that cannot be skipped when loading with OD, but there is an anti trace component. (and that doesnt matter.) anti tracking isnt what this article is talking about today. Its just a side talk. 2. countermeasures: In a software to find its file check code, where the same need to use ideas, and the case is similar. Dont worry. Lets see what language it is written first. If it is written in VC++ or Delphi, the software after unpacking is basically no sec