他这个是纯粹脱掉VMP加的入口区段壳,自建调试+定位特征码到壳解压代码位置硬件断点脱壳原理,至于修复IAT可以参考tmd修复方式,解决基址+重定位就可以了,至于对某个函数或者代码分页进行VMP的话,是基本上脱不掉的得处理opcode+乱序花+膨胀代码+还有jmp表和若干个handle More @Wikipedia
Hover over any link to get a description of the article. Please note that search keywords are sometimes hidden within the full article and don't appear in the description or title.