【简要说明】：本来不是很想写，只因这个软件是我看到svkp1.3x抽代码最多的（足足抽了6A字节），所以"厚着脸皮"，灌上一贴，只写了一下壳所抽代码的找回，不足或失误之处，还请各位大虾指点一二。建议如果你是新手，就先不要去试这样的壳，因为有点难度，当然这并不是说我很厉害，其实我也很菜的。
【详细过程】:
设置：忽略全部异常。隐藏你OD。
OD载入目标停在这里:
00598000 > 60 PUSHAD 停在这里
00598001 E8 00000000 CALLDAP.00598006
00598006 5D POPEBP
00598007 81ED 06000000 SUBEBP,6
按f9一次，发生异常，异常位置:
0012E3B6 6285 20220000 BOUNDEAX,QWORDPTRSS:[EBP+2220] 这里异常
0012E3BC EB 02 JMPSHORT 0012E3C0
0012E3BE 0FE88B D1EB02CD PSUBSBMM1,QWORDPTRDS:[EBX+CD02EBD1]
0012E3C5 208B C2EB02CD ANDBYTEPTRDS:[EBX+CD02EBC2],CL
异常后在code段下f2断点.
Memory map, item 13
Address=00401000
Size=000F0000 (983040.)
Owner=DAP 00400000
Section=
Contains=code
Type=Imag 01001002
Access=R
Initial access=RWE
下断后,SHIFT+F9这样来到了这里.
0394F14F 8A06 MOVAL,BYTEPTRDS:[ESI]
0394F151 46 INCESI
0394F152 47 INCEDI
0394F153 8843 0F MOVBYTEPTRDS:[EBX+F],AL
0394F156 8A46 FF MOVAL,BYTEPTRDS:[ESI-1]
0394F159 55 PUSHEBP
0394F15A E8 00000000 CALL0394F15F
0394F15F 5D POPEBP
0394F160 81ED 0D470000 SUBEBP,470D
0394F166 8A8D 50030000 MOVCL,BYTEPTRSS:[EBP+350]
0394F16C 5D POPEBP
0394F16D 32C1 XORAL,CL
0394F16F 8847 FF MOVBYTEPTRDS:[EDI-1],AL
0394F172 8BC5 MOVEAX,EBP
0394F174 4D DECEBP
0394F175 85C0 TESTEAX,EAX
0394F177 ^ 75 A4 JNZSHORT 0394F11D 这里跳回去循环解压代码
0394F179 33C0 XOREAX,EAX
0394F17B 5D POPEBP
0394F17C 5F POPEDI
0394F17D 5E POPESI
0394F17E 5B POPEBX
0394F17F C2 1400 RETN14 直接在这里下F4
在0394f17f处下F4,因解压要一定的时间，所以如果你的机子配置较低的话可能等的时间比较长。f4停下后，我们再次在code段下f2断点，这里来到了这里：
039499AE 66:813E 4A43 CMPWORDPTRDS:[ESI],434A
039499B3 0F85 23010000 JNZ03949ADC
039499B9 83C6 0A ADDESI,0A
现在在12FFB0处下硬件访问断点(也就是hr 12ffb0)，为什么在这里下呢，这个看官你自己想想吧，如果要在这里下断的原因也不知道的话，建议你先看一下基础知识。
第一次断这里：
0012FC40 60 PUSHAD
0012FC41 E8 03000000 CALL0012FC49
……
0012FC54 E8 01000000 CALL0012FC5A 第二次
0012FC59 E8 E8020000 CALL0012FF46
0012FC5E 00CD ADDCH,CL
0012FC60 2083 04240B83 ANDBYTEPTRDS:[EBX+830B2404],AL
……
0012FCFB E8 00000000 CALL0012FD00 第三次
0012FD00 5D POPEBP
0012FD01 E8 02000000 CALL0012FD08
第三次中断后hd 12ffb0取消断点。再下tc ebp==12ffc0(start espvalue-4，谢谢tDasm),这样在这里断下:
03AD0647 0AAF BB010424 ORCH,BYTEPTRDS:[EDI+240401BB]
03AD064D 5D POPEBP
03AD064E E9 A10A0000 JMP03AD10F4 断在这里
现在先清掉run trace window里的内容，并选择log file，记录到文件。做完准备工作后，下tc eip<03000000,这样到了fake oep处.
004D6214 90 NOP
004D6215 90 NOP
004D6216 E8 6183F5FF CALLDAP.0042E57C 停在这里
004D621B 391D 380E5400 CMPDWORDPTRDS:[540E38],EBX
004D6221 75 0C JNZSHORT DAP.004D622F
004D6223 68 5E634D00 PUSHDAP.004D635E
向上看一下，晕倒，壳抽了这么多的代码。要命呀，有点苦了。现在我们要开始分析代码了，
看看程序的"模样"，就知道它应该是用C写的程序。所以现在要"联想"一下C的oep的大概样子，当然，其实是要分析代码得出壳所抽的代码。先静态分析出轮廓。也因为这篇文章就是讲怎么找代码，所以个人认为应该详细一点（所以把大部分的代码都copy过来），
03AD10F4 Main POPEAX◆这里典型的SVKP的代码，所以这里应该是push ebp
03AD10F5 Main NOP◆因为一般C的开始处都不变，也就是说，第二句应该是mov ebp,esp
03AD10F6 Main PUSHADEDF13D
03AD10FB Main PUSHEAX
03AD10FC Main MOVEAX,52120FAB EAX=52120FAB
03AD1101 Main ADDDWORDPTRSS:[ESP+4],EAX
03AD1105 Main POPEAX EAX=03AD05B3
03AD1106 Main ADDEAX,52120FAB EAX=55BF155E
03AD110B Main ADDEAX,52120FAB EAX=A7D12509
03AD1110 Main JMP03AD195B
03AD195B Main PUSHEAX
03AD195C Main JMP03AD0B7A
03AD0B7A Main MOVEAX,52120FAB EAX=52120FAB
03AD0B7F Main SUBDWORDPTRSS:[ESP],EAX
03AD0B82 Main JMP03AD124F
03AD124F Main MOVEAX,DWORDPTRSS:[ESP] EAX=55BF155E
03AD1252 Main JMP03AD1FAE
03AD1FAE Main MOVEAX,52120FAB EAX=52120FAB
03AD1FB3 Main SUBDWORDPTRSS:[ESP],EAX
03AD1FB6 Main JMP03AD10A6
03AD10A6 Main MOVEAX,DWORDPTRSS:[ESP] EAX=03AD05B3
03AD10A9 Main PUSHADEDF06C
03AD10AE Main PUSHEAX
03AD10AF Main MOVEAX,52120FAB EAX=52120FAB
03AD10B4 Main ADDDWORDPTRSS:[ESP+4],EAX
03AD10B8 Main JMP03AD1CA5
03AD1CA5 Main POPEAX EAX=03AD05B3
03AD1CA6 Main JMP03AD2175
03AD2175 Main POPEAX EAX=00000017
03AD2176 Main ADDDWORDPTRSS:[ESP+4],EAX
03AD217A Main POPEAX EAX=03AD05B3
03AD217B Main PUSHAF7D04C0
03AD2180 Main ADDEAX,52120FAB EAX=55BF155E
03AD2185 Main PUSHEAX
03AD2186 Main MOVEAX,52120FAB EAX=52120FAB
03AD218B Main SUBDWORDPTRSS:[ESP],EAX
03AD218E Main MOVEAX,DWORDPTRSS:[ESP] EAX=03AD05B3
03AD2191 Main MOVEAX,52120FAB EAX=52120FAB
03AD2196 Main ADDDWORDPTRSS:[ESP+4],EAX
03AD219A Main POPEAX EAX=03AD05B3
03AD219B Main ADDEAX,52120FAB EAX=55BF155E
03AD21A0 Main PUSHEAX
03AD21A1 Main MOVEAX,52120FAB EAX=52120FAB
03AD21A6 Main JMP03AD1AC5
03AD1AC5 Main SUBDWORDPTRSS:[ESP],EAX
03AD1AC8 Main JMP03AD0D5A
03AD0D5A Main MOVEAX,DWORDPTRSS:[ESP] EAX=03AD05B3
03AD0D5D Main JMP03AD15CB
03AD15CB Main PUSHACAF316A
03AD15D0 Main ADDEAX,52120FAB EAX=55BF155E
03AD15D5 Main PUSHEAX
03AD15D6 Main JMP03AD2370
03AD2370 Main MOVEAX,52120FAB EAX=52120FAB
03AD2375 Main JMP03AD06B7
03AD06B7 Main SUBDWORDPTRSS:[ESP],EAX
03AD06BA Main MOVEAX,DWORDPTRSS:[ESP] EAX=03AD05B3
03AD06BD Main MOVEAX,52120FAB EAX=52120FAB
03AD06C2 Main ADDDWORDPTRSS:[ESP+4],EAX
03AD06C6 Main POPEAX EAX=03AD05B3
03AD06C7 Main JMP03AD19F3
03AD19F3 Main POPEAX EAX=FEC14115
03AD19F4 Main ADDDWORDPTRSS:[ESP+4],EAX
03AD19F8 Main JMP03AD0740
03AD0740 Main POPEAX EAX=03AD05B3
03AD0741 Main PUSH18C221F
03AD0746 Main PUSHEAX
03AD0747 Main PUSH0
03AD074C Main MOVEAX,52120FAB EAX=52120FAB
03AD0751 Main ADDDWORDPTRSS:[ESP],EAX
03AD0754 Main MOVEDX,EDX
03AD0756 Main POPEAX
03AD0757 Main ADDDWORDPTRSS:[ESP],EAX
03AD075A Main POPEAX EAX=55BF155E
03AD075B Main PUSHEAX
03AD075C Main PUSH0
03AD0761 Main PUSHEAX
03AD0762 Main MOVEAX,52120FAB EAX=52120FAB
03AD0767 Main JMP03AD1F8D
03AD1F8D Main ADDDWORDPTRSS:[ESP+4],EAX
03AD1F91 Main JMP03AD1040
03AD1040 Main POPEAX EAX=55BF155E
03AD1041 Main POPEAX EAX=52120FAB
03AD1042 Main SUBDWORDPTRSS:[ESP],EAX
03AD1045 Main MOVEAX,DWORDPTRSS:[ESP] EAX=03AD05B3
03AD1048 Main MOVEAX,FEC14115 EAX=FEC14115
03AD104D Main ADDDWORDPTRSS:[ESP+4],EAX
03AD1051 Main POPEAX EAX=03AD05B3
03AD1052 Main XCHGEBP,EBP
03AD1054 Main PUSH5A9D21BF
03AD1059 Main PUSHEAX
03AD105A Main MOVEAX,52120FAB EAX=52120FAB
03AD105F Main ADDDWORDPTRSS:[ESP+4],EAX
03AD1063 Main POPEAX EAX=03AD05B3
03AD1064 Main MOVESP,ESP
03AD1066 Main PUSHEAX
03AD1067 Main PUSH0
03AD106C Main JMP03AD19B7
03AD19B7 Main PUSHEAX
03AD19B8 Main MOVEAX,52120FAB EAX=52120FAB
03AD19BD Main JMP03AD1F6C
03AD1F6C Main ADDDWORDPTRSS:[ESP+4],EAX
03AD1F70 Main JMP03AD0C6B
03AD0C6B Main POPEAX EAX=03AD05B3
03AD0C6C Main JMP03AD0C43
03AD0C43 Main POPEAX EAX=52120FAB
03AD0C44 Main JMP03AD07FC
03AD07FC Main ADDDWORDPTRSS:[ESP+4],EAX
03AD0800 Main JMP03AD1D77
03AD1D77 Main POPEAX EAX=03AD05B3
03AD1D78 Main POPEAX EAX=FEC14115
03AD1D79 Main JMP03AD23AA
03AD23AA Main PUSHDWORDPTRFS:[0] ◆这里也是变形的，看它无端端来一个push fs:[0]也可以看到，肯定有动作.
03AD23B1 Main SUBDWORDPTRSS:[ESP],EAX
03AD23B4 Main POPEAX EAX=0151BECB
03AD23B5 Main PUSHEAX 分析结果，上面的是mov eax,fs:[0]
03AD23B6 Main PUSH5A9D21BF
03AD23BB Main PUSHEAX
03AD23BC Main MOVEAX,EAX
03AD23BE Main MOVEAX,52120FAB EAX=52120FAB
03AD23C3 Main ADDDWORDPTRSS:[ESP+4],EAX
03AD23C7 Main POPEAX EAX=0151BECB
03AD23C8 Main MOVEAX,52120FAB EAX=52120FAB
03AD23CD Main ADDDWORDPTRSS:[ESP],EAX
03AD23D0 Main POPEAX EAX=FEC14115
03AD23D1 Main ADDDWORDPTRSS:[ESP],EAX
03AD23D4 Main JMP03AD24B4
03AD24B4 Main POPEAX EAX=0012FFE0
03AD24B5 Main JMP03AD1424
03AD1424 Main PUSHEAX
03AD1425 Main PUSHACAF316A
03AD142A Main JMP03AD1366
03AD1366 Main MOVEAX,52120FAB EAX=52120FAB
03AD136B Main ADDDWORDPTRSS:[ESP],EAX
03AD136E Main POPEAX EAX=FEC14115
03AD136F Main ADDDWORDPTRSS:[ESP],EAX
03AD1372 Main POPEAX EAX=FED440F5
03AD1373 Main ADDEAX,52120FAB EAX=50E650A0
03AD1378 Main ADDEAX,52120FAB EAX=A2F8604B
03AD137D Main PUSHEAX
03AD137E Main MOVEDI,EDI
03AD1380 Main MOVEAX,52120FAB EAX=52120FAB
03AD1385 Main SUBDWORDPTRSS:[ESP],EAX
03AD1388 Main MOVEAX,DWORDPTRSS:[ESP] EAX=50E650A0
03AD138B Main JMP03AD13D5
03AD13D5 Main MOVEAX,52120FAB EAX=52120FAB
03AD13DA Main SUBDWORDPTRSS:[ESP],EAX
03AD13DD Main MOVEAX,DWORDPTRSS:[ESP] EAX=FED440F5
03AD13E0 Main PUSHACAF316A
03AD13E5 Main PUSHEAX
03AD13E6 Main JMP03AD211A
03AD211A Main MOVEAX,52120FAB EAX=52120FAB
03AD211F Main ADDDWORDPTRSS:[ESP+4],EAX
03AD2123 Main JMP03AD1D50
03AD1D50 Main POPEAX EAX=FED440F5
03AD1D51 Main JMP03AD08CD
03AD08CD Main POPEAX EAX=FEC14115
03AD08CE Main SUBDWORDPTRSS:[ESP],EAX
03AD08D1 Main JMP03AD1820
03AD1820 Main MOVEAX,DWORDPTRSS:[ESP] ◆这里就是变形的push eax
03AD1823 Main JMP03AD152B
03AD152B Main MOVDWORDPTRFS:[0],ESP◆
03AD1532 Main SUBESP,68 ◆
03AD1535 Main PUSHEAX
03AD1536 Main ADDEBX,52120FAB EBX=D20FFFAB
03AD153C Main PUSHEBX
03AD153D Main JMP03AD0888
03AD0888 Main PUSHEAX
03AD0889 Main MOVEAX,52120FAB EAX=52120FAB
03AD088E Main SUBDWORDPTRSS:[ESP+4],EAX
03AD0892 Main POPEAX EAX=0012FFE0
03AD0893 Main SUBEBX,52120FAB EBX=7FFDF000
03AD0899 Main PUSHACAF316A
03AD089E Main PUSH0
03AD08A3 Main PUSHEAX
03AD08A4 Main JMP03AD173D
03AD173D Main MOVEAX,52120FAB EAX=52120FAB
03AD1742 Main ADDDWORDPTRSS:[ESP+4],EAX
03AD1746 Main JMP03AD0E89
03AD0E89 Main POPEAX EAX=0012FFE0
03AD0E8A Main POPEAX &n, bsp; EAX=52120FAB
03AD0E8B Main ADDDWORDPTRSS:[ESP],EAX
03AD0E8E Main POPEAX EAX=FEC14115
03AD0E8F Main ADDDWORDPTRSS:[ESP],EAX
03AD0E92 Main JMP03AD1EFE
03AD1EFE Main POPEBX EBX=7EBF3115
03AD1EFF Main POPEAX EAX=0012FFE0
03AD1F00 Main ADDEBX,52120FAB EBX=D0D140C0
03AD1F06 Main PUSHEBX
03AD1F07 Main PUSHEAX
03AD1F08 Main MOVEAX,52120FAB EAX=52120FAB
03AD1F0D Main SUBDWORDPTRSS:[ESP+4],EAX
03AD1F11 Main JMP03AD207F
03AD207F Main POPEAX EAX=0012FFE0
03AD2080 Main JMP03AD1E40
03AD1E40 Main SUBEBX,52120FAB EBX=7EBF3115
03AD1E46 Main ADDEAX,52120FAB EAX=52250F8B
03AD1E4B Main ADDEAX,52120FAB EAX=A4371F36
03AD1E50 Main NOP
03AD1E51 Main PUSHEAX
03AD1E52 Main JMP03AD2331
03AD2331 Main MOVEAX,52120FAB EAX=52120FAB
03AD2336 Main SUBDWORDPTRSS:[ESP],EAX
03AD2339 Main MOVEAX,DWORDPTRSS:[ESP] EAX=52250F8B
03AD233C Main JMP03AD16FD
03AD16FD Main MOVEAX,52120FAB EAX=52120FAB
03AD1702 Main MOVECX,ECX
03AD1704 Main SUBDWORDPTRSS:[ESP],EAX
03AD1707 Main JMP03AD09FB
03AD09FB Main MOVEAX,DWORDPTRSS:[ESP] EAX=0012FFE0
03AD09FE Main PUSHACAF316A
03AD0A03 Main PUSHEAX
03AD0A04 Main JMP03AD1E78
03AD1E78 Main MOVEAX,52120FAB EAX=52120FAB
03AD1E7D Main ADDDWORDPTRSS:[ESP+4],EAX
03AD1E81 Main POPEAX EAX=0012FFE0
03AD1E82 Main POPEAX EAX=FEC14115
03AD1E83 Main SUBDWORDPTRSS:[ESP+4],EAX
03AD1E87 Main POPEAX EAX=0012FFE0
03AD1E88 Main PUSHEAX
03AD1E89 Main ADDEBX,52120FAB EBX=D0D140C0
03AD1E8F Main JMP03AD1DEE
03AD1DEE Main PUSHEBX
03AD1DEF Main JMP03AD189B
03AD189B Main PUSHEAX
03AD189C Main JMP03AD1C65
03AD1C65 Main MOVEAX,52120FAB EAX=52120FAB
03AD1C6A Main SUBDWORDPTRSS:[ESP+4],EAX
03AD1C6E Main XCHGEDI,EDI
03AD1C70 Main POPEAX EAX=0012FFE0
03AD1C71 Main SUBEBX,52120FAB EBX=7EBF3115
03AD1C77 Main PUSH50D350C0
03AD1C7C Main PUSH0
03AD1C81 Main PUSHEAX
03AD1C82 Main MOVEAX,52120FAB EAX=52120FAB
03AD1C87 Main JMP03AD240E
03AD240E Main ADDDWORDPTRSS:[ESP+4],EAX
03AD2412 Main JMP03AD20B4
03AD20B4 Main POPEAX EAX=0012FFE0
03AD20B5 Main POPEAX EAX=52120FAB
03AD20B6 Main SUBDWORDPTRSS:[ESP],EAX
03AD20B9 Main JMP03AD22B8
03AD22B8 Main POPEAX EAX=FEC14115
03AD22B9 Main SUBDWORDPTRSS:[ESP],EAX
03AD22BC Main POPEBX◆ EBX=7FFDF000
03AD22BD Main POPEAX EAX=0012FFE0
03AD22BE Main PUSHEAX
03AD22BF Main XCHGEAX,EAX
03AD22C1 Main PUSHESI◆
03AD22C2 Main JMP03AD0A52
03AD0A52 Main PUSHACAF316A
03AD0A57 Main JMP03AD2508
03AD2508 Main MOVEAX,52120FAB EAX=52120FAB