去壳的步骤(国外英文资料).doc

去壳的步骤(国外英文资料) How to unshell and crack the EXE file Step 1 test case The concept of shell: The so-called shell is a specially compressed tool. The compression is not here we normally use RAR and ZIP compression of such tools, the compression of shell means for exe, com, and DLL program file is compressed, the program to add a code as protective layer, lose the original procedure code, thus protecting procedure is not illegal modification and decompiling, this piece of code as protective layer, and the shell on the function of animals and plants in nature, there are a lot of similarities, so we vividly shell called a program. The role of the shell: The protection program is not illegally modified and decomcompiled. Compress the program specifically to reduce file size and facilitate propagation and storage. The difference between a shell and a compressed software is that The compression software can only compress the program After the shell is compressed, the program files such as exe, com, and DLLS can run as normal programs Here is a software that detects the shell Reid v0.92 The software can detect 450 shells The new version increases virus scanning capability, which is the most powerful of all kinds of inspection tools. It is also possible to recognize that the EXE files are written in languages such as vc + +, Delphi, VB, or Delphi. Support folder batch scan We scanned easymail exe with PEID Find the type of shell UPX 0.89.6-1.02/1.05-1.24- Markus Laszlo That is UPX shell The following are Step 2 shells For a program with a shell, remove the irrelevant information and protection restrictions, remove his shell, remove the disguise, and restore the software as it is. This process is called peeling. The symbol of success in peeling off the shell The file is running smoothly after the shell, and the function is not lost. In general, the length of the file will be greater than the length of the original file. Even with the same file, the removal of the shell from a