A practiced hand unpackme bitarts
1, loaded directly OD, where one kind of shelling recording method, F9 to run the program, view the log window, found many anomalies
2. It should be noted that at Red Label, which is the last exception, in fact, this can also be directly in the memory window in the code segment (or use a process of elimination) under the direct memory breakpoint, then F9 to run, wait for the program the code segment (or other) to be accessed / written off the next time we are using here is the shark constant teacher abnormal method to learn ....
3 and then OD of the off-tone options, and then manually run manually ignore abnormal, to address a int3 most of 0046E88F above figures are marked, to a position
4, and the memory window of the program code segment to set memory breakpoints, then repeatedly F8, because the last exception is our next breakpoint, it is also not far from the OEP, and then continue to F9, went as follows, analysis of the code from the module, OEP find success
Summary: In fact, the second point in himself when it comes to the direct memory breakpoint at the beginning of the memory window, but the teacher said that if the constant shark encounter anti-debugging, then probably not, so this is another idea of it