当你走到这样的代码：call 583145 时，停一下，为了偷懒，直接下中断：bpx 583683. F5断下后，一路又要小心了，还有anti-debug,还是那些东东。顺利走过那些陷阱后，到达下面就是终点了：
167:005837AF INT 20
0167:005837B1 POPA
0167:005837B2 JMP NEAR [ESP-30] 《————oep=[esp-30]==535334,
0167:005837B6 ADD BYTE [EAX],00
0167:005837B9 ADD [EAX],AL
0167:005837BB JMP SHORT 005837BE
0167:005837BD MOV EAX,6090C523
0167:005837C2 CALL 005837CD
0167:005837C7 MOV ESP,[ESP+08]
到达535334后，pedump,得到脱壳文件。用importREC 的 Auto trace一次，会发现有138个函数需修正，如果耐心好的话，那就一个一个的搞；不然，想想办法，有窍门的。具体如何修复重建请参考那些高人的教程。
4)先用W32dasm反汇编脱壳文件，在SDR中可以发现 " - Evaluation Copy"。双击它
会找到很多处。看一下这里：
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00525E08(C)
|
:00525E1D 803DA0A0530000 cmp byte ptr [0053A0A0], 00 //比较
:00525E24 7411 je 00525E37------------------>不要跳
* Possible StringData Ref from Code Obj ->"FlashFXP"
|
:00525E26 BAA0615200 mov edx, 005261A0
:00525E2B A120C05300 mov eax, dword ptr [0053C020]
:00525E30 E87F21F2FF call 00447FB4
:00525E35 EB0F jmp 00525E46
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00525E24(C)
|
* Possible StringData Ref from Code Obj ->"FlashFXP - Evaluation Copy"
|
:00525E37 BAB4615200 mov edx, 005261B4
:00525E3C A120C05300 mov eax, dword ptr [0053C020]
:00525E41 E86E21F2FF call 00447FB4
啊，很明显，[0053A0A0]这个内存地址中的值与注册关系满密切的，查找文本
"cmp byte [00533ec0],00"这样的地方好像有48处之多！！
5)好，开始吧！
运行flashfxp.exe，注册的nag窗口出来了！填入build 819的key
退出后，用TRW载入，下断bpm 53A0A0 W，F5来到：
:0050C55F E82079EFFF call 00403E84
:0050C564 83F811 cmp eax, 00000011 <------------------此时 查eax＝11
:0050C567 0F9405A0A05300 sete byte ptr [0053A0A0]<------------置1
:0050C56E 803DA0A0530000 cmp byte ptr [0053A0A0], 00<---------光标
:0050C575 0F849A020000 je 0050C815
:0050C57B A188C25300 mov eax, dword ptr [0053C288]
:0050C580 3DCE7F210B cmp eax, 0B217FCE
:0050C585 0F8F53010000 jg 0050C6DE
......
不用说，后面有暗桩了，往下追追看。。会来到：
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0050C58B(C), :0050C59C(C), :0050C5A9(C), :0050C5B6(C), :0050C5C1(C)
|:0050C5CC(C), :0050C5D7(C), :0050C5E7(C), :0050C5F2(C), :0050C604(C)
|:0050C60F(C), :0050C61A(C), :0050C62A(C), :0050C635(C), :0050C647(C)
|:0050C654(C), :0050C65F(C), :0050C66A(C), :0050C675(C), :0050C685(C)
|:0050C690(C), :0050C6A2(C), :0050C6AD(C), :0050C6B8(C), :0050C6C8(C)
|:0050C6D3(C), :0050C6E9(C), :0050C6F6(C), :0050C703(C), :0050C70E(C)
|:0050C719(C), :0050C724(C), :0050C734(C), :0050C73F(C), :0050C751(C)
|:0050C758(C), :0050C75F(C), :0050C76B(C), :0050C772(C), :0050C780(C)
|:0050C789(C), :0050C790(C), :0050C797(C), :0050C7A0(C), :0050C7A7(C)
|:0050C7B2(C), :0050C7B9(C), :0050C7C0(C), :0050C7C9(C)
|
:0050C7D2 C605A0A0530000 mov byte ptr [0053A0A0], 00<------置0后，当然是未注册了！####
:0050C7D9 33C0 xor eax, eax
:0050C7DB A334C05300 mov dword ptr [0053C034], eax
:0050C7E0 B828C05300 mov eax, 0053C028
:0050C7E5 8B15FCA55300 mov edx, dword ptr [0053A5FC]
....
这么jump到0050C7D2，这真是“热点”啊。还是改改吧，在0050C7D2 改为 jmp 0050C815后，往下走：
:0050C815 A188C25300 mov eax, dword ptr [0053C288]
:0050C81A 33D2 xor edx, edx
:0050C81C 52 push edx
:0050C81D 50 push eax
:0050C81E 8D45F0 lea eax, dword ptr [ebp-10]
:0050C821 E8AAC6EFFF call 00408ED0
:0050C826 8B4DF0 mov ecx, dword ptr [ebp-10]
* Possible StringData Ref from Code Obj ->"Main"
|
:0050C829 BA40CE5000 mov edx, 0050CE40
:0050C82E A17CC05300 mov eax, dword ptr [0053C07C]
:0050C833 E87CFDFAFF call 004BC5B4－－－－－－－－--－>进入
:0050C838 84C0 test al, al<--------------------标志测试
:0050C83A 7443 je 0050C87F
:0050C83C C605A0A0530000 mov byte ptr [0053A0A0], 00<----注意这里
。。。
call 004BC5B4－－－－－－－－－>进入后来到
* Possible StringData Ref from Code Obj ->""
|
:004BC5EE BA2CC64B00 mov edx, 004BC62C
:004BC5F3 E89C79F4FF call 00403F94
:004BC5F8 0F95C0 setne al<------置标志 #####
:004BC5FB 8BD8 mov ebx, eax
:004BC5FD 33C0 xor eax, eax
:004BC5FF 5A pop edx
:004BC600 59 pop ecx
:004BC601 59 pop ecx
:004BC602 648910 mov dword ptr fs:[eax], edx
:004BC605 681AC64B00 push 004BC61A