PDA

View Full Version : DBPE v2.x Unpacking Script!


loveboom
March 23rd, 2004, 03:26
Bad luck, cann't visite http://ollyscript.apsvans.com/ ("http://ollyscript.apsvans.com/")
error message:time out.
so,post here.
/*
//////////////////////////////////////////////////
DBPE V2.X Unpack script v0.1
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
Date : 2004-3-21
Config: Ignore all exceptions
Note : If imports table like this "JMP DWORD PTR DS:[804EXXXX] or Call DWORD PTR DS:[804EXXXX]" then use winhex edit
target's memory,strat addr:IAT start address,find hex"4E80" Replace "4E00".
f you have one or more question, email me please,thank you!
Warning:If you want unpacking manual,you'd better use Winxp+IDT tool debug target
If your system is Win2k,Be careful in(SYSTEM CRASH,hoho!)
//////////////////////////////////////////////////
*/

var csize
var cbase
var count
mov count,3
gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT

lbl1:
eob lbl2
gpa "CloseHandle","kernel32.dll"
bphws $RESULT,"x"
run

lbl2:
sub count,1
cmp count,0
je lbl3
run
jmp lbl2

lbl3:
bphwc $RESULT
eob lbl4
bprm cbase,csize
run

lbl4:
bpmc
eob lbl5
findop eip,#FFE0#
bprm $RESULT,A
msg "Now Ctrl+B Find 89BD(like this '75 89 jnz addr <89BDxxxxxxxx>'),at the third time replace'nop(909090909090)' and then find 890F replace 8907,last time,resume script!"
pause
run

lbl5:
bpmc
sto
cmt eip,"OEP Found,please dumped it!"
msg "Script by loveboom[DFCG],Thank you for using my script!"
ret

psyCK0
March 23rd, 2004, 04:23
Added to site, thanks loveboom.

Yeah, the site goes down from time to time. Thats coz my hosting provider sucks... =(

Anonymous
May 15th, 2004, 22:49
I can't use this script to uppack the DBPE V2.X,Because when I find 89BD everytime,it look's like this:
7FF936E7 ^75 E9 JNZ SHORT 7FF936D2
7FF936E9 BD 0100007A MOV EBP,7A000001
"89BD" is in sunder, how can i do ?

loveboom
May 17th, 2004, 01:52
If you are from china or you can speak chinese,you can download my unpacking demo for dbpe 2.x.
download address:
http://www.chinadfcg.com/viewthread.php?tid=873 ("http://www.chinadfcg.com/viewthread.php?tid=873")