PDA

View Full Version : PECompact 2.01a script


Anonymous
April 29th, 2004, 05:27
My final scrip for this packer..


/*

PECompact 2.01a (27-04-04 release) OEP Finder by Scarabee

Make sure you Select NO on 'Compressed code message' when loading application in Olly.
When at OEP, just dump and fix with IMPREC.

*/

var cbase
var csize
var lbl1
var oki

sto
findop eax, #c3#
bp $RESULT
esto
esto
GMI eip, CODEBASE
mov cbase, $RESULT
GMI eip, CODESIZE
mov csize, $RESULT
bpwm cbase, csize
esto
sto
bpmc
findop eip, #FFE0#
mov oki, $RESULT
bp $RESULT
esto

cmp eip, oki
jne lbl1
sto
MSG "This is OEP, now dump and fix!"
ret

lbl1:
MSG "Press SHIFT-F9 till break at 'JMP EAX'. Then F8 and you're on OEP!"


/Scarabee

Anonymous
April 29th, 2004, 06:19
I managed to solve my problem, so this should be final :

/*

PECompact 2.01a (27-04-04 release) OEP Finder by Scarabee

Make sure you Select NO on 'Compressed code message' when loading application in Olly.
When at OEP, just dump and fix with IMPREC.

*/

var cbase
var csize
var lbl2
var lbl1
var oki

sto
findop eax, #c3#
bp $RESULT
esto
esto
GMI eip, CODEBASE
mov cbase, $RESULT
GMI eip, CODESIZE
mov csize, $RESULT
bpwm cbase, csize
esto
sto
bpmc
findop eip, #FFE0#
mov oki, $RESULT
bp $RESULT
esto

lbl2:
cmp eip, oki
jne lbl1
sto
MSG "This is OEP, now dump and fix!"
ret

lbl1:
esto
jmp lbl2

Anonymous
April 29th, 2004, 08:11
Works for v2.02 also! (release 29-04-04)

eos
April 29th, 2004, 08:58
http://www.pgware.com/downloads/pcmedik.exe ("http://www.pgware.com/downloads/pcmedik.exe") <= pecompact 2.0
ollyscript OEP not find.

Anonymous
April 29th, 2004, 10:09
Works fine for me.
i tried your application and script gives me OEP:

0048566C 55 PUSH EBP
0048566D 8BEC MOV EBP,ESP
0048566F B9 37000000 MOV ECX,37
00485674 6A 00 PUSH 0
00485676 6A 00 PUSH 0
00485678 49 DEC ECX
00485679 ^75 F9 JNZ SHORT PcMedik.00485674

vivaman
April 30th, 2004, 08:57
Thanks.. "Anonymous"..

Scarabee
April 30th, 2004, 09:44
You're welcome..

i didnt register here just yet. as you can see, i did by now )