Anonymous
April 29th, 2004, 05:27
My final scrip for this packer..
/*
PECompact 2.01a (27-04-04 release) OEP Finder by Scarabee
Make sure you Select NO on 'Compressed code message' when loading application in Olly.
When at OEP, just dump and fix with IMPREC.
*/
var cbase
var csize
var lbl1
var oki
sto
findop eax, #c3#
bp $RESULT
esto
esto
GMI eip, CODEBASE
mov cbase, $RESULT
GMI eip, CODESIZE
mov csize, $RESULT
bpwm cbase, csize
esto
sto
bpmc
findop eip, #FFE0#
mov oki, $RESULT
bp $RESULT
esto
cmp eip, oki
jne lbl1
sto
MSG "This is OEP, now dump and fix!"
ret
lbl1:
MSG "Press SHIFT-F9 till break at 'JMP EAX'. Then F8 and you're on OEP!"
/Scarabee
/*
PECompact 2.01a (27-04-04 release) OEP Finder by Scarabee
Make sure you Select NO on 'Compressed code message' when loading application in Olly.
When at OEP, just dump and fix with IMPREC.
*/
var cbase
var csize
var lbl1
var oki
sto
findop eax, #c3#
bp $RESULT
esto
esto
GMI eip, CODEBASE
mov cbase, $RESULT
GMI eip, CODESIZE
mov csize, $RESULT
bpwm cbase, csize
esto
sto
bpmc
findop eip, #FFE0#
mov oki, $RESULT
bp $RESULT
esto
cmp eip, oki
jne lbl1
sto
MSG "This is OEP, now dump and fix!"
ret
lbl1:
MSG "Press SHIFT-F9 till break at 'JMP EAX'. Then F8 and you're on OEP!"
/Scarabee