Log in

View Full Version : How to find the OEP of a Crypkey protected program


Praveen
January 20th, 2005, 03:09
The problem was finding the OEP of the program. I was using olly and tried to break on GetProcAddress - The third one...
Then I tried to come into the caller prog and step until I came to a sub eax,ecx followed by a jmp eax instruction.
I am not sure whether I'd missed it but I didn't find EITHER of those instructions.

I will be very happy if you could please tell me the EXACT steps YOU'D do to get to the goal of finding the OEP.

In other words, the question is very simple... - How EXACTLY do i get the OEP of a program which is packed with Crypkey 5.6?
There is not much useful material on the net reg this point which I could follow.
And I'd spent almost 3 months researching about this Crypkey business.

I'm sure that there MUST be a simple and generic way to find the OEP of Crypkey programs...

Any guidance in this direction will be much appreciated...
Thanks....

1bitshort
January 20th, 2005, 03:31
Try the OllyDump plugin, it has two generic OEP finders. No idea if it'll work on Crypkey though.

Praveen
January 20th, 2005, 03:41
That was fast...
However that didn't work as there was no entry into a new section etc...

The entrypoint was initially itself in the 450000 range and so it was useless...

There MUST be SOME comands to bp on... And the question is what they are and how to exactly to bp on them...