View Single Post
  #26  
Old 01-23-2004, 17:30
lownoise
 
Posts: n/a
aspack

Here a quick and dirty script to stop on the oep of aspack compressed programs

Start Programmer comments
First it walks threw the program and search for the oep bytes 7561 and 7503 (when breakpoint has been set in a earlier run) if it's found we will set a breakpoint on that eip, then it runs the program and when the breakpoint occurs it does a singlestep to OEP. This script has only been tested on 2 programs so please test it and report the results back.
End Programmer comments


var x
var y

mov x, eip


lab1:
mov y, [eip]
and y, 0000ffff
cmp y,7561
je lab2
cmp y,75cc
je lab3
add eip,1
jmp lab1

lab2:
ubp eip

lab3:
mov eip,x

eob lab4
eoe lab4

lab4:
sto
sto
sto
sto
log eip
ret
Reply With Quote