|
It is very simple...
I've unpacked it with Olly.
1. Run prog with F9. Break on SEH (access violation)
2. View->Memory. Break on .code section. Run with Shift+F9. Breaking on 7XXXXX (usually).
3. Run till return (Ctrl+F12). Exit from function.
4. set break on jmp eax (it is nearby)
5. We are on OEP.
|