|
Hi all !
I think I found the manual way to unpack FSG 1.0.
1. Bp GetProcAddress
2. Go until breakpoint occurred
3. F12 (run until return)
4. If the address of EIP is in the memory range of exe, scroll up 2-3 line. We will see a je OEP. If not, repeat the step 1 (continue run)
Attached file is a script file of OllyScript, will find address of the je and the OEP. It can have bug.
Regards
|