Thread: svkp
View Single Post
  #4  
Old 06-05-2011, 18:34
orfei orfei is online now
Family
 
Join Date: Aug 2010
Posts: 139
Rept. Given: 33
Rept. Rcvd 80 Times in 50 Posts
Thanks Given: 16
Thanks Rcvd at 133 Times in 54 Posts
orfei Reputation: 80
Is possible in hand (or script) with olly. I do decryption several times before long time.
Basicly in manual mode (and as i remember):
1. Break on OEP.
2. Find where is encrypted code block/s by comparing svkp begin marker.
3. Set new origin on start code block. Step several times to run over decryption routine.
You will see how below code is decrypted (and looks like x86 code).
4. Asemble start/end of crypted code block with jmp (to avoid crypt again and to make good code for dumping).
5. Do above procedure for all crypted blocks.
6. Return origin to OEP and dump.
now is time for imp reconstruction
Reply With Quote