![]() |
|
#11
|
|||
|
|||
|
aspack
Here a quick and dirty script to stop on the oep of aspack compressed programs
Start Programmer comments First it walks threw the program and search for the oep bytes 7561 and 7503 (when breakpoint has been set in a earlier run) if it's found we will set a breakpoint on that eip, then it runs the program and when the breakpoint occurs it does a singlestep to OEP. This script has only been tested on 2 programs so please test it and report the results back. End Programmer comments var x var y mov x, eip lab1: mov y, [eip] and y, 0000ffff cmp y,7561 je lab2 cmp y,75cc je lab3 add eip,1 jmp lab1 lab2: ubp eip lab3: mov eip,x eob lab4 eoe lab4 lab4: sto sto sto sto log eip ret |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Plugin+ Configuration for olly 2.01 | Conquest | General Discussion | 4 | 03-25-2013 00:04 |