pecompact 1.84 oep finder.txt

700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.

// PECompact 1.84 OEP Finder v0.1 !unstable edition!
// by FEUERRADER [AHTeam]
// http://ahteam.org

eob Break1
findop eip, #F3A58BFBC3# 
bphws $RESULT, "x" 
run 

Break1: 
bphwc $RESULT 
sto
sto
sto
sto
sto
sto
sto
sto
sto
sto
sto
findop eip, #5068# 
bphws $RESULT, "x" 
eob endl
run

endl:
sto
bphwc $RESULT 
sto
sto 
cmt eip, "OEP"
ret