ultraprotect 1.xx acprotect 1.22 oep finder (none delphi).txt

来自「700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.」· 文本 代码 · 共 40 行

/* 
////////////////////////////////////////////////// 
UltraProtect 1.x/ACprotect 1.22 OEP Finder(Default mode,not for Delphi) 
Author: loveboom 
Email : [e-mail] 
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62 
Date : 2004-3-28 
Config: Hide ollydbg(IsDebuggerPresent),Exceptions:uncheck "INT3 breaks". 
Note : If you have one or more question, email me please,thank you! 
////////////////////////////////////////////////// 
*/ 

var bpaddr //Break Point Address 

start: 
run 

lbl1: 
findop eip,#C3# 
eob lbl2 
bp $RESULT 
esto 

lbl2: 
bc $RESULT 
sto 
mov bpaddr,esp 
eob lbl3 
bphws bpaddr,"r" 
run 

lbl3: 
bphwc bpaddr 
sto 
sto 

end: 
cmt eip,"OEP found!please dumped it!" 
msg "Script by loveboom[DFCG],Thank you for using my script!" 
ret