pecompact2.02.txt

来自「700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.」· 文本 代码 · 共 43 行

/*

PECompact 2.01a (27-04-04 release) OEP Finder by Scarabee

Make sure you Select NO on 'Compressed code message' when loading application in Olly.
When at OEP, just dump and fix with IMPREC.

*/

var cbase
var csize
var lbl2
var lbl1
var oki

sto
findop eax, #c3#
bp $RESULT
esto
esto
GMI eip, CODEBASE
mov cbase, $RESULT
GMI eip, CODESIZE
mov csize, $RESULT
bpwm cbase, csize
esto
sto
bpmc
findop eip, #FFE0#
mov oki, $RESULT
bp $RESULT
esto

lbl2:
cmp eip, oki
jne lbl1
sto
MSG "This is OEP, now dump and fix!"
ret

lbl1:
esto
jmp lbl2