ultraprotect 1.xx acprotect 1.22 oep finder (vb only).txt

700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.

/*
////////////////////////////////////////////////// 
UltraProtect 1.x/ACprotect 1.22 OEP Finder(For VB only!) 
( for 'oep obfuscation and anti loader' mode) 
Author: loveboom 
Email : [e-mail] 
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62 
Date : 2004-3-26 
Config: Hide ollydbg(IsDebuggerPresent),Exceptions:uncheck "INT3 breaks". 
Note : If you have one or more question, email me please,thank you! 
////////////////////////////////////////////////// 
*/ 

var addr 
var paddr //push address 
var Aaddr // asm Address 
var cbase 
gmi eip,CODEBASE 
mov cbase,$RESULT 
gmi eip,CODESIZE 
eob lbl1 
run 

lbl1: 
findop eip,#C3# 
eob lbl2 
bp $RESULT 
esto 


lbl2: 
bc $RESULT 
sto 
mov addr,esp 
eob lbl3 
bphws addr,"r" 
run 

lbl3: 
bphwc addr 
eob lbl4 
bprm cbase,FF 
run 

lbl4: 
bpmc 
mov addr,esp 
add addr,4 
mov paddr,[addr] 
mov Aaddr,eip 
add Aaddr,7 
mov [Aaddr],paddr 
sub Aaddr,1 
mov [Aaddr],#68# 
mov addr,Aaddr 
cmt addr,"OEP is Found" 
add addr,5 
cmt addr,"Here patch code 'call EIP',and then you can dumped it!" 
msg "Script by loveboom[DFCG],Thank you for using my script!" 
ret