asprotect oep finder (all versions).txt

来自「700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.」· 文本 代码 · 共 66 行

var addra
var addrb
var addrc
var test

run
eoe checkme
eob checkme

checkme:
mov addrb,eip
add addrb,2
mov addrb,[addrb]
cmp addrb,00058f64
je checklast
esto


checklast:

mov addra,ebp
sub addra,10
mov addra,[addra]

cmp addra,400000
je found
esto

found:
eob end
eoe end
mov addrc,[40003c]
add addrc,100
add addrc,400000

mov addrc,[addrc]

bprm 401000,addrc
esto

end:
mov addra,[eip]
and addra,0000ff

cmp addra,c3


jne endmsg
mov test,[esp]

and test,f00000
shr test,14

cmp test,9

jae loop
jmp endmsg
loop:
eob endmsg
eoe endmsg
esto

endmsg:
MSG " Please click on k at toolbar,if is not empty double click on the last address within the code section that you see at the bottom,and please rmove analysis if analysis has been done. Thank you!;BriteDream "
ret