mew 10 se v1.0 oep finder.txt

来自「700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.」· 文本 代码 · 共 30 行

/*
// OEP FINDER FOR: Mew 10 exe-coder 1.0 by Northfox
// AUTHOR        : SMoKE ([e-mail])
// OS            : WinXP SP1, OllyDbg v1.10c, OllyScript v0.8
// INFOZ         : dump at OEP and simply fix import table by ImpRec
*/


var X
gpa "LoadLibraryA", "kernel32.dll"
bphws $RESULT, "x"
eob label1
run
label1:
bphwc $RESULT
mov X, [esp]
bp X
eob label2
run
label2:
bc X
findop eip, #C3#
bp $RESULT
eob label3
run
label3:
bc $RESULT
sto
cmt eip, "OEP Reached !"
ret