pecompact2.xx.oep.txt

700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.

/* 
//////////////////////////////////////////////////////////////
// PECompact 2.xx (Support all ver) OEP finder 
// Author: hacnho/VCT2k4 
// Email : [e-mail] 
// Website: http://nhandan.info/hacnho 
// OS : WinXP Pro, OllyDbg 1.10 Final, OllyScript v0.85
// Date ReLeAsE: 14 July 2004
/////////////////////////////////////////////////////////////
*/

var CS
var CB
var Temp

sto 
findop eax, #C3# 
bp $RESULT 
esto 
esto

gmi eip, CODEBASE
mov CB, $RESULT 
log CB

gmi eip, CODESIZE 
mov CS, $RESULT 
log CS

bpwm CB, CS 
esto 
sto 
bpmc 
findop eip, #FFE0# 
mov Temp, $RESULT 
bp $RESULT 
esto 
jmp exit


Return: 
esto 
jmp exit

exit: 
cmp eip, Temp 
jne Return 
sto
log eip 
cmt eip, "This is the OEP! Found by hacnho/VCT2k4"
MSG "Dumped and fix IAT now! Thanx for using my Script...!"
ret

;---