exestealth 2.7 oep finder v0.1.txt

来自「700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.」· 文本 代码 · 共 53 行

// EXEStealth v2.7 OEP Finder v0.1
// by FEUERRADER [AHTeam]
// http://ahteam.org

var s
var k

eob Break 
mov s, esp
sub s, 04
bphws s, "r"
run

Break:
eob Break2
run

Break2:
eob B21
eoe expp
sto
run

expp:
esto

B21:
bphwc s
eob B3
mov k, eax
bp k
run

B3:
bphwc k
eob Br4
findop eip, #C1C7#
bphws $RESULT, "x"
run

Br4:
bphwc $RESULT
sto
sto
eob Br5
mov k, edi
bp k
run

Br5:
bphwc k
cmt eip, "OEP"
ret