pecompact208.txt

700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.

/*
//////////////////////////////////////////////////
	Pecompact v2.08 OEP Finder v0.1 beta
	Author:	loveboom
	Email : [e-mail]
	OS    : winxp,OllyDbg 1.1C,OllyScript v0.7
	Date  : 2004-5-8
	Config: Ignore all exceptions.
	Note  : Donn't use this script unpack "pe2gui.exe"
        If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/
var addr

start:
  gpa "VirtualFree","kernel32.dll"
  cmp $RESULT,0
  JE lblabort
  mov addr,$RESULT
  bp addr
  run

lbl1:
  run
  bc addr 	//Clear break point
  rtu

lbl2:
  findop eip,#FFE0#
  cmp $RESULT,0
  je lblabort
  mov addr,$RESULT
  bp addr
  eob lbl3
  run

lbl3:
  bc addr
  sto

lblend:
  cmt eip,"OEP Found,Please dumped it!"
  msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"
  ret

lblabort:
  msg "Error! script abort, Maybe target is not packed by pecompact v2.08,more information,mailto [e-mail]."
  ret