thinstall 2.521 oep finder.txt

700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.

/*
	============================
	      .:[OllyScript Editor v2.0]:.
	      Author: GaBoR RES]
	      Packer: Thinstall 2.521
	      Script for: Thinstall 2.521 packed appz
	      Level: Intermediate
	      Date: Monday, November 28, 2005
              Thanks to: MaDMAn_H3rCul3s, haggar
              for their tutorials on Thinstall
	 ============================
						*/
var GetEnvironmentVariableA
var v
gpa "GetEnvironmentVariableA","kernel32.dll"
mov GetEnvironmentVariableA,$RESULT
bp GetEnvironmentVariableA
run
run
run
rtu
bc GetEnvironmentVariableA
find eip,#83BDE4FEFFFF00#
bp $RESULT
run
bc $RESULT
sto
sto
sto
sto
sto
sti
find eip,#0F84#
bphws $RESULT,"x"
run
bphwc $RESULT
cmp eax,0
jne change
cont:
rtr
/*
uncomment the following line if you don't have "After Executing till RET, step over RET" enabled in "Debugging Options->Trace'"
*/
//sto
find eip,#5968FA000000#
bp $RESULT
run
bc $RESULT
find eip,#83601000#
mov v,$RESULT
add v,24
bp v
run
bc v
sti
cmt eip,"OEP reached"
msg "Dump & fix IAT"
ret
change:
repl eip,#0F84#,#0F85#,2
jmp cont