molebox2.x 跳过iat加密.txt

来自「700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.」· 文本 代码 · 共 32 行

// MoleBox 2.x跳过IAT加密 v0.1b
// This script will quickly put you at the OEP And Patch IAT of an MoleBox 2.x EXE.
// Just run it!

var addr
  
  sto        
  mov addr,esp  //Esp定律

  gpa "VirtualProtect","kernel32.dll"  //特征API
  bp $RESULT
  run

  bc $RESULT
  rtu

  find eip,#8901#  //查找特征加密语句
  bp $RESULT
  run
  bc $RESULT
  repl eip, #8901#, #9090#, 10  //替换为9090
  
  bphws addr,"r"    
  run

  sto
  bphwc addr
  cmt eip,"OEP To Get,Please dumped it,Enjoy!"