700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.

源代码在线查看: pespin 1.0 oep finder.txt

软件大小: 643 K
上传用户: peterzhang1982
关键词: ollyscript Plugin 700 脚本
下载地址: 免注册下载 普通下载 VIP

相关代码

				/*
				11h11 AM Webnesday 12 January 2005
				PESpin 1.0 OEP Finder without Method "Remove OEP"
				Author : dqtln
				Email : dqtlncrk@gmail.com
				OS : WinXP Pro SP1 , OllyDbg 1.10 , OllyScript 0.92
				Website : www.phudu.com
				For opinions & bugreport send me a email
				Thank you very much
				*/
				
				msgyn "Please check Options/Exceptions/INT3 breaks"
				cmp $RESULT,0
				je dqtln3
				var x
				sto
				sto
				bphws esp,"r"
				mov x,esp
				run
				
				dqtln1:
				esto
				cmp eax,FF
				jne dqtln1
				je dqtln2
				
				dqtln2:
				esto
				bphwc x
				ask "See E9???????? code - Jump to OEP - Enter new EIP"
				cmp $RESULT,0
				je dqtln3
				mov eip,$RESULT
				sto
				msg "Please press No if have a question"
				an eip
				cmt eip,"This is the OEP - Found by dqtln"
				msg "Dump and fix IAT now - Good day"
				ret
				
				dqtln3:
				msg "Script Abort"
				ret			

相关资源