June 25, 200718 yr Script unpackvar countervar ImageBasevar OEPvar iat_startmov counter,0gmi eip,MODULEBASEmov ImageBase,$RESULTmov OEP,esp-4gpa "LoadLibraryExA","kernel32.dll" <---- Sorry Has corrected herebp $RESULTrunbc eiprtumov iat_start,esifind eip,#ABE9#cmp $RESULT,0je quitmov [$RESULT],#90#bphws OEP,"r"runstistibphwc OEPmov oep,eipcmt eip, "This is the entry point"sub OEP,ImageBasesub iat_start,ImageBasemov counter,ImageBaseadd counter,3Cmov counter,[counter]add counter,ImageBaseadd counter,28mov [counter],OEPadd counter,58mov [counter],iat_startDPE "dump.exe",eipmsg "The file is unpacked! Name ->Dump.exe Remove unnecessary section in Dump"ret Edited June 26, 200718 yr by pavka
June 26, 200718 yr @pavkaYour script does not function correctly.Error on this line-je quit?Your script does not come to the OEP (004271B0).@azmoYour "Unpacking NakedPacker 1.0" link on your homepage does also not work.The file is suspected.....Can you fix this.Thank
June 26, 200718 yr @pavkaBoth versions of the script works fine 100% with ODbgScript plugin v1.51 and it reaches the OEP 004271B0@LCF-ATthank you, i've fixed the link _http://www.4shared.com/file/18528855/420877c2/UnpackingNP10AoRE.htmlazmo
June 27, 200718 yr No problem azmo. I get an error message with line "je quit" and the script ends here... 00469155 8BF8 MOV EDI,EAX ; This is the entry point but the OEP is here... 004271B0 55 PUSH EBP The same error with ODbgScript 1.47 and 1.63. greetz
Create an account or sign in to comment