Teddy Rogers Posted July 4, 2007 Share Posted July 4, 2007 Undetector 1.2http://tuts4you.com/download.php?view.1766Ted. Link to comment Share on other sites More sharing options...
What Posted July 6, 2007 Share Posted July 6, 2007 Well it took a while to find the oep, but all unpacked and working. Link to comment Share on other sites More sharing options...
LCF-AT Posted July 6, 2007 Share Posted July 6, 2007 Here a little script for this UnpackMe.ItUndetector_1.2_OEP_finder_and_detach_processes.rar Link to comment Share on other sites More sharing options...
sdy100 Posted July 7, 2007 Share Posted July 7, 2007 (edited) // code by sdy100// test : Ollydbg 1.10 Odbgscript 1.65.1 mov tmp,1loop:gpa "CreateProcessA", "Kernel32.dll"mov CreateProcessA, $RESULTgpa "WriteProcessMemory", "Kernel32.dll"mov WriteProcessMemory, $RESULTbp CreateProcessAerunbp WriteProcessMemoryerunbcmov addr, [esp+c]mov size, [esp+10]eval "dump{tmp}.exe"mov name, $RESULTdm addr, size, nameeval "dumped dump{tmp}.exe"msg $RESULTinc tmpMSGYN "1 more ?"cmp $RESULT, 1je loopend:ret Edited July 7, 2007 by sdy100 Link to comment Share on other sites More sharing options...
LCF-AT Posted July 7, 2007 Share Posted July 7, 2007 Hello sdy100,your script doesn't work correctly.I get the dump Link to comment Share on other sites More sharing options...
sdy100 Posted July 7, 2007 Share Posted July 7, 2007 (edited) Hello LCF-AT Your script doesn't work correctly.I get the dump Edited July 7, 2007 by sdy100 Link to comment Share on other sites More sharing options...
Ufo-Pu55y Posted July 7, 2007 Share Posted July 7, 2007 Use Odbgscript 1.65.1Hi,erm, where did u get it ?The latest version I can see on their site is 1.64...Greets Link to comment Share on other sites More sharing options...
sdy100 Posted July 7, 2007 Share Posted July 7, 2007 (edited) http://odbgscript.svn.sourceforge.net/view...script/Release/1.65 (SVN) + BPHWC without parameter clears all hardware breakpoints (same as BPHWCALL, which could be removed/renamed) + BC without parameter clears all loaded breakpoints (Breakpoints Window) + BD without parameter disables all loaded breakpoints * Breakpoints saving enhanced, and saving/restore on restart. Edited July 7, 2007 by sdy100 Link to comment Share on other sites More sharing options...
LCF-AT Posted July 7, 2007 Share Posted July 7, 2007 Hello again sdy100,ok now it works but i think it Link to comment Share on other sites More sharing options...
sdy100 Posted July 7, 2007 Share Posted July 7, 2007 hi LCF-AT You don't need to manual work use PEtools -> section -> right click -> dumpfixer (PEtools 1.5 Rc7)regard Link to comment Share on other sites More sharing options...
LCF-AT Posted July 7, 2007 Share Posted July 7, 2007 Hey sdy100, you are right.I dont have used this feature before. That smoothly escaped me.Thanks for the advice and excuse for the trouble. greetz Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now