Jump to content
Tuts 4 You

[unpackme] Kaos Pe-dll Executable Undetecter


Teddy Rogers

Recommended Posts

script unpack:

var counter

var ImageBase

var OEP

var iat_start

mov counter,0

gmi eip,MODULEBASE

mov ImageBase,$RESULT

find eip,#61FF25#

cmp $RESULT,0

je quit

mov OEP,$RESULT+1

bp OEP

find eip,#89043BA1??????0083C704#

cmp $RESULT,0

je quit

fill $RESULT,3,90

mov iat_start,$RESULT

bp iat_start

erun

bc eip

mov iat_start,esi

erun

bc eip

sti

mov OEP,eip

sub OEP,ImageBase

sub iat_start,ImageBase

mov counter,ImageBase

add counter,3C

mov counter,[counter]

add counter,ImageBase

add counter,28

mov [counter],OEP

add counter,58

mov [counter],iat_start

dpe "dump.exe", eip

MSG "File Unpacked"

ret

quit:

MSG "KaOs PE-DLL eXecutable Undetecte"

ret

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...