能力值:
( LV2,RANK:10 )
|
-
-
2 楼
//////////////////////////////////////////////////
// FileName : NsPack.V1.0-V3.5.osc
// Comment : OEP Find For NsPack V1.0-V3.5 OEP Find
// Environment : WinXP SP2,OllyDbg V1.10,OllyScript V0.92
// Author : fly
// WebSite : http://www.unpack.cn
// Date : 2005-10-02 13:30
//////////////////////////////////////////////////
#log
MSGYN "Plz Clear All BreakPoints And Set Debugging Options : Events->Make First Pause at->WinMain ! "
cmp $RESULT, 0
je TryAgain
//GameStart————————————————————————————————
eob VirtualProtect
gpa "VirtualProtect", "KERNEL32.dll"
bp $RESULT
esto
GoOn0:
esto
VirtualProtect:
cmp eip,$RESULT
jne GoOn0
bc $RESULT
rtu
find eip, #619DE9#
cmp $RESULT, 0
je NoFind
log $RESULT
add $RESULT,2
eob PoPad
bp $RESULT
esto
GoOn1:
esto
PoPad:
cmp eip,$RESULT
log eip
log $RESULT
jne GoOn1
bc $RESULT
sti
//GameOver————————————————————————————————
cmt eip, "This is the OEP! Found by fly"
MSG "Just : OEP ! Dump and Fix IAT. Good Luck "
ret
NoFind:
MSG "Error! Maybe It's not NsPack V1.0-V3.5 "
ret
TryAgain:
MSG " Plz Try Again ! "
ret
上面是fly大侠的脚本 保存为 ocx文件或者txt文件 然后打开od 选择插件->odbgscript(如果没有去下载放到 od目录下面的plugin下面 )->运行脚本->打开 刚刚保存的文件就ok了
|
能力值:
( LV2,RANK:10 )
|
-
-
3 楼
// Environment : WinXP SP2,OllyDbg V1.10,OllyScript V0.92
用上面说的插件较好
|
能力值:
( LV2,RANK:10 )
|
-
-
4 楼
非常感谢。。。。。。。。。。。。。。。。。。。。。。。。。。。
|
能力值:
( LV2,RANK:10 )
|
-
-
5 楼
汗nSPack 2.1 - 2.5 -> North Star/Liu Xing Ping
还是没去掉
|
|
|