三、OEP内存断点万能脱壳法简化变形的OD脚本
OEP内存断点万能脱壳法经过简化变形后其操作变得非常简单机械,我们可以用一个很简单的ollydbg脚本来使其自动执行脱壳,脚本如下:
/*
//////////////////////////////////////////////////
All Compress packer Unpacking script
Author: sxssl
Email : sxssl@163.com
OS : WinXP sp2,Ollydbg 1.1,OllyScript v0.92
Date : 2008-1-20
Config: Ignore all exceptions
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/
input:
ask "Please Enter OEP VA"
cmp $RESULT,400000
jb message
cmp $RESULT,400000
ja bphw
bphw:
bphws $RESULT, "x"
run
bphwc $RESULT
jmp end
message:
msg "OEP VA Is False! Please Enter True OEP VA!"
jmp input
end:
msg "Script by sxssl,Thank you for using my script!"
ret