12311134 Unpacker

mycsy

var counter
var ImageBase

var OEP
var iat_start


mov counter,0
gmi eip,MODULEBASE
mov ImageBase,$RESULT
find eip,#33C0BF????????F3ABC3#
cmp $RESULT,0
je quit
mov OEP,$RESULT+9
mov iat_start, $RESULT+49
bp iat_start
bp OEP
run
bc iat_start
mov iat_start,esi
mov [eip+4E],#90E9#
run
sti
bc OEP
mov OEP,eip
cmt eip, "This is the entry point"

sub OEP,ImageBase
sub iat_start,ImageBase
mov counter,ImageBase
add counter,3C
mov counter,[counter]
add counter,ImageBase
add counter,28
mov [counter],OEP
add counter,58
mov [counter],iat_start

DPE "dump.exe",eip
msg "The file is unpacked! Name ->Dump.exe Remove  section Xiao in Dump"
ret



quit:
MSG "Not 12311134"
ret

 

richard257

啥脚本，怎么没说呀

zsl01

什么脚本啊，能不能说下。