Thinstall 2.521 OEP Finder.txt

/* ============================ .:[OllyScript Editor v2.0]:. Author: GaBoR RES] Packer: Thinstall 2.521 Script for: Thinstall 2.521 packed appz Level: Intermediate Date: Monday, November 28, 2005 Thanks to: MaDMAn_H3rCul3s, haggar for their tutorials on Thinstall ============================ */ var GetEnvironmentVariableA var v gpa "GetEnvironmentVariableA","kernel32.dll" mov GetEnvironmentVariableA,$RESULT bp GetEnvironmentVariableA run run run rtu bc GetEnvironmentVariableA find eip,#83BDE4FEFFFF00# bp $RESULT run bc $RESULT sto sto sto sto sto sti find eip,#0F84# bphws $RESULT,"x" run bphwc $RESULT cmp eax,0 jne change cont: rtr /* uncomment the following line if you don't have "After Executing till RET, step over RET" enabled in "Debugging Options->Trace'" */ //sto find eip,#5968FA000000# bp $RESULT run bc $RESULT find eip,#83601000# mov v,$RESULT add v,24 bp v run bc v sti cmt eip,"OEP reached" msg "Dump & fix IAT" ret change: repl eip,#0F84#,#0F85#,2 jmp cont