Reverse Engineering b10g | REM

hi

 OllyDbg ExeCryptor version for hiding olly and ….

link:

http://rapidshare.com/files/39851301/exec.olly.zip 

hi

this is  another of ollydbg modificated :) 

This  version of OllyDBG is moded to be undetectable by protectors or
      protecting  formulas,  it  is  fast  and with most needed plugins for
      everyday cracking!

http://rapidshare.com/files/39044055/DeFixed_Edition.rar

// tElock 0.99 OEP Finder

// Coded by: kNiGhT

// Note: Ignore all exceptions

var temp

var temp1

var ImgBase

var CodeEnd

var CodeStart

var CodeSize

gmi eip, MODULEBASE

mov ImgBase, $RESULT

mov temp, 3c

add temp, ImgBase

mov temp, [temp]

add temp, ImgBase

add temp, 100

mov CodeSize, [temp]

add temp, 4

mov CodeStart, [temp]

add CodeStart, ImgBase

mov CodeEnd, CodeStart

add CodeEnd, CodeSize

gpa “LoadLibraryA”, “kernel32.dll”

add $RESULT, 2

bp $RESULT

run

bc $RESULT

rtu

String_Schleife:

sto

mov temp, [eip]

and temp, FFFF

cmp temp, 858D

jne String_Schleife

sto

mov temp, eax

DeleteString:

mov temp1, [temp]

and temp1, FF000000

cmp temp1, 0

je FindOEP

mov [temp], 0

inc temp

jmp DeleteString

FindOEP:

bprm CodeStart, CodeSize

OEP_Schleife:

run

cmp eip, CodeStart

jb OEP_Schleife

cmp eip, CodeEnd

ja OEP_Schleife

bpmc

cmt eip, “OEP found by kNiGhT”

msg “Dump and rebuild IAT!”

ret

// WinXP SP2,OllyDbg V1.10,ODbgScript 1.48xxx1.60,FantOm plugin0,58

var br

var pt

var va

run

mov [eip],#CC#

mov br,[esp+8]

bp br

run

bc br

gpa “LoadLibraryA”,”kernel32.dll”

bp $RESULT

run

bc $RESULT

rtr

mov br,eip

bpcnd br, “EDI==7C809A81″//–”VirtualAlloc”,”kernel32.dll”

run

bc br

sti

mov pt,eip

add pt,A8

mov [pt],#EB#

find eip,#8944241C61FFE0#

cmp $RESULT,0

je quit

mov br,$RESULT

add br,5

bp br

run

bc br

sti

cmt eip, “This is the entry point”

MSG “OEP Faund ! IAT fixed! Dump it”

ret

quit:

ret