Unpacking Dekaron.exe

[GrandSlam]

ok there was a script and a ollydbg.ini

The older people should kno about it

so anyone who has it can you post it kinda lost it when i reformatted ty...

[xCoCaKoLax]

Originally Posted by GrandSlam

ok there was a script and a ollydbg.ini

The older people should kno about it

so anyone who has it can you post it kinda lost it when i reformatted ty...

/* Derakon Unpacking Script - CoCaKoLa [09.01.2008] */

msgyn "Alt+O -> Disable all exceptions"
cmp , 0
je retry

dbh

var a
var b
var c
var d
var e
var test
var rva

run
eoe checkme
eob checkme

checkme:
mov b,eip
add b,2
mov b,[b]
cmp b,00058F64
je checklast
esto

checklast:
mov a,ebp
sub a,10
mov a,[a]
cmp a,400000
je found
esto

found:
eob end
eoe end
mov c,[40003C]
add c,100
add c,400000
mov c,[c]
bprm 401000,c
esto

end:
mov a,[eip]
and a,0000FF
cmp a,C3
jne exit
mov test,[esp]
and test,F00000
shr test,14
cmp test,9
jae loop
jmp exit

loop:
eob exit
eoe exit
esto

exit:
sti
mov d,eip
sub d,9
mov eip,d
mov e,[ebp-8]
mov [eip],e
mov d,eip
sub d,1
mov eip,d
mov [eip],#68#
mov d,eip
sub d,2
mov eip,d
mov [eip],#6A60#
dpe "dump.exe",eip
cmt eip,"OEP! Stolen bytes fixed & dumped. Fix IAT with ImpREC!"
mov rva,eip
sub rva,400000
log rva,"RVA of OEP: "
ret

retry:
ret

have fun

[GrandSlam]

hmm i disabled all exceptions but still getting that gay mini-launcher pop-up when i try to use the script

[xCoCaKoLax]

Originally Posted by GrandSlam

hmm i disabled all exceptions but still getting that gay mini-launcher pop-up when i try to use the script

dude u dont need disable nothing ( exceptions )

this is my scrypt i make this all auto ,

-disabling exceptions
-rebasing OEP
-fixing IAT

all with no importREC and fixing .dlls

have fun

[GMThunder]

hey coka how did you get lvl 5 clearance. is that like area 51 atuff?

[xCoCaKoLax]

Originally Posted by GMThunder

hey coka how did you get lvl 5 clearance. is that like area 51 atuff?

haha GMThunder ; this is only my topic for nick name i dont wanna explain why i type LvL 5
anyways this is out than theme


@grandslam: someone dude with scrypt or running this, u know i help you. pm

[HellSpider]

Originally Posted by xCoCaKoLax

dude u dont need disable nothing ( exceptions )
this is my scrypt i make this all auto ,

-disabling exceptions
-rebasing OEP
-fixing IAT

all with no importREC and fixing .dlls

have fun

I think he meant the debugger options to handle the exceptions. Your script pops a message to untick all exceptions in the beginning... .

[xCoCaKoLax]

Originally Posted by InstantDeath

I think he meant the debugger options to handle the exceptions. Your script pops a message to untick all exceptions in the beginning... .

true haha long time i make this simple scrypt ..

msgyn "Alt+O -> Disable all exceptions"

this open messagebox ,