Quote:
Originally Posted by xCoCaKoLax
Hiya alls;
finally [today :pimp: 3hours..] unpacket the MUlegend .. for those who pass the(rebase) IAT and find the correct OEP (the first ones are false ...) -debugging
I am currently unpacket.scrypt successfully.
Code:
eoe exit
esto
exit:
sti
mov d,eip
sub d,9
mov eip,d
mov e,[ebp-8]
mov [eip],e
mov d,eip
sub d,1
mov eip,d
mov [eip],#68#
mov d,eip
sub d,2
mov eip,d
mov [eip],#6A60#
dpe "dump.exe",eip
cmt eip,"OEP! Stolen bytes fixed & dumped. Fix IAT with ImpREC!"
mov rva,eip
sub rva,400000
log rva,"RVA of OEP: "
ret
retry:
ret
*working/programming clientless.bot
have fun
|
Hello, i use your unpack script for MULegend and seems IAT is restored fine, but OEP i land with it, seems to wrong. I land on offset: 02B0AE1A, is it correct?