///////////////////////////////////////////////////////////////

// FileName    :  DexCrypt 2.0.oSc

// Comment     :  DexCrypt 2.0.UnPacK

// Environment :  WinXP SP2,OllyDbg V1.10,OllyScript V1.65

// Author      :  kienmanowar [REA-cRaCkErTeAm]

// WebSite     :  http://reaonline.net

// Date        :  2008.03.21

///////////////////////////////////////////////////////////////

#LOG

dbh



var MagicAddr

var cbase
var csize

var OEP

var index



gmi eip,CODEBASE
mov cbase,$RESULT

gmi eip,CODESIZE
mov csize,$RESULT



MSGYN "Plz Clear All BreakPoints + Make First Pause at:Entry Point Of Main Module !  "

cmp $RESULT, 0

je TryAgain

cmp $VERSION, "1.65"

jb CheckODbgScripVersion

bphwc

bc

bprm cbase, csize

esto

bpmc



find eip, #EBF3E800000000C3#

cmp $RESULT,0

je NoFind

add $RESULT,7

mov MagicAddr, $RESULT

log MagicAddr

bp MagicAddr

run

bc MagicAddr

sto

sto



mov OEP,eip

eval "OEP VA:{OEP}"

log OEP

cmt eip, "This is the OEP!  Found By: kienmanowar[REA-cRaCkErTeAm] "                              

msg "Just : OEP !  Dump and Fix IAT.  Good Luck   "

ret       



NoFind:

msg "Error! Don't find."

ret



CheckODbgScripVersion:

msg  "ODBGScript Version Need 1.65 or higher!"

ret



TryAgain:

msg " Plz  Try  Again   !   "

ret