*/

KaOs PE-DLL eXecutable Undetecter Unpacker

Pavka

/*



var counter

var ImageBase

var OEP

var iat_start

mov counter,0

gmi eip,MODULEBASE

mov ImageBase,$RESULT

find eip,#61FF25#

cmp $RESULT,0

je quit

mov OEP,$RESULT+1

bp OEP

find eip,#89043BA1??????0083C704#

cmp $RESULT,0

je quit

fill $RESULT,3,90

mov iat_start,$RESULT

bp iat_start

erun

bc eip

mov iat_start,esi 

erun

bc eip

sti

mov OEP,eip

sub OEP,ImageBase

sub iat_start,ImageBase

mov counter,ImageBase

add counter,3C

mov counter,[counter]

add counter,ImageBase

add counter,28

mov [counter],OEP

add counter,58

mov [counter],iat_start

dpe "dump.exe", eip

MSG "File Unpacked"

ret

quit:

MSG "KaOs PE-DLL eXecutable Undetecte"

ret