//////////////////////////////////////////////////

//  FileName    :  SafeCast 2.60.30

//  Comment     :  SafeCast 2.60.30 FixedImportingFunction

//  Environment :  WinXP SP2,OllyDbg V1.10,OllyScript V0.92

//  Author      :  Original by fly modified by Human

//  WebSite     :  http://www.unpack.cn

//  Date        :  2006-06-10 22:00

//////////////////////////////////////////////////

#log

dbh



var EP

var CreateEventA

var MagicJmp



find eip,#6113600DE9#

add $RESULT,4

mov EP,$RESULT

bphws EP, "x"



gpa "CreateEventA", "KERNEL32.dll"

mov CreateEventA,$RESULT

eob CreateEventA

bphws CreateEventA, "x"



GoOn:

esto



CreateEventA:

cmp eip,CreateEventA

jne GoOn

rtu



find eip, #D3E223C285C0752C8B45F8#

cmp $RESULT, 0

je GoOn

add $RESULT,4

mov MagicJmp,$RESULT

bphwc CreateEventA

eob FixedImportingFunction

bphws MagicJmp, "x"



GoOn2:

esto



FixedImportingFunction:

cmp eip,MagicJmp

je MagicJmp

cmp eip,EP

je EP

jmp GoOn2



MagicJmp:

add eip,4

jmp GoOn2



EP:

bphwc EP

bphwc MagicJmp

sti



log eip

cmt eip, "This is the OEP! Found By: fly"

MSG "Just : OEP !  Dump and Fix IAT/Reloction.  Good Luck  "

ret