/*

////////////////////////////////////////////////// 

UltraProtect 1.x/ACprotect 1.22 OEP Finder(For VB only!) 

( for 'oep obfuscation and anti loader' mode) 

Author: loveboom 

Email : bmd2chen@tom.com 

OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62 

Date : 2004-3-26 

Config: Hide ollydbg(IsDebuggerPresent),Exceptions:uncheck "INT3 breaks". 

Note : If you have one or more question, email me please,thank you! 

////////////////////////////////////////////////// 

*/ 



var addr 

var paddr //push address 

var Aaddr // asm Address 

var cbase 

gmi eip,CODEBASE 

mov cbase,$RESULT 

gmi eip,CODESIZE 

eob lbl1 

run 



lbl1: 

findop eip,#C3# 

eob lbl2 

bp $RESULT 

esto 





lbl2: 

bc $RESULT 

sto 

mov addr,esp 

eob lbl3 

bphws addr,"r" 

run 



lbl3: 

bphwc addr 

eob lbl4 

bprm cbase,FF 

run 



lbl4: 

bpmc 

mov addr,esp 

add addr,4 

mov paddr,[addr] 

mov Aaddr,eip 

add Aaddr,7 

mov [Aaddr],paddr 

sub Aaddr,1 

mov [Aaddr],#68# 

mov addr,Aaddr 

cmt addr,"OEP is Found" 

add addr,5 

cmt addr,"Here patch code 'call EIP',and then you can dumped it!" 

msg "Script by loveboom[DFCG],Thank you for using my script!" 

ret