// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com

/*

	======================================

   	   |_____ // tRUE! \\  _____  2008

	 __/    /_  __________/    /_________

	/_     __ \/  __     /    /         /

	 /    / /    / /    /    /    /    /

	/    / /    / /    /    / ________/__

	\___/  \___/  \________/\___________/



		Coded by: Xylitol // tRUE

		Contact: www.forum.lastepidemic.net

		Packer: fEaRz Crypter 1.0

		Script for: Found the OEP

		Date: monday 6 mai 2008

	 ====================================

						*/



Start:

GO 402509

MSGYN "Did you see 'CreateProcessA' in the highlighted line ?"

cmp $RESULT,0

je abort

BP 402670 //The packer use the same plan crypting and same adresse

run       //For all appz crypted by fEaRz Crypter 1.0 !

sto

sto

sto

sto

sto

sto

sto

MSG "Look in the Registers (FPU),  your OEP is the EAX value"

cmt eip, "The Original Entry Point is the EAX value"

MSG "OEP found by tRUE tEAM 2008"

ret



abort:

msg "Error,Script aborted!,Meybe target is not protect by fEaRz Crypter 1.0"

ret