Hi everyone, we know that Unpacker Execryptor by RSI (public version) can unpack a lot of target but sometimes it can find OEP (miss VC8 signature in public version)
Ex:
[Option: One-touch Trial + Protect Entry Point] VC8

396K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4Z5M7X3W2K6L8h3y4Q4x3X3g2V1k6g2)9J5c8X3c8W2N6X3g2D9L8%4m8E0k6h3&6@1i4K6u0r3P5r3q4J5M7q4)9J5c8W2S2m8M7Y4m8Q4x3X3g2W2P5r3f1`.

[Option: Not Compress section code, Not dynamic import]


8f1K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3c8D9i4K6u0W2M7r3!0%4k6i4u0S2M7X3y4Z5K9i4k6W2M7W2)9J5k6h3y4G2L8g2)9J5c8U0t1H3x3o6N6Q4x3V1k6H3L8%4N6S2M7X3x3I4x3o6t1J5i4K6u0W2k6i4S2W2

So I modified Bypass AntiDebug script to find VM EP or Stolen OEP and you can input it into Unpacker Execryptor.

///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
//	FileName		:	Execryptor 2.x - 2.41 find VM EP - Stolen OEP.osc
//	Version			:	1.0
//	Comment			:	modified Bypass anti debug script,just for find Stolen OEP
//	Environment		:	WinXP SP2,OllyICE with Phantom plugin,ODBGScript V1.64+, Check bypass All Exception:00000000 - FFFFFFFF
//	Author			:	Trickyboy
//	WebSite			:	216K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4u0W2j5h3!0F1L8r3W2F1k6g2)9J5k6h3&6W2N6l9`.`.
//	Date			:	2008-06-15 14:50
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

Data:
	var imagebase
	var ecseg
	var vmseg
	var ep
	var oep
	var vmep
	var codeseg
	var sizeheader
	var oriByte
	var temp
	
Init:
	BPHWCALL
	gmi eip, MODULEBASE
	mov imagebase, $RESULT
	mov codeseg, $RESULT
	mov temp, $RESULT
	gmemi imagebase, MEMORYSIZE
	mov sizeheader, $RESULT
	add codeseg, sizeheader
	add temp, 3C
	mov temp, [temp]
	add temp, imagebase
	add temp, 28
	mov temp, [temp]
	add temp, imagebase
	bc temp									//Clear memory breakpoint at EP
	mov ep, temp
	gmemi eip, MEMORYBASE
	mov ecseg, $RESULT
	gpa "CreateThread", "kernel32.dll"
	mov oriByte, [$RESULT] 					//Store original byte at CreateThread
	mov [$RESULT], #C3#						//Patch RETN at CreateThread
	
FindSOEPNotPacked:
	mov temp, eip							//Store current EIP
	cmp [codeseg], 00000000				//Is section code null?
	je FindVMEP								
	mov eip, codeseg						//If section code is not packed
	eval "JMP 0{ep}"
	findcmd eip, $RESULT					//Find command JMP EP
	cmp $RESULT, 0							
	jne FoundSOEP							//Found OEP
	
FindVMEP:
	mov eip, temp							//Restore last EIP
	bphws ep, "x"
	esto
	bphwc ep
	mov temp, ecseg
	sub temp, 1
	gmemi temp,MEMORYBASE
	mov vmseg,$RESULT
	gmemi temp,MEMORYSIZE
	bprm vmseg,$RESULT
	esto
	bpmc
	mov vmep, eax
	sti
	bprm vmep, 1
	
LoopFind:
	esto
	cmp eip, vmep
	jne LoopFind
	
FoundVMEP:
	bpmc
	mov temp, vmep
	sub temp, imagebase
	eval "VM EP: {vmep} RVA: {temp}"
	log $RESULT
	mov temp, $RESULT
	msg temp
	eval "<== Found VM EP by Trickyboy. {temp}"
	cmt vmep, $RESULT
	gpa "CreateThread","kernel32.dll"
	mov [$RESULT],oriByte					//Restore CreateThread API
	
FindSOEP:
	mov eip,codeseg
	eval "JMP 0{vmep}"
	findcmd eip,$RESULT
	cmp $RESULT,0
	je notFoundSOEP
	
FoundSOEP:
	mov eip, $RESULT
	mov oep, $RESULT
	mov temp, oep
	sub temp, imagebase
	eval "OEP: {oep} RVA: {temp}"
	log $RESULT
	mov temp, $RESULT
	msg temp
	eval "<== Found Stolen OEP by Trickyboy. {temp}"
	cmt oep, $RESULT
	ret
	
notFoundSOEP:
	mov eip, vmep
	msg "Sorry, not found Stolen OEP !"
	ret
	

Note:
1. OllyICE + Phantom plugin
2. ODBGScript V1.64+
3. Check bypass all exception in Olly option: 00000000 - FFFFFFFF

Hope it useful!

Regards,

Trick.

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课