1、/ FileName : JDProtect.V0.9/JDPack.V1.X.osc/ Comment : JDPack V1.X / JDProtect V0.9 UnPacK Script/ Environment : WinXP SP2,OllyDbg V1.10,OllyScript V0.92/ Author : fly/ WebSite : / Date : 2005-10-22 15:30/#logdbhvar Tempvar ImageBasevar PEvar e_lfanewvar PE_Signaturevar ImportTableRVAvar -ImportTabl
2、eRVAvar ImportTableSizevar -EPvar OEPRVA/GetPEInformationmov Temp,eaxexecpush 0call GetModuleHandleAendemov ImageBase,eaxmov eax,Templog ImageBasemov Temp,ImageBaseadd Temp,3Cmov e_lfanew,Templog e_lfanewmov Temp,e_lfanewadd Temp,ImageBasemov PE_Signature,Templog PE_Signatureadd Temp,28mov -EP,Templ
3、og -EPadd Temp,58mov -ImportTableRVA,Templog -ImportTableRVA/mov ImportTableRVA,-ImportTableRVAadd Temp,4mov ImportTableSize,Templog ImportTableSize/ImportTableRVAfind eip, #E2EB#cmp $RESULT, 0je NoFindadd $RESULT,2log $RESULTgo $RESULTfind eip, #03F28B460C0BC0#cmp $RESULT, 0je NoFindeob GetImportTa
4、bleRVAbp $RESULTestoGoOn:estoGetImportTableRVA:cmp eip,$RESULTjne GoOnbc $RESULTmov ImportTableRVA,esilog ImportTableRVAmov -ImportTableRVA,ImportTableRVA/OEPstistiasm eip, xor eax, eaxstistifind eip, #03C28944241C#cmp $RESULT, 0je NoFindeob OEPbp $RESULTestoOEP:bc $RESULTlog eaxmov OEPRVA,eaxlog OE
5、PRVAmov -EP,OEPRVAfind eip, #6150C3#cmp $RESULT, 0je NoFindadd $RESULT,2eob OKbp $RESULTestoOK:bc $RESULTstidpe C:UnPacKed.eXe, eipMSG Dumped File C:UnPacKed.eXe /GameOvercmt eip, This is the OEP! Found by flyMSG OK, Already Fixed OEP and ImportTable ! Good Luck retNoFind:MSG Error! Maybe Its not JDPack V1.X / JDProtect V0.9 ret
