1、/*= .:OllyScript Editor v2.0:. Author: GaBoR RES Packer: Thinstall 2.521 Script for: Thinstall 2.521 packed appz Level: Intermediate Date: Monday, November 28, 2005 Thanks to: MaDMAn_H3rCul3s, haggar for their tutorials on Thinstall =*/var GetEnvironmentVariableAvar vgpa GetEnvironmentVariableA,kern
2、el32.dllmov GetEnvironmentVariableA,$RESULTbp GetEnvironmentVariableArunrunrunrtubc GetEnvironmentVariableAfind eip,#83BDE4FEFFFF00#bp $RESULTrunbc $RESULTstostostostostostifind eip,#0F84#bphws $RESULT,xrunbphwc $RESULTcmp eax,0jne changecont:rtr/*uncomment the following line if you dont have After Executing till RET, step over RET enabled in Debugging Options-Trace*/stofind eip,#5968FA000000#bp $RESULTrunbc $RESULTfind eip,#83601000#mov v,$RESULTadd v,24bp vrunbc vsticmt eip,OEP reachedmsg Dump & fix IATretchange:repl eip,#0F84#,#0F85#,2jmp cont
