1、/ FileName : SafeCast 2.60.30/ Comment : SafeCast 2.60.30 FixedImportingFunction/ Environment : WinXP SP2,OllyDbg V1.10,OllyScript V0.92/ Author : Original by fly modified by Human/ WebSite : / Date : 2006-06-10 22:00/#logdbhvar EPvar CreateEventAvar MagicJmpfind eip,#6113600DE9#add $RESULT,4mov EP,
2、$RESULTbphws EP, xgpa CreateEventA, KERNEL32.dllmov CreateEventA,$RESULTeob CreateEventAbphws CreateEventA, xGoOn:estoCreateEventA:cmp eip,CreateEventAjne GoOnrtufind eip, #D3E223C285C0752C8B45F8#cmp $RESULT, 0je GoOnadd $RESULT,4mov MagicJmp,$RESULTbphwc CreateEventAeob FixedImportingFunctionbphws MagicJmp, xGoOn2:estoFixedImportingFunction:cmp eip,MagicJmpje MagicJmpcmp eip,EPje EPjmp GoOn2MagicJmp:add eip,4jmp GoOn2EP:bphwc EPbphwc MagicJmpstilog eipcmt eip, This is the OEP! Found By: flyMSG Just : OEP ! Dump and Fix IAT/Reloction. Good Luck ret
