Have you tried standard stack hr bpx? you can then obtain OEP.
If it is a standard packer (upx, asp, etc.) just bpx in IAT, take notice of instruction writing at IAT, rerun and brak at it. Then dump (original IAT will be kept), fix with found OEP, alter IAT pointers with LordPE to point the unscrewed/virgin IAT et voil¨¤ (ImpREC might help you locating real IAT size, I think).
Regards,
Maximus
(btw I found NOP+PUSHAD+CALL in some AsPack EP version)
|