View Single Post
  #1  
Old 09-13-2005, 20:46
wildmans
 
Posts: n/a
How to find YP's OEP

Hey Guys

Been working on unpacking a YP 1.03 .DLL lately..I've been following a tutorial as I did not want te reinvent the wheel for that packer

Can somebody explain to me how to find the OEP for a YP 1.03 packed .dll ? The unpacking process went quite fine, but I dumped it while the thread was stopped after BP'ing on the .code section.. Now I have the dumped file but no OEP...
I tried comparing it with other dll's to see if i could match the entrycode but no luck

Furthermore: YP has an anti-dump trick.. I wondered how this 'trick' works ? I mean when you dump normally you get a packed dump.. Does this mean that the dll repacks itself after every method in the dll has been called or something ?? Im really confused here

Any info on these 2 subject would be great
Reply With Quote