View Single Post
  #15  
Old 01-03-2006, 13:18
deroko's Avatar
deroko deroko is offline
cr4zyserb
 
Join Date: Nov 2005
Posts: 217
Rept. Given: 13
Rept. Rcvd 30 Times in 14 Posts
Thanks Given: 7
Thanks Rcvd at 33 Times in 16 Posts
deroko Reputation: 30
Well if you have located them just change eip to pushad/push eax... decrypt code and dump it =)
I've used hiew to scan for pattern in optimik and just redirected eip to those addreses, dumped them with ice-ext and fixed dump

or event better would be to code debug loader if there is more then 20 crypted code places and automate process of eip redirection/code dumping.

cheers
Reply With Quote