Thread: svkp
View Single Post
  #4  
Old 06-05-2011, 18:34
orfei orfei is offline
Family
 
Join Date: Aug 2010
Posts: 138
Rept. Given: 33
Rept. Rcvd 77 Times in 48 Posts
Thanks Given: 15
Thanks Rcvd at 117 Times in 53 Posts
orfei Reputation: 77
Is possible in hand (or script) with olly. I do decryption several times before long time.
Basicly in manual mode (and as i remember):
1. Break on OEP.
2. Find where is encrypted code block/s by comparing svkp begin marker.
3. Set new origin on start code block. Step several times to run over decryption routine.
You will see how below code is decrypted (and looks like x86 code).
4. Asemble start/end of crypted code block with jmp (to avoid crypt again and to make good code for dumping).
5. Do above procedure for all crypted blocks.
6. Return origin to OEP and dump.
now is time for imp reconstruction
Reply With Quote