If u have any documentation on this question post me pleas

Reply

Unpack ASPack. >>>>>>>

how fiend OEP
begin the code of ASPack
004A4000 60 PUSHAD
004A4001 E8 00000000 CALL HC.004A4006

----?
push key F7 or F8 trace
or in Olly after PUSHAD, dump the ESI register and set Hardware breakpoint on Dword push F9
---->
end the code ASPack code:

004A4197 61 POPAD
007063BF C3 RETN

this RET code, show where our OEP.
Make memory dump to disk... it's all... nearly
use PEtools or imprec16 for restore programm import table

Reply