SFX Method
The "SFX" method takes advantage of the OEP search function that comes with Ollydbg. You can choose to stop the program directly at the OEP found by the OD. At this time, the decompression process of the shell is completed, and you can directly dump the program.
要点¶
- Set OD, ignore all exceptions, that is, check the exception tab
- Switch to the SFX tab and select "Byte mode to track the actual entry (very slow)", OK
- Reload the program (if "Block code?" is selected, "No", OD directly reaches OEP)
example¶
The sample program can be downloaded here: 6_sfx.zip
First we check all ignore exceptions in the menu Options -> Debug Settings -> Exceptions tab.
Then switch to the SFX tab and click on "Byte mode to track the real entrance (very slow)"
Overloading the program, the program has stopped at the code entry point, and there is no need to re-analyze the OEP.
本页面的全部内容在 CC BY-NC-SA 4.0 协议之条款下提供，附加条款亦可能应用。