有时间的朋友帮忙给测试一下吧!
Asprotect2.3 Build4.26 Find OEP

代码:
/* ///////////////////////////////////////////////////// Auther  : Linex   version : v1.01 Test Environment : OllyDbg 1.1                    ODBGScript 1.47 under WINXP or WIN2003 ///////////////////////////////////////////////////// */ var tmp1             var tmp2             var tmp3             var tmp4             var tmp5             var tmp6             var tmp7             var tmp8             var tmp9             var imgbase var 1stsecbase var 1stsecsize var dllimgbase var count var transit1 var stolen var stolenstart var stolencmt var stolenadds checkversion: cmp  $VERSION,"1.47" jae  int3 msg  "ODBGScript version need 1.47 or higher!" ret int3: msgyn "Setting:Ignore all exceptions except 'INT 3 breaks',Continue?(请设置忽略除INT3外的所有异常!继续吗?)" cmp $RESULT,1 je  start           ret start: dbh BPHWCALL                //clear hardware breakpoint GMI eip, MODULEBASE     //get imagebase mov imgbase, $RESULT log imgbase mov tmp1, imgbase add tmp1, 3C              //40003C mov tmp1, [tmp1] add tmp1, imgbase         //tmp1=signature VA add tmp1, f8              //1st section log tmp1 add tmp1, 8 mov 1stsecsize, [tmp1] log 1stsecsize add tmp1, 4 mov 1stsecbase, [tmp1] add 1stsecbase, imgbase log 1stsecbase gpa "GetSystemTime", "kernel32.dll" bp $RESULT run bc $RESULT rtr sti GMEMI eip, MEMORYOWNER mov dllimgbase, $RESULT cmp dllimgbase, 0 je error log dllimgbase alloc 2000 mov stolen,$RESULT log stolen mov stolenstart,stolen find dllimgbase, #3135310D0A# mov tmp1, $RESULT cmp tmp1, 0 je wrongver mov tmp1, dllimgbase add tmp1, 010e00 find tmp1, #B8050000005b5dc20400#      //MOV EAX,5 POP EBX POP EBP RETN 4 mov tmp4, $RESULT cmp tmp4, 0 je error31 bphws tmp4 ,"x" find tmp1, #8B45F08B55F43B55FC#          //remove anti mov tmp5, $RESULT cmp tmp5, 0 je wrongver add tmp5,0e bp tmp5    find tmp1, #83c4245f5e5bc3#         //ADD ESP,24 POP EDI POP ESI POP EBX mov tmp6, $RESULT cmp tmp6, 0 je wrongver sub tmp6,5 bphws tmp6 ,"x"  find tmp1, #83c3088b0385c075df33c0#   //ADD EBX,8  MOV EAX,DWORD PTR DS:[EBX] TEST EAX,EAX mov tmp7, $RESULT cmp tmp7, 0 je error31 add tmp7,9 bp tmp7  eob lab3 eoe lab3 run lab3: cmp eip, tmp4 je lab4 cmp eip,tmp5 je lab31 cmp eip,tmp7 je lab6 cmp eip,tmp6 je lab62 eob lab3 eoe lab3 run lab31: cmp !zf,1 je lab32 mov !zf,1 lab32: bc tmp5 run lab4: mov [stolen],ebx add stolen,4 run lab6: bc tmp7 bphwc tmp4 cob  coe lab61: run cmp eip,tmp6 je lab5 jmp lab61 lab62: bc tmp7 bphwc tmp4 cob  coe bphwc tmp6 sti rtr sti bprm 1stsecbase, 1stsecsize run bpmc msg "OEP found, no stolen code at the OEP!" pause ret lab5: bphwc tmp6 sti rtr sti oep: msg "Stolen Oep Find !Press Ok to add cmtments" cmtstolen: mov stolencmt,[stolenstart] cmp stolencmt,0 je end mov tmp8,stolencmt add tmp8,1 mov stolenadds,[tmp8] mov stolenadds,stolenadds+stolencmt+5 eval "{stolencmt}" cmt stolenadds, $RESULT add stolenstart,4 jmp cmtstolen end: msg "cmtments  are added!" ret error: msg "Error!" pause jmp end wrongver: msg "Unsupported Aspr version or it is not packed with Aspr?" pause jmp end error31: msg "Error 31!" pause jmp end notfound: msg "Not found" pause end: ret


thank:
Volx,shoooo及帮助过我,支持我的朋友们!