/*
////////////////////////////////////////////////////////////////////// ///////////////////////
// PESpin v0.7 OEP finder
// Author: hacnho/VCT2k4
// Email : hacnho@hotmail.com
// Website: http://nhandan.info/hacnho ("http://nhandan.info/hacnho")
// OS : WinXP Pro, OllyDbg 1.10 Final, OllyScript v0.85
//You can download my unpackme at http://nhandan.info/hacnho/tuts/unpackme_PESpin_07.zip ("http://nhandan.info/hacnho/tuts/unpackme_PESpin_07.zip") for //test this script.
//Note: Not work with Delphi (OllyDBG will be crash when loading).
////////////////////////////////////////////////////////////////////// ////////////////////////
*/
MSG "Do not clear memory breakpoint! Thanx for using my script!"
var temp
sti
sti
findop eip, #61E9#
bphws esp,"r"
mov temp,esp
run
eob Break1

Break1:
run
esto
esto
esto
esto
eob Break2

Break2:
esto
esto
esto
esto
esto
eob exit

jmp exit
exit:
log eip
cmt eip, "Script by hacnho/VCT2k4"
MSG "Please press Shift+F9 one times! When you trace to a jump (E9 XXXXXXXX). Press Enter, you'll still on OEP! Ctrl+A for analyze."
ret

I has one,and i wll post it,

Tried on PeSpin v0.7 -> endless loop
Check it yourself:

h**p://cyanid.de/rn/todo/simpleapi[pespin.v.0.7].zip

Your packed file is simple for find OEP. Because i am busy now, so i can not write a script for find OEP. But i can show the way for find OEP.

- 1. In Olly Options, choose SFX tab, check radio button " Stop at entry of selt-extractor"!

- 2. Load simpleapiP.exe into OllyDBG!

- 3. Press Shif+F9. A dialog will appear. Choose "No"!

- 4. Press F8 two times!

- 5. We now need to get to the address in the ESP register and set a hardware breakpoint.
click on the Hex dump window and do Ctrl+G and type in the value from the ESP register then enter.
you will end up here. Highlite the first two values in dumpscreen,
(these values are from the EDI register and is how we will find the OEP.)
right click on the values and select Breakpoint -> Hardware, on Access -> Word.

- 6. Press F9 to run.

- 7. Press Shift+F9 7 times! You will still here:




- 8. Just press Enter! You will still on OEP.



Use PEiD detect : Borland C++ 1999

Regards

hacnho

For PESpin.exe, simpleapi[pespin.v.0.7] and other progs with "jmp..."
-------------------------
var temp
var l
var wr_addr

mov l, eip
shr l, 8
shl l,8
eoe lab1
eob lab1
esto

lab1:
cmp [eip], FFFFFFFF
log [eip]
je lab2
esto

lab2:
mov wr_addr, l
add wr_addr, 99a
mov [wr_addr], #807FFF007413807FFFE975E766C747FFFF258957018902EB03890290595FC3#
mov wr_addr, l
add wr_addr, 0f69
mov [wr_addr], #9090909090#
find l, #041FEBFB7C8304240CC3E861# // signature of "start Stolen code "
mov l, $RESULT
add l, 0c
log l
bp l
eob lab3
eoe lab3
esto

lab3:
mov temp, eip
sub temp,4
mov temp, [temp]
cmp temp, 61e8c30c
je loc_end
esto

loc_end:
bc l
msg "Stolen bytes here and you may set EP here "
ret
-------------------------

If file use PESpin_iat you must add in dump function for redirect and recombine Orig_iat on PESpin_iat. And set EP on start of this function.