/*
//////////////////////////////////////////////////
	UltraProtect 1.x/ACprotect 1.22 OEP Finder(For VB only!)
		( for 'oep obfuscation and anti loader' mode)
	Author:	loveboom
	Email : bmd2chen@tom.com
	OS    : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
	Date  : 2004-3-26
	Config: Hide ollydbg(IsDebuggerPresent),Exceptions:uncheck "INT3 breaks".
	Note  : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/

var addr
var paddr   //push address
var Aaddr  // asm Address
var cbase
gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
eob lbl1
run

lbl1:
findop eip,#C3#
eob lbl2
bp $RESULT
esto


lbl2:
bc $RESULT
sto
mov addr,esp
eob lbl3
bphws addr,"r"
run

lbl3:
bphwc addr
eob lbl4
bprm cbase,FF
run

lbl4:
bpmc
mov addr,esp
add addr,4
mov paddr,[addr]
mov Aaddr,eip
add Aaddr,7
mov [Aaddr],paddr
sub Aaddr,1
mov [Aaddr],#68#
mov addr,Aaddr
cmt addr,"OEP is Found"
add addr,5
cmt addr,"Here patch code 'call EIP',and then you can dumped it!"
msg "Script by loveboom[DFCG],Thank you for using my script!"
ret