Archive for the ‘Chal2. Easy Unpack Challenge’ Category


Load Easy_UnpackMe to OllyDBG, scroll down to find JMP instruction:

Krchal21

Figure 1

Set BP at 0040A1FB - E9 506FFFFF     jmp     Easy_Unp.00401150, press F9 to run. Stop at BP, press F8 to trace over, we get the OEP is 0x00401150:

Krchal22

Figure 2

Anotherway to find OEP is to set BP at GetVersion API:

Krchal23

Figure 3

End.

Advertisements