Morphine 2.7 Unpacker?

[y2k3]

Hi Are There Any ollyscript or any tutorial, any unpacker for morphine 2.7 and other versions?

Thanks...

[hosiminh]

PeID plugin:

_http://go.to/Hairy_Bits

[y2k3]

There is Morphine 2.7 gui but it is not working on my computer. How can i unpack :\

hosiminh, for your message, thanks...

But i want packer(s) for morphine 2.x versions.

Note : i wouldn't find any morphine unpacker another from 1.2 / 1.3 and they are on ollyscript site. Please Help Me. i am waiting You.

Thanks..

[TBD]

[warning] walking on thin ice

translation: keep only OD related topics - unpacking is not!

[y2k3]

OllyScript is an unpacker program or not? Why Everybody send unpacking script. Did You See Only Me? Okay. Thanks.!

[TBD]

OllyScript is not an unpacker, it is more like a macro recorder.

yes, it seems that OllyScript is used lately only as a tool for unpacking. from now on, all unpacking scripts will be deleted - use OllyScript site for unpacking script repository.

[KaGra]

http://biw.rult.at/vbb/upload/showthread.php?s=&threadid=1130


Morphine 2.7 unpacking tutor

[KaGra]

Morphine 2.7 unpacking tutor also in http://www.angelfire.com/indie/zong

[haggar]

Ignore all exceptions in Olly, then (you must have win XP) put "bp IsBadReadPtr" in cmdline, and run it. You will get message "Bad format..." click OK, you are now in kernel, return in user code, press Ctrl+F9 to rach RETN 0C (I think), execute it. You will land somewhere. Below is JMP EAX go to it , execute it and you are on OEP. The shortest tutorial on the world ;-)

Or paste this in your text:

// ExeStealth v3.04 and Morphine v2.7 - OEP finder script
//
// Works only on Windows XP (because of breakpoint on dll).
//
// ExeStealth first pack file with UPX (but that's optional)
// and then crypt it with Morphine wich uses IsBadReadPtr
// API to clear any breakpoints (that's the reason for that
// "Bad or unknown 32-bit ...").
//
// If there is something wrong with script please mail me
// at "dalmatinac_ipo@yahoo.com".
//
// written by haggar 29.03.2005
//


msg "Ignore all exceptions. If you get 'Bad or unknown format...' message just click OK. "
gpa "IsBadReadPtr","kernel32.dll"
bp $RESULT
run
bc eip
rtu
rtr
sti
findop eip,#FFE0# // Find JMP EAX that leads to OEP
bp $RESULT
run
bc eip
sti
find eip,#60BE????????8DBE????????# //Is it packed with UPX too?
cmp $RESULT,eip
jne OEP_found
sti
var x
mov x,esp
bphws x,"r"
run
bphwc x
sti
OEP_found:
an eip
cmt eip,"This is the OEP. Just dump and fix IAT!"
ret