Use the ASPack 2.xx.txt
script from the Collection of x64dbg scripts.
Alternatively, I copied the content of this script file here:
//////////////////////////////////////////////////
// FileName : ASPack 2.xx.txt
// Comment : OEP Find For ASPack 2.xx
// Author : _pusher_
// Date : 2015-07-08
//////////////////////////////////////////////////
//start
msg "ASPack 2.xx OEP Finder"
msg "make sure you're at the entry point of the program before you continue"
pause
//clear breakpoints
bc
bphwc
//find oep jump
find cip,"617508B801000000C20C0068" //some pattern
log "found: {0}", $result
cmp $result,0
je error
//go there
bp $result
erun
bc
$dw = 4:[cip+c]
log "OEP: {0}", $dw
//Go to OEP
bp $dw
erun
//clear breakpoints
bc
cmt cip,"OEP"
TimeToDump:
msgyn "Successfully found OEP! Wanna use Scylla to dump the target?"
cmp 0,$result
je finishScript
scylla
finishScript:
//finish script
ret
error:
msg "didn't find oep jump"
ret
so
- you may copy/paste/save it in your favorite editor for loading it later, or
- copy/paste it directly to the Script tab of the x64dbg.
Instructions in detail:
Supposing you have
- a freshly loaded / reloaded ASPacked debugee, and
- the freshly loaded / pasted / reloaded the above script (you may see it in the Script tab).
Then
- Press F9 key - only once! - to run debugee up to its entry point.
- In the CPU tab check if you see the "EntryPoint" comment of the current instruction.
- Switch to the Script tab.
- Press space bar to run the script. The first message box appears.
- Click OK. The second message box appears.
- Click OK. The script is now paused. Press space bar to continue it.
- The message box with the message "Successfully found OEP! Wanna use Scylla to dump the target?" appears.
- Press "No" for now. (Later you may repeat this procedure and press "Yes".)
- The message box "Script finished!" Appears. Click OK.
The script performed the unpacking code of your ASPacked debugee and stopped at the first instruction (OEP in the comment means "Original Entry Point") already in-memory unpacked code.
Now you may analyze your already unpacked debugee.
F9
option.