Questions tagged [oep]
The oep tag has no usage guidance.
3 questions
5
votes
2
answers
3k
views
Why to dump precisely at OEP while manual unpacking?
What is the exact reason for dumping a process when the Program Counter is at OEP? I haven't found a decent answer.
This Link says:
In order to identify the IAT structure, Import Reconstructor ...
- 218
2
votes
2
answers
4k
views
how to find OEP when packer runs from original code section?
i think its pretty easy to find the OEP when the packer runs from a different section. there are many tricks, such as running a trace until you hit the codesection, or breaking on writes to the IAT, ...
- 21
3
votes
1
answer
2k
views
What are indicators for hitting the OEP?
for me, it is sometimes difficult to decide if I have hit the OEP when I try to manuelly unpack it.
Especially in cases, when it does not begin with the standard function prologue.
For example:
I ...
- 1,541