svkp

[orfei]

Is possible in hand (or script) with olly. I do decryption several times before long time.
Basicly in manual mode (and as i remember):
1. Break on OEP.
2. Find where is encrypted code block/s by comparing svkp begin marker.
3. Set new origin on start code block. Step several times to run over decryption routine.
You will see how below code is decrypted (and looks like x86 code).
4. Asemble start/end of crypted code block with jmp (to avoid crypt again and to make good code for dumping).
5. Do above procedure for all crypted blocks.
6. Return origin to OEP and dump.
now is time for imp reconstruction