por lo que cree un script para ODBGScript capas de encontrar:
JMP r32
Call r32
POP r32/POP r32 / RETN
El script es el siguiente:
Código
VAR ADDRESS VAR V_OPCODE ASK "Select option: JMP (1) - CALL (2) - POP/POP/RET (3)" CMP $RESULT,1 JE L_BEGIN_SEARCH_1 CMP $RESULT,2 JE L_BEGIN_SEARCH_2 CMP $RESULT,3 JE L_BEGIN_SEARCH_3 JMP L_EXIT L_BEGIN_SEARCH_1: FINDMEM #FFE?# L_SEARCH_JMP: TEST $RESULT,$RESULT JE L_EXIT MOV ADDRESS,$RESULT TEST ADDRESS,FF00FF00 JNE L_NEXT_SEARCH_JMP MOV V_OPCODE,$RESULT INC V_OPCODE MOV V_OPCODE,[V_OPCODE],1 CMP V_OPCODE,E7 JA L_NEXT_SEARCH_JMP GCI ADDRESS,COMMAND EVAL "ADDRESS:[00{ADDRESS}] - INSTRUCTION:[{$RESULT}]" LOG "",$RESULT L_NEXT_SEARCH_JMP: INC ADDRESS FINDMEM #FFE?#,ADDRESS JMP L_SEARCH_JMP L_BEGIN_SEARCH_2: FINDMEM #FFD?# L_SEARCH_CALL: TEST $RESULT,$RESULT JE L_EXIT MOV ADDRESS,$RESULT TEST ADDRESS,FF00FF00 JNE L_NEXT_SEARCH_CALL MOV V_OPCODE,$RESULT INC V_OPCODE MOV V_OPCODE,[V_OPCODE],1 CMP V_OPCODE,D7 JA L_NEXT_SEARCH_CALL GCI ADDRESS,COMMAND EVAL "ADDRESS:[00{ADDRESS}] - INSTRUCTION:[{$RESULT}]" LOG "",$RESULT L_NEXT_SEARCH_CALL: INC ADDRESS FINDMEM #FFD?#,ADDRESS JMP L_SEARCH_CALL L_BEGIN_SEARCH_3: FINDMEM #5?5?C3# L_SEARCH_POP_POP_RET: TEST $RESULT,$RESULT JE L_EXIT MOV ADDRESS,$RESULT TEST ADDRESS,FF00FF00 JNE L_NEXT_SEARCH_POP_POP_RET EVAL "ADDRESS:[00{ADDRESS}] - INSTRUCTION:[POP/POP/RET]" LOG "",$RESULT L_NEXT_SEARCH_POP_POP_RET: INC ADDRESS FINDMEM #5?5?C3#,ADDRESS JMP L_SEARCH_POP_POP_RET L_EXIT: RET
Saludos.