find-oep

Smart trace-based OEP finder for packed/protected PE executables. Walks through unpacking stages using intelligent stepping, anti-debug evasion, and heuristic OEP detection. Once the OEP is found, captures a state snapshot for downstream use (PE reconstruction, analysis, etc.).

Instructions

1. Gather input and assess target

Ask the user (via AskUserQuestion) for any information not already provided:

• Target path — absolute path to the packed PE on disk
• x64dbg path — absolute path to x64dbg/x32dbg (if not already known)
• Bitness — 64-bit or 32-bit (default: 64)

Determine the CIP register name: rip for 64-bit, eip for 32-bit. Determine the stack pointer register: rsp for 64-bit, esp for 32-bit. Determine the debugger variant: x64dbg.exe for 64-bit, x32dbg.exe for 32-bit.

2. Launch the debugger and load the target