dbh //隐藏调试器

///支持旧版，功能不全

#log

var cbase

var addr1

gmi eip, CODEBASE

mov cbase, $RESULT 



var k

var imgbase

var espsave

mov espsave,esp

sub espsave,4



gmi eip,MODULEBASE //模块基地址400000

mov imgbase,$RESULT

mov k,imgbase

add k,3C //40003C

mov k,[k]

add k,imgbase 

add k,f8 //第一区段名

log k

add k,8 //地址加8字节的偏移就是区段大小 

mov k,[k] //401000处第一区段大小

log k 



var addr2

mov addr2,ebp //保存ebp=12fff0判断后面是否到达OEP 或 FOEP



var addr3

sub ebp,30 //实际取ebp=12ffc0判断后面是否到达OEP 或 FOEP

mov addr3,ebp

add ebp,30 //修改了寄存器值得还原



msg "除了内存异常,忽略所有异常,打上prosess32next和unhandleexcption补丁"

gpa "LoadLibraryA","kernel32.dll"

cmp $RESULT,0

je err

sti

var esptemp

mov esptemp,esp



var bp1

mov bp1,$RESULT

bp $RESULT

gpa "GetProcAddress","kernel32.dll"

cmp $RESULT,0

add $RESULT,5

var bp2

mov bp2,$RESULT

je err

bp $RESULT

esto

var temp

mov temp,esp

add temp,4

mov temp,[temp]



var reps // repl code判断变量

mov reps,0



lp:

esto

cmp eip,bp1

je ddd

cmp eip,bp2

je ddd

jmp rep



ddd:

var temp2

mov temp2,esp

add temp2,4

mov temp2,[temp2]

cmp temp2,temp

jne abcd

mov temp,temp2

jmp lp





abcd:

bc bp1

bc bp2



rtu



 //开始处理输入表了

msg "IAT"

find eip,#3B85#

cmp $RESULT,0 

je ULTRAPROTECTOR





STARTIAT:



find eip,#7F??#

cmp $RESULT,0

je err

mov [$RESULT],#EB# 

log $RESULT



find eip,#3B85#

cmp $RESULT,0

je err

add $RESULT,6

mov [$RESULT],#EB# //messagebox比较



find eip,#8D85????4000#

cmp $RESULT,0

je err

mov [$RESULT],#909090909090#



find eip,#8D85????4000#

cmp $RESULT,0

je cool

mov [$RESULT],#909090909090#

cool:



find eip,#83C614#

cmp $RESULT,0

je err

add $RESULT,E

go $RESULT

msg "IAT fix end"



var espvar



//下面开始处理repl code

cmp reps,1 //如果确认没有Replace Code,则直接跳到取OEP位置代码处

jmp label69

msg "存在repl code"



label69:

//jmp bibi  二哥方法

pushad:

var temp

mov temp,[eip]

and temp,FF

cmp temp,60 //pushad

je popad

find eip,#60#

go $RESULT

jmp pushad

ret



popad:

sto

mov espvar,esp





bphws espvar,"r"

esto

mov temp,[eip]

and temp,FF

cmp temp,61 //popad

je call

ret



call:



bphwc espvar

sto

lps:

var temp

mov temp,[eip]

and temp,FF

cmp temp,E8 //call;ret

jne err

sto

sto

mov espvar,esp

add espvar,C

bphws espsave,"r"

ret

bstp1:

esto

step1:

mov temp,[eip]

and temp,FF

cmp temp,53   //push ebx

jne bstp1



bstp2:

esto

step2:

mov temp,[eip]

and temp,FF

cmp temp,60   //pushad

jne bstp2

bstp3:

run

bphwc espsave

ret

esto

step3:

mov temp,[eip]

and temp,FF

cmp temp,EB   //EB01

jne bstp3

bphwc espsave

sto

sto

ret

esto

bphwc espvar

gpa "CreateToolhelp32Snapshot","kernel32.dll"

var CTS

cmp $RESULT,0

je err

mov CTS,$RESULT

find CTS,#C20800#

cmp $RESULT,0

je err

mov CTS,$RESULT

bp CTS

bphws esptemp,"r"

esto

bphwc esptemp

cmp eip,CTS

//je CTS

bc CTS

msg "如果有stolen oep 则dump,否则继续脚本"

ask "是否有replace code"

cmp $RESULT,0

jne label333

pause

jmp bibi

ret



CTS:

esto

bc CTS

rtu

bphws esptemp,"r"

esto

bphwc esptemp

msg "注意上面的stolen code,如果要带发则终止脚本"

jmp bibi



//以下是ESP定律

cools:

esto

var temp

mov temp,[eip]

and temp,FFFF

cmp temp,1EB //jmp

jne cools

sto

mov temp,[eip]

and temp,FFFF

cmp temp,25FF //jmp

jne cools

bphwc espvar

sto



ret

lok:



ret



bibi:

bphwc espvar

bprm cbase, k //然后就是跳OEP或FOEP了,内存镜像断点



esto //Shift+F9





label444: //这里我用一个条件判断OEP OR FOEP，有些AC壳到OEP或FOEP时候EBP一般是12fff0,或是



//12ffc0,401000处中断一般都是OEP。



cmp eip,401000 //汇编比较常用



je label333



cmp ebp,addr2 //12fff0一般没有抽代码 



je label333



cmp ebp,addr3 //12ffc0,抽代码常见



je label333



cmp ebp,12fff2 //12fff2,VB类



je label333



var addr4



add addr4,1



cmp addr4,70 //定义循环上限，如果Code段执行70行代码仍然无法发现OEP则认为死循环。



ja Sorry



esto



jmp label444 //循环直到条件成立，当然有些AC版本会跑飞。



label333:

cmt eip,"OEP"

bpmc

msg "如果要修复STOLEN CODE,记下最后区段地址继续"

pause

var cb

gmi eip,CODEBASE

cmp $RESULT,0

je err

mov cb,$RESULT

var sb

var ss

ask "stolen start"

cmp $RESULT,0

je end

mov sb,$RESULT

ask "stolen size"

cmp $RESULT,0

je end

mov ss,$RESULT

add ss,sb

var temp1

var temp



loa:

find cb,#E8# //call

cmp $RESULT,0

je end

mov cb,$RESULT

add cb,1

cmp cb,468000 // 代码段结束地址,自己修改

ja end

mov temp,cb

mov temp,[temp]

add temp,4

add temp,cb

cmp temp,sb

jb DNS

cmp ss,temp

jb DNS

add temp,2

mov temp,[temp]

mov temp,[temp]

mov temp1,[temp]

sub cb,1

log cb

mov [cb],temp1

add cb,4

add temp,4

mov temp1,[temp]

var save

mov save,cb

add save,1

mov save,[save]

mov [cb],temp1

add cb,1

mov [cb],save

jmp loa



DNS:

add cb,1

jmp loa

ret



end:

msg "修复完毕"

ret



err:

msg "出错,可能版本不支持"

ret



Sorry:

Msg "估计脚本陷入死循环，提前结束。"

bpmc

ret



end: //INT1

coe

bprm 401000, k //内存镜像断点 //意外情况，没有Replace Code的程序，这时要跳FOEP了，得拦住

bc addr1 //清除GlobalAlloc断点

jmp label444



rep:

var temps

mov temps,[eip]

and temps,FFFF

cmp temps,1CD  //int1

je hosp

esto

hosp:

msg "repl code"

mov reps,1

jmp lp

ret



GOGOGO:

eob loopas

eoe loopas

esto





ULTRAPROTECTOR:

var temp

mov temp,ebx

bp bp2

loopas:

cmp temp,ebx

log temp

log ebx

jne abcool

mov temp,ebx

jmp GOGOGO





abcool:

bc bp2

cob loopas

coe loopas

rtu

jmp STARTIAT

ret