/*Acprotect unpacker V1.2

To find the oep and fix the IAT

  by zpunpack

*/

BPHWCALL

bpmc









var eipaddr1 

var esiadd   

var ebxadd   

var cbase

var csize

var imgbase 

var iatrva

var add1

var count

var bp1

var foepaddr1

var fopeaddr2

GMI eip, MODULEBASE 

cmp $RESULT,0

je lblabort

mov imgbase,$RESULT

gmi eip,CODEBASE     //Get code base

cmp $RESULT,0

je lblabort

mov cbase,$RESULT

mov cbase,$RESULT

gmemi cbase,MEMORYsize

cmp $RESULT,0 

je lblabort

mov csize,$RESULT

gpa "GetModuleHandleA","kernel32.dll"

cmp $RESULT,0

je lblabort

mov add1,$RESULT

bprm add1,ff 

esto 

bpmc

rtu 

findop eip,#F3AA# //rep stos byte ptr es:[edi]

cmp $RESULT,0

je lblabort   

repl $RESULT,#F3AA#,#9090#,2 

bp $RESULT

run

bc $RESULT

sto 

sto 

sto

bprm add1,ff

esto

bpmc

rtu

mov eipaddr1,eip

mov eipaddr1,eipaddr1-30

mov esiadd,esi+0c 

mov ebxadd,ebx-imgbase

mov [esiadd],ebxadd

mov iatrva,esi-imgbase

findop eipaddr1,#83660c00# //and dword ptr ds:[esi+C],0

cmp $RESULT,0

je lblabort

repl $RESULT,#83660C00#,#90909090#,4

find eipaddr1,#2BC08803# //find:sub eax,eax mov byte ptr ds:[ebx]

cmp $RESULT,0

je lblabort

repl $RESULT,#2BC08803#,#90909090#,4

find eipaddr1,#2BC08803#

cmp $RESULT,0

je lblabort

repl $RESULT,#2BC08803#,#90909090#,4

find eipaddr1,#80BD16564100007457# //Magic Jump

je lblabort

repl $RESULT,#80BD16564100007457#,#80BD1656410000eb57#,9 //jmp

find eipaddr1,#8DBD????400033c0#

cmp $RESULT,0

je lblabort

bp $RESULT

esto

bc $RESULT

bpmc





MSGYN "Does it has code replace or Obfuscation ?"

cmp $RESULT,"1"

je codereplace





bprm cbase,csize

esto

allend:

cmt eip,"OEP found!please dumped it!"

eval "OEP found!please dump it ,Reference IAT RVA:{iatrva}!"

BPHWCALL 

bpmc 

msg $RESULT

ret

codereplace:

find eipaddr1,#6161E8????????C3#

cmp $RESULT,0

je lblabort

bp $RESULT

esto

bpmc

sto

sto

sto

sto

ask "Please Input the FOEP address:"

cmp $RESULT,0 

je cancel

mov foepaddr1,$RESULT

cmt eip,"please wait a minute ! ...."

msg "please wait a minute ! ...."

bprm $RESULT, FF

run

bpmc

findnext:

mov eipaddr1,eip

find eipaddr1,#0f85??ffffff#

cmp $RESULT,0

je cont2

mov eipaddr1,$RESULT+6

mov foepaddr2,foepaddr1-$RESULT

cmp foepaddr2,50 //设code replace只有50h字节

ja cont2

bp eipaddr1 //found code :jnz XXXX

esto

bc eipaddr1

bpmc

msg "please press F7 until FOEP is Found ,Then continue the script !"

pause

MSGYN "Try to patch code ?"

cmp $RESULT,"1"

je  patchcode

ret



patchcode:

eoe err1 //may be jmp short error !

eob err1 

//sti

var redi

var resi

var rebp

var resp

var rebp

var rebx

var redx

var recx

var reax

var rr1

var rr2

var rr3

var newcode //新代码地址

var code1

mov newcode,1013500

var fOPCODE1

var fopcode1l //指令长度

var faddr

var f1

var f2

var f3

var f5 //找不到次数



mov faddr,cbase

fm1:

inc f5

cmp f5,100

ja noerea

find faddr,#000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000#

mov f1,$RESULT

cmp f1,0

je noerea

mov newcode,f1

mov faddr,faddr+3c

fm2:

find faddr,#000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000#

mov f2,$RESULT

cmp f2,0

je noerea

mov f3,f2-f1

cmp f3,14

ja fm1

mov newcode,newcode+a

mov eipaddr1,eip //到了FOEP

opcode eipaddr1

mov fopcode1,$RESULT_1 //保存opcode

mov fopcode1l,$RESULT_2

mov resp,esp

mov redi,[resp]

mov resi,[resp+4]

mov rebp,[resp+8]

//mov resp,[resp+c]

mov rebp,[resp+10]

mov rebx,[resp+14]

mov redx,[resp+18]

mov recx,[resp+20]

mov reax,[resp+24]

mov rr1,[resp+28]

mov rr2,[resp+2c]

mov rr3,[resp+30]

eval "jmp {newcode}"

mov code1,$RESULT

asm eipaddr1,code1

eval "mov eax,{redi}"

mov code1,$RESULT

asm newcode,code1

mov newcode,newcode+$RESULT 

asm newcode,"mov dword ptr ss:[esp],eax"

mov newcode,newcode+$RESULT

eval "mov eax,{resi}"

mov code1,$RESULT

asm newcode,code1

mov newcode,newcode+$RESULT 

asm newcode,"mov dword ptr ss:[esp+4],eax"

mov newcode,newcode+$RESULT

eval "mov eax,{rebp}"

mov code1,$RESULT

asm newcode,code1

mov newcode,newcode+$RESULT 

asm newcode,"mov dword ptr ss:[esp+8],eax"

mov newcode,newcode+$RESULT

eval "mov eax,{rebx}"

mov code1,$RESULT

asm newcode,code1

mov newcode,newcode+$RESULT 

asm newcode,"mov dword ptr ss:[esp+10],eax"

mov newcode,newcode+$RESULT

eval "mov eax,{redx}"

mov code1,$RESULT

asm newcode,code1

mov newcode,newcode+$RESULT 

asm newcode,"mov dword ptr ss:[esp+14],eax"

mov newcode,newcode+$RESULT

eval "mov eax,{recx}"

mov code1,$RESULT

asm newcode,code1

mov newcode,newcode+$RESULT 

asm newcode,"mov dword ptr ss:[esp+18],eax"

mov newcode,newcode+$RESULT

eval "mov eax,{reax}"

mov code1,$RESULT

asm newcode,code1

mov newcode,newcode+$RESULT 

asm newcode,"mov dword ptr ss:[esp+1c],eax"

mov newcode,newcode+$RESULT

eval "mov eax,{rr1}"

mov code1,$RESULT

asm newcode,code1

mov newcode,newcode+$RESULT 

asm newcode,"mov dword ptr ss:[esp+20],eax"

mov newcode,newcode+$RESULT

eval "mov eax,{rr2}"

mov code1,$RESULT

asm newcode,code1

mov newcode,newcode+$RESULT 

asm newcode,"mov dword ptr ss:[esp+24],eax"

mov newcode,newcode+$RESULT

eval "mov eax,{rr3}"

mov code1,$RESULT

asm newcode,code1

mov newcode,newcode+$RESULT 

asm newcode,"mov dword ptr ss:[esp+28],eax"

mov newcode,newcode+$RESULT

cmt newcode,fopcode1

asm newcode,fopcode1

mov newcode,newcode+fopcode1l

mov fopcode1l,fopcode1l+eipaddr1

eval "jmp {fopcode1l}"

mov code1,$RESULT

asm newcode,code1

msg "Get Foep ! Dumped it and write down all data in the strack !"

ret //到了Foep

cont2:

sto

jmp findnext



err1: 

msg "may be jmp short XXXX error !,fix code to jmp XXXX by yourself !"

ret

















lblabort:

msg "Script aborted !"

ret



cancel:

msg "has not anything Input !" 

bprm cbase,csize

esto

jmp allend



noerea:

No memory to patch code !

ret