/////////////////////////////////////////////////////////////

// this script does a cruicial job, it finds all the correct API's corresponding 

// to the HIGHMEM calls. like i said before, the log-HIGHMEM-calls-BIN.txt 

// file will contain all the highmem call address ready to be BINARY-PASTED 

// in olly (just a little fix needed as mentioned above) 

//

// to use this script what you need to do is to know 

//

// 1. where to binary paste all the values from log-HIGHMEM-calls-BIN.txt 

// 2. the address where the script should put hardware bp and log the eax values 

//

// the first job is easy, normaly with the targets i worked ADATA section 

// contained all places you need , filled up all with zero. but u can chose any 

// non-destructive place to put them, as u want. just set the address to 

// the variable binary_paste in the script 

//

// the second job is a little tough, u gotta find the right addr where to set the 

// hardware bp ... okey, follow the instructions 

//

// load the app 

// F9 once ... now you r in ASPR code 

//

// binary search for binary search of : 8945FCA1??????008B008B15??????008B1233028B15??????002B02 

// you will land in some place like this : 

//

// D73409 MOV DWORD PTR SS:[EBP-4],EAX 

// D7340C MOV EAX,DWORD PTR DS:[D77824] 

// D73411 MOV EAX,DWORD PTR DS:[EAX] 

// D73413 MOV EDX,DWORD PTR DS:[D77824] 

// D73419 MOV EDX,DWORD PTR DS:[EDX] 

// D7341B XOR EAX,DWORD PTR DS:[EDX] 

// D7341D MOV EDX,DWORD PTR DS:[D77680] 

// D73423 SUB EAX,DWORD PTR DS:[EDX] 

//

// so, D73409 will be addr_hwbp in the script 

/////////////////////////////////////////////////////////////

/*

********************

     nick_name

 TEAM RESSURRECTiON

********************

*/





/*€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€*/

/*€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€*/



DEFINE_BEFORE_EXECUTION:



//mov addr_hwbp,00D950A7

//mov addr_hwbp,00EF4376

mov binary_paste,491000

mov addr_hwbp,00A850A7

												

/*€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€*/

/*€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€*/



SCRIPT_START:



mov path1,".\log-RESOLVE calls.txt"

mov path2,".\log-RESOLVE calls-BIN.txt"





mov manual,0



msgyn "MANUAL process ??"

cmp $RESULT,1

jne ANALYZE_CALLS

mov manual,1



ANALYZE_CALLS:

	

		lc

		bphws addr_hwbp,"x"





LOOP:



		exec

			pushad

			pushfd

		ende

		

		mov save_ebp,ebp

		mov save_esp,esp



		cmp manual,1

		je LBL

		mov eip,[binary_paste]	

		mov call_addr,[binary_paste]

		jmp COMMON





//.......................................[MANUAL PROCESS]		



LBL:

		ask "set EIP :-"

		cmp $RESULT,"`"

		je END

		cmp $RESULT,0

		jbe LBL



		mov eip, $RESULT

		mov call_addr,$RESULT



//.......................................



COMMON:

		run

		cmp eip,addr_hwbp

		je LOG

		jmp ERR



LOG:

		mov tmp, esp

		add tmp,20

		mov tmp2,[tmp]

		gn eax

		eval "{tmp2} :: {eax}={$RESULT}"

		log $RESULT, ""

		wrta path1, $RESULT

		wrta path1, "\r\n"



		rev tmp2

		

		wrta path2, $RESULT

		wrta path2, " "



		mov tmp_eax, eax

		rev tmp_eax

		

		wrta path2, $RESULT

		wrta path2, "\r\n"

		

		add binary_paste,4

		

		mov ebp,save_ebp

		mov esp,save_esp

		

		exec

			popfd

			popad

		ende



		cmp manual,1

		je LOOP	//................................jump back for another input [MANUAL]

				

		cmp [binary_paste],00000000

		jne LOOP //...............................jump when 481000 place dont have anymore inputs [AUTOMATIC]

		

		jmp END



ERR:

		mov tempo,[binary_paste]

		log tempo

		eval "{tempo} : EIP does'nt match with HWBP-EIP"

		msg $RESULT

		

		mov ebp, save_ebp

		mov esp, save_esp

		exec

			popfd

			popad

		ende



END:

		bphwc addr_hwbp

		ret