//////////////////////////////////////////////////////////

// FileName    :  DebugActiveProcess.osc

// Comment     :  Armadillo V4.X CopyMem-II DebugActiveProcess

// Environment :  WinXP SP2,OllyDbg V1.10,OllyScript V0.92

// Author      :  fly

// WebSite     :  http://www.unpack.cn

// Date        :  2005-11-03 11:30

//////////////////////////////////////////////////////////

#inc "Get.eXe.PE.Information.osc"

#log

dbh





MSGYN "Plz Clear All BreakPoints  And  Set Debugging Option Ignore All Excepions Options  !"

cmp $RESULT, 0

je TryAgain





/*

0012DB94   007590FC  /CALL DebugActiveProcess From 007590F6

0012DB98   00000BD0  \ProcessId = BD

*/



var temp

var DebugActiveProcess





gpa "DebugActiveProcess", "KERNEL32.dll"

cmp $RESULT, 0

je Only Win2K/XP

mov DebugActiveProcess, $RESULT



eob DebugActiveProcess

bp DebugActiveProcess

esto

GoOn0:

esto



DebugActiveProcess:

cmp eip,DebugActiveProcess

jne GoOn0

bc DebugActiveProcess

mov temp,esp

add temp,4

mov temp,[temp]



log EP

mov EP,[EP]

//and EP,FFFF

log EP





eval " Plz Run OllyDBG Attach [ProcessId= {temp}] Child Process  And  Run Armadillo.fiXed.IT.osc  And  Modified EP Code={EP}  !   "

MSG $RESULT

ret





//GameOver！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！





Only Win2K/XP:

MSG "Error! This Script only Run on the Win2K/WinXP !   "

ret



TryAgain:

MSG " Plz  Try  Again   !   "

ret