//The script 2, rereorganizes ARM chaotic IAT

//comes from the Ricardo Narvaja 207 courses, makes the revision slightly



var it

var it2

var x

var y

var pit

var pit2

var dll

var dll1

var pitt

var it1_end

var base

var savecode



//Needs to establish content

mov it, 00F32B38 //chaotic IAT first site

mov it1_end, 00F338C0//chaotic at the end of IAT site

mov it2,00F32B38//waits depositing to reorganize after the IAT first site



//

mov savecode, [eip]//preserved current eip directional content

mov [eip], # EBFE #//jmp eip, because reorganizes IAT quite to be slow, uses in treating can renovate the contact surface, guards against the contact surface to play dead 



gmi eip, MODULEBASE//takes the master file base address

log $RESULT

mov base, $RESULT



INICIO:              //Initialization

mov pitt, it// the pitt direction is processing the api address presently, its front all api is processed finished

                     //pitt each turn to increase 4, after it is equal to the chaotic at the end of IAT site, then this script movement finished

COMIENZO:

add pit, it

add pit2, it2



SEGUIMOS: //WE FOLLOWED new? ¬ the link starts



add pit, x

add pit2, y

cmp pit, it1_end

log pit

log x

log y

je FIN

cmp pit, it1_end

ja FIN



gmi [pit], MODULEBASE//takes this api correspondence module base address

log $RESULT

log dll1

cmp pit, pitt

jne NOPRIMERA



cmp $RESULT, base//this address place api, whether has been processed, if has been processed then its base address primarily document base address base

je PIRULO//processes has jumped changes to next round



cmp $RESULT, dll1//these two resemble uselessly, if first 1 dll has been processed, here simply cannot jump transfers

je IGUALES

mov dll, $RESULT

log dll

jmp NOPRIMERA



NOPRIMERA:       //not first

cmp $RESULT, dll

jne NOGUARDO



//This address place api, whether has been processed, if has been processed then its base address

//for example, after processing this 005CA000 place content is 005CADD0, takes its corresponding module base address for primarily document base address base

cmp $RESULT, base

je NOGUARDO//processes has jumped changes to next round

mov [pit2],[pit]//chaotic IAT will preserve api to move in the new address? ¬ the address depositing indicator aims at new address

mov [pit], pit2

mov x, 4

mov y, 4

jmp FINLOOP



NOGUARDO:    //I do not keep

mov x, 4

mov y, 0

jmp FINLOOP



FINLOOP:      //1 turn of small? ¬ the link finished

log pit

log pit2

jmp SEGUIMOS





IGUALES: //What doesn'tEQUAL have to use?

mov x, 4

mov y, 0

jmp FINLOOP





FIN:              //1 dll processing finished

mov [pit2], 0

mov dll1, dll

sto//guards against the contact surface to play dead, to renovate od contact surface

xor x, x

xor y, y

add pitt, 4

cmp dll, base

je SALTO



add pit2,4



SALTO:          //JUMP

mov pit, pitt

cmp pitt, it1_end

je FINISH

cmp pitt, it1_end

ja FINISH

log pit

log pit2

log pitt

jmp SEGUIMOS



FINISH:            //All dll has been processed all finished

mov [eip], savecode//preserved current eip directional content

MSG “TERMINAMOS”

log pitt

ret

PIRULO:         //This address api has been processed in dll, therefore jumps over this address, makes a fresh start turn of

add pitt, 4

jmp NOPRIMERA