//////////////////////////////////////////////////////////// /// Themida&WinLicense.V1.9.1-V2.0.X.UnPacKScript.Public // /// By fxyang[CUG] // /// Version 0.2 // /// http://www.unpack.cn // /// 2009.01.17 // //////////////////////////////////////////////////////////// /*重写整个脚本,修复Bug 2008： 01.10 +对1.97版VirtualAlloc函数的定位，并实现识别1.97版本 01.13 +在脚本的开始部分实现对VB程序的识别 01.15 +对VB程序实行单独处理 01.20 +修改原脚本代码，保持对1.97的兼容 01.22 +完成 1.97&1.96 iat处理部分 01.23 +完成对程序编程语言识别，修复ASM程序对iat调用代码,1.96可能是1.97版。 03.07 修改VirtualAlloc重定位 03.07 +对壳插入90在E8之前的处理，即可以不用考验90问题。 05.20 修正脚本对修改VirtualAlloc重定位引起的错误。 05.20 +脚本对WinLicen&Themida1.99版支持 08.19 +增加对WinLicen&Themida2.0以上版本支持 08.20 修正获取api时机 08.20 修正脚本破坏堆栈平衡 08.20 修正Ntdll.dll中Api问题 08.28 修正vb程序中被vmp保护引起的问题 08.29 修正vb修复代码错误 09.01 修正使用EAX破坏堆栈问题 09.03 +跳过输入表对api第二次加密 09.04 +增加对2.0.30支持 09.08 修正一个特征码定位bug 11.17 增加对2.0.40支持 12.29 +根据网上资料添加对加壳软件版本的获得 12.29 修正些bug 2009： 01.09 + EXE Dll判断 + pack version，pack type判断 * 处理vb、1.95版以下的脚本使用原代码，并修复Bug + vb程序的判断更准确 01.11 完成1.95前和VB脚本到新脚本的移植，并优化了脚本 01.13 完成移植1.96以上版本脚本 01.17 还是改为普通版外放 */ data: var packver var packtype var Imgtype var codebase var codesize var dllimg var dllsize var modulebase var moduleend var modulesize var vcflag var delphiflag var vbflag var iatprocbegin var iatprocend var vbmain var kerneldll var V_kernel var advapidll var V_advapi var userdll var V_user var vbdll var vallocapi var tmdappver var filename var procname var filedir var modbase var modsect var crcadd var tmp var temp var tmpbp cmp $VERSION,"1.65" jb Err_ver lc #LOG LOG "------------Statr--------------" mov vcflag,0 mov delphiflag,0 mov vbflag,0 bphwcall bpmc gmemi eip,MEMORYBASE mov dllimg,$RESULT gmemi eip,MEMORYSIZE mov dllsize,$RESULT gmi eip,MODULEBASE mov modulebase,$RESULT call GetImageType gmi eip,CODEBASE mov codebase,$RESULT gmemi codebase,MEMORYSIZE mov codesize,$RESULT gpi PROCESSNAME mov procname, $RESULT gpi CURRENTDIR mov filedir, $RESULT GPI EXEFILENAME mov filename, $RESULT GETSYSAPI: gpa "MessageBoxA","user32.dll" gmi $RESULT,MODULEBASE mov userdll,$RESULT gpa "RegQueryValueExA","advapi32.dll" gmi $RESULT,MODULEBASE mov advapidll,$RESULT gpa "GetProcAddress", "kernel32.dll" mov getprocadd_1,$RESULT gmi $RESULT,MODULEBASE mov kerneldll,$RESULT cmp getprocadd_1,0 je stop gpa "_lclose","kernel32.dll" mov getprocadd_2,$RESULT gpa "GetLocalTime", "kernel32.dll" mov tmp,$RESULT cmp tmp,0 je stop bphws tmp ,"x" esto bphwc tmp rtu gpa "RtlRaiseException","ntdll" cmp $RESULT,0 je stop bphws $RESULT var tmpvall var vallocapi var rreflag mov rreflag,0 gpa "VirtualAlloc", "kernel32.dll" mov tmpvall,$RESULT cmp tmpvall,0 je stop mov vallocapi,tmp bphws tmpvall,"x" esto gn eip scmp $RESULT,"ntdll.RtlRaiseException" je findver nextvall: inc rreflag rtu mov V_kernel,eax cmp rreflag,2 je overver bphwc tmpvall esto findver: call Getpacktype call Getpackver cmp rreflag,1 je vallnext jmp overver vallnext: bphws tmpvall,"x" esto jmp nextvall overver: bphws tmpvall,"x" //重定位VirtualAlloc mov tmp,tmpvall gmi tmp,MODULEBASE sub tmp,$RESULT sub tmp,0c00 add tmp,V_kernel bphws tmp,"x" tmploop: esto cmp eax,getprocadd_1 je findapibegin cmp eax,getprocadd_2 je findapibegin jmp tmploop findapibegin: esto esto bphwcall rtr sti find eip,#83F9000F84# cmp $RESULT,0 je stop mov iatprocbegin,$RESULT log $RESULT,"IAT_Procbegin:" bphws $RESULT,"x" esto sti mov temp,eip add temp,02 mov temp,[temp] add temp,eip OPCODE eip add temp,$RESULT_2 mov iatprocend,temp log iatprocend,"IAT_Procend:" var iattabbegin var iattabend mov iattabbegin,esi log iattabbegin,"加密表的首地址：" mov temp,[esi-4] log temp,"加密表长度:" add temp,esi sub temp,0c mov iattabend,temp GetVb: gpa "ThunRTMain","MSVBVM60.dll" mov vbmain,$RESULT gmi vbmain,MODULEBASE mov vbdll,$RESULT cmp vbdll,0 //vb程序单独处理 jne _vbapp /* -----------packversion判断------------ 1.95版前使用原脚本处理，效率比较好。 */ cmp packver,1.90 jbe findoldver cmp packver,1.930 jbe findver193 cmp packver,1.950 jbe findver195 jmp findver_196 findver193: call GetApi_193 jmp oepvmbegin findver195: call GetApi_195 jmp oepvmbegin findver_196: call GetApi_196 oepvmbegin: call oepvmbeginfn findapplanguage: call findapplanguagefn ret //-------------Functions-------------- //--------------vmpatch--------------- oepvmbeginfn: var i var vmbegin var vmbeginadd mov i,0 bphwcall mov temp,iattabbegin sub temp,3000 loopfindvmep: cmp i,10 je findvmepover find temp,#68????????E9??????FF# mov tmp,$RESULT add tmp,06 mov vmbegin,[tmp] add tmp,vmbegin add tmp,04 push eax mov al,[tmp] cmp al,6A je findvmoepbegin cmp al,60 je findvmoepbegin findvmoepnext1: pop eax sub temp,3000 inc i jmp loopfindvmep findvmoepbegin: bphws tmp,"x" bprm codebase,codesize findvmoepbeginloop: esto cmp tmp,eip jne novm cmp edi,1 jne findvmoepbeginloop jmp patchvm novm: mov temp,codebase add temp,codesize cmp eip,temp jb findvmepover jmp findvmoepbeginloop pause patchvm: bphwcall mov temp,[esp] mov eip,iattabbegin eval "push {temp}" asm eip,$RESULT add iattabbegin,05 eval "jmp {tmp}" asm iattabbegin,$RESULT add esp,04 add iattabbegin,30 mov vmbeginadd,eip log vmbeginadd findvmepover: ret //end ///////////////////////////////////////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////////////////////////////////// //findapplanguagebegin findapplanguagefn: var codeendadd var delphiapp var iatlength var vcapp var mfcapp var asmapp var bcapp mov i,0 mov tmp,iattop findiatbegin: mov iattop,tmp sub tmp,04 cmp [tmp],0 je findiatbeginnext jmp findiatbegin findiatbeginnext: sub tmp,4 cmp [tmp],0 jne findiatbegin find iattop,#0000000000000000# mov temp,$RESULT sub temp,iattop mov iatlength,temp cmp codeadd,0 je findcodeerr find codeadd,#00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000# mov codeendadd,$RESULT sub $RESULT,codebase mov codesize,$RESULT find codebase,#EB10# cmp codebase,$RESULT je findbcapp mov temp,codeadd findcodeok: push eax mov al,[temp] cmp al,0E9 je findjump cmp al,0E8 je findcall dec temp mov al,[temp] cmp al,0E9 je findjump cmp al,0E8 je findcall add temp,02 mov al,[temp] cmp al,0E9 je findjump cmp al,0E8 je findcall jmp stop findjump: pop eax mov temp, codesize add temp,codebase sub temp,codeadd cmp temp,200 jb findasmapp mov delphiapp,1 call delphiappiatrevertfn ret findcall: pop eax mov vcapp,1 call vcappiatrevertfn ret findbcapp: pop eax mov bcapp,1 call bcappiatrevertfn ret findasmapp: pop eax mov asmapp,1 call asmappiatrevertfn ret findcodeerr: ret jmp stop //====================delphi==================== delphiappiatrevertfn: bphwcall bpmc add iattabbegin,50 exec pushad pushfd ende mov ecx,codebase add codesize,codebase mov edx,codesize mov ebx,iattop mov [iattabbegin],#8A013CE89074163CE9741290833900750141413BCA0F8FA2000000EBE38B690103E983C5058BF3AD83F8007506833E009074DF3BE87402EBEE908079FF90753580790590741B8039E9750866C741FFFF25EB0666C741FFFF1583EE04897101EB308079068B7402EBDD807907C075D79090909090908039E9750766C701FF25EB0566C701FF1583EE0489710283C104EB818B690203E983C5068BF3AD83F800750A833E00900F8467FFFFFF3BE87402EBEA9089710283C104E955FFFFFF90909090# push eip mov eip,iattabbegin sti mov temp,iattabbegin add temp,0be bphws temp,"x" esto bphwcall pop eip bp eip exec popfd popad ende bc eip cmp Imgtype,"dll" je dllcode eval "Delphi_{Imgtype}程序--IAT基地址在:{iattop};IAT表长度：{iatlength}; VM_OEP地址：{eip};{packtype}: {packver}" msg $RESULT ret dllcode: eval "Delphi_{Imgtype}程序--IAT基地址在:{iattop};IAT表长度：{iatlength};VM_OEP地址：{eip};{packtype}: {packver}" msg $RESULT ret //====================End==================== //====================VC==================== vcappiatrevertfn: bphwcall bpmc exec pushad pushfd ende mov ecx,codebase add codesize,codebase mov edx,codesize mov ebx,iattop mov [iattabbegin],#8A013CE89074163CE9741290833900750141413BCA0F8FA2000000EBE38B690103E983C5058BF3AD83F8007506833E009074DF3BE87402EBEE908079FF9075358079FEC3741B8039E9750866C741FFFF25EB0666C741FFFF1583EE04897101EB30807905907402EBDD807906E874D7807906E974D18039E9750766C701FF25EB0566C701FF1583EE0489710283C104EB818B690203E983C5068BF3AD83F800750A833E00900F8467FFFFFF3BE87402EBEA9089710283C104E955FFFFFF90909090# push eip mov eip,iattabbegin sti mov temp,iattabbegin add temp,0be bphws temp,"x" esto bphwcall pop eip bp eip exec popfd popad ende bc eip cmp Imgtype,"dll" je dllcode eval "VC_{Imgtype}程序--IAT基地址在:{iattop};IAT表长度：{iatlength}; VM_OEP地址：{eip}; {packtype}: {packver} " msg $RESULT ret dllcode: eval "VC_dll程序--IAT基地址在:{iattop};IAT表长度：{iatlength};VM_OEP地址：{eip};{packtype}: {packver}" msg $RESULT ret //====================End==================== //====================Borland C++==================== bcappiatrevertfn: bphwcall bpmc exec pushad pushfd ende mov temp,iattop add temp,1100 find temp,#0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000# mov tmp,$RESULT sub tmp,temp add temp,tmp mov edi,temp mov ecx,codebase add codesize,codebase mov edx,codesize mov ebx,iattop mov [iattabbegin],#8A013CE89074273CE97423668B01663DFF159090663DFF259090833900907503419090413BCA0F8F9C000000EBD28B690103E983C5058BF3AD83F800750B833E0075063BF77FDCEBEF3BE87402EBE98079FF9075219090909090908039E9750866C741FFFF25EB0666C741FFFF1583EE04897101EB21908039E9750866C701FF2590EB0566C701FF159083EE04897102909083C104EB8C8B690203E983C5068BF3AD83F800750F833E00750A3BF70F8F6FFFFFFFEBEB3BE87402EBE589710283C104E95CFFFFFF909090# push eip mov eip,iattabbegin sti mov temp,iattabbegin add temp,0c9 bphws temp,"x" esto bphwcall pop eip bp eip exec popfd popad ende bc eip cmp Imgtype,"dll" je dllcode eval "Borland C++_{Imgtype}程序--IAT基地址在:{iattop};IAT表长度：{iatlength};VM_OEP地址：{eip};{packtype}: {packver}" msg $RESULT ret dllcode: eval "Borland C++_dll程序--IAT基地址在:{iattop};IAT表长度：{iatlength};VM_OEP地址：{eip};{packtype}: {packver} " msg $RESULT ret //====================End==================== //====================ASM==================== asmappiatrevertfn: mov temp,codeendadd sub temp,05 findopnext_asm: opcode temp cmp $RESULT_2,05 je findop_asm dec temp jmp findopnext_asm findop_asm: bphwcall bpmc exec pushad pushfd ende mov esi,temp mov ebp,iattop push eip mov eip,iattabbegin mov [eip],#908BDE807B050074568A033CE975288B430103C383C00555837D0000740A3B4500742B83C504EBF083C504837D000075E75D83EB06EBD2807BFFE975058B0348EBD0807B01E9751B8B430240EBC49066C703FF25896B025D83EB06EBAC90904BEBA7909090# sti mov temp,eip add temp,64 bphws temp,"x" esto bphwcall pop eip bp eip exec popfd popad ende bc eip cmp Imgtype,"dll" je dllcode eval "ASM程序--IAT基地址在:{iattop};IAT表长度：{iatlength};VM_OEP地址：{eip};{packtype}: {packver}" msg $RESULT ret dllcode: eval "ASM_dll程序--IAT基地址在:{iattop};IAT表长度：{iatlength};VM_OEP地址：{eip};{packtype}: {packver}" msg $RESULT ret //====================End==================== //end //////////////////////////////////////////////////////////////////////////////////////////////////////// //=============GetApi_193============= GetApi_193: //193-版本Api处理 find eip,#83BD????????01# bphws $RESULT ,"x" mov tmp,$RESULT sub tmp,02 mov antiadd,tmp esto sti bphwcall mov temp,eip mov [temp],#909090909090# mov tmp,0 loop1: find eip,#3B8D????????0F84# bphws $RESULT ,"x" cmp $RESULT,0 je findnewver esto bphwcall mov iatfn,eax //获得函数，并修改magic jump log iatfn,"API:" sti mov temp,eip mov [temp],#909090909090# inc tmp cmp tmp,03 je next_1 jmp loop1 next_1: add iattabbegin,04 bphws iattabbegin,"r" esto bphwcall findiataddpro: //iataddress find eip,#0385????????# bphws $RESULT,"x" mov tmp,$RESULT add tmp,05 find tmp,#0385????????# bphws $RESULT,"x" esto sti bphwcall mov iattop,eax log iattop,"EAX是iat表中函数写入地址，然后判断这个值最小时就是iat基地址:" add iattabbegin,04 bphws iattabbegin,"r" esto bphwcall find eip,#0385# bphws $RESULT,"x" esto sti bphwcall mov codeadd,eax cmp iatprocend,eip je tmd193over bprm codebase,codesize esto bpmc find eip,#83F8500F82# mov temp, $RESULT cmp temp,0 je apicodeend193 bphws temp,"x" esto sti bphwcall mov temp,eip add temp,02 mov tmp,[temp] add tmp,temp add tmp,04 eval "jmp {tmp}" asm eip,$RESULT apicodeend193: bphws antiadd,"r" bphws iatprocend,"x" esto find eip,#3985????????0F84#, mov temp, $RESULT bphws temp,"x" cmp temp,0 je findvmoepbegin esto bphwcall sti mov temp,eip mov [temp],#90E9# log temp bphwcall bphws iatprocend,"x" esto tmd193over: ret //=============GetApi_195============= GetApi_195: var tmdanti195 bphwcall find eip,#2BD9# bphws $RESULT esto sti log eax,"API:" bphwcall //mov [eip],#909090909090# mov tmdanti195,eip find eip,#2BD9# bphws $RESULT esto sti bphwcall mov [eip],#909090909090# find eip,#2BD9# bphws $RESULT esto sti bphwcall mov [eip],#909090909090# mov temp,esi bphws temp,"r" esto bphwcall find eip,#0385????????# bphws $RESULT,"x" esto sti bphwcall mov iattop,eax log iattop,"EAX是iat表中函数写入地址，然后判断这个值最小时就是iat基地址:" mov iattabbegin,esi bphws iattabbegin,"w" esto bphwcall find eip,#0385# bphws $RESULT,"x" esto sti bphwcall mov codeadd,eax bprm codebase,codesize esto bpmc find eip,#83F8500F82# mov temp, $RESULT cmp temp,0 je apicodeend195 bphws temp,"x" esto sti bphwcall mov temp,eip add temp,02 mov tmp,[temp] add tmp,temp add tmp,04 eval "jmp {tmp}" asm eip,$RESULT apicodeend195: bphws iatprocend,"x" bphws tmdanti195,"r" bprm codeadd,codesize esto cmp eip,dllimg jb tmd195end cmp iatprocend,eip je tmd195end find eip,#3985????????0F84#, mov temp, $RESULT bphws temp,"x" cmp temp,0 je iatpatch_195over esto bphwcall sti mov temp,eip mov [temp],#90E9# log temp iatpatch_195over: bphwcall bphws iatprocend,"x" esto tmd195end: ret //=============GetApi_196以上============= GetApi_196: iatpatch_197: var getapiep var tmdanti197 var codeadd var iatintoadd var iatfntmp var movadd var subadd var getiatadd1 mov movadd,0 mov subadd,0 mov i,0 var iatfn var iattop var codeadd var antiadd bphwcall bphws iattabbegin,"r" esto bphwcall bpmc find eip,#B90?0000000BC974# //第一次用于定位 cmp $RESULT,0 je stop mov epapiflag,$RESULT bphws epapiflag,"x" mov temp,esi esto iatloop_197: bphwcall bpmc cmp subadd,0 jne bpsubadd find eip,#3B85??????090F85????0000# mov getiatadd1,$RESULT find eip,#2BD90F84????0000# mov subadd,$RESULT bpsubadd: bphws getiatadd1,"x" bphws subadd,"x" bphws iatprocend,"x" novmapi: esto cmp eip,iatprocend je iatpatchover cmp [esi+8],0 je iatpatchover cmp ecx,kerneldll je nextloopget cmp ecx,userdll je nextloopget cmp ecx,advapidll je nextloopget jmp novmapi nextloopget: cmp [eax], 4C44544E jne getapiadd find eip,#81384E54444C# bphwcall bpmc bphws $RESULT,"x" esto find eip,#894424# cmp $RESULT,0 je stop bphwcall bphws $RESULT,"x" esto getapiadd: cmp getiatadd1,eip je getapiadd2 mov getiatadd1,subadd getapiadd2: log eax,"API:" mov iatfn,eax bphwcall nextesto: bprm codebase,codesize esto cmp eip,10000000 jg nextesto cmp movadd,0 jne findiattop mov movadd,eip findiattop: //查找iat表基地址 cmp iattop,0 je beginfindiattop mov tmp,iattop cmp movadd,eip je beginfindiattop opcode eip cmp $RESULT_2,02 jne stop push eax mov temp,eip mov al,[temp] cmp al,8F je findpopmode cmp al,89 je findmovmode jne stop findmovmode: opcode eip mov al,[eip] cmp al,89 jne stop pop eax mov ecx,iatfn sti jmp loopgetpatchiat findpopmode: pop eax beginfindiattop: opcode eip cmp $RESULT_2,02 jne stop push eax mov al,[eip] cmp al,89 jne findpopapiadd pop eax mov ecx,iatfn mov temp,eip sti jmp loopgetpatchiat findpopapiadd: dec $RESULT_2 mov temp,eip add temp, $RESULT_2 mov al,[temp] cmp al,0 jne findiataddnext1 mov iattop,[esp] jmp findiattopend findiataddnext1: cmp al,1 jne findiataddnext2 mov iattop,ecx jmp findiattopend findiataddnext2: cmp al,02 jne findiataddnext3 mov iattop,edx jmp findiattopend findiataddnext3: cmp al,03 jne findiataddnext4 mov iattop,ebx jmp findiattopend findiataddnext4: pop eax jmp patch197next findiattopend: pop eax cmp tmp,iattop ja getpatchiatbegin mov iattop,tmp getpatchiatbegin: mov [esp],iatfn mov temp,eip find eip,#81#,50 cmp $RESULT,0 je loopgetpatchiat sub $RESULT,temp cmp $RESULT,2 jne loopgetpatchiat sti add eip,06 loopgetpatchiat: bphws epapiflag,"x" bphws iatprocend,"x" esto cmp temp,eip je iatloop_197 cmp iatprocend,eip je iatpatchover cmp epapiflag,eip je iatloop_197 mov iatintoadd,eip log iatintoadd nextaddpatch: //下面代码用于判断代码调用api的地址 opcode eip cmp $RESULT_2,2 ja notfindstos jb findmovaddcode push eax mov al,[eip] cmp al,8F je findpopintoadd cmp al,89 jne notfindintoadd mov al,[eip+1] cmp al,08 jne cmpaddnext1 mov codeadd,[esp] pop eax jmp findpopaddover cmpaddnext1: cmp al,0a jne cmpaddnext2 mov codeadd,1 pop eax jmp findpopaddover cmp addnext2: cmp al,0b jne notfindintoadd: mov codeadd,ebx pop eax jmp findpopaddover notfindintoadd: pop eax jne notfindstos push eax findpopintoadd: mov temp,eip inc temp mov al,[temp] cmp al,0 jne nextecx mov codeadd,[esp] pop eax jmp findpopaddover nextecx: cmp al,1 jne nextedx mov codeadd,ecx pop eax jmp findpopaddover nextedx: cmp al,02 jne nextebx mov codeadd,edx pop eax jmp findpopaddover nextebx: cmp al,03 jne stop mov codeadd,ebx pop eax jmp findpopaddover notfindstos: esto cmp iatprocend,eip je iatpatchover cmp epapiflag,eip je iatloop_197 jmp nextaddpatch findmovaddcode: cmp $RESULT_2,2 jne findstos findstos: cmp $RESULT,"AB" jne notfindstos mov codeadd,edi findpopaddover: mov iatfntmp,iatfn sub iatfntmp,codeadd sub iatfntmp,04 patch197next: bphwcall //bpmc bphws getiatadd1,"x" bphws epapiflag,"x" bphws iatprocend,"x" bphws iatintoadd,"x" esto cmp codeadd,1 je findapino mov [codeadd],iatfntmp findapino: cmp iatprocend,eip je iatpatchover cmp iatintoadd,eip je nextaddpatch cmp getiatadd1,eip je getapiadd cmp epapiflag,eip jne nextaddpatch mov temp,esi jmp iatloop_197 iatpatchover: bphwcall bpmc ret //==============VBApp================= _vbapp: var vbantiadd bphwcall find eip,#3B85????????0F84# cmp $RESULT,0 je vbpatch1 bphws $RESULT ,"x" esto mov temp,eip mov tmp,ebp add temp,02 add tmp,[temp] cmp [tmp],vbmain jne vbpatch1 sti mov tmp,eip OPCODE tmp cmp $RESULT_2,6 jne opcodenext_1 mov [eip],#90E9# mov vbantiadd,eip jmp vbnext_1 opcodenext_1: mov [eip],#E9# mov vbantiadd,eip vbnext_1: bphwcall bphws vbantiadd,"r" mov iattabbegin,esi bphws iattabbegin,"r" esto bphwcall find eip,#0385????????# bphws $RESULT,"x" esto sti bphwcall mov iattop,eax log iattop,"IAT表在这个附近：" mov iattabbegin,esi bphwcall bphws iattabbegin,"w" esto bphwcall find eip,#0385# bphws $RESULT,"x" esto sti bphwcall mov codeadd,eax bprm codebase,codesize esto bpmc find eip,#83F8500F82# mov temp, $RESULT cmp temp,0 je apicodeendvb bphws temp,"x" esto sti bphwcall mov temp,eip add temp,02 mov tmp,[temp] add tmp,temp add tmp,04 eval "jmp {tmp}" asm eip,$RESULT apicodeendvb: bphws iatprocend,"x" bphws vbantiadd,"r" esto cmp iatprocend,eip je iatpatchend find eip,#3985????????0F84#, mov temp, $RESULT cmp temp,0 je iatpatchend mov crcadd,temp bphws temp,"x" esto bphwcall sti mov [eip],#90E9# log temp,"程序CRC地址：" sub iattabend,04 cmp iattabend,0 je findvmoepbegin sub iattabend,8 bphws iattabend,"w" esto iatpatchend: find codeadd,#E9????0000????????????????E9????0000# cmp $RESULT,0 je novapioepbegin sti sti novapioepbegin: bphwcall bprm codebase,9000 esto bphwcall bpmc vbvmrecover: push eax mov al,[eip] cmp al,0E9 pop eax jne novapioepbegin var voep mov voep,eip add eip,06 mov temp,esp add temp,04 mov temp,[temp] eval "push {temp}" asm eip,$RESULT mov tmp,eip add tmp,05 eval "call {voep}" asm tmp,$RESULT vbapirecover: var iatlength var vbcodebegin find codebase,#00000000# mov iatlength,$RESULT sub iatlength,codebase log iatlength,"IAT表长度：" find eip,#558BEC# cmp $RESULT,0 je findvbcode mov vbcodebegin,$RESULT find $RESULT,#0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000# mov codesize,$RESULT sub codesize,vbcodebegin exec pushad pushfd ende mov ebp,codebase mov esi,vbcodebegin mov edi,codesize push eip mov ebx,eip mov eip,iattabbegin mov [eip],#9083EB06803B0074348A033CE975258B430103C383C00555837D000074133B4500740683C504EBF09066C703FF25896B025DEBCD8B4302EBD9909090908A063CE8740A464F83FF00742FEBF1908B460103C683C00555837D000074133B4500740683C504EBF09066C706FF15896E025D83C60183EF01EBC59090# sti mov temp,eip add temp,78 bphws temp,"x" esto bphwcall pop eip bp eip exec popfd popad ende bc eip eval "VB_{Imgtype}程序--IAT基地址在:{iattop}; OEP地址：{eip}; {packtype}: {packver} " msg $RESULT jmp end findvbcode: msg "VB_code编码，不需要修复代码部分!" eval "IAT基地址在:{iattop}; OEP地址：{eip}; {packtype}: {packver} " msg $RESULT jmp end //vbend //========================== Getpacktype: //添加获取壳类型 inc rreflag bphwcall mov tmp,[esp+8] add tmp,40 push eax findtypeloop: mov al,[tmp] cmp al,20 jne findpacktype inc tmp jmp findtypeloop findpacktype: cmp al,57 je findtypewl cmp al,54 je findtypetmd pop eax jmp valnext findtypewl: pop eax mov [tmp+17],0 eval "{[tmp]}" mov packtype,$RESULT jmp valnext findtypetmd: pop eax mov [tmp+14],0 eval "{[tmp]}" mov packtype,$RESULT jmp valnext valnext: bphwcall bpmc ret Getpackver: //添加壳版本获得,by qql504 感谢! mov temp, [esp+8] mov tmp, [esp+8] GMEMI temp, MEMORYBASE mov temp, $RESULT find temp, #000004000000322E# //特征码 cmp $RESULT, 0 jz next jmp ver next: find temp, #000004000000312E# //特征码 cmp $RESULT, 0 jz stop ver: mov temp, $RESULT add temp, 6 eval "{[temp]}" mov packver,$RESULT ret GetImageType: //获得镜像类型,这个代码抄别人的。感谢! var characteristics mov tmp,modulebase add tmp, 3C mov tmp, [tmp] add tmp, modulebase add tmp,16 mov characteristics,[tmp] and characteristics,0FFFF and characteristics,2000 cmp characteristics,2000 je ImageType_DLL mov Imgtype,"exe" ret ImageType_DLL: mov Imgtype,"dll" ret Err_ver: MSG "脚本插件版本过低，请重新安装新版本再试!" RET stop: msg "出错啦！" ret findoldver: msg "发现老版本，请用老版脚本！" eval "{packtype}: {packver}" msg $RESULT ret end: ret