////////////////////////Château-Saint-Martin///////////////////////////////////////////////

//                                                                      //////////////////

//  FileName    :  WinLicense HWID & TRIAL Loader & Bypass Creater {U1} /////////////////

//  Features    :                                                       ////////////////

//                 Use this script to create a loader which can         ///////////////

//                 bypass the HWID & TRIAL check in the packed          //////////////

//                 WinLicense file.                                     /////////////

//                                                                      ////////////

//                 1. Script inline´s the HWID & TRIAL patch            ///////////

//                 2. Create´s a extra file with all patches            //////////

//                    for Advanced Loader Generator etc.                /////////

//                 3. Patch Method CISC & RISC (memory)                 ////////

//                                                                      ///////

//                                                                      //////

//  Environment :  WinXP,OllyDbg V1.10,OllyScript v1.65.4               /////

//  Author      :  LCF-AT                                               ////

//  Date        :  2009-07-03                                           ///

//                                                                      //

//                                                                     // 

///////////////WILLST DU SPAREN,DANN MUßT DU SPAREN!////////////////////



var GetLocalTime

var VirtualAlloc

var apibase

var apibase2

var LoadLibraryA

var rappa

var SECTEST

var HWID

var CALC

var ADDRESS

var TRIAL

var JUMP

var NEWPATCH

var JUMP_2

var BINARY

var BINARYJUMP

var FIRSTJUMP

var NULLER

var TESTER

var risc

var TALLA

var JUMP_B

var DEST

var A

var B

var C

var JUMP_start

var NAME

var M_BASE

var M_SIZE

var MEM_TEST

var MEMO

var EXTRAADDRESS

var FRG

/////////////////////////////

lc

dbh

BC

bpmc

bphwcall

dbh

GPI PROCESSNAME

mov NAME, $RESULT

gpi MAINBASE

mov M_BASE, $RESULT

gmi M_BASE, MODULESIZE

mov M_SIZE, $RESULT

add M_SIZE, M_BASE

mov M_SIZE, M_SIZE



start0:

mov $RESULT, 0

ask "Enter a address of free space if you alraedy have!If not then enter nothing and press a button"

cmp $RESULT, 0

je HAL_2

cmp $RESULT, FFFFFFFF

je ende_2

cmp $RESULT, 02

je ende_3



mov A, $RESULT

mov B, $RESULT

mov C, $RESULT

READSTR C, len

mov C, $RESULT

len $RESULT

mov C, $RESULT

cmp $RESULT, 0

ja ende_2

mov FRG, A

and FRG, ffff0000

mov FRG, FRG

cmp FRG, 0

je ende_2

mov FRG, A



////////////////////////////////////

HAL:

inc EXTRAADDRESS

////////////////////////////////////

HAL_2:

bpmc



gpa "GetLocalTime", "kernel32.dll"

mov GetLocalTime, $RESULT



find GetLocalTime, #C9C20400#

cmp $RESULT, 0

jne hessel

pause



hessel:

mov GetLocalTime, $RESULT+1

bphws GetLocalTime ,"x"

esto

bphwc GetLocalTime

sti

gpa "VirtualAlloc", "kernel32.dll"

mov VirtualAlloc, $RESULT



find VirtualAlloc, #C21000#

cmp $RESULT, 0

jne seiber

pause

seiber:

mov VirtualAlloc, $RESULT

bphws VirtualAlloc ,"x"

esto

bphwc VirtualAlloc

sti

mov apibase,eax

log apibase



gpa "LoadLibraryA", "kernel32.dll"

mov LoadLibraryA, $RESULT



find LoadLibraryA, #C20400#

cmp $RESULT, 0

jne wessel

pause



wessel:

mov LoadLibraryA, $RESULT

bphws LoadLibraryA ,"x"

esto

bphwc LoadLibraryA

sti



API_1:

find apibase, #558BECFF7514FF7510FF750CFF75086AFFE81B0000005DC21000#

cmp $RESULT, 0

jne API_start



API_2:

find apibase, #558BECFF7514FF7510FF750CFF75086AFFE884FFFFFF5DC21000#

cmp $RESULT, 0

jne API_start



API_3:

find apibase, #558BECFF7514FF7510FF750CFF75086AFFE878FFFFFF5DC21000#

cmp $RESULT, 0

jne API_start



API_4:

find apibase, #558BECFF7514FF7510FF750CFF75086AFFE8090000005DC21000#

cmp $RESULT, 0

jne API_start



API_5:

find apibase, #558BECFF7514FF7510FF750CFF75086AFFE8040000005DC21000#

cmp $RESULT, 0

jne API_start



API_6:

find apibase, #558BECFF7514FF7510FF750CFF75086AFFE8????????5DC21000#

cmp $RESULT, 0

je ende



mov apibase, $RESULT

inc rappa

inc apibase

cmp rappa, 2

je API_starta

jmp API_6



API_starta:

dec apibase

//////////////////////////

API_start:

mov apibase2, $RESULT

bphws apibase2 ,"x"



RAS:

esto

mov SECTEST, [esp]

cmp SECTEST, 0

je RAS



gmemi SECTEST, MEMORYBASE

mov SECTEST, $RESULT



find SECTEST, #B8010000008985????????C785????????01000000#

cmp $RESULT, 0

je RAS



mov HWID, $RESULT

add HWID, 0B



add HWID, 02

mov HWID, [HWID]

add HWID, ebp

mov HWID, HWID

mov CALC, ebp



log HWID

log [HWID]

//////////////////mov [HWID], 02

log ebp



bphws HWID, "w"

bphwc apibase2



RAS_2:

esto



mov [HWID], 02

mov TALLA, eip+06

cmp [TALLA], 0FFFFFFFF

je RAS_2 



gmemi eip, MEMORYBASE

mov MEM_TEST, $RESULT



cmp M_BASE, MEM_TEST

ja TR1



cmp M_SIZE, MEM_TEST

jb TR1

jmp TR2



TR1:

eval "JUMP PATCH ADDRESS is OUTSIDE from our TARGET!YOU CAN´T CREATE A LOADER WITH THIS SCRIPT!"

log $RESULT, ""

mov MEMO, $RESULT

jmp TR3



TR2:

eval "JUMP PATCH ADDRESS is INSIDE from our TARGET!YOU CAN CREATE A LOADER WITH THIS SCRIPT!"

log $RESULT, ""

mov MEMO, $RESULT



TR3:

mov [HWID], 02



mov risc, [eip]

and risc, 0ffff

mov risc, risc

cmp risc, A4F3    // RISC  F3A4

je RISC

///////////////////////////jmp RAS_3A

mov TALLA, [eip]

and TALLA, 0ff

mov TALLA, TALLA

cmp TALLA, E9

je RAS_3

pause

pause



RAS_3:

esto

RAS_3A:

mov [HWID], 02

mov ADDRESS, eip

find SECTEST, #81BD????????00050000#

cmp $RESULT, 0

je RAS_3



mov ADDRESS, eip

mov TRIAL, $RESULT

log TRIAL



opcode ADDRESS

/////////////////////////READSTR [ADDRESS], 5

mov FIRSTJUMP, $RESULT



add TRIAL, 02

mov TRIAL, [TRIAL]

add TRIAL, CALC

mov TRIAL, TRIAL

log TRIAL

log [TRIAL]

mov [TRIAL], 500

///////////////////////////

PATCHERS:

bphwcall



gci ADDRESS, DESTINATION

cmp $RESULT, 0

jne RAS_4

pause

pause



RAS_4:

mov JUMP, $RESULT

mov NULLER, #00#



mov NEWPATCH, FRG

mov JUMP_2, FRG

cmp EXTRAADDRESS, 0

jne RAS_5S1



find eip, #0000000000000000000000000000000000000000000000000000000000000000000000000000000000#

cmp $RESULT, 0

jne RAS_5

pause

pause



RAS_5:

mov NEWPATCH, $RESULT

mov JUMP_2, $RESULT

RAS_5S1:

mov [NEWPATCH], #81FAEEEEEEEE741581FAEEEEEEEE7405E9A7B73EEEC70200050000EBF3C70202000000EBEB#

add NEWPATCH, 02

mov [NEWPATCH], HWID

add NEWPATCH, 08

mov [NEWPATCH], TRIAL

add NEWPATCH, 06

eval "JMP {JUMP}"

asm NEWPATCH, $RESULT



eval "JMP {JUMP_2}"

asm ADDRESS, $RESULT



eval "This are the bytes which you have to enter in Advanced Loader Generator!"

log $RESULT, ""

log "-----"



opcode ADDRESS

mov BINARYJUMP, $RESULT



find JUMP_2, #00000000#

cmp $RESULT, 0

jne RAS_6

pause

pause



RAS_6:

mov TESTER, $RESULT

sub TESTER, JUMP_2

mov TESTER, TESTER



READSTR [JUMP_2], TESTER

mov BINARY, $RESULT





eval "Advanced Loader Generator DATA! \r\n\r\nAddress First Original \r\nVA: {ADDRESS} \r\nBytes: {FIRSTJUMP}  \r\nAddress First Patched \r\nVA: {ADDRESS} \r\nBytes: {BINARYJUMP} \r\n\r\nAddress Second Original \r\nVA: {JUMP_2} \r\nBytes: {NULLER} x {TESTER} HEX Value \r\nAddress Second Patched \r\nVA: {JUMP_2} \r\nBytes: {BINARY} \r\n\r\nNOTE: {MEMO}"

log "Advanced Loader Generator DATA!"

MSG $RESULT

log ADDRESS

log FIRSTJUMP, ""

log ADDRESS

log BINARYJUMP, ""

log JUMP_2

log NULLER, ""

log JUMP_2

log BINARY, ""

jmp FILE



ende:

msg "Can´t find the API Base!Maybe your target still needs some dll file?"

pause

ret



FILE:

eval "ALG Patches for {NAME}.txt"

mov sFile, $RESULT

eval "Advanced Loader Generator Patches for {NAME}"

wrt sFile, $RESULT

wrta sFile, "\r\n"

wrta sFile, "\r\n"

eval "NOTE: {MEMO}"

wrta sFile, $RESULT

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "Address First Original"

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "VA: "

eval "{ADDRESS}"

wrta sFile, $RESULT

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "Bytes: "

eval "{FIRSTJUMP}"

wrta sFile, $RESULT

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "Address First Patched"

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "VA: "

eval "{ADDRESS}"

wrta sFile, $RESULT

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "Bytes: "

eval "{BINARYJUMP}"

wrta sFile, $RESULT

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "Address Second Original"

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "VA: "

eval "{JUMP_2}"

wrta sFile, $RESULT

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "Bytes: "

eval "{NULLER} x {TESTER} HEX Value"

wrta sFile, $RESULT

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "Address Second Patched"

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "VA: "

eval "{JUMP_2}"

wrta sFile, $RESULT

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "Bytes: "

eval "{BINARY}"

wrta sFile, $RESULT

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "*************************"

wrta sFile, "\r\n"

wrta sFile, "\r\n"

wrta sFile, "gRn @ LCF-AT"

wrta sFile, "\r\n"

wrta sFile, "\r\n"

eval "Script finished!All patches are written into a new file now! \r\n\r\nPress run to start your app now if you like!"

msg $RESULT

pause

ret

/////////////////////////////////////////

/////////////////////////////////////////

RISC:

mov A, edi

sub A, 01

mov A, A



mov B, [A]

///////////////// cmp B, 02      // HWID

////////////////  jne RISC_3

mov HWID, A

mov HWVALUE, B

mov [HWID], 02



mov JUMP_start, eip

findop JUMP_start, #E9#

cmp $RESULT, 0

jne RISC_2

pause

pause



RISC_2:

mov JUMP_B, $RESULT

gci JUMP_B, DESTINATION

mov DEST, $RESULT



RISC_2A:

esto

mov [HWID], 02

find SECTEST, #81BD????????00050000#

cmp $RESULT, 0

je RISC_2A



mov TRIAL, $RESULT

log TRIAL

add TRIAL, 02

mov TRIAL, [TRIAL]

mov TRIAL, TRIAL

add TRIAL, CALC

mov TRIAL, TRIAL

log TRIAL

log [TRIAL]



mov [TRIAL], 500

///////////////////////////////

PATCHERS_2:

bphwcall



gci JUMP_B, DESTINATION

cmp $RESULT, 0

jne RAS_4S

pause

pause



RAS_4S:

mov JUMP, $RESULT

mov NULLER, #00#



mov NEWPATCH, FRG

mov JUMP_2, FRG

cmp EXTRAADDRESS, 0

jne RAS_5S2



find eip, #000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000#

cmp $RESULT, 0

jne RAS_5S

pause

pause



RAS_5S:



mov NEWPATCH, $RESULT

mov JUMP_2, $RESULT



RAS_5S2:

opcode JUMP_B

mov FIRSTJUMP, $RESULT



mov [NEWPATCH], #833DEEEEEEEE02751D813DEEEEEEEE000500007505E9657F62EEC705EEEEEEEE00050000EBEFC705EEEEEEEE02000000EBE3#

add NEWPATCH, 02

mov [NEWPATCH], HWID

add NEWPATCH, 09

mov [NEWPATCH], TRIAL

add NEWPATCH, 0A

eval "JMP {JUMP}"

asm NEWPATCH, $RESULT



add NEWPATCH, 07

mov [NEWPATCH], TRIAL

add NEWPATCH, 0C

mov [NEWPATCH], HWID



mov ADDRESS, JUMP_B



eval "JMP {JUMP_2}"

asm ADDRESS, $RESULT



eval "This are the bytes which you have to enter in Advanced Loader Generator!"

log $RESULT, ""

log "-----"



opcode ADDRESS

mov BINARYJUMP, $RESULT



find JUMP_2, #00000000#

cmp $RESULT, 0

jne RAS_6S

pause

pause



RAS_6S:

mov TESTER, $RESULT

sub TESTER, JUMP_2

mov TESTER, TESTER



opcode JUMP_B

mov BINARYJUMP, $RESULT



READSTR [JUMP_2], TESTER

mov BINARY, $RESULT



eval "Advanced Loader Generator DATA! \r\n\r\nAddress First Original \r\nVA: {ADDRESS} \r\nBytes: {FIRSTJUMP}  \r\nAddress First Patched \r\nVA: {ADDRESS} \r\nBytes: {BINARYJUMP} \r\n\r\nAddress Second Original \r\nVA: {JUMP_2} \r\nBytes: {NULLER} x {TESTER} HEX Value \r\nAddress Second Patched \r\nVA: {JUMP_2} \r\nBytes: {BINARY} \r\n\r\nNOTE: {MEMO}"

log "Advanced Loader Generator DATA!"

MSG $RESULT

log ADDRESS

log FIRSTJUMP, ""

log ADDRESS

log BINARYJUMP, ""

log JUMP_2

log NULLER, ""

log JUMP_2

log BINARY, ""

jmp FILE

////////////////////

RISC_3:

pause

pause

ende_2:

mov TT_1, 0

msg "You have to enter minimum 5 digits for the address and also no strings so try it again!"

jmp start0

ende_3:

ret