/*

//////////////////////////////////////////////////

Назначение скрипта Thinstall 2.5 extr

/////////////////////////////////////////////////

*/

var va

var va2

var dmp

var rgn

var sz

var Name

var check



gpa  "SetEnvironmentVariableA","kernel32.dll"

bp $RESULT

run 

bc $RESULT

rtu

find eip,#83A5??FEFFFF00FFB5F4FEFFFFFFB5??FEFFFF8B45??FF30FF75CCE8#

cmp $RESULT,0

je quit

mov va,$RESULT

add va,1b

bp va



run

/*

//////////////////////////////////////////////////

7FF212D2    83A5 74FEFFFF 0>AND DWORD PTR SS:[EBP-18C],0

7FF212D9    FFB5 F4FEFFFF   PUSH DWORD PTR SS:[EBP-10C]

7FF212DF    FFB5 74FEFFFF   PUSH DWORD PTR SS:[EBP-18C]

7FF212E5    8B45 0C         MOV EAX,DWORD PTR SS:[EBP+C]

7FF212E8    FF30            PUSH DWORD PTR DS:[EAX]

7FF212EA    FF75 CC         PUSH DWORD PTR SS:[EBP-34]

7FF212ED    E8 A0D4FFFF     CALL 7FF1E792                      ; <-------alloc dlll

7FF212F2    83C4 10         ADD ESP,10

7FF212F5    8945 C8         MOV DWORD PTR SS:[EBP-38],EAX

7FF212F8    837D C8 00      CMP DWORD PTR SS:[EBP-38],0

7FF212FC    0F85 D9000000   JNZ 7FF213DB

7FF21302    83BD 44FFFFFF 0>CMP DWORD PTR SS:[EBP-BC],0

7FF21309    75 43           JNZ SHORT 7FF2134E

7FF2130B    8B45 0C         MOV EAX,DWORD PTR SS:[EBP+C]

7FF2130E    8338 02         CMP DWORD PTR DS:[EAX],2

7FF21311    74 3B           JE SHORT 7FF2134E

7FF21313    8B45 0C         MOV EAX,DWORD PTR SS:[EBP+C]

7FF21316    FF30            PUSH DWORD PTR DS:[EAX]

7FF21318    8B85 D8FEFFFF   MOV EAX,DWORD PTR SS:[EBP-128]

7FF2131E    0385 F4FEFFFF   ADD EAX,DWORD PTR SS:[EBP-10C]

7FF21324    50              PUSH EAX

7FF21325    FFB5 D8FEFFFF   PUSH DWORD PTR SS:[EBP-128]

7FF2132B    FF75 08         PUSH DWORD PTR SS:[EBP+8]

7FF2132E    68 64A0F47F     PUSH 7FF4A064                      ; ASCII "%s does not have image base relocation information and cannot be loaded
Address %x-%x
Loadlib_flags=%x"

7FF21333    68 7D050000     PUSH 57D

7FF21338    68 789FF47F     PUSH 7FF49F78                      ; ASCII "X:\thinstall\stub\load_library.cc"

7FF2133D    E8 16460100     CALL 7FF35958

/////////////////////////////////////////////////

*/

msg "in [esp] Name dll"

mov va2,va

add va2,140

mov dmp,va

add dmp,783

bp dmp

sto

cmp eax,0

je lastdll

mov check,eax

and check,F0000000

cmp check,70000000

je Thin_L

mov rgn,eax

mov sz,[esp+C]

run

ask "Enter name dll"

cmp $RESULT, 0	

je def

mov Name,$RESULT

dm rgn, sz, Name

jmp loop

def:

dm rgn, sz, "our1.dll"

msg "Rename our dll"

bc va2

jmp loop



lastdll:

bp va2

run

mov rgn,[esp]

run

mov sz,rgn

find sz,#5045#

mov sz,$RESULT

add sz,50

mov sz,[sz]

ask "Enter name dll"

cmp $RESULT, 0	

je def2

mov Name,$RESULT

dm rgn, sz, Name

pause

bc va2

jmp loop

	

def2:

dm rgn, sz, "our2.dll"

msg "Rename our dll"

bc va2

jmp loop



loop:

run

cmp eip,va

jne loop

cmp eip,dmp

je loop

msg "in [esp] Name dll"



jmp lastdll





Thin_L:

bp va2

run

mov rgn,[esp]

run

mov sz,rgn

find sz,#5045#

mov sz,$RESULT

add sz,50

mov sz,[sz]

ask "Enter name dll"

cmp $RESULT,0	

je def3

mov Name,$RESULT

dm rgn, sz, Name

pause

jmp loop

def3:

dm rgn, sz, "our3.dll"

msg "Rename our dll"

pause

jmp loop



quit:

msg "not Thinstall 2.5"

ret

quit2:

msg "Все больше нет!"

ret