// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com
/*
////////////////////////////////////////////////////
// ASProtect 2.0 RC 06.2X import & scrambled code recovery (only Delphi & Imagebase = 400000)
// Author: Mario555
// Email : Mario555@pisem.net
// OS : WinXP SP1, OllyDbg 1.10, OllyScript v0.92
// Note : Olly must be hide (IsDebuggerPresent)
// !!! This script not fix Initialization Table (call eax), you must fix it manually.
// !!! some emulated api not determined by script, addresses of jmp [emul api] see at log (red letters).
// usually this api = GetProcAddress, but I am not sure that always GetProcAddress ;)
////////////////////////////////////////////////////
*/
var cbase
gmi eip, CODEBASE
mov cbase, $RESULT
log cbase
var csize
gmi eip, CODESIZE
mov csize, $RESULT
log csize
var k
var l
var c
var b
var function
var first
var a1
var a2
var a3
var a4
var a5
var a6
var iat_addr
var wr_addr
var mhandle
var mhandle_old
var iat_addr_old
var last
var mem_check2
var DllBase
var imbase
var asec
var temp
var temp2
var redirect
var ap
var paddr
var savevar
var CmpEmul
var CmpEmulProc
var t
var EmulProc
var CodeRedirect
var credirproc
mov b,0
mov c,0
mov mhandle_old,0
mov first,0
mov iat_addr, 400000
mov imbase, 400000
add iat_addr, [40027c]
log iat_addr
mov temp, 4002f4
asecn:
add temp, 28
mov temp2, [temp]
add temp2, imbase
mov temp2,[temp2]
cmp temp2, 03e86090
je asecf
cmp temp2, imbase
je asecnf
jmp asecn
asecnf:
msg "AsprSection not found"
ret
asecf:
mov asec, [temp]
add asec, imbase
log asec
add temp, 28
mov CodeRedirect, [temp]
add CodeRedirect, imbase
log CodeRedirect
gpa "VirtualAlloc", "kernel32.dll"
bp $RESULT
eoe lab_DllBase
eob lab_DllBase
run
lab_DllBase:
inc b
cmp b, 2
jne loc_DBn
bc $RESULT
cob
coe
rtu
mov DllBase, eax
log DllBase
eoe lab_first
eob lab_first
mov b, 0
loc_DBn:
esto
lab_first:
find DllBase, #C700CA00000033C0#
mov redirect, $RESULT
find redirect, #8D43088B4B04#
mov redirect, $RESULT
sub redirect, 6
bp redirect
eoe lab1
eob lab1
esto
lab1:
cmp eip, last
je lab_last
cmp eip, mem_check2
je lab_mem_check2
cmp eip, redirect
je loc_redirect
cmp eip, savevar
je loc_savevar
cmp eip, CmpEmul
je loc_CmpEmul
cmp eip, credirproc
je loc_coderedirect
cmp c,0a
je lab_Breaks
add c,1
esto
loc_redirect:
bc redirect
add redirect,2
mov redirect, [redirect]
mov ap, asec
add ap, 7000
mov [redirect], ap
log "-=-=-=-=-=-"
log "redirected to"
log ap
log "-=-=-=-=-=-"
mov temp, esp
sub temp, 30
mov temp, [temp]
log temp
log "-=-=-=-=-=-"
add ap, temp
mov [ap], #608B74242083C4EC33C08BE88944240C90909090908B068944240483C6048B168BC280EA080F92C280FA0175118BC88D5C243090E8C00000008BE890909083C6048B06894424089083C6048B168BC280EA080F92C280FA0175118BC88D5C243090E8930000008944240C90036C24048B4424080344240C89442410909083C6048B0683F800741283F801741583F802741F83F8037426EB3B908B6D00EB359090908B4424108B0089442410EB2690909033C08A45008BE8EB1A9090908B4424100FB60089442410EB0A909090909090909090908B5424108BC5E82500000083C4146183042414FF7424C49DC390909090909090909090909090C1E0022BD88B03C390902BD09C58C3#
log ap
mov EmulProc, ap
add ap, 109
esto
loc_savevar:
bc savevar
mov savevar, [401000]
mov [401000], ap
esto
lab_Breaks:
log "breaks"
mov c, 0b
var addr
mov addr, DllBase
find addr, #68C8000000E8????????0143085E5BC3#
mov temp, $RESULT
sub temp, 5
mov [temp], #3bc090#
log temp
find addr, #837C24200074448B44240C8B542420#
mov temp, $RESULT
sub temp, 10
log temp
mov a1,temp
bp temp
add temp, 125
mov a2,temp
bp temp
add temp, 0a9
mov a3,temp
bp temp
add temp, 52
mov a4,temp
bp temp
sub temp, 4f
mov a5, temp
bp a5
find addr, #5E5B5DC21800#
mov a6, $RESULT
bp a6
add temp, 0d3
bpl temp, "esi"
find addr, #0F857AFFFFFF8B45FC5F5E5B#
mov mem_check2, $RESULT
add mem_check2, 0f
bp mem_check2
log mem_check2
find addr, #8B45FC8B0085C0752B#
mov last, $RESULT
add last, 0f
log last
find addr, #8BF003731C03736C8B53208BC6#
mov paddr, $RESULT
add paddr, 8
mov savevar, paddr
sub savevar, 3
log savevar
bp savevar
mov [paddr], #8BCF908BC3E8A3FCFFFF#
find addr, #2C0272127443FEC80F848F000000#
mov paddr, $RESULT
add paddr, 8
log paddr
mov [paddr],#EB3F90909090E9EB0000009090908B45F88B406C03F8897DF0837DF0FF75110345F48B55F803420C8945F0E9CE0000008B45F88B401C0145F0E9C000000090909033C08A43048B55F88B5482448BC6FFD28B1D001040008BCB66C7030F8043000343894DF08B45F88B401C0345F48B55F803426C2BC383E80489038B45F803781C8B45F803786C83C304C603E9432BFB83EF04893B8305001040000B909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909033C05A5959648910EB1790909090909090909090909090909090909090909090909090908B45F0908B742404C606E92BC683E8059090909090909090909090909090909090905F5E5B8BE55DC3#
mov CmpEmul, paddr
sub CmpEmul, 2
bp CmpEmul
find addr, #5356575583C4EC8BF98914248BD8#
mov CmpEmulProc, $RESULT
mov [CmpEmulProc], #5356575583C4EC8BF98914248BD88D732833ED33C08944240C90909033C08A46078B5483448BC7FFD28944240433C08A46058B5483448BC7FFD2BA001040008B12538B5C2408891A5B83C204890283C2048305001040000833C08A46088B5483448BC7FFD28944240833C08A46068B5483448BC7FFD2BA001040008B12538B5C240C891A5B83C204890283C2048305001040000890909090909090909090909090909090909090909033C08A46098B5483448BC7FFD2BA001040008B1289028305001040000483C4145D5F5E5B9033C08A43048B55F88B5482448BC6FFD28B1D001040008BCB66C7030F804300034383E919894DF0C3#
find addr, #8B008B388B5D088B4304#
mov credirproc, $RESULT
add credirproc, 0f
bp credirproc
eob lab2
eoe lab2
esto
loc_CmpEmul:
mov t, [401000]
mov [t], 0e8
mov temp, EmulProc
sub temp, t
sub temp, 5
inc t
mov [t], temp
add [401000], 5
mov ecx, esi
mov t, ebp
add t, 0c
mov edx, [t]
sub t, 14
mov eax, [t]
sub esp, 4
add eip, 67
mov [esp], eip
mov eip, CmpEmulProc
esto
loc_coderedirect:
mov eax, CodeRedirect
mov temp, ebx
add temp, 4
add CodeRedirect, [temp]
add CodeRedirect, 10
sub temp, 4
mov temp, [temp]
add temp, imbase
log "----------------------"
log "coderedirect address:"
log temp
log "----------------------"
esto
lab2:
cmp eip, a1
je loc_imp
cmp eip, a2
je loc_imp
cmp eip, a4
je loc_imp
cmp eip, a3
je loc_imp2
cmp eip, a5
je loc_imp21
cmp eip, a6
je loc_imp_ord
jmp lab1
loc_imp:
mov k, esp
add k, 14
mov mhandle, [k]
cmp mhandle, mhandle_old
je loc1
mov mhandle_old, mhandle
add iat_addr, 4
loc1:
cmp first,0
mov first,1
je loc3
loc2:
sub wr_addr,2
mov [wr_addr], #ff25#
add wr_addr,2
mov [wr_addr], iat_addr_old
mov [iat_addr_old], function
loc3:
mov wr_addr, esi
mov function, eax
mov iat_addr_old, iat_addr
add iat_addr, 4
run
loc_imp2:
mov mhandle, eax
cmp mhandle, mhandle_old
je loc22
mov mhandle_old, mhandle
add iat_addr, 4
loc22:
sub wr_addr,2
mov [wr_addr], #ff25#
add wr_addr,2
mov [wr_addr], iat_addr_old
mov [iat_addr_old], function
mov k, esp
add k, 0c
mov k, [k]
run
loc_imp21:
mov l, esp
sub l, 14
mov l, [l]
add k, l
add k, 400000
mov wr_addr, k
mov k, esp
sub k, 24
mov k, [k]
mov function, k
mov iat_addr_old, iat_addr
add iat_addr, 4
// log function
// log wr_addr
run
loc_imp_ord:
mov k, esp
sub k, 8
mov mhandle, [k]
cmp mhandle, mhandle_old
je loc_imp_ord_2
mov mhandle_old, mhandle
add iat_addr, 4
loc_imp_ord_2:
sub wr_addr,2
mov [wr_addr], #ff25#
add wr_addr,2
mov [wr_addr], iat_addr_old
mov [iat_addr_old], function
mov wr_addr, eax
sub k, 10
mov function, [k]
mov iat_addr_old, iat_addr
add iat_addr, 4
run
lab_mem_check2:
log "mem_check2"
inc b
cmp b, 2
je loc_check2
esto
loc_check2:
bp last
esto
lab_last:
log "last"
sub wr_addr,2
mov [wr_addr], #ff25#
add wr_addr,2
mov [wr_addr], iat_addr_old
mov [iat_addr_old], function
mov [401000], savevar
cmp ecx, 0
jne loc_stolen
bprm cbase, csize
eob loc_end
eoe loc_end
esto
loc_end:
Msg "OEP finded"
bpmc
jmp loc_clear
loc_stolen:
sti
sti
sti
sti
sti
Msg "Scrambler(VM) removed, dump and set EP here"
loc_clear:
bc a1
bc a2
bc a3
bc a4
bc a5
bc a6
bc last
bc mem_check2
log "-=-=-=-=-=-=-=-=-=-"
log "+ script finished +"
log "+ Mario555 +"
log "-=-=-=-=-=-=-=-=-=-"
ret
