// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com /* //////////////////////////////////////////////////// // ASProtect 2.0 RC 06.2X import & scrambled code recovery (only Delphi & Imagebase = 400000) // Author: Mario555 // Email : Mario555@pisem.net // OS : WinXP SP1, OllyDbg 1.10, OllyScript v0.92 // Note : Olly must be hide (IsDebuggerPresent) // !!! This script not fix Initialization Table (call eax), you must fix it manually. // !!! some emulated api not determined by script, addresses of jmp [emul api] see at log (red letters). // usually this api = GetProcAddress, but I am not sure that always GetProcAddress ;) //////////////////////////////////////////////////// */ var cbase gmi eip, CODEBASE mov cbase, $RESULT log cbase var csize gmi eip, CODESIZE mov csize, $RESULT log csize var k var l var c var b var function var first var a1 var a2 var a3 var a4 var a5 var a6 var iat_addr var wr_addr var mhandle var mhandle_old var iat_addr_old var last var mem_check2 var DllBase var imbase var asec var temp var temp2 var redirect var ap var paddr var savevar var CmpEmul var CmpEmulProc var t var EmulProc var CodeRedirect var credirproc mov b,0 mov c,0 mov mhandle_old,0 mov first,0 mov iat_addr, 400000 mov imbase, 400000 add iat_addr, [40027c] log iat_addr mov temp, 4002f4 asecn: add temp, 28 mov temp2, [temp] add temp2, imbase mov temp2,[temp2] cmp temp2, 03e86090 je asecf cmp temp2, imbase je asecnf jmp asecn asecnf: msg "AsprSection not found" ret asecf: mov asec, [temp] add asec, imbase log asec add temp, 28 mov CodeRedirect, [temp] add CodeRedirect, imbase log CodeRedirect gpa "VirtualAlloc", "kernel32.dll" bp $RESULT eoe lab_DllBase eob lab_DllBase run lab_DllBase: inc b cmp b, 2 jne loc_DBn bc $RESULT cob coe rtu mov DllBase, eax log DllBase eoe lab_first eob lab_first mov b, 0 loc_DBn: esto lab_first: find DllBase, #C700CA00000033C0# mov redirect, $RESULT find redirect, #8D43088B4B04# mov redirect, $RESULT sub redirect, 6 bp redirect eoe lab1 eob lab1 esto lab1: cmp eip, last je lab_last cmp eip, mem_check2 je lab_mem_check2 cmp eip, redirect je loc_redirect cmp eip, savevar je loc_savevar cmp eip, CmpEmul je loc_CmpEmul cmp eip, credirproc je loc_coderedirect cmp c,0a je lab_Breaks add c,1 esto loc_redirect: bc redirect add redirect,2 mov redirect, [redirect] mov ap, asec add ap, 7000 mov [redirect], ap log "-=-=-=-=-=-" log "redirected to" log ap log "-=-=-=-=-=-" mov temp, esp sub temp, 30 mov temp, [temp] log temp log "-=-=-=-=-=-" add ap, temp mov [ap], #608B74242083C4EC33C08BE88944240C90909090908B068944240483C6048B168BC280EA080F92C280FA0175118BC88D5C243090E8C00000008BE890909083C6048B06894424089083C6048B168BC280EA080F92C280FA0175118BC88D5C243090E8930000008944240C90036C24048B4424080344240C89442410909083C6048B0683F800741283F801741583F802741F83F8037426EB3B908B6D00EB359090908B4424108B0089442410EB2690909033C08A45008BE8EB1A9090908B4424100FB60089442410EB0A909090909090909090908B5424108BC5E82500000083C4146183042414FF7424C49DC390909090909090909090909090C1E0022BD88B03C390902BD09C58C3# log ap mov EmulProc, ap add ap, 109 esto loc_savevar: bc savevar mov savevar, [401000] mov [401000], ap esto lab_Breaks: log "breaks" mov c, 0b var addr mov addr, DllBase find addr, #68C8000000E8????????0143085E5BC3# mov temp, $RESULT sub temp, 5 mov [temp], #3bc090# log temp find addr, #837C24200074448B44240C8B542420# mov temp, $RESULT sub temp, 10 log temp mov a1,temp bp temp add temp, 125 mov a2,temp bp temp add temp, 0a9 mov a3,temp bp temp add temp, 52 mov a4,temp bp temp sub temp, 4f mov a5, temp bp a5 find addr, #5E5B5DC21800# mov a6, $RESULT bp a6 add temp, 0d3 bpl temp, "esi" find addr, #0F857AFFFFFF8B45FC5F5E5B# mov mem_check2, $RESULT add mem_check2, 0f bp mem_check2 log mem_check2 find addr, #8B45FC8B0085C0752B# mov last, $RESULT add last, 0f log last find addr, #8BF003731C03736C8B53208BC6# mov paddr, $RESULT add paddr, 8 mov savevar, paddr sub savevar, 3 log savevar bp savevar mov [paddr], #8BCF908BC3E8A3FCFFFF# find addr, #2C0272127443FEC80F848F000000# mov paddr, $RESULT add paddr, 8 log paddr mov [paddr],#EB3F90909090E9EB0000009090908B45F88B406C03F8897DF0837DF0FF75110345F48B55F803420C8945F0E9CE0000008B45F88B401C0145F0E9C000000090909033C08A43048B55F88B5482448BC6FFD28B1D001040008BCB66C7030F8043000343894DF08B45F88B401C0345F48B55F803426C2BC383E80489038B45F803781C8B45F803786C83C304C603E9432BFB83EF04893B8305001040000B909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909033C05A5959648910EB1790909090909090909090909090909090909090909090909090908B45F0908B742404C606E92BC683E8059090909090909090909090909090909090905F5E5B8BE55DC3# mov CmpEmul, paddr sub CmpEmul, 2 bp CmpEmul find addr, #5356575583C4EC8BF98914248BD8# mov CmpEmulProc, $RESULT mov [CmpEmulProc], #5356575583C4EC8BF98914248BD88D732833ED33C08944240C90909033C08A46078B5483448BC7FFD28944240433C08A46058B5483448BC7FFD2BA001040008B12538B5C2408891A5B83C204890283C2048305001040000833C08A46088B5483448BC7FFD28944240833C08A46068B5483448BC7FFD2BA001040008B12538B5C240C891A5B83C204890283C2048305001040000890909090909090909090909090909090909090909033C08A46098B5483448BC7FFD2BA001040008B1289028305001040000483C4145D5F5E5B9033C08A43048B55F88B5482448BC6FFD28B1D001040008BCB66C7030F804300034383E919894DF0C3# find addr, #8B008B388B5D088B4304# mov credirproc, $RESULT add credirproc, 0f bp credirproc eob lab2 eoe lab2 esto loc_CmpEmul: mov t, [401000] mov [t], 0e8 mov temp, EmulProc sub temp, t sub temp, 5 inc t mov [t], temp add [401000], 5 mov ecx, esi mov t, ebp add t, 0c mov edx, [t] sub t, 14 mov eax, [t] sub esp, 4 add eip, 67 mov [esp], eip mov eip, CmpEmulProc esto loc_coderedirect: mov eax, CodeRedirect mov temp, ebx add temp, 4 add CodeRedirect, [temp] add CodeRedirect, 10 sub temp, 4 mov temp, [temp] add temp, imbase log "----------------------" log "coderedirect address:" log temp log "----------------------" esto lab2: cmp eip, a1 je loc_imp cmp eip, a2 je loc_imp cmp eip, a4 je loc_imp cmp eip, a3 je loc_imp2 cmp eip, a5 je loc_imp21 cmp eip, a6 je loc_imp_ord jmp lab1 loc_imp: mov k, esp add k, 14 mov mhandle, [k] cmp mhandle, mhandle_old je loc1 mov mhandle_old, mhandle add iat_addr, 4 loc1: cmp first,0 mov first,1 je loc3 loc2: sub wr_addr,2 mov [wr_addr], #ff25# add wr_addr,2 mov [wr_addr], iat_addr_old mov [iat_addr_old], function loc3: mov wr_addr, esi mov function, eax mov iat_addr_old, iat_addr add iat_addr, 4 run loc_imp2: mov mhandle, eax cmp mhandle, mhandle_old je loc22 mov mhandle_old, mhandle add iat_addr, 4 loc22: sub wr_addr,2 mov [wr_addr], #ff25# add wr_addr,2 mov [wr_addr], iat_addr_old mov [iat_addr_old], function mov k, esp add k, 0c mov k, [k] run loc_imp21: mov l, esp sub l, 14 mov l, [l] add k, l add k, 400000 mov wr_addr, k mov k, esp sub k, 24 mov k, [k] mov function, k mov iat_addr_old, iat_addr add iat_addr, 4 // log function // log wr_addr run loc_imp_ord: mov k, esp sub k, 8 mov mhandle, [k] cmp mhandle, mhandle_old je loc_imp_ord_2 mov mhandle_old, mhandle add iat_addr, 4 loc_imp_ord_2: sub wr_addr,2 mov [wr_addr], #ff25# add wr_addr,2 mov [wr_addr], iat_addr_old mov [iat_addr_old], function mov wr_addr, eax sub k, 10 mov function, [k] mov iat_addr_old, iat_addr add iat_addr, 4 run lab_mem_check2: log "mem_check2" inc b cmp b, 2 je loc_check2 esto loc_check2: bp last esto lab_last: log "last" sub wr_addr,2 mov [wr_addr], #ff25# add wr_addr,2 mov [wr_addr], iat_addr_old mov [iat_addr_old], function mov [401000], savevar cmp ecx, 0 jne loc_stolen bprm cbase, csize eob loc_end eoe loc_end esto loc_end: Msg "OEP finded" bpmc jmp loc_clear loc_stolen: sti sti sti sti sti Msg "Scrambler(VM) removed, dump and set EP here" loc_clear: bc a1 bc a2 bc a3 bc a4 bc a5 bc a6 bc last bc mem_check2 log "-=-=-=-=-=-=-=-=-=-" log "+ script finished +" log "+ Mario555 +" log "-=-=-=-=-=-=-=-=-=-" ret
