/*
///////////////////////////////////////////////////////////////////////////////
脚本 : VP1.XX-Vprotect 1.84 Unpacker
调试选项 : 1.设置 OllyDbg 忽略所有异常选项
2.使用海风月影全选项.
3.去掉'选项-调试设置-地址-解析修饰符号名称' 前面的勾,然后重新打开OD.跑脚本.(必须)
4.使用PhantOm保护DRX。
工具 : OllyDbg1.1, ODBGScript 1.65
感谢 : 感谢KISSY 的脚本，感谢苦力的DLL源码，感谢那些曾经帮助我的人!
////////////////////////////////////////////////////////////////////////////////////
var getapi
var write
var addr
var dword
var vpro
var rapi
var dllname
var apiname
var imgbase
var imgbasefromdisk
var sizeofimg
var tmp1
var tmp2
var tmp3
var secbase
var secsize
var logfile
var oep
var fixtype
var typeadd
var typexor
var typenot
var vmiataddr
mov logfile,"FakIat.txt"
/////////////////////////
//配置区
/////////////////////////
mov vmexit,008D21ED //VM出口
mov oep,0069C168
mov write,008AC492 //填充函数
mov typeadd,008A8F41 //对IAT进行SUB处理的地址
mov typexor,008AA673 //对IAT进行xor处理的地址
mov typenot,008AC257 //对IAT进行not处理的地址
/////////////////////////
cmp $VERSION, "1.64"
jb odbgver
GMI eip, MODULEBASE
mov imgbase, $RESULT
mov tmp1, [imgbase+3C]
add tmp1, imgbase
mov signVA, tmp1
mov imgbasefromdisk, [signVA+34]
mov sizeofimg, [signVA+50]
mov tmp1, signVA
add tmp1, f8
mov tmp2, 0
mov tmp2, [signVA+6], 2
wrta logfile,tmp2
wrta logfile,"\r\n"
last:
mov secsize, [tmp1+8]
mov tmp3, [tmp1+0C]
add tmp3, imgbase
mov secbase, tmp3
wrta logfile,secbase
wrta logfile,"\r\n"
wrta logfile,secsize
wrta logfile,"\r\n"
cmp tmp2, 1
je lab1
add tmp1, 28
sub tmp2, 1
jmp last
lab1:
cmp imgbasefromdisk, imgbase
je lab1_1
jmp error
lab1_1:
bc
start:
bp vmexit
cmp eip,oep
je exit
cmp eip,write
je findkey
cmp eip,typeadd
je findkey
cmp eip,typexor
je findkey
cmp eip,typenot
je findkey
esto
len [ecx]
cmp $RESULT,8
jb start
scmpi [ecx],"ole32.dll"
je loopfix
scmpi [ecx],"advapi32.dll"
je loopfix
scmpi [ecx],"user32.dll"
je loopfix
scmpi [ecx],"kernel32.dll"
je loopfix
cmp [ecx],"oleaut32.dll"
je loopfix
scmpi [ecx],"advapi32.dll"
je loopfix
cmp [ecx],"uxtheme.dll"
je loopfix
scmpi [ecx],"ws2help.dll"
je loopfix
cmp [ecx],"ws2_32.dll"
je loopfix
scmpi [ecx],"winspool.dll"
je loopfix
cmp [ecx],"MSCTFIME.dll"
je loopfix
scmpi [ecx],"shell32.dll"
je loopfix
cmp [ecx],"shlwapi.dll"
je loopfix
scmpi [ecx],"GDI32.dll"
je loopfix
cmp [ecx],"rpcrt4.dll"
je loopfix
scmpi [ecx],"secur32.dll"
je loopfix
cmp [ecx],"msvcrt.dll"
je loopfix
scmpi [ecx],"version.dll"
je loopfix
cmp [ecx],"comctl32.dll"
je loopfix
scmpi [ecx],"iphlpapi.dll"
je loopfix
cmp [ecx],"imagehlp.dll"
je loopfix
scmpi [ecx],"psapi.dll"
je loopfix
cmp [ecx],"msctf.dll"
je loopfix
scmpi [ecx],"msimg32.dll"
je loopfix
cmp [ecx],"imm32.dll"
je loopfix
scmpi [ecx],"comdlg32.dll"
je loopfix
scmpi [ecx],"ntdll.dll"
jne start
loopfix:
esto
bp typeadd
bp typexor
bp typenot
bp oep
len [ecx]
cmp $RESULT,0
je loopfix
sub $RESULT,4
readstr [ecx],$RESULT
mov dllname,$RESULT
len [edx]
cmp $RESULT,0
je loopfix
readstr [edx],$RESULT
mov apiname,$RESULT
esto
esto
esto
esto
add eax,ecx
add eax,7
mov addr,eax
mov dword,[addr+7]
sub eax,7
sub eax,ecx
cmp dword,0
je start
mov fixtype,0
wrta logfile,addr
wrta logfile,","
wrta logfile,dword
wrta logfile,","
wrta logfile,dllname
wrta logfile,","
wrta logfile,apiname
wrta logfile,","
wrta logfile,fixtype
wrta logfile,"\r\n"
jmp start
goon:
cmp eip,oep
je exit
bp typeadd
bp typexor
bp typenot
bp write
bp oep
esto
findkey:
cmp eip,oep
je exit
cmp eip,typeadd
je addkey
cmp eip,typexor
je xorkey
cmp eip,typenot
je notkey
jmp goon
addkey:
mov fixtype,0
mov dword,[eax+ecx+10]
gn edx
mov dllname,$RESULT_1
mov apiname,$RESULT_2
cmp $RESULT,0
je goon
bc eip
bp write
esto
bc eip
mov addr,edx
jmp writetxt2
xorkey:
mov fixtype,2
mov dword,[eax+edx+10]
gn ecx
mov dllname,$RESULT_1
mov apiname,$RESULT_2
cmp $RESULT,0
je goon
bc eip
bp write
esto
bc eip
mov addr,edx
jmp writetxt2
notkey:
mov fixtype,1
mov dword,edx
gn edx
mov dllname,$RESULT_1
mov apiname,$RESULT_2
cmp $RESULT,0
je goon
bc eip
bp write
esto
bc eip
mov addr,edx
writetxt2:
wrta logfile,addr
wrta logfile,","
wrta logfile,dword
wrta logfile,","
wrta logfile,dllname
wrta logfile,","
wrta logfile,apiname
wrta logfile,","
wrta logfile,fixtype
wrta logfile,"\r\n"
jmp goon
error:
msg "dll不支持."
RET
odbgver:
msg "ODSCR版本要大于1.65"
ret
exit:
bc
bphwc
ret
