var Map
var Temp
var CloseHandle
var MapViewOfFile
var GetEnvironmentVariableA
var MagicOccasion
var FindOEP
var ImageBase
var PE_Signature
var SizeOfImage
var NumberOfSections
var GetNumberOfSections
MSGYN "Plz Clear All BreakPoints + Set Debugging Option Ignore All Excepions Options + Set Events Make first pause at Entry Point !"
cmp $RESULT, 0
je TryAgain
add Temp,0CA
mov [Temp],#00000000000000000000000000000000#
//Clear Bound Import Table and Import Address Table's Address And Size.
MSG "Plz Set LordPE->Option->Task View ->Select " Full Dump: force RAW mode " Only ! "
Dump:
MSGYN " OK , plz dump it now ! Dump file will be fixed ! Don't click " Y " before dump . "
cmp $RESULT, 0
je Dump
var Map
var Temp
var VirtualAlloc
var SetEnvironmentVariableA
var MagicOccasion
var FindOEP
var ImageBase
var PE_Signature
var SizeOfImage
var NumberOfSections
var GetNumberOfSections
MSGYN "Plz Clear All BreakPoints + Set Debugging Option Ignore All Excepions Options + Set Events Make first pause at Entry Point !"
cmp $RESULT, 0
je TryAgain
find Map,#F3A56A38598DB5????????8B7D??F3A5A1????????250000800085C00F848F000000#
cmp $RESULT,0
je NoFind
add $RESULT,2
mov GetNumberOfSections,$RESULT
bp GetNumberOfSections
pause
eob GetNumberOfSections
esto
GoOn2:
esto
GetNumberOfSections:
cmp eip,GetNumberOfSections
jne GoOn2
bc GetNumberOfSections
mov Temp,PE_Signature
add Temp,6
mov NumberOfSections,[Temp]
log NumberOfSections
//MagicOccasion――――――――――――――――――――――――――――――――
/*
7FF61821 FF75 DC push dword ptr ss:[ebp-24]
7FF61824 E8 FB2AFFFF call 7FF54324
7FF61829 834D DC FF or dword ptr ss:[ebp-24],FFFFFFFF
7FF6182D 8B45 0C mov eax,dword ptr ss:[ebp+C]
7FF61830 8B00 mov eax,dword ptr ds:[eax]
7FF61832 83E0 02 and eax,2
7FF61835 85C0 test eax,eax
*/
find Map,#FF????E8????????83??????8B????8B0083E00285C0#
cmp $RESULT,0
je NoFind
mov MagicOccasion,$RESULT
bp MagicOccasion
eob MagicOccasion
esto
GoOn3:
esto
MagicOccasion:
cmp eip,MagicOccasion
jne GoOn3
bc MagicOccasion
MSG "Plz Set LordPE->Option->Task View -> Only Select " Full Dump: force RAW mode " ! "
Dump:
MSGYN " OK , plz dump it now ! Dump file will be fixed ! Don't click " Y " before dump . "
cmp $RESULT, 0
je Dump
esti
thinstall hook了一部分win32api,如FindFirstFileA, CreateFileA...
而这一部分iat没有在unpack.exe中正确恢复
所以会出现一些对话框
如:File does not exists:c:\program files\thinstall/resource/install.scm