脚本如下
/*
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
PELock 1.0x -> Bartosz Wojcik 脱壳脚本
作者 : Peaceworld
系统 : Win2K+sp4,Ollydbg 1.1,ODbgScript v1.47
日期 : 2006-04-29
作用 : 取回入口代码.修正 IAT,修正混淆代码
感谢 : 台湾网际论坛 (
www.centurys.net ) yoyo007版主协助完成,在此致谢!!
去花脚本沿用 loveboom 阁下所有,在此致谢!!
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
*/
msg "请设定忽略"整数除零"与"非法访问内存"以外的所有异常,另外:脚本执行需要一点时间,请耐心等候!!"
var addr
var iatstart
var iatlast
var iatrva
var iatsize
var counter
mov counter,11
dbh
lblesto:
cmp counter,0
je lblstart
esto
dec counter
jmp lblesto
lblstart:
mov $RESULT,[esp+4]
mov addr,$RESULT
bp addr
esto
bc addr
findop eip,#018FB8000000#
cmp $RESULT,0
je lblerr
mov addr,$RESULT
go addr
sti
mov $RESULT,[edi+b8]
mov addr,$RESULT
bp addr
esto
bc addr
lbliat:
find eip,#8919#
cmp $RESULT,0
je lblerr
mov addr,$RESULT
go addr
mov iatstart,ecx
mov iatlast,ecx
lbl0:
mov [addr],#8901#
sti
mov [addr],#8919#
cmp iatstart,ecx
ja lbliatstart
cmp iatlast,ecx
jb lbliatlast
lbliatover:
find eip,#0F8585FBFFFF#
cmp $RESULT,0
je lblerr
go $RESULT
sti
cmp eip,$RESULT
jb lbl2
find eip,#0F8451180000#
cmp $RESULT,0
je lblerr
go $RESULT
sti
cmp eip,$RESULT+6
je lbl2
jmp lblend
lbliatstart:
mov iatstart,ecx
jmp lbliatover
lbliatlast:
mov iatlast,ecx
jmp lbliatover
lbl2:
go addr
jmp lbl0
lblend:
mov addr,esp-18
bphws addr,"r"
esto
esto
esto
cgehex:
bphwc addr
findop eip,#c602e9#
cmp $RESULT,0
je lblerr
go $RESULT
mov addr,eip
mov [addr],#803E06772766817E0181F87425608BC78BFA2BC283E8058A06460FB6C883E003C1E902F3A58BC8F3A48A0661807E018D7503C602E98BC72BC283E805803AE975038942018A06460FB6C883E003C1E902F3A58BC8F3A48A064603D0C607E92BD783EA0589570183C7058BCA2BC803CF8039E974124B7405E97CFFFFFF5F8D4D662BCFF3AA61C3608BD103490183C105B8000000008BF903470283C706803FE975F5E98400000080790105742A8079010D742D8079011574308079011D74338079012574368079012D743C8079013574428079013D7448C602B889420161EB95C602B989420161EB8CC602BA89420161EB83C602BB89420161E977FFFFFF89420161E96EFFFFFFC602BD89420161E962FFFFFFC602BE89420161E956FFFFFFC602BF89420161E94AFFFFFF66813981F80F8571FFFFFFC6023D89420161E933FFFFFF#
findop eip,#c3#
cmp $RESULT,0
je lblerr
mov addr,$RESULT
bp addr
esto
bc addr
sti
lastesto:
esto
mov addr,[esp+4]
bp addr
esto
bc addr
findop eip,#8380B800000002#
cmp $RESULT,0
je lblerr
mov addr,$RESULT
go addr
sti
mov addr,[eax+b8]
bp addr
esto
bc addr
lblClearJunkCode:
mov addr,esp+8
bphws addr,"r"
esto
bphwc addr
repl eip,#E801000000??#,#E80100000090#,1000
repl eip,#E802000000????#,#E8020000009090#,1000
repl eip,#EB01??#,#909090#,1000
repl eip,#EB02????#,#90909090#,1000
repl eip,#EB03??????#,#9090909090#,1000
repl eip,#EB04????????#,#909090909090#,1000
repl eip,#C1??00#,#909090#,1000
repl eip,#72037301??#,#9090909090#,1000
repl eip,#7C037D01??#,#9090909090#,1000
tcfoep:
ticnd "eip>401000"
sub iatlast,iatstart
mov iatsize,iatlast
add iatsize,4
gmi eip, MODULEBASE
sub iatstart,$RESULT
mov iatrva,iatstart
log iatrva
log iatsize
dbs
msg "请查看 OD 纪录视窗(Alt+L)取得 IAT 相关讯息."
msg "请查看 OD 追踪视窗(Alt+V+N)取回被偷取的入口代码==>特别注意:最后一个 PUSH xxxxxx 不要使用!!."
msg "希望此脚本能为您带来方便 by-peaceworld"
cmt eip, "这是伪 OEP,请于上方填入找回的入口代码后 DUMP."
ret
lblerr:
msg "something error, sorry I can't help you!"
ret
一用脚本过不了多久就出现
Error on line 17
Text: mov $RESULT,[esp+4]
Variable '$RESULT' is not declared
请问是什么问题？
[课程]FART 脱壳王！加量不加价！FART作者讲授！
