首页
论坛
课程
招聘
[分享]修复IAT_Execryptor脚本
2007-4-13 17:05 6162

[分享]修复IAT_Execryptor脚本

2007-4-13 17:05
6162
在看雪论坛下载了ASProtect.2.3.6.26.Modified汉化版,光看了一个PE节,用壳用PEid扫了一下,不知是什么壳,可能是PEid的Sign库太老了,我OD原来是启动着的,后来运行了这家伙,可恶被强暴了,激动着要用OD载入调试之,就单步异常,又不是入口,很快又被踢开了,原来有Tls小刀!没接触过 execryptor (后来种种表现有点象simonzh2000兄文章提的execryptor),Hide了OD,太多单步了,糊涂地死了,又发现修改XXXXX
mov     dword ptr [ecx], 10001
mov     dword ptr [ecx], 10013
将其所有NOP之,保留 Int3 异常项,一路shit,Code解压之,待VM(后来才知叫VM)解开,同样NOP之, Code节F2内存访问断点,shit了几下中断,来到真正入口。看了一下是Delphi,再F4到第一个API调用,盲的都知道是GetModuleHandleA,返回处下了断点跟之,死得难看,几次跟踪后,发现IAT有这样的处理:1.未到OEP入口时IAT存放的是固定的VM地址和模块序号,序号的将会自动解出API替换之;2.存入VM地址的,有的会运行时解之替换,有时雷打不动。所以要在OEP处解之,必定要用VM解之!

    于是在论坛上找了些文章和脚本,抄起脚本器调试之,发现没有脚本可顺利运行到结束,Crash之或没什么反映,看来看去还是 okdodo 的脚本处理得还可以(呵呵,加壳者弄的水印),便找起Bug来,发现扫描判断有些不保险的安排!改了改它,便发现可以顺利地运行,报告可观点!

    Dump后修复OEP、IAT和Tls,kqunredf节名改回.idata,Cut掉壳的3节节省了185000h,Cut掉空的reloc节少了12000h,重新调整了资源节又少了1000h,改回对节数,保存运行之OK了!

/*
Script written by okdodo  2007/03
Tested for execryptor v2.24/v2.25

Ollyice: Ignore all exceptions (add 0EEDFADE,C0000005,C000001E)
HideOD : Check HideNtDebugBit and ZwQueryInformationProcess(method2)

Test Environment : Ollyice 1.1 + HideOD    
                   ODBGScript 1.51 under WINXP
Thanks :
         kanxue     - author of HideOD       
         hnhuqiong  - author of ODbgScript 1.51
*/

/*
  Test Environment : Ollyice 1.1 + HideOD    
                   ODBGScript 1.52 under WINXP
  test only by ASProtect.2.3.6.26.Modified by KuNgBiM && Supply: shoooo^_^(I don't konow what Packer on it, but sure can do by this script)
  fixed some bug in crash condition
  Modify by NewHand

*/

data:
    var hInstance
    var codeseg
    var vmseg
    var ep
    var oep
    var esptmp
    var _esp
    var iat_start
    var iat_end
    var iat_cur
    var addr
    var c_gpa
    var ibase
    var iend
    var temp
    var tmp
    var SBM
    var TOA
    var mbase
    var msize


code:
    bphwcall
    gpa "SetBkMode","GDI32.dll"
    mov SBM,$RESULT
    REV SBM
    mov SBM,$RESULT
    itoa SBM
    gpa "TextOutA","GDI32.dll"
    mov TOA,$RESULT
    REV TOA
    mov TOA,$RESULT
    itoa TOA

    gpa "VirtualFree","kernel32.dll"
    bphws $RESULT,"x"
    run
    bphwc $RESULT
    rtu
    gmi eip,MODULEBASE
    mov hInstance,$RESULT
    mov temp,$RESULT
    add temp,3c
    mov temp,[temp]
    add temp,hInstance
    add temp,28
    mov temp,[temp]
    add temp,hInstance
    mov ep,temp // Clear Deubuger CC on EP

    bc ep

    gmemi eip,MEMORYBASE
    mov codeseg,$RESULT
/*
    find $RESULT,#2ECC9D#
    cmp $RESULT,0
    jne @error
    mov [$RESULT],#2ECC90# // what??? Clear comment if your Target need 
*/
    gpa "EnumWindows","user32.dll"
    mov [$RESULT],#8BC09C85C09D0578563412C20800# // Enum Fail

    gpa "CreateThread","kernel32.dll"
    find $RESULT,#FF7518#
    mov [$RESULT],#6A0490#  // Suspend Child Thread

    gpa "ZwCreateThread","ntdll.dll"
    bp $RESULT

loop1:
    esto
    cmp eip,$RESULT
    jne loop1
    bc $RESULT 
    bp ep // set breakpoint on src ep

bpep:
    run // skip Load DLL
    cmp eip,ep
    je loop2
    jmp bpep

loop2:
    bc ep
    mov esptmp,esp
    sub esptmp,4    

    mov temp,codeseg
    sub temp,1
    gmemi temp,MEMORYBASE // GetPreBlockBase
    mov vmseg,$RESULT
    gmemi temp,MEMORYSIZE
    bprm vmseg,$RESULT

loop3:    
    esto
    mov tmp,eip // handle IAT API Entry
    mov tmp,[tmp]
    cmp tmp,992C008A
    jne loop5
    mov oep,eax // Get pseudo OEP
    sti
    bprm oep,1

loop4:
    esto
    cmp eip,oep
    jne loop4
    jmp iat

loop5:
    cmp esp,esptmp
    jne loop3

iat:
    bpmc
    mov oep,eip
    cmt eip,"OEP?" 
    gmi eip, MODULEBASE
    mov ibase, $RESULT
    mov temp,ibase
    add temp,3C
    mov temp,[temp]
    add temp,ibase
    add temp,50
    mov iend,[temp]
    add iend,ibase
    
    mov count,0
    mov iatbase,0
    mov mbase,codeseg
    
hwloop: 
    sub mbase,1 
    cmp mbase,ibase
    jb regnext
    gmemi mbase,MEMORYBASE
    mov mbase,$RESULT
    gmemi msize,MEMORYSIZE
    mov msize,$RESULT
    mov temp,mbase

    cmp iatbase,0
    jne vmsegloop
    eval #{SBM}#
    find temp,$RESULT
    cmp 0,$RESULT
    je findTextOutA
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT
    jmp vmsegloop

findTextOutA:
    cmp iatbase,0
    jne vmsegloop
    eval #{TOA}#
    find temp,$RESULT
    cmp 0,$RESULT
    je vmsegloop
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT

vmsegloop:
    find temp,#0355FC03C28B000345FC#
    mov tmp, $RESULT
    cmp tmp,0
    je regged
    add tmp,0A
    bphws tmp,"x"
    mov temp,tmp
    mov c_gpa,tmp 
    inc count
    jmp vmsegloop

regged:
    cmp count,0
    jne hwloop

regnext:
    mov mbase,codeseg
 
hwloop1: 
    sub mbase,1 
    cmp mbase,ibase
    jb @iatinit
    gmemi mbase,MEMORYBASE
    mov mbase,$RESULT
    mov temp,mbase

    cmp iatbase,0
    jne vmsegloop1
    eval #{SBM}#
    find temp,$RESULT
    cmp 0,$RESULT
    je findTextOutA1
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT
    jmp vmsegloop1

findTextOutA1:
    cmp iatbase,0
    jne vmsegloop1
    eval #{TOA}#
    find temp,$RESULT
    cmp 0,$RESULT
    je vmsegloop1
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT

vmsegloop1:
    find temp,#0345FC8945F48B45F4#
    mov tmp, $RESULT
    cmp tmp,0
    je hwloop1
    add tmp,3
    bphws tmp,"x"
    mov temp,tmp
    mov c_gpa,tmp
    inc count 
    jmp vmsegloop1

@iatinit:
    cmp iatbase,0
    je @error
    cmp count,0
    je @error
    gmemi iatbase,MEMORYSIZE
    mov iat_end,$RESULT
    add iat_end,iatbase
    sub iat_end,4
    mov _esp,esp
    mov iat_cur,iatbase
    sub iat_cur,4
    mov count,0    
    pause
@ImpInc:  
    add iat_cur,4
    cmp iat_cur,iat_end
    ja @end
    mov addr,[iat_cur]
    cmp addr,0
    je @ImpInc
    gn addr
    cmp $RESULT,0 // There is Real Api!
    jne @ImpInc
    cmp count,0
    jne @next
    mov iat_start,iat_cur
    log iat_start

@next:
    cmp addr,iatbase
    jb @error2
    cmp addr,iend
    jae @error2
    cmp addr,iat_end
    je @end
    inc count
    mov temp,iat_cur
    mov esp,_esp
    mov eip,addr
    mov [esp],eip  
    esto    
    mov [iat_cur],eax    
    jmp @ImpInc

@end:
    mov iat_end,temp
    add temp,8
    cmp [temp],0
    je @exit
    sub temp,4
@IsApi:
    add temp,4
    gn [temp]
    cmp $RESULT,0
    jne @IsApi
    cmp [temp],0
    jne @error
    add temp,4
@exit:
    sub temp, iat_start
    bphwcall
    log iat_end
    mov eip,oep
    eval "IAT Begin: {iat_start}   IAT End: {iat_end}   Size: {temp} "
    msg $RESULT   
    msg "Script ends ok!  Find the OEP manually and dump it~"
    ret

@error:
    bphwcall
    msg "ERROR!"
    ret 
@error2:
    eval "May be [{iat_cur}]-> {addr}: IAT has some problem or Other data!"
    msg $RESULT
    mov iat_end, iat_cur
    mov temp, iat_end 
    jmp @exit

@MayEnd:
    mov iat_end, iat_cur
    sub iat_end, 4
    mov temp, iat_end
    jmp @exit  

[2023春季班]《安卓高级研修班(网课)》月薪两万班招生中~

收藏
点赞0
打赏
分享
最新回复 (5)
雪    币: 170
活跃值: 活跃值 (18)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
yzjsdn 活跃值 2007-4-13 17:42
2
0
,GOOD~
雪    币: 201
活跃值: 活跃值 (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
deardream 活跃值 2007-6-28 20:08
3
0
很好用啊,,,,谢谢
雪    币: 200
活跃值: 活跃值 (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
dtfable 活跃值 2007-8-9 11:42
4
0
学习中谢谢提供
雪    币: 201
活跃值: 活跃值 (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
deardream 活跃值 2007-9-3 13:26
5
0
谢谢,似乎好用了不少,不过运行到最后出现了一个错误。。。。

请问该怎么弄呢?搜索论坛发现有高手说要 删除所有date,,,date是日期吗?在哪删。。。
上传的附件:
  • 1.JPG (26.94kb,216次下载)
雪    币: 200
活跃值: 活跃值 (11)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
qintomb 活跃值 2007-9-13 16:59
6
0
谢谢!下载来试试看。
游客
登录 | 注册 方可回帖
返回