//Script for yoda's Protector v1.01
//by cyclotron [BCG][DFCG][FCG][OCN]
//收集IAT
//━━━━━━━━━━━━━━━━━━━━━━━━━━━
gpa "Process32Next","kernel32.dll"
bp $RESULT
run //F9
bc $RESULT //clear bp
rtu //run to user code
find eip,#3BC374# //cmp eax,ebx
add $RESULT,2 //next instruction
bp $RESULT
run
bc $RESULT
mov !ZF,1 //置Z标志
//━━━━━━━━━━━━━━━━━━━━━━━━━━━
gpa "Process32Next","kernel32.dll"
bp $RESULT
run //F9
bc $RESULT //clear bp
rtu //run to user code
find eip,#3BC374# //cmp eax,ebx
add $RESULT,2 //next instruction
bp $RESULT
run
bc $RESULT
mov !ZF,1 //置Z标志
//━━━━━━━━━━━━━━━━━━━━━━━━━━━
gpa "Process32Next","kernel32.dll"
bp $RESULT
run //F9
bc $RESULT //clear bp
rtu //run to user code
find eip,#3BC374# //cmp eax,ebx
add $RESULT,2 //next instruction
bp $RESULT
run
bc $RESULT
mov !ZF,1 //置Z标志
//━━━━━━━━━━━━━━━━━━━━━━━━━━━
gpa "LoadLibraryA","kernel32.dll"
bp $RESULT
run //F9
bc $RESULT //clear bp
rtu //run to user code
gpa "GetProcAddress","kernel32.dll"
bp $RESULT
run //F9
bc $RESULT //clear bp
rtu //run to user code
//━━━━━━━━━━━━━━━━━━━━━━━━━━━
bp 451599
run
bc 451599
asm eip,"MOV DWORD PTR [EDX],EAX"
add eip,2
bp eip
run
msg "IAT收集开始"
pause
//Script for yoda's Protector v1.01
//by cyclotron [BCG][DFCG][FCG][OCN]
//直取OEP
//━━━━━━━━━━━━━━━━━━━━━━━━━━━
gpa "Process32Next","kernel32.dll"
bp $RESULT
run //F9
bc $RESULT //clear bp
rtu //run to user code
find eip,#3BC374# //cmp eax,ebx
add $RESULT,2 //next instruction
bp $RESULT
run
bc $RESULT
mov !ZF,1 //置Z标志
//━━━━━━━━━━━━━━━━━━━━━━━━━━━
gpa "Process32Next","kernel32.dll"
bp $RESULT
run //F9
bc $RESULT //clear bp
rtu //run to user code
find eip,#3BC374# //cmp eax,ebx
add $RESULT,2 //next instruction
bp $RESULT
run
bc $RESULT
mov !ZF,1 //置Z标志
//━━━━━━━━━━━━━━━━━━━━━━━━━━━
gpa "Process32Next","kernel32.dll"
bp $RESULT
run //F9
bc $RESULT //clear bp
rtu //run to user code
find eip,#3BC374# //cmp eax,ebx
add $RESULT,2 //next instruction
bp $RESULT
run
bc $RESULT
mov !ZF,1 //置Z标志
//━━━━━━━━━━━━━━━━━━━━━━━━━━━
var cbase
gmi eip,CODEBASE
mov cbase,$RESULT
var csize
gmi eip,CODESIZE
mov csize,$RESULT
bprm cbase,csize //内存读断点
run
bpmc
pause
