#log
//KRYPTON0.2 code by skylly
//msg "忽略所有异常" 修复输入表, 修复ff15 call, goto oep.
var oep
var codebase
var packerbase
var iidstart
var iidsize
gpa "VirtualAlloc","kernel32.dll"
cmp $RESULT,0
je err
find $RESULT,#C2??00#
cmp $RESULT,0
je err
bp $RESULT
esto
esto
bc $RESULT
mov packerbase,eax
go packerbase
//正式进入壳代码
find eip,#8B188B7E10#
cmp $RESULT,0
je err
bp $RESULT
esto
bc $RESULT
mov codebase,edx
find eip,#83BD????????007413#
cmp $RESULT,0
je err
add $RESULT,7
bp $RESULT
esto
bc $RESULT
mov [eip],#EB# //不让它破坏函数名
mov iidstart,esi
find eip,#0F85????0000EB39#
cmp $RESULT,0
je err
mov [$RESULT],#90E9# //magic jmp
bpwm packerbase,1
esto
bpmc
mov iidsize,esi
sub iidsize,iidstart
add iidsize,14 //还要一个空白iid收尾
sub iidstart,codebase
var patch
find eip,#FFE2#
cmp $RESULT,0
je err
add $RESULT,1
//在第二个jmp edx处跳OEP
find $RESULT,#FFE2#
cmp $RESULT,0
je err
var jmpoep
mov jmpoep,$RESULT
//在无用区域,写入对特殊call的补丁代码
mov patch,$RESULT
add patch,2
mov [patch],#E8000000005B81C3100900008B133BD0740583C30AEBF583C3048B13891083C00483C304668B13668910EBBD#
find eip,#895802#
cmp $RESULT,0
je err
mov [$RESULT],#EB1890# //对特殊call作一个jmp 跳到补丁代码处
//跳OEP
bp jmpoep
esto
bc jmpoep
sti
mov oep,eip
sub oep,codebase
log oep
log iidstart
log iidsize
cmt eip,"OEP,直接dump,查看日志窗口,根据其中提示用loadpe修改dump下的文件"
ret
err:
msg "error"
ret
