#log
//sd protector
//code by skylly
msg "忽略所有异常"
var seccount
var secaddr
var oep
var codebase
var elfnew
var ntheader
var oepaddr
var iidaddr
var iidsizeaddr
var iidstart
var iidsize
var neediat
mov neediat,0 //这个标志位是调试iat用的
var ccccadr
var eipvar
var issd
var EP
mov EP,eip
var temp
mov temp,eip
mov temp,[temp]
and temp,FF
cmp temp,55
je sd
mov issd,0
jmp api
sd:
mov issd,1
api:
gpa "VirtualProtectEx","kernel32.dll"
cmp $RESULT,0
je err
find $RESULT,#C2??00#
cmp $RESULT,0
je err
var VirtualProtect
mov VirtualProtect,$RESULT
gpa "GetSystemInfo","kernel32.dll"
cmp $RESULT,0
je err
var GetSystemInfo
mov GetSystemInfo,$RESULT
find GetSystemInfo,#7C20#
cmp $RESULT,0
je err
mov [$RESULT],#EB#
find GetSystemInfo,#C2??00#
cmp $RESULT,0
je err
mov GetSystemInfo,$RESULT
gpa "GetVersion","kernel32.dll"
cmp $RESULT,0
je err
find $RESULT,#C3#
cmp $RESULT,0
je err
var GetVersion
mov GetVersion,$RESULT
gpa "CreateFileA","kernel32.dll"
cmp $RESULT,0
je err
find $RESULT,#C2??00#
cmp $RESULT,0
je err
var CreateFileA
mov CreateFileA,$RESULT
gpa "CloseHandle","kernel32.dll"
cmp $RESULT,0
je err
find $RESULT,#C2??00#
cmp $RESULT,0
je err
var CloseHandle
mov CloseHandle,$RESULT
allstart:
bp GetVersion
esto
esto
esto
bc GetVersion
mov eax,80000000
bp CreateFileA
esto
cmp eip,CreateFileA
jne err
bc CreateFileA
rtu
bp CloseHandle
esto
bc CloseHandle
cmp eip,CloseHandle
jne err
rtu
rtr
//查找转单线程地址
var single
find eip,#837C24??01#
cmp $RESULT,0
je start
var single1
mov single1,$RESULT
add $RESULT,1
find $RESULT,#837C24??01#
cmp $RESULT,0
je start
mov single,$RESULT
log single
log single1
start:
//查找转单进程地址
find EP,#0F84????0000E8010000#
cmp $RESULT,0
je err
log $RESULT
mov ccccadr,$RESULT
bphws $RESULT,"x"
bp GetVersion
esto
bphwc $RESULT
bc GetVersion
cmp eip,GetVersion
jne singlepro
//这里是单进程程序的特殊处理
msg "这是单进程程序"
rtu
jmp sdproiat
singlepro:
//转单进程
mov !ZF,1
msg "转换为单进程"
var iataddr
mov ccccadr,eip
//查找iat 判断地址
find eip,#8B8424????000085C00F#
cmp $RESULT,0
je err
mov iataddr,$RESULT
//softdefender
bp GetSystemInfo
bprm iataddr,1
jmp sdproiat
good:
esto
cmp eip,GetSystemInfo
je sing
cmp eip,iataddr
je iatpro
jmp good
iatpro:
bphwc iataddr
bpmc
var temp
var espvar
mov espvar,esp
mov temp,eip
add temp,3
mov temp,[temp]
add espvar,temp
//iat 保护
mov [espvar],0
jmp sdproiat
ret
sing:
//处理转换单线程
sti
cmp eip,70000000
ja good
msg "转单线程"
log eip
var addr
mov addr,esp
sub addr,4
mov addr,[addr] //让外壳认为不是单CPU
add addr,14
mov [addr],0
var count
inc count
cmp count,2
je final
cmp issd,1
je sdproiat
jmp good
ret
sdproiat:
bc GetSystemInfo
bp GetVersion
//mov eipvar,eip
//sub eipvar,1000
find EP,#03F5# //#03F589??24??E8#
cmp $RESULT,0
je err
var iid
mov iid,$RESULT
mov iataddr,0
bprm iid,1
gogo:
esto
cmp eip,GetVersion
je gogo
cmp eip,GetSystemInfo
je sing
cmp eip,iataddr
je iatpro
cmp eip,iid
jne gogo
log iid
bpmc iid
msg "下面开始处理输入表"
bpmc
var crcaddr
var iidend
var procend
var oldprcend
//自校验1
find EP,#5F5E85C05B#
cmp $RESULT,0
je err
mov crcaddr,$RESULT
add crcaddr,5
mov [crcaddr],#EB#
log crcaddr
//iid结束
find eip,#83??148B#
cmp $RESULT,0
je err
find $RESULT,#E9????FFFF#
cmp $RESULT,0
je err
mov iidend,$RESULT
add iidend,5
bp iidend
bphws VirtualProtect,"x"
final:
//找OEP了
bc GetSystemInfo
bp GetVersion
bpwm ccccadr,1
esto
cmp eip,GetVersion
je final
cmp eip,VirtualProtect
jne ending
bphwc VirtualProtect
rtu
find eip,#83C4??C3#
cmp $RESULT,0
je err
sub $RESULT,4
//绕开壳的 ANTI-DUMP
mov eip,$RESULT
//绕开壳偷OEP代码
find EP, #8854241C#
cmp $RESULT,0
je final
bphws $RESULT,"x"
esto
bphwc $RESULT
cmp eip,$RESULT
jne err
mov oep,esi
sub oep,codebase
find eip,#755A#
cmp $RESULT,0
je err
go $RESULT
mov !ZF,0
find eip,#7415#
cmp $RESULT,0
je err
go $RESULT
mov !ZF,0
find eip,#0F85??000000#
cmp $RESULT,0
je err
go $RESULT
mov !ZF,0
jmp final
ending:
//这个GetVersion用于奇怪的延时
bphwc VirtualProtect
bc GetVersion
bpmc
sti
sto
var nowcode
lop:
sti
mov nowcode,eip
mov nowcode,[nowcode]
and nowcode,FF
cmp nowcode,C3 //retn
//自动走retn
je lop
cmp nowcode,9C //pushfd sdprotector会是这个
jne allend
sti
var espvar
mov espvar,esp
bphws espvar,"r"
esto
esto
bphwc espvar
jmp lop
allend:
mov oep,eip
sub oep,codebase
log iidstart
log iidsize
log oep
msg "dump(去掉粘贴PE头选项)"
mov [oepaddr],oep
ret
err:
msg "err"
ret