2009年05月07日 星期四 上午 00:40//vmp 1.7 iat repair
//run the script at oep
//vmp code base = va of .vmp0
//vmp code end = va of .vmp1
//if the program crashes, check log and make sure "mov reg32, [iat]" references are correctly fixed!
var codebase
var refaddr
var vmpbase
var vmpend
var ptr
var tmpesp
var oep
var tmp
var codesize
var isfirst
var phase
mov oep, eip
GMI eip, CODEBASE
mov codebase, $RESULT
mov ptr, codebase
GMI eip, CODESIZE
mov codesize, $RESULT
Ask "vmp code base"
mov vmpbase, $RESULT
Ask "vmp code end"
mov vmpend, $RESULT
mov tmpesp, esp
next:
mov esp, tmpesp
cmp phase, 0
jne findcall
find ptr, #E9??????00#
jmp check
findcall:
find ptr, #E8??????0090#
check:
cmp $RESULT,0
je done
cmp $RESULT, vmpbase
ja done
mov ptr, $RESULT
mov eip, ptr
inc ptr
mov tmp, [ptr]
add tmp, eip
cmp tmp, vmpbase
jb next
cmp tmp, vmpend
ja next
mov refaddr, ptr
cmp isfirst, 0
jne fuck
firstfuck:
sti
find eip,#c2#,1
cmp $RESULT,0
je firstfuck
bphws eip, "x"
inc isfirst
jmp fix
fuck:
run