arm3.7std_release.txt

masm 调试工具

/*
Script written by VolX
Debugging options: Tick all items in Debugging Options-Exceptions 
                   and add C000001D..C000001E in custom exceptions
Test Environment : 1.OllyDbg 1.1b & 1.1C 
                   2.OllyScript 0.71, 0.81 .
                   3.OS -- WINXP & WIN2K SP3
Thanks : Oleh Yuschuk - author of OllyDbg
         SHaG - author of OllyScript
*/

var j
var k
var l
var m
var y
var z
var ori1
var ori2
var ori3
var paddr1
var paddr2
var paddr3
var imgbase
var decryptcall
var dllimgbase
var dll1stend
var backstep
var relocva
var relocstk
var min
var splitva
var codesplit
var Elimination
var autofill

mov [ebx],#00000000#
gmi eip,MODULEBASE     //get imagebase
mov imgbase,$RESULT
mov k,imgbase
add k,3C              //40003C
mov k,[k]
add k,imgbase         //j=signature VA
add k,f8              //1st section
add k,28             //2nd section
add k,28             //3rd section
add k,28             //4th section
add k,28             //5th section
add k,28             //6th section
mov m,2

loc11:
mov l,[k]
cmp l,7461642E      //".dat" ? check if it is .data1 section
jne loc12
add k,4
mov l,[k]
cmp l,00003161     //"a1  " ?
je loc13


loc12:
cmp m,0 
je loc15              //can't find the .data1 section
add k,28 
sub m,1
jmp loc11

loc13:
sub k,4
add k,8
mov j,[k]
cmp j,20000     //check if VSize=20000
je loc14
jmp loc15

loc14:
mov autofill,1
add k,4
mov m,[k]       //get the VOffset
add m,imgbase   //get the VA 
add m,10000
mov splitva,m

loc15:
gpa "CreateFileMappingA", "kernel32.dll"
bphws $RESULT, "x"
eoe lab2
eob lab2
run

lab2:
bphwc $RESULT
gpa "time", "msvcrt.dll"
mov j, $RESULT
bp j
gpa "VirtualProtect", "kernel32.dll"
bp $RESULT
eob lab3
eoe lab3
esto

lab3:
bc $RESULT
bc j
cmp eip,j             //check if it break on time API 
jne lab31             //jump if not equal which means no code splicing
eob lab32
rtu

lab31:
eob lab4
rtu

lab32:
findop eip,#250000FF#
cmp $RESULT,0
je lab4               //jump if equal which means no code splicing
mov codesplit,1

lab4:
mov j,eip
and j,0fff0000
mov l,2
lab41:
cmp l,0
je error
sub j,10000
mov k,[j]
cmp k,00905A4D  //e_magic ?
je lab42
sub l,1
jmp lab41

lab42:
mov dllimgbase,j
log dllimgbase
add j,014AC
mov decryptcall,j
log decryptcall
cmp codesplit,1       //check if code splicing is used
jne lab52             //jump if no code splicing 
findop eip,#250000FF#
mov j,$RESULT
add j,b
mov paddr1,j
mov ori1,[j]
mov [j],51
add j,52
bp j
eob lab5
run

lab5:
bc j
mov [paddr1],ori1     //restore original code
cmp autofill,1        //check if auto filling code splicing VA 
je lab51
msg "Edit the EAX to an address for the splicing code and then press resume"
pause
mov splitva,eax
jmp lab52

lab51:
mov eax,splitva

lab52:
gpa "strchr", "msvcrt.dll"
bp $RESULT
eoe lab6
eob lab6
esto

lab6:
bc $RESULT
eoe lab7
eob lab7
rtr

lab7:
sti
//pause
findop eip,#8908#     //search "MOV DWORD PTR DS:[EAX],ECX"
mov z,$RESULT
findop eip,#80A5#     //search "AND BYTE PTR SS:[EBP-1750],0"
log $RESULT
mov j,$RESULT
add j,9
mov j,[j]
and j,0ffff
add j,ebp
sub j,10000
mov relocstk,j
log relocstk
mov j,[j]
mov relocva ,j
log relocva
cmp relocva,0         //check if import table elimination is used
je lab101             //jump if not used
mov Elimination,1
mov j,eip
sub j,90
findop j,#EBCA#
mov backstep,$RESULT
add backstep,2
log backstep
findop eip,#C1E802#   //search "SHR EAX,2"
mov j,$RESULT
add j,5
mov ori1,[j]
findop z,#8908#       //search "MOV DWORD PTR DS:[EAX],ECX"
mov y,$RESULT
mov j,y
sub j,4
mov ori2,[j]
mov paddr1,j  
mov [j],ori1
sub j,6
mov ori3,[j]
mov j,y
add j,b
mov paddr2,j   
mov k,dllimgbase
add k,3C              
mov k,[k]
add k,dllimgbase         //j=signature VA
add k,f8                 //1st section
add k,0C
mov l,[k]
add k,4
mov j,[k]
add j,dllimgbase
add j,l
mov dll1stend,j
sub j,100
mov paddr3,j        //store addr for putting patch code
mov [j],#8985#
add j,2
mov [j],ori3
add j,4
mov [j],#FF85#
add j,2
mov [j],ori1
add j,4
mov k,j
mov l,paddr2
add l,6
sub k,l
mov m,10000
sub m,k
sub m,5
mov [j],#E9#
add j,1
mov [j],m
add j,2
mov [j],#FFFF#
mov j,paddr2
mov k,paddr3
sub k,j
sub k,5
mov j,paddr2
mov [j],#E90000000090#
add j,1
mov [j],k
findop paddr2,#FF15#
mov y,$RESULT
add y,b
bp y
eob lab8
run

lab8:
bc y
mov j,eip
add j,18
mov eip,j
mov [paddr1],ori2
mov j,paddr2
mov [j],#8985#
add j,2
mov [j],ori3
mov j,paddr3
mov [j],#0000000000000000000000000000000000000000#
findop eip,#E9#
mov j,$RESULT
add j,5
bp j
eob lab9
run

lab9:
bc j
mov eip,backstep
mov [relocstk],00000000   //emulate no import table elimination

lab91:
findop eip,#0FBE00#   //look for addr to chk FirstThunk for comparison
mov j,$RESULT
add j,14
mov y,j
bp y
eob lab10
run

lab10:
mov min,eax               //store FirstThunk

lab101:
mov ori1,[z]
mov [z],#9090#            //nop the gabage btw dll filling code
findop z,#595940#
mov j,$RESULT
add j,10
mov paddr1,j
mov ori2,[j]
mov [j],#EB#              //patch magic jump
findop paddr1,#0F84#
bp $RESULT
cmp Elimination,0         //check if import table elimination is not used
je lab102                 //jump if it is not used
eob lab12
run

lab102:
eob lab131
run

lab12:
cmp eip,y
je lab121
jmp lab13

lab121:
mov j,eax
cmp min,j
jb less
mov min,j
less:
eob lab12
run

lab13:
bc y

lab131:
bc $RESULT
//log min
mov [z],ori1             //restore original code
mov [paddr1],ori2        //restore original code
bp decryptcall
mov k,3
eob lab14
run

lab132:
sub k,1
eob lab14
eoe lab14
esto

lab14:
cmp k,0
jne lab132
eob lab15
rtr

lab15:
bc decryptcall
sti
cmp Elimination,0     //check if import table elimination is used
je lab181             //jump if not
findop eip,#EBCA#
mov j,$RESULT
add j,2
bp j
eob lab16
run

lab16:
bc j
mov j,relocstk
mov [j],relocva
findop eip,#0FB685#
mov j,$RESULT
add j,9
bp j
eob lab17
run

lab17:
bc j
cmp !ZF,1   //some Arm program will encrypt the import table section so better check it
je lab171
msg "Copy the section contains import table then press resume"
pause
sti
msg "Paste the data back to the section contains import table then press resume"
pause

lab171:
findop eip,#8908#     //search "MOV DWORD PTR DS:[EAX],ECX"
mov y,$RESULT
add y,7
bp y
mov j,$RESULT
sub j,6
mov paddr2,j
mov ori2,[paddr2]
mov [j],#E90000000090#
mov k,paddr3
sub k,j
sub k,5
add j,1
mov [j],k
mov j,paddr3
mov [j],ori2
add j,4
mov [j],#FFFF5350BB000000008B098D048B8BC8585BE9#
add j,5
mov k,min
add k,imgbase
mov [j],k
mov l,paddr2
add l,6
mov k,paddr3
add k,16
sub k,l
mov m,10000
sub m,k
sub m,5
add j,0e
mov [j],m
add j,2
mov [j],#FFFF#
eob lab18
run

lab18:
bc y

lab181:
findop eip,#2BF9FFD7#
mov j, $RESULT
add j,2
bp j
eob lab19
run

lab19:
bc j
sti
msg "OEP arrived! You can dump the file and fix the IAT"
log codesplit
log splitva
log Elimination
pause
jmp end

error:
msg "error"

end:
ret