execryptor_2.xx_oep_finder_+_iat_repair_v1.02sc.txt

ExetCryptor Unpacker

/*
脚本版本 : v1.02SC
调试环境 : OllyDbg 1.1(修改版), ODBGScript 1.52, HideOD V0.17, WINXP
调试选项 : 设置 OllyDbg 除了 INT 3 异常选项, 忽略所有异常选项 .

*/

var codeseg
var tmp1
var tmp2
var tmp3
var tmp4
var tmp5
var tmp6
var tmp7
var tmp8
var tmp9
var imgbase
var signVA
var 1stsecsize
var 1stsecbase
var lastsecbase
var lastsecsize
var rangeaddr
var range
var SizeofImage
var fs30
var LoaderData
var ESP_EP
var EPAddr
var codeloc
var hOEP
var Delphi10
var BCB
var RTaddr
var CTpatch
var kfreeloc
var RPMpatch
var ZCpatch
var newZCaddr
var config1
var noncrypted
var caller

//IAT fix
var _esp
var iat_start
var iat_end
var iat_cur
var addr
var iatsecsize
var iend
var mbase
var msize
var iatcrypted
var v22x
var ori1
var ori2

cmp $VERSION, "1.52"
jb odbgver
BPHWCALL
mov tmp1, eax
mov tmp2, eip
gpa "IsDebuggerPresent", "kernel32.dll"
mov tmp3, $RESULT
cmp tmp3, 0
je @error
mov eip, tmp3
sti
sti
mov fs30, eax        //PEB
sti
mov eip, tmp2
mov eax, tmp1
mov LoaderData, [fs30+0c]
mov tmp2, [fs30+8]     //PEB+8 ImageBaseAddress
mov imgbase, tmp2
log imgbase
mov tmp1, [imgbase+3C]    //40003C
add tmp1, imgbase         //tmp1=signature VA
mov signVA, tmp1
mov tmp2, [signVA+28]
add tmp2, imgbase
mov EPAddr, tmp2
log EPAddr                  //EP
gmemi EPAddr,MEMORYBASE
mov codeseg,$RESULT
mov SizeofImage, [signVA+50]
log SizeofImage
mov 1stsecsize, [signVA+100]
log 1stsecsize
mov 1stsecbase, [signVA+104]
mov [signVA+2c], 1stsecbase
add 1stsecbase, imgbase
log 1stsecbase
mov tmp1, signVA
add tmp1, f8             //1st section
mov tmp2, [signVA+6], 2

last:
cmp tmp2, 1
je lastfound
add tmp1, 28
sub tmp2, 1
jmp last

lastfound:
add tmp1, 8
mov lastsecsize, [tmp1]
add tmp1, 4
mov tmp3, [tmp1]
add tmp3, imgbase
mov lastsecbase, tmp3

mov tmp2, [signVA+C0]     //TLS table
add tmp2, imgbase
mov tmp1, [tmp2+0C]
mov tmp3, [tmp1]
log tmp3, "CallBackTableVA "
mov tmp1, tmp3
sub tmp1, EPAddr
cmp tmp1, 10
jb lab1
mov config1, 1
   
lab1:
//log config1
BPHWS tmp3, "x"
run
BPHWC tmp3
gpa "CreateThread", "kernel32.dll"
mov tmp1, $RESULT
GMEMI tmp1, MEMORYBASE
mov tmp2, $RESULT
GMEMI tmp1, MEMORYSIZE
mov tmp3, $RESULT
mov tmp4, tmp3
sub tmp4, 1000
add tmp4, tmp2
find tmp4, #00000000000000000000000000000000#
mov tmp2, $RESULT
cmp tmp2, 0
je @error
and tmp2, 0FFFFFFF0
add tmp2, 30
mov kfreeloc, tmp2
find tmp1, #FF751C#
mov CTpatch, $RESULT
cmp CTpatch, 0
je @error
eval "push {kfreeloc}"
asm CTpatch, $RESULT
mov tmp1, CTpatch
add tmp1, 5
mov [tmp1], #C3#
mov [tmp2], #FF751CC7451804000000FF7518#
add tmp2, 0D
add tmp1, 1
eval "push {tmp1}"
asm tmp2, $RESULT
add tmp2, 5
mov [tmp2], #C3#
gpa "ReadProcessMemory", "kernel32.dll"
mov tmp1, $RESULT
cmp tmp1, 0
je @error
find tmp1, #FF7510FF750C#
mov RPMpatch, $RESULT
cmp RPMpatch, 0
je @error
mov tmp4, kfreeloc
add tmp4, 30
eval "push {tmp4}"
asm RPMpatch, $RESULT
mov tmp2, RPMpatch
add tmp2, 5
mov [tmp2], #C3#
mov [tmp4], #C7450C00004000FF7510FF750C#
mov tmp1, tmp4
add tmp1, 3
mov [tmp1], imgbase
add tmp1, 0A
add tmp2, 1
eval "push {tmp2}"
asm tmp1, $RESULT
add tmp1, 5
mov [tmp1], #C3#
gpa "ResumeThread", "kernel32.dll"
mov RTaddr, $RESULT
cmp RTaddr, 0
je @error
mov [RTaddr], #C20400#
gpa "ZwClose", "ntdll.dll"
mov ZCpatch, $RESULT
GMEMI ZCpatch, MEMORYBASE
mov tmp2, $RESULT
GMEMI ZCpatch, MEMORYSIZE
mov tmp3, $RESULT
mov tmp4, tmp3
sub tmp4, 1000
add tmp4, tmp2
find tmp4, #00000000000000000000000000000000#
mov tmp1, $RESULT
cmp tmp1, 0
je @error
and tmp1, 0FFFFFFF0
add tmp1, 30
mov newZCaddr, tmp1
mov [newZCaddr], #837C240408720A817C2404001000007203C20400#
find ZCpatch, #C20400#
mov tmp3, $RESULT
cmp tmp3, 0
je @error
sub tmp3, ZCpatch      //bytes to copy
mov tmp1, newZCaddr
add tmp1, 14
mov tmp2, ZCpatch

loop2:
cmp tmp3, 0
je lab2
mov tmp4, [tmp2], 1
mov [tmp1], tmp4
add tmp1, 1
add tmp2, 1
sub tmp3, 1
jmp loop2

lab2:
eval "push {newZCaddr}"
asm ZCpatch, $RESULT
mov tmp2, ZCpatch
add tmp2, 5
mov [tmp2], #C3#
mov [tmp1], #C20400#
gpa "LdrLoadDll", "ntdll.dll"
mov tmp5, $RESULT
bc EPAddr
cmp config1, 1
jne lab3
find 1stsecbase, #558BEC#
mov tmp1, $RESULT
cmp tmp1, 0
jne lab2_1
find 1stsecbase, #33C0#
mov tmp1, $RESULT
cmp tmp1, 0
je lab3

lab2_1:
mov noncrypted, 1
jmp lab7

lab3:
bp tmp5
eoe lab4
eob lab4
esto

lab4:
cmp eip, tmp5
je lab5
mov tmp1, eip
sub tmp1, 1
mov tmp1, [tmp1]
and tmp1, FF
cmp tmp1, CC
je lab4_1
esto

lab4_1:
BPHWCALL
esto

lab5:
bc tmp5
BPHWCALL
gpa "ZwTerminateProcess", "ntdll.dll"
mov tmp1, $RESULT
cmp tmp1, 0
je @error
mov tmp2, esp
add tmp2, 2C
mov tmp3, 4

loop3:
cmp tmp3, 0
je lab7
mov tmp4, [tmp2]
cmp tmp1, tmp4
je lab6
add tmp2, 4
sub tmp3, 1
jmp loop3

lab6:
msg "OD 被发现了!"
pause
jmp end

lab7:
cmp eip, EPAddr
je lab9
bp EPAddr
eoe lab8
eob lab8
esto

lab8:
cmp eip, EPAddr
je lab9
esto

lab9:
mov ESP_EP, esp
log ESP_EP
BPHWCALL
bc EPAddr
GMEMI eip, MEMORYBASE
mov codeseg, $RESULT
mov tmp1, 1stsecsize
add tmp1, 1stsecbase
add tmp1, 1
find tmp1, #558bec#
mov tmp2, $RESULT
cmp tmp2, 0
je lab9_1
mov Delphi10, 1

lab9_1:
cmp noncrypted, 1
je lab16
mov tmp1, codeseg
sub tmp1, 1
GMEMI tmp1, MEMORYBASE
mov rangeaddr, $RESULT
GMEMI tmp1, MEMORYSIZE
mov range, $RESULT
bprm rangeaddr, range
eob lab10
eoe lab11
esto

lab10:
mov tmp1, eip
sub tmp1, 1
mov tmp2, [tmp1], 1
cmp tmp2, CC
je lab11
mov tmp1, rangeaddr
add tmp1, range
cmp eip, tmp1
ja lab11
cmp eip, rangeaddr
jb lab11
jmp lab12

lab11:
find eip, #8B12F62A3CA4#   //search "mov edx,[edx],"imul byte [edx]", "cmp al, A4"
mov tmp1, $RESULT
esto

lab12:
cmp ecx, edx
jne lab12_5
cmp ecx, eip
je lab12_3
mov tmp1, ecx
mov tmp3, [tmp1], 1
cmp tmp3, 0E8
jne lab12_2
mov tmp2, ecx
add tmp2, 5
mov tmp3, [esp]
cmp tmp2, tmp3
je lab12_1
mov tmp3, [esp+4] 
cmp tmp2, tmp3
jne lab12_5
add esp, 8
mov eip, ecx
jmp lab12_3

lab12_1:
add esp, 4
mov eip, ecx
jmp lab12_3

lab12_2:
cmp tmp3, 0E9
jne lab12_4
mov tmp2, [tmp1+1]
add tmp1, tmp2
add tmp1, 5
cmp tmp1, eip
jne lab12_5
cmp ESP_EP, esp
jne lab12_5
cmp ecx, 1stsecbase
jb lab12_5
mov tmp2, 1stsecbase 
add tmp2, 1stsecsize
cmp ecx, tmp2
ja lab12_5
mov hOEP, eip
jmp lab17

lab12_3:
mov hOEP, ecx
jmp lab17

lab12_4:
findop ecx, #E9#
mov tmp1, $RESULT
cmp tmp1, 0
je lab12_5
mov tmp2, [tmp1+1]
add tmp2, tmp1
add tmp2, 5
cmp tmp2, eip
jne lab12_5
mov eip, ecx
mov esp, ESP_EP
mov hOEP, ecx
jmp lab17

lab12_5:
eob lab10
eoe lab11
esto

lab16:
mov hOEP, EPAddr

lab17:
mov tmp1, LoaderData
add tmp1, 60
mov [tmp1], SizeofImage     //correct Size of image
bpmc
mov range, 1stsecsize
cmp Delphi10, 1
jne lab17_1
mov tmp1, 1stsecsize
add tmp1, 1stsecbase
add tmp1, 1
GMEMI tmp1, MEMORYSIZE
add range, $RESULT

lab17_1:
mov tmp6, eip
alloc 10000
mov codeloc, $RESULT
mov tmp1, codeloc
mov [tmp1], #609C33C0B0E9B900600000BF00104000F2AE8B1703D783C20481FAE5FB4000740F83F90075EA9D61686E614E00C30000#
add tmp1, 30
mov [tmp1], #C70550003F0001000000893D54003F00EBE40000000000000000000000000000#
mov tmp1, codeloc
add tmp1, 7     //7
mov [tmp1], range
add tmp1, 5     //C
mov [tmp1], 1stsecbase
add tmp1, 0F    //1B
mov [tmp1], hOEP
add tmp1, 0E    //29
mov [tmp1], tmp6
mov tmp2, codeloc 
add tmp2, 50    //50
mov tmp3, tmp2
add tmp3, 4     //54
add tmp1, 09    //32
mov [tmp1], tmp2
add tmp1, 0A    //3C
mov [tmp1], tmp3
mov eip, codeloc
bp tmp6
eob lab17_2
eoe lab17_2
run

lab17_2:
cmp eip, tmp6
je lab18
esto

lab18:
bc tmp6
mov tmp1, [tmp2]
cmp tmp1, 1
je lab22
mov tmp4, 0
bprm 1stsecbase, range
eob lab19
eoe lab19
esto

lab19:
mov tmp1, esp
cmp ESP_EP, tmp1
je lab21
cmp tmp4, 8
je lab19_1
add tmp4, 1
esto

lab19_1:
bpmc
mov tmp3, ESP_EP
sub tmp3, 4
bphws tmp3, "r"
eob lab20
eoe lab20
esto