execryptor_2.xx_oep_finder_+_iat_repair_v1.02sc.txt

ExetCryptor Unpacker

lab20:
cmp ESP_EP, esp
je lab20_1
esto

lab20_1:
mov tmp1, eip
cmp tmp1, 1stsecbase
jb lab20_2
mov tmp2, 1stsecbase
add tmp2, range
cmp tmp1, tmp2
jb lab21

lab20_2:
bphwc tmp3
bprm 1stsecbase, range
mov tmp4, 0
eob lab19
eoe lab19
esto

lab21:
bpmc
BPHWCALL
mov hOEP, eip
cmp noncrypted, 1
je lab21_1
msg "这儿是 OEP ?"
jmp lab21_3

lab21_1:
MSGYN "这儿是 OEP ? 程序代码没加密, 按 YES 将继续进行修复 IAT."
cmp $RESULT, 1
jne end
cmp lastsecsize, 1000
je lab21_2
mov codeseg, lastsecbase
jmp lab21_3

lab21_2:
mov tmp1, lastsecbase
sub tmp1, 1
gmemi tmp1,MEMORYBASE
mov codeseg,$RESULT

lab21_3:
mov tmp6, eip
jmp start

lab22:
mov tmp1, [tmp3]
sub tmp1, 1
mov hOEP, tmp1
eval "OEP == {tmp1}"
cmt eip, $RESULT
cmp noncrypted, 1
je lab22_1
eval "这儿是伪 OEP, OEP == {hOEP}."
msg $RESULT
jmp lab22_3

lab22_1:
eval "这儿是伪 OEP, OEP == {hOEP}, 程序代码没加密, 按 YES 将继续进行修复 IAT."
MSGYN $RESULT
cmp $RESULT, 1
jne end
cmp lastsecsize, 1000
je lab22_2
mov codeseg, lastsecbase
jmp lab22_3

lab22_2:
mov tmp1, lastsecbase
sub tmp1, 1
gmemi tmp1,MEMORYBASE
mov codeseg,$RESULT

lab22_3:
mov tmp6, eip

start:
cob
coe
mov tmp1, [signVA+30]
add tmp1, imgbase
find tmp1, #426F726C616E6420432B2B202D#   //Search "Borland C++ -"
mov tmp2, $RESULT
cmp tmp2, 0
je lab23
mov BCB, 1

lab23:
mov iend, SizeofImage
add iend, imgbase
mov count,0
mov iatbase,0

lab25:
mov tmp1, codeloc
mov [tmp1], #609CBD0003B000B8FF000000B9FC5F0000BF0010400033F6F2AE803F157421803F25741C83F90075EF90909D61000000#
add tmp1, 30    //30
mov [tmp1], #000000000000000000000000000000908B5F0181FB0010400072CD81FB00B0420077C5508B033D00000010770358EBB8#
add tmp1, 30    //60
mov [tmp1], #58895D0083FE10740683C5044675A933DB8B45002500F0FFFF83FB0075308BD8B92001400081C1040100008BD1528B09#
add tmp1, 30    //90
mov [tmp1], #81C10000400081F900A095007742034AFC3BC1772B5A8B1281C2000040003BC1772E3BC2722A4E83FE000F8469FFFFFF#
add tmp1, 30
mov [tmp1], #83ED04EBAC00000000000000000000905983C128EBB50000000000000000000090900000000000000000000000000000#
mov tmp1, codeloc
mov tmp2, tmp1
add tmp1, 3       //3
add tmp2, 300     //codeloc+300
mov [tmp1], tmp2
add tmp1, 0A      //0D
mov tmp2, SizeofImage
sub tmp2, 1004
mov [tmp1], tmp2
add tmp1, 5       //12
mov [tmp1], 1stsecbase
add tmp1, 33      //45
mov [tmp1], 1stsecbase
add tmp1, 8       //4D
mov tmp2, SizeofImage
add tmp2, imgbase
mov [tmp1], tmp2
add tmp1, 34      //81
mov [tmp1], signVA
add tmp1, 11      //92
mov [tmp1], imgbase
add tmp1, 6       //98
mov [tmp1], tmp2
add tmp1, 12      //AA
mov [tmp1], imgbase
mov tmp3, codeloc
mov tmp4, tmp3
add tmp3, 29    //end point
bp tmp3
add tmp4, E0    //error point
bp tmp4
mov tmp6, eip
mov eip, codeloc
eob lab26
eoe lab26
run

lab26:
cmp eip, tmp3
je lab27
cmp eip, tmp4
je lab28
jmp @error

lab27:
cob
coe
bc tmp3
bc tmp4
mov tmp1, ebx
sti
sti
sti
sti
mov eip, tmp6
fill codeloc, 400, 00
gmemi tmp1, MEMORYBASE
mov iatbase, $RESULT
jmp lab29

lab28:
msg "无法找到输入表区段!"
jmp @error

//chk IAT start, IAT end
lab29:
gmemi iatbase,MEMORYSIZE
mov iatsecsize,$RESULT
mov tmp1, codeloc
mov [tmp1], #609CBD0003D100BF00B05A00B9FC3F00008B0783F800752883E90483C70483F90077EE9090909D619000000000000000#
add tmp1, 30
mov [tmp1], #0000000000000000000000000000009090608BC78BDFBF00104000B9FC6F2D00F2AE83F90074493947FF75F466817FFD#
add tmp1, 30    //60
mov [tmp1], #FF15740866817FFDFF2575E4837D04007503894504894508C7450C000000008B003D00104000720E3D00806D007707C7#
add tmp1, 30    //90
mov [tmp1], #45000100000061E97CFFFFFF00000000837D040074138B1881FB000000107709837D0C08741AFF450C61E959FFFFFF00#
add tmp1, 30    //C0
mov [tmp1], #0000000000000000000000000000009061E94DFFFFFF00000000000000000000#
mov tmp1, codeloc
mov tmp2, tmp1
add tmp1, 3    //3
add tmp2, 300   //codeloc+300
mov [tmp1], tmp2
add tmp1, 5    //8
mov [tmp1], iatbase
add tmp1, 05   //0D
mov tmp2, iatsecsize
sub tmp2, 4
mov [tmp1], tmp2
add tmp1, 3A   //47
mov [tmp1], 1stsecbase
add tmp1, 5    //4C
mov tmp2, SizeofImage
sub tmp2, 1004
mov [tmp1], tmp2
add tmp1, 36   //82
mov [tmp1], 1stsecbase
add tmp1, 7    //89
mov tmp2, SizeofImage
add tmp2, imgbase
mov [tmp1], tmp2
mov tmp6, eip
mov eip, codeloc
mov tmp4, codeloc
add tmp4, 23    //endpoint
bp tmp4
eob lab30
eoe lab30
run

lab30:
cmp eip, tmp4
je lab31
jmp @error

lab31:
cob
coe
bc tmp4
mov tmp1, codeloc
add tmp1, 300
mov iatcrypted, [tmp1]
mov iat_start, [tmp1+4]
mov iat_end, [tmp1+8]
sti
sti
sti
sti
sti
mov eip, tmp6
fill codeloc, 400, 00
mov tmp1, iat_end
mov tmp4, 2

lab32:
cmp tmp4, 0
je lab34
mov tmp2, [tmp1]
cmp tmp2, 0
je lab33
gn tmp2
mov tmp3, $RESULT_2
cmp tmp3, 0
je lab34
mov iat_end, tmp1
add tmp1, 4
mov tmp4, 2
jmp lab32

lab33:
add tmp1, 4
sub tmp4, 1
jmp lab32

lab34:
cmp iatcrypted, 1
je lab50
jmp iatskip

lab50:
log iat_start
log iat_end
mov tmp6, eip
mov tmp1, codeloc
mov [tmp1], #60B889000000BD000FE200B9FCFF3000BF00104000BE000EE200F2AE83F90074178B1781E2FFFF000081FA45F4000074#
add tmp1, 30       //30
mov [tmp1], #0FEBE790909090909061909090909090508BD783C202895504895508C74514000000008B5D088B0325FFFFFF003D8B45#
add tmp1, 30       //60
mov [tmp1], #F400741CE897010000837D10007402EBE258EBA69090909090909090909090908B450883C303895D08C7451000000000#
add tmp1, 30       //90
mov [tmp1], #C74514000000008B5D088B0325FFFFFF003D3B45EC007428E853010000837D10007402EBE258E95FFFFFFF0000000000#
add tmp1, 30       //C0
mov [tmp1], #000000000000000000000000000000908B450883C303895D08C7451000000000C745140000000066C7052D02CD00EB11#
add tmp1, 30       //F0
mov [tmp1], #8B5D088B03663D0F82740DE800010000837D10007402EBE866C7052D02D1008B03663D0F82740958E9FDFEFFFF909090#
add tmp1, 30       //120
mov [tmp1], #8BC783E80189065883C604E9EAFEFFFF#
add tmp1, 0E0      //200
mov [tmp1], #608B5D088B0325FF00FFF03D87002450743E3D8900245074373CE874633C680F84AB0000003CE90F84F30000008B0325#
add tmp1, 30       //230
mov [tmp1], #FFF000003D0F8000000F842101000090C745100000000061C3000000000000908BCB83C104C7451001000000C7451400#
add tmp1, 30       //260
mov [tmp1], #000000894D0861C3000000000000000000000000000000000000000000000000837D1401742A8B4B0103CB83C105E81D#
add tmp1, 30       //290
mov [tmp1], #01000085C07419C7451001000000C7451401000000894D0861C3000000009090C745100000000061C300000000000000#
add tmp1, 30       //2C0
mov [tmp1], #00000000000000000000000000000090837D1401742A807B05E975248B4B01E8CC00000085C07418894D08C745100100#
add tmp1, 30       //2F0
mov [tmp1], #000061C3000000000000000000000000C745100000000061C300000000000000# 
add tmp1, 30       //320
mov [tmp1], #837D1401742A8B4B0103CB83C105E87D00000085C07419894D08C745100100000061C300000000000000000000000090#
add tmp1, 30       //350
mov [tmp1], #C745100000000061C300000000000090837D1401742A8B4B0203CB83C106E83D00000085C07419894D08C74510010000#
add tmp1, 30       //380
mov [tmp1], #0061C300000000000000000000000090C745100000000061C300000000000000#
add tmp1, 30       //3B0
mov [tmp1], #33C081F900104000720981F9FF1F7100770140C3000000000000000000000000#
mov tmp1, codeloc
mov tmp2, tmp1
mov tmp3, tmp1
mov tmp4, tmp1
add tmp2, 0f00     //codeloc+0f00
add tmp3, 0e00     //codeloc+0e00
add tmp4, 22D      //codeloc+022d
add tmp1, 7        //7
mov [tmp1], tmp2
add tmp1, 5        //0c
mov tmp2, SizeofImage
sub tmp2, 1004
mov [tmp1], tmp2
add tmp1, 5        //11
mov [tmp1], 1stsecbase
add tmp1, 5        //16
mov [tmp1], tmp3
add tmp1, 0D4      //EA
mov [tmp1], tmp4
add tmp1, 21       //10B
mov [tmp1], tmp4
add tmp1, 2A9      //3B4
mov [tmp1], 1stsecbase
add tmp1, 8        //3BC
mov tmp2, lastsecbase
add tmp2, lastsecsize
mov [tmp1], tmp2
mov tmp5, codeloc
add tmp5, 38       //end point
bp tmp5
mov eip, codeloc
eob lab50_1
eoe lab50_1
run

lab50_1:
cmp eip, tmp5
je lab51
jmp @error

lab51:
cob
coe
bc tmp5
mov tmp4, esi
sti
sti
mov eip, tmp6
mov tmp1, codeloc
add tmp1, 0e00
mov count, 0

lab52:
cmp tmp1, tmp4
je lab52_1
inc count
add tmp1, 4
jmp lab52

lab52_1:
cmp count, 0
je wrongver
cmp count, 1
je lab53
msg "more than one point"
pause
jmp @error

lab53:
mov tmp5, [codeloc+0e00]
mov ori1, [tmp5]
mov ori2, [tmp5+4]
mov tmp1, codeloc
add tmp1, 30
eval "jmp {tmp1}"
asm tmp5, $RESULT

lab54:
fill codeloc, 400, 00
mov tmp1, codeloc
mov [tmp1], #60BD0004CD008965088B45003DDC6A5300774D8B003D0010400072163D00D07300770F890424FFE09090909090909090#
add tmp1, 30      //30
mov [tmp1], #9090909090909090BD0004CD008B5D0089038B650883450004EBBE909090909090909090909090909090909090909090#
add tmp1, 30      //60
mov [tmp1], #8B650861909090909090909090909090#
mov tmp1, codeloc
mov tmp2, tmp1
add tmp2, 400     //codeloc+400
add tmp1, 2      //2
mov [tmp1], tmp2
add tmp1, 0B     //0D
mov [tmp1], iat_end
add tmp1, 9      //16
mov [tmp1], 1stsecbase
add tmp1, 7      //1D
mov tmp3, imgbase
add tmp3, SizeofImage
mov [tmp1], tmp3
add tmp1, 1C    //39
mov [tmp1], tmp2
mov tmp1, codeloc
add tmp1, 400
mov [tmp1], iat_start
mov eip, codeloc
mov tmp4, codeloc
add tmp4, 63    //end point
bp tmp4
eob lab55
eoe lab55
run

lab55:
cmp eip, tmp4
je lab56
jmp @iaterror

lab56:
bc tmp4
mov tmp1, [codeloc+400]
sub tmp1, 04
mov iat_end, tmp1
sti
mov eip, tmp6
mov tmp1, tmp5
mov [tmp1], ori1
add tmp1, 4
mov [tmp1], ori2
fill codeloc, 1000, 00

iatfixok:
cmp BCB, 1
je iatfixok_bcb
log hOEP, "OEP= "
log iat_start
log iat_end
//log iatbase
eval "OEP : {hOEP} , IAT 起始地址: {iat_start} ,  IAT 结束地址: {iat_end}"
msg $RESULT
pause
jmp end    

iatfixok_bcb:
mov tmp1, hOEP
sub tmp1, 12
mov tmp2, [tmp1], 2
cmp tmp2, 10EB
jne iatfixok_bcb1
sub hOEP, 12

iatfixok_bcb1:
log hOEP, "OEP= "
log iat_start
log iat_end
eval "OEP : {hOEP} , IAT 起始地址: {iat_start},  IAT 结束地址: {iat_end}. 这是 BCB 程序请确认 IAT 结束地址."
msg $RESULT
pause
jmp end 

iatskip:
cmp BCB, 1
je iatskip_bcb
log hOEP, "OEP= "
log iat_start
log iat_end
//log iatbase
eval "OEP : {hOEP} , IAT 没加密!  IAT 起始地址: {iat_start} ,  IAT 结束地址: {iat_end}."
msg $RESULT
pause
jmp end

iatskip_bcb:
mov tmp1, hOEP
sub tmp1, 12
mov tmp2, [tmp1], 2
cmp tmp2, 10EB
jne iatskip_bcb1
sub hOEP, 12

iatskip_bcb1:
log hOEP, "OEP= "
log iat_start
log iat_end
eval "OEP : {hOEP} , IAT 没加密!  IAT 起始地址: {iat_start} ,  IAT 结束地址: {iat_end}. 这是 BCB 程序请确认 IAT 结束地址."
msg $RESULT
pause
jmp end

odbgver:
msg "本脚本须配合 ODbgscript 1.52 或以上的版本"
jmp end

wrongver:
msg "本脚本不支持这版的 execryptor."
jmp end

@error:
bphwcall
msg "ERROR!"
pause
jmp end

@iaterror:
msg "修复 IAT 时出错!"
pause

end:
ret