asprotect 1.2x - 1.3x [registered].txt

700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.

// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com
/*
////////////////////////////////////////////////// 
Author : ~Hellsp@wN~
Email : [e-mail]
OS : OllyDbg 1.10 with OllyScript plugin v0.92
Date : 02.12.2004
Version: 1.0

1) Find OEP 
2) Hide Olly ! 

Support with:
ASProtect 1.2x - 1.3x [Registered]
////////////////////////////////////////////////// 
*/ 

var cbase 
var csize 
var eip_
var check

gmi eip, CODEBASE 
mov cbase, $RESULT 
log cbase 
gmi eip, CODESIZE 
mov csize, $RESULT 
log csize 

eob lab1
esto

lab1:
mov check,0
sto
log "Find anti Debugger call:"
trace:
inc check
log check
cmp check,20
je error
sto
mov eip_,[eip]
log eip_
cmp eip_,C084D0FF
jne trace
cmt eip,"[ IsDebuggerPresent ]" 
log "call eax is found"
FIND eip,#74#
cmp $RESULT,0
je error
eob lab3
log $RESULT
bp $RESULT
esto

lab3:
log "Change flag !ZF"
mov !ZF,1
sto
bc $RESULT
eob lab4
esto

lab4:
cmt eip,"[ Anti Olly ]"
mov eip_,[eip]
log eip_
cmp eip_,00F88090
jne error
sto
sto
log "Change flag !ZF"
mov !ZF,1
eob end1
esto

end1:
bprm cbase, csize 
eob end
eoe end
esto

end:
cmt eip," [ OEP ]" 
bpmc
ret

error:
log "Not found"
MSG "Error"
ret




// [BACK]