sdprotect 1.12 oep finder.txt

700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.

/*
//////////////////////////////////////////////////
        SDProtect 1.12 ????
        Author:        loveboom
        Email : loveboom...163.com
        OS    : Winxp sp2,OllyDbg 1.1,OllyScript v0.92
        Date  : N/A
        Config: ????????????????
        Note  : ????????????,?????????,??????????^_^
                ????1.12????;????????????????????,??????
                ????????????????
//////////////////////////////////////////////////
*/


var                apigetver
var                count
var                 apiaddr
var                 val
var                 addr
var                oep
var                 packerbase
var                 epaddr
var                crcaddr
var                 apisysinfo
var                IMGBASE


start:
                dbh
                mov epaddr,eip
                gpa "LoadLibraryA","kernel32.dll"
                cmp $RESULT,0
                JE lblend
                MOV apigetver,$RESULT
                BPRM apigetver,0F
                eoe lblexcept
                eob l1
                esto

l1:
                cob
                bpmc
                mov val,[esp]                //?esp??
                mov addr,val
                /*
                        $+30  85F6   TEST ESI,ESI
                        $+32  8BD8   MOV EBX,EAX
                */
                add addr,30
                mov val,[addr]                //????
                cmp val,D88BF685
                jne lblinver
                bp addr
                eoe lblexcept
                run                
l2:
                bc addr
                mov packerbase,eax        //Packer base
                mov addr,eax
                add addr,18
                mov oep,[addr]


l3:
                bprm epaddr,FF
                eob l4
                eoe lblexcept
                run


l4:
                cob 
                bpmc
                findop eip,#C3#                        //????
                go $RESULT
                mov addr,$RESULT
                add addr,153                        //8B4C24 04    MOV ECX,DWORD PTR SS:[ESP+4]
                mov val,[addr]
                cmp val,04244C8B
                jne lblinver
                mov crcaddr,addr                //??CRC????
        

l5:
                gpa "GetVersion","kernel32.dll"
                mov apiaddr,$RESULT
                findop apiaddr,#C3#
                mov apiaddr,$RESULT
                bp apiaddr
                mov count,0


l6loop:
                eoe lblexcept
                eob l7
                esto



l7:
                cob
                mov addr,[esp]
                add addr,2
                mov val,[addr]
                cmp val,73800000                //????????win9x??,??Winnt???Anti-debug
                jne l6loop
                mov eax,80000000
                cmp count,1
                je l8
                inc count
                jmp l6loop
l8:
                
                bc apiaddr
                sto
                rtr
                sto
                

l9:
                eob l10
                eoe lblexcept
                findop eip,#2DFA121DBC#                // 2D FA121DBC      SUB EAX,BC1D12FA
                cmp $RESULT,0
                JE lblinver
                bp $RESULT
                esto

l10:
                cob
                bc $RESULT
                mov eax,BC1D12FA


l11:
                eob l12
                eoe lblexcept
                gpa "GetSystemInfo","kernel32.dll"
                mov apisysinfo,$RESULT
                add apisysinfo,8
                bp apisysinfo
                esto


l12:
                cob
                bc apisysinfo
                rtu
                mov addr,esp
                sub addr,4
                mov addr,[addr]                                //????????CPU
                add addr,14
                mov [addr],0
                cob

l13:
                eob lblbperr
                eoe l14
                esto


l14:
                coe
                gpa "GetModuleHandleA","kernel32.dll"
                mov apiaddr,$RESULT
                findop apiaddr,#C20400#                        //??GetModuleHandleA????RET4
                mov apiaddr,$RESULT
                bp apiaddr

l15:
                eob l16
                eoe lblexcept
                esto


l16:
                cob
                mov addr,esp
                add addr,4
                mov val,[addr]                        //mov val,[esp+4]
                cmp val,0
                jne l15
                sto

l17:
                bc  apiaddr
                mov IMGBASE,eax
                mov [crcaddr],08244c8b                //MOV ECX,DWORD PTR SS:[ESP+4]
                mov addr,eip
                add addr,12c
                log addr
                mov val,[addr]
                log val
                cmp val,282444c7      //$+121 >  C74424 28 01>MOV DWORD PTR SS:[ESP+28],1
                jne lblinver
                add addr,4
                mov [addr],0
                findop addr,#C20400#
                bp $RESULT

l18:
                eob l19
                eoe lblexcept
                esto


l19:
                cob
                bc $RESULT
                mov [addr],1                        //????,??xxxx:-)
                mov [crcaddr],04244C8B
                

ldone:
                eval         "Done!target OEP(RVA):{oep},now please dump target."                //??????????,?????????
                log         $RESULT                                //????,??????:-)
                cmt        eip,$RESULT
                msg "Script by loveboom[DFCG],[FCG][CUG],Thank you for using my Scripts!"                        

lblend:

                ret        



lblexcept:
                msg        "????,?????????,??????SDProtect 1.12???"
                ret

lblinver:
                msg        "??????SDPROTECT 1.12???."
                ret

lblbperr:
                eval        "???????:{eip}"
                msg        $RESULT
                ret