copy of arm_detach.txt

700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.

/*
Armadillo script - detach parent from client - by hipu
tnx to Ricardo for his complete instructions (im just emulating what the man says...)

MAKE SURE ALL BREAKPOINTS ARE DELETED BEFORE EXECUTING THE SCRIPT!!! 

ALSO: since im using the IsDebuggerPresent plugin, i didnt do IsDebuggerPresent patch.
do whatever is needed if u dont use the plugin...

*/

var WaitForDebugEvent
var WriteProcessMemory+5
var pDebugEvent
var pBuffer
var child_ProcID

//eob found_WaitForDebugEvent
gpa "WaitForDebugEvent", "kernel32.dll" 
mov WaitForDebugEvent, $RESULT
gpa "WriteProcessMemory+5", "kernel32.dll" 
mov WriteProcessMemory+5, $RESULT

bp WriteProcessMemory+5
run

//stopped here cause of breakpoint
run

//stopped here cause of breakpoint (2nd time)
bc WriteProcessMemory+5
mov pBuffer, esp
add pBuffer, 0c
mov pBuffer, [pBuffer]
log "*** original OEP bytes :"
log [pBuffer]
mov [pBuffer], #EBFE#
log "*** changed OEP bytes :"
log [pBuffer]

bp WaitForDebugEvent
run
run
run
bc WaitForDebugEvent

mov pDebugEvent, esp
add pDebugEvent, 04
mov pDebugEvent, [pDebugEvent]
log pDebugEvent
mov child_ProcID, pDebugEvent
add child_ProcID, 4
mov child_ProcID, [child_ProcID]
log child_ProcID

rtr	//ctrl-f9
sto	//f8
mov eax, child_ProcID
asm eip, "push eax"
sto	//f8
asm eip, "call DebugActiveProcessStop"
sto	//f8
asm eip, "nop"
sto	//f8
ret