asprotect 1.23 rc4.txt

来自「700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.」· 文本 代码 · 共 56 行

/*
tested on asprotect 1.23 RC4 only - arz

*/

var j
var k

eoe main

main:
/* 
check for signature bytes
*/
mov j,eip
add j,47
mov k,[j]
mov j,[k]
cmp j,746F7250 
je reset


/*
last exception? 
*/
mov j,esp //based on britedreams lastex
add j,1C
mov k,[j]
cmp k,400000
je exit
cmp k,1000000 //did some testing on notepad :P
je exit
jmp continue


reset:
/* 
zero the debugger check flags for no debugger checks 
*/
mov j,eip
add j,41
mov k,[j] // get ptr to debug check array
sub k,4 // k Ptr do IsDebuggerPresent check flag
mov [k],0 // kill it (api won\'t be called)
add k,8 // k Ptr do anti-debug checks flag 
mov [k],0 // kill the internal FS[?],TRW and system debugger checks
jmp continue


continue:
esto
jmp main

exit:
ret