armadillo 4.30a simple unpacking script.txt

来自「700个脱壳脚本, 可以放在在OD的ollyscript Plugin中.」· 文本 代码 · 共 106 行

/*
==============================================
  Armadillo 4.30a - simple unpacking script
==============================================

This script can unpack Armadillo 4.30a 
with standard protection enabled.

Features:

- Finds OEP;
- Prevents import emulation.

Usage:
- Ignore all exceptions!!!
- Add to custom C000001E and ignore it.
==============================================
*/



//Defining_variables:

var DebugString
var TickCount
var MagicJump


//==============================================
// 1. Fooling Olly debug string exploit
//==============================================


gpa "OutputDebugStringA","kernel32.dll"
mov DebugString,$RESULT
bp  DebugString
esto
bc eip
asm eip,"RETN 4"



//================================================================
// 2. Finding import redirection procedure and preventing it
//================================================================

gpa "GetTickCount","kernel32.dll"
mov TickCount,$RESULT
bp  TickCount
esto
bc  eip
rtr
bp  eip
mov TickCount,eip


SearchingPlace:
esto
sti
find eip,#75118B85??????FF8B40??8985??????FFEB02EB??8B85??????FF408985??????FFEB378D8D??????FFE8????????0FB6C0996A??59F7F9#
cmp $RESULT,0
je SearchingPlace

bc    TickCount
mov   MagicJump,$RESULT
bphws MagicJump,"x"
esto

bphwc MagicJump
mov [eip],858B11EB


find MagicJump,#8B85??????FF8985??????FFFFB5??????FFE8??????005983BD??????FF000F84??????00#
bp $RESULT
esto

bc eip
mov [MagicJump],858B1175




//================
// 3. Find OEP 
//================

gpa "CreateThread","kernel32.dll"
bp $RESULT
esto
bc eip
rtu
rtr
sti

find eip,#FFD18945FC8B45FC5F5EC9C3#
bp $RESULT
esto
bc eip
sti


cmt eip,"OEP found! Fix header by copy-paste before dump."
ret