ExeCryptor脱壳脚本

Bypass AntiDBG OEP.txt －－－－－－－－－－－－－－－从下面复制－－－－－－－－－－－－－－－－－－－－－－－－－ data: var hInstance var codeseg var vmseg var ep var oep var temp code: gpa "VirtualFree","kernel32.dll" bphws $RESULT,"x" run bphwc $RESULT rtu gmi eip,MODULEBASE mov hInstance,$RESULT mov temp,$RESULT add temp,3c mov temp,[temp] add temp,hInstance add temp,28 mov temp,[temp] add temp,hInstance bc temp mov ep,temp gmemi eip,MEMORYBASE mov codeseg,$RESULT find $RESULT,#2ECC9D# mov [$RESULT],#2ECC90# gpa "EnumWindows","user32.dll" mov [$RESULT],#8BC09C85C09D0578563412C20800# gpa "CreateThread","kernel32.dll" find $RESULT,#FF7518# mov [$RESULT],#6A0490# gpa "ZwCreateThread","ntdll.dll" bp $RESULT loop1: run cmp eip,$RESULT jne loop1 bc $RESULT bp ep loop2: run cmp eip,ep jne loop2 bc ep mov temp,codeseg sub temp,1 gmemi temp,MEMORYBASE mov vmseg,$RESULT gmemi temp,MEMORYSIZE bprm vmseg,$RESULT run bpmc mov oep,eax sti bprm oep,1 loop3: run cmp eip,oep jne loop3 bpmc ret －－－－－－－－－－－－－－－－－－－到此结束－－－－－－－－－－－－－－－－－－－－－－－修复脚本：ExeCryptor 2.xx IAT Rebuilder v1.1.txt －－－－－－－－－－－－－－－－－－从下行复制——————————————————————— //Execryptor 2.x IAT rebuilder by KaGra v1.1 //This script may not resolve all pointers,or may resolve a few wrong...Fix them manually then;) //THE VALUE OF thersa IS CRUCIAL FOR THE RIGHT API RESOLVING,SO IF U HAVE INVALIDS (CHECK WHERE THE EXE //CRASHES) RUN THE SCRIPT AGAIN WITH A HIGHER OR LOWER LAVUE OF THAT value here (SEE where in script is that value) //In case the app crashes,do those thersa changes and re-run or re-run from APIfailed+4 pointer,having //saved the previous pointers.This that cannot be resolved,find it tracing,manually (or again change thersa) //You can also play with IATstart and IATend values,are what their name say... //This script can fix all or the most of them ;)...EnJoY //In zip is notepad packed,and the script succeeds in all IAT APIs :) //No need to be at OEP,and you should not be.It may not work at OEP...but i assume easier to find //a place not at OEP.Just run the exe and bp on code section...u should land somewhere in the code ;) //Then the script rulez... //So,changing a little bit the script,can resolva all pointerz ;) //only the rets,standard hard-coded tracer var IATstart var IATend var temp var size var temp2 var size2 var temp3 var temp4 var temp5 var thersa mov thersa,10 mov temp5,esp mov IATstart,042844C mov IATend,00428C70 again: mov esp,temp5 mov temp2,[IATstart] cmp temp2,00000000 je here //in case of zeros,somewhere is a bug... cmp temp2,50000000 ja here //in case that the IAT has a valid pointer :) mov eip,temp2 mov [esp],eip exec ret ende sub esp,4 BPHWS esp,"r" mov temp2,esp add esp,4 esto check: BPHWC temp2 mov temp3,eip gn temp3 cmp $RESULT_2,0 je checkF7 ok: mov temp2,eip mov [IATstart],temp2 // found!! add IATstart,4 cmp IATstart,IATend je endit sub IATstart,4 here: add IATstart,4 cmp IATstart,IATend je endit jmp again notfound: BPHWS temp2,"r" esto jmp check checkF7: sti mov temp3,eip gn temp3 cmp $RESULT_2,0 jne ok dec thersa cmp thersa,0 jne checkF7 mov thersa,10 //for next time jmp notfound endit: ret －－－－－－－－－－－－－－－到此结束——————————————————————————————

ExeCryptor脱壳脚本相关推荐

移动安全-Frida脱壳脚本与加固迭代
文章目录前言加固迭代代码混淆保护 Dex整体加密 Dex函数抽取 Dex混合加密 VPM保护技术 Frida 脱壳 Dexdump脚本手机银行APP 航旅纵横APP 失败案例APP More ...
乐见Safengine licensor终于有了脱壳脚本
[原创] 公布过SafengineChallenge悬赏壳的脚本及OLLYDBG [复制链接] twogun 9 主题 2 好友 25 积分 Lv.3 精华 1 热心 4 坛币 59 ...
004 .NetReactor 3.6.0.0之另类脱壳法
文章目录前言查壳脱壳修复目标程序前言最近一直在看脱壳的相关资料,看到了Tuts4you社区脱壳脚本的教程,这个壳我感觉很不错挺有意思的,于是打算将内容整理下分享出来. 查壳这个壳是.Ne ...
[原创]基于frida的脱壳工具
frida-unpack 基于Frida的脱壳工具 0x0 frida环境搭建 frida环境搭建,参考frida官网:frida. 0x2 原理说明利用frida hook libart.so中的 ...
LyScript 插件实现UPX脱壳
LyScript 插件可实现对压缩壳的快速脱壳操作,目前支持两种脱壳方式,一种是运用API接口自己编写脱壳过程,另一种是直接加载现有的脱壳脚本运行脱壳. 首先准备一个加了UPX压缩壳的程序,然后我们通 ...
android dex加载过程,8.1版本dex加载流程笔记--第二篇:DexFile::Open流程与简单脱壳原理...
在看雪发了,52再发一下,共同学习菜鸟刚刚学完了dex_file.cc这个源码,大致搞明白了大佬们hook脱整体加固的原理了,原理在帖子最后学习了大佬angelToms的帖子https://bbs ...
对themida(1.8.5.5)加密VC++程序的完美脱壳
-------------------------------------------------------------------------------- [详细过程] 我经过探索 ...
ASPROTECT 1.23RC4　脱壳分析
ASPR1.23RC4脱壳之advanced im password Recovery+简单MD5 [目标]: advanced im password Recovery v2.31 [工 ...
X86逆向教程15：OD脚本的编写技巧
本章节我们将学习OD脚本的使用与编写技巧,脚本有啥用呢?脚本的用处非常的大,比如我们要对按钮事件进行批量下断点,此时使用自动化脚本将大大减小我们的工作量,再比如有些比较简单的压缩壳需要脱壳,此时我们也 ...

ExeCryptor脱壳脚本

ExeCryptor脱壳脚本相关推荐

最新文章

热门文章