-
Notifications
You must be signed in to change notification settings - Fork 110
/
UPack_all.txt
176 lines (154 loc) · 3.48 KB
/
UPack_all.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
//////////////////////////////////////////////////
// FileName : UPack_all.txt
// Comment : OEP find for *all* UPack
// Author : _pusher_
// Date : 2015-12-25
// Its abit messy i know.
//////////////////////////////////////////////////
//start
msg "UPack *all* OEP Finder"
msg "make sure you're at the entry point of the program before you continue"
pause
//clear breakpoints
bc
bphwc
sti
//find oep code
find cip,"74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50 53 FF D5 AB EB E7 C3" //some pattern
log "found: {0}", $result
cmp $result,0
jnz a0
//0.34
find cip,"F3 AB C1 E0 0A B5 ?? F3 AB BF ?? ?? ?? ?? E9" //some pattern
log "found: {0}", $result
cmp $result,0
jnz aw0
//find oep code
find cip,"74 30 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50 53 FF D5 AB EB E7 33 C0 40 8D 54 85 00 FF 16 13 C0 3B C1 72 F4 2B C1 C3" //some pattern
log "found: {0}", $result
cmp $result,0
jnz a1
//find oep code
find cip,"E2 FA 5B 03 DA 43 59 89 5D 0C 56 8B F7 2B F3 F3 A4 AC 5E B1 80 AA 3B 7E 2C 73 03 FF 66 28 58 8B 4E 30 5F E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 1C 2B C7 AB E2 E5 8B 5E 34 8B 76 38 46 AD ?? C0 0F 84" //some pattern
log "found: {0}", $result
cmp $result,0
jnz a2
//find oep code
find cip,"8B 5E 28 56 52 8B 76 2C 46 AD 85 C0 5A 74 22 03 C2 52 56 97 FF 53 FC 95 AC 84 C0 75 FB 38 06 74 E7 8B C6 79 05 46 33 C0 66 AD 50 55 FF 13 AB EB E7 59 5F 8B 49 44 E3 0D 33 C0 AC 3C 04 72 0C 03 F8 01 17 E2 F3 61 E9" //some pattern
log "found: {0}", $result
cmp $result,0
jnz a3
//finish script
ret
a3:
bp $result+46
erun
bc
sti
cmt cip,"OEP"
//finish script
ret
a2:
bp $result+4a
erun
bc
$dw = 4:[$result+4c]
$dest = $result+4 + $dw + 4c
log "OEP: {0}", $dest
bp $dest
erun
cmt cip,"OEP"
//finish script
ret
a1:
//find oep code
find cip,"57 51 E9" //some pattern
log "found: {0}", $result
cmp $result,0
jz error2
//go to JMP
bp $result+2
erun
bc
sti
find cip,"74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50 53 FF D5 AB EB E7 C3" //some pattern
log "found: {0}", $result
cmp $result,0
jz error1
bp $result+21
erun
bc
sti
cmt cip,"OEP"
//finish script
ret
aw0:
//find oep code
find cip,"F3 AB C1 E0 0A B5 ?? F3 AB BF ?? ?? ?? ?? E9" //some pattern
log "found: {0}", $result
cmp $result,0
jz error2
//go to JMP
bp $result+e
erun
bc
sti
find cip,"74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50 53 FF D5 AB EB E7 C3" //some pattern
log "found: {0}", $result
cmp $result,0
jz test2
bp $result+21
erun
bc
sti
cmt cip,"OEP"
ret
test2:
//0.33 ..
//find jb loop then ret code
find cip,"F3 A4 AC 5E B1 80 AA 81 FF ?? ?? ?? ?? 0F 82" //some pattern
log "found: {0}", $result
cmp $result,0
jz error1
bp $result+13
erun
bc
find cip,"74 30 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50 53 FF D5 AB EB E7 33 C0 40 8D 54 85 00 FF 16 13 C0 3B C1 72 F4 2B C1 C3" //some pattern
log "found: {0}", $result
cmp $result,0
jz error1
bp $result+32
erun
bc
sti
cmt cip,"OEP"
//finish script
ret
a0:
//find oep code
find cip,"57 51 E9" //some pattern
log "found: {0}", $result
cmp $result,0
jz error2
//go to JMP
bp $result+2
erun
bc
sti
find cip,"74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50 53 FF D5 AB EB E7 C3" //some pattern
log "found: {0}", $result
cmp $result,0
jz error1
bp $result+21
erun
bc
sti
cmt cip,"OEP"
//finish script
ret
error2:
msg "didn't find JMP code"
ret
error1:
msg "didn't find OEP code"
ret