1、/ FileName : DebugActiveProcess.osc/ Comment : Armadillo V4.X CopyMem-II DebugActiveProcess/ Environment : WinXP SP2,OllyDbg V1.10,OllyScript V0.92/ Author : fly/ WebSite : / Date : 2005-11-03 11:30/#inc Get.eXe.PE.Information.osc#logdbhMSGYN Plz Clear All BreakPoints And Set Debugging Option Ignore
2、 All Excepions Options !cmp $RESULT, 0je TryAgain/*0012DB94 007590FC /CALL DebugActiveProcess From 007590F60012DB98 00000BD0 ProcessId = BD*/var tempvar DebugActiveProcessgpa DebugActiveProcess, KERNEL32.dllcmp $RESULT, 0je Only Win2K/XPmov DebugActiveProcess, $RESULTeob DebugActiveProcessbp DebugAc
3、tiveProcessestoGoOn0:estoDebugActiveProcess:cmp eip,DebugActiveProcessjne GoOn0bc DebugActiveProcessmov temp,espadd temp,4mov temp,templog EPmov EP,EP/and EP,FFFFlog EPeval Plz Run OllyDBG Attach ProcessId= temp Child Process And Run Armadillo.fiXed.IT.osc And Modified EP Code=EP ! MSG $RESULTret/GameOverOnly Win2K/XP:MSG Error! This Script only Run on the Win2K/WinXP ! retTryAgain:MSG Plz Try Again ! ret
