1、/*Detach Father from Child+Patch Crypto Process+CopyMem2Credits go to Ricardo, Hippu, Tenketsu and VolX for thier scripts and ideas.*/Variable Declarationsvar WaitForDebugEventvar WriteProcessMemoryvar DebugActiveProcessStopvar PEHeaderBasevar ImageBasevar CodeBeginvar DataBeginvar ProcessDebugEvent
2、var ProcessBuffervar ChildProcessIDvar ChildOEPvar OEPBytesvar OEPOffset1var OEPOffset2var OEPOffset3var CryptoProcessvar Addressvar Buffervar Patch1var Patch2var temp1/Setupdbhmsg Clear all breakpoints, and Set Ollydbg to pass all exceptions,rnand add custom exceptions C0000005, C000001D, C000001E
3、and C0000096, press OK to continue.gpa WaitForDebugEvent, kernel32.dllmov WaitForDebugEvent, $RESULTgpa WriteProcessMemory, kernel32.dllmov WriteProcessMemory, $RESULTgpa DebugActiveProcessStop, kernel32.dllmov DebugActiveProcessStop, $RESULT/Get Section Basesgmi eip, MODULEBASEmov ImageBase, $RESUL
4、Tmov PEHeaderBase, ImageBaseadd PEHeaderBase, 3C / Offset to PE signaturemov PEHeaderBase, PEHeaderBaseadd PEHeaderBase, ImageBasemov CodeBegin, PEHeaderBaseadd CodeBegin, 104 / Offset to 1st Section Virtual Addressmov CodeBegin, CodeBeginadd CodeBegin, ImageBasemov DataBegin, PEHeaderBase / Offset
5、to 2nd Section Virtual Addressadd DataBegin, 12Cmov DataBegin, DataBeginadd DataBegin, ImageBaselog CodeBeginlog DataBegin/ Begin Unpackingbphws WriteProcessMemory, xerunbphwc WriteProcessMemorybphws WaitForDebugEvent, xerun/ Get Information at WaitForDebugEventbphwc WaitForDebugEventmov ProcessDebu
6、gEvent, espadd ProcessDebugEvent, 04mov ProcessDebugEvent, ProcessDebugEventmov OEPOffset1, ProcessDebugEventadd OEPOffset1, 18mov OEPOffset2, ProcessDebugEventadd OEPOffset2, 24mov OEPOffset3, ProcessDebugEventadd OEPOffset3, 28log ProcessDebugEventlog OEPOffset1log OEPOffset2log OEPOffset3/ Get Ch
7、ild Process ID and Child OEPbphws WriteProcessMemory, xerunbphwc WriteProcessMemorymov ChildProcessID, ProcessDebugEventadd ChildProcessID, 04mov ChildProcessID, ChildProcessIDmov ChildOEP, OEPOffset1/ Get Stack Infomov Address, espadd Address, 08mov Address, Addresslog Addressmov Buffer, espadd Buf
8、fer, 0Cmov Buffer, Bufferlog Buffer/ Patch OEP of Childmov temp1, ChildOEPsub temp1, Addressadd temp1, Buffermov OEPBytes, temp1log OEP of Child Process was patched to EBFElog ChildOEPlog ChildProcessIDmov temp1, #EBFE#/ Find and patch Crypto Procrtrstigmemi eip, MEMORYBASEmov CryptoProcess, $RESULT
9、find CryptoProcess, #8B048A50E8?83C40C# / mov eax, dword ptr ds:edx+ecx*4 push eax call XXXXXXXX add esp,0ccmp $RESULT, 0je Error1mov CryptoProcess, $RESULTadd CryptoProcess, 04mov CryptoProcess, #9090909090#log CryptoProcesslog Crypto Process was nopped.eval Successfully Patched OEP = ChildOEP of C
10、hild Process (PID= ChildProcessID) from OEPBytes (Inverted) to EBFE.rnrnCheck log for more info. Press OK to continue. msg $RESULT/ Patch CopyMemII and WaitForDebugEventbphws WaitForDebugEvent, xerunbphwc WaitForDebugEventmov Patch1, espsub Patch1, 12log Patch1mov Patch1, #90909090909090909090909090
11、9090909090#add Patch1, 14eval jmp CodeBeginasm Patch1, $RESULTadd Patch1, 05eval nopasm Patch1, $RESULTmov Patch2, CodeBegineval add dword OEPOffset1,1000asm Patch2, $RESULTadd Patch2, 0Aeval add dword OEPOffset2,1000asm Patch2, $RESULTadd Patch2, 0Aeval add dword OEPOffset3,1000asm Patch2, $RESULTa
12、dd Patch2, 0Aeval cmp dword OEPOffset3,DataBeginasm Patch2, $RESULTadd Patch2, 0Aeval jnz Patch1asm Patch2, $RESULTadd Patch2, 06eval push ChildProcessIDasm Patch2, $RESULTadd Patch2, 05eval call DebugActiveProcessStopasm Patch2, $RESULTadd Patch2, 05eval nopasm Patch2, $RESULTsub CodeBegin, 1000mov OEPOffset1, CodeBeginmov OEPOffset2, CodeBeginmov OEPOffset3, CodeBegin/go espmov eip, espbphws Patch2, xerunbphwc Patch2msg Script Completed Successfully! More Info in Log. Have fun!jmp EndError1:msg Cant find Crypto Process call!End:ret
