1、/*AM 5.4x selfcheck remover script by russiankid.It will finds and disables new AM selfcheck (which was added since AM v5.4).This script should be run at new EP (can be run on original target after upack script or on dumped target).*/*the code that do the ckeck:0050978D 8845 E0 MOV BYTE PTR SS:EBP-2
2、0,AL00509790 E8 BE170000 CALL dumped_.0050AF5300509795 8DBE B4000000 LEA EDI,DWORD PTR DS:ESI+B40050979B 895D FC MOV DWORD PTR SS:EBP-4,EBX0050979E 57 PUSH EDI0050979F E8 2FF00500 CALL dumped_.005687D3005097A4 84C0 TEST AL,AL005097A6 59 POP ECX005097A7 75 0A JNZ SHORT dumped_.005097B3005097A9 FF35 1
3、0DB4F00 PUSH DWORD PTR DS:4FDB10005097AF 53 PUSH EBX005097B0 57 PUSH EDI005097B1 EB 41 JMP SHORT dumped_.005097F4005097B3 399E 60010000 CMP DWORD PTR DS:ESI+160,EBX005097B9 74 43 JE SHORT dumped_.005097FE*/var FixAddrvar SeqAddrfind eip,#E8?8DBEB4000000895DFC57E8#mov SeqAddr,$RESULTcmp SeqAddr,0je SeqAddrNotFoundadd SeqAddr,10mov FixAddr,SeqAddradd FixAddr,SeqAddradd FixAddr,4mov FixAddr,#B001C3#dec SeqAddreval New ActiveMark selfcheck fixed in the call at: SeqAddrmsg $RESULTretSeqAddrNotFound:msg Could not find sequence to fix!ret
