1、/*/PESpin v0.7 Stolen Code Finder v0.1 Author:loveboomEmail : bmd2chenOS : WinXP sp1,Ollydbg 1.1,OllyScript v0.85Date : 2004-7-10 Action: Auto fix IAT,Removed Junkcode,fix oep code(if target is vbs program)Config: Ignore other exceptions except Invalid or privileged instructionNote : If you have one
2、 or more question, email me please,thank you!/*/var addrvar isvbapp/target is a vb application?var espval/esp valuevar iatstart/iat start addressvar cbasevar csizevar isasmvar isvcgmi eip,CODEBASEmov cbase,$RESULTgmi eip,CODESIZEmov csize,$RESULTstart: msgyn Setting:Ignore other exceptions except In
3、valid or privileged instruction,Continue? cmp $RESULT,0 je lblretlbl1: dbh/Hide your debugger run esto estolbl2: gpa LoadLibraryA,kernel32.dll/GetProcess mov addr,$RESULT bp addr estolbl3: bc addr rtu cmp eip,70000000/System is wixp and target is a Vb program ? jb lblnext sto rtulblnext: #log mov is
4、vbapp,ebx findop eip,#830A00#/find OR EDX,0 cmp $RESULT,0 je lblabort mov addr,$RESULT go addr mov iatstart,edx rtr stocheckvb: mov espval,esp add espval,4 cmp isvbapp,4256534D/is that a vb application? jne lbl4 msgyn Target like a vb program,go vb module? cmp $RESULT,0 je lbl4 mov isvbapp,1 jmp lbl
5、bpesplbl4: find eip,#8944241C61#/found mov ss:esp+1c,eax cmp $RESULT,0 je lblabort mov addr,$RESULT mov addr,#36890290#/Replace to mov ss:edx,eax find eip,#8902EB#/found mov ds:edx,eax cmp $RESULT,0 je lblabort mov addr,$RESULT fill addr,2,90/Replace to NOP findop eip,#7635#/found JBE SHORT Address
6、cmp $RESULT,0 je lblabort mov addr,$RESULT mov addr,#EB#/Replace JMP SHORT Address find eip,#83C704#/Target is a MASM program? cmp $RESULT,0 je lblabort mov isasm,$RESULT bp isasm find eip,#EB06?8907#/Target is a VC/Delphi program? cmp $RESULT,0 je lblabort mov addr,$RESULT add addr,3 mov isvc,addr
7、bp isvc runlbleob: cmp eip,isasm/If target is a vc/delphi program then goto vc/delphi module jne lblvc bc isasm mov isasm,#66C747FFFF25# add isasm,6 mov isasm,#895701EB05#lblbpesp: bphws espval,r/set a hardware breakpoint esp+4 cmp isvbapp,1 je lblvb runlbl5: bphwc espval cmp isvc,1/if Target is a V
8、C/Delphi program then clear code jne lblnext1 fill filladdr,30,00lblnext1: repl eip,#EB01?#,#909090#,FF msg Junk Code has been Removed! cmt eip,Stolen code,lblend: msg Script by loveboomDFCGFCG,Thank you for using my script!lblret: retlblabort:/if error then abort script msg Error,Script aborted!May
9、be target is not protect by PESPIN v0.7 or your config error! ret/ Vb module/lblvb: runlblvb1: bphwc espval bprm cbase,csize runlblvb2: bpmclblvbfixoep: mov addr,eip add addr,6 /eval OEP is: addr /cmt addr,$RESULT mov addr,68 add addr,1 mov espval,esp add espval,4 mov addr,espval add addr,4 mov addr
10、,#E8F0FFFFFF# add addr,5 /eval Targets IAT start address is iatstart /cmt addr,$RESULT jmp lblend/ VC/Delphi module/lblvc:var addr1var addr2var addrvalvar filladdrbc isvc/Clear Break pointmov addr1,isvcmov addr1,#E9#mov addr2,cbaseadd addr2,csizesub addr2,2cadd addr1,1mov addrval,addr2sub addrval,ad
11、dr1sub addrval,4mov addr1,addrvalmov filladdr,addr2mov addr2,#609CBB#add addr2,3mov addr2,cbaseadd addr2,4mov addr2,#B9#add addr2,1mov addr2,csizeadd addr2,4mov addr2,#8B133BD7750C#add addr2,6mov addr2,#8B17891383C3#add addr2,6mov addr2,#0483E903EB03#add addr2,6mov addr2,#83C301E2E99D61E9#add addr2,Cadd isvc,5sub isvc,addr2sub addr2,4mov addr2,isvcmov isvc,1jmp lblbpesp