RLPack 1.21 (Basic Edition) OEP Finder + IAT Repair

Hmily 发表于 2009-1-28 23:13

// RLPack 1.21 (Basic Edition) OEP Finder + IAT Repair
var Pointer
var RLPOEP
var RLPImp
var IATStart
var IATEnd
var IATLength
var IATCount1
var IATCount2
var ModBase
var YesNo
var ImpREC1
var ImpREC2
wrt "RLPack Report.txt", "\r\n"
msg "Clear any BPs/HWBPs then click 'OK' to start"
msgyn "Click 'Yes' only if you want me to find IAT, otherwise click 'No'"
mov YesNo , $RESULT
cmp YesNo , 2
je Cancelled
//Finding Imports --------------
/*
   FF95 6D0C    CALL DWORD PTR SS:
   894424 1C    MOV DWORD PTR SS:,EAX
   61             POPAD
   C2 0800             RET 8 <--------- Important RET
   60             PUSHAD
*/
find eip , #C2080060#
cmp $RESULT , 0
je NoRLPImp
mov Pointer , $RESULT
bp Pointer
esto
bc Pointer
sti
/*
   8907                MOV DWORD PTR DS:,EAX    <--------- EAX=Import / EDI=Address
   8385 F6050000 04    ADD DWORD PTR SS:,4
   83C7 04             ADD EDI,4
*/
cmp YesNo , 0
je RLPOepStart
find eip , #89078385#
cmp $RESULT , 0
je NoRLPImp
mov RLPImp , $RESULT
bp RLPImp
//Finding RLPack OEP --------------
/*
   61                   POPAD
   E9 A706FEFF          JMP 01012475 <----- To OEP
   90                   NOP
   61                   POPAD
   C3                   RET
*/
RLPOepStart:
find eip , #E9????????9061C3#
cmp $RESULT , 0
je NoRLPOep
mov Pointer , $RESULT
bp Pointer
//Gathering RLPack Imports ------------------
RLPIATLoop:
esto
cmp eip , RLPImp
jne RLPOepEnd
inc IATCount1
cmp IATCount1 , 1
jne RLPIATLoop1
mov IATStart , edi
jmp RLPWrite
RLPIATLoop1:
cmp IATStart , edi
jb RLPIATLoop2
mov IATStart , edi
jmp RLPWrite
RLPIATLoop2:
inc IATCount2
cmp IATCount2 , 1
jne RLPIATLoop3
mov IATEnd , edi
jmp RLPWrite
RLPIATLoop3:
cmp IATEnd , edi
ja RLPWrite
mov IATEnd , edi
jmp RLPWrite
ret
//Finalizing OEP _____________________________
RLPOepEnd:
bc RLPImp
bc Pointer
sti
mov RLPOEP , eip
cmt RLPOEP , "*** RLPack OEP ***"
an RLPOEP
//RLPack Report _________________________________________
mov IATLength , IATEnd
sub IATLength , IATStart
add IATLength , 8
mov ImpREC1 , RLPOEP
mov ImpREC2 , IATStart
GMI RLPOEP, MODULEBASE
mov ModBase, $RESULT
sub ImpREC1, ModBase
sub ImpREC2, ModBase
wrta "RLPack Report.txt", "\r\n"
wrta "RLPack Report.txt", "OEP = "
wrta "RLPack Report.txt", RLPOEP
wrta "RLPack Report.txt", " "
wrta "RLPack Report.txt", "* For ImpREC 1.6 use= "
wrta "RLPack Report.txt", ImpREC1
wrta "RLPack Report.txt", "\r\n"
wrta "RLPack Report.txt", "IAT Start = "
wrta "RLPack Report.txt", IATStart
wrta "RLPack Report.txt", " "
wrta "RLPack Report.txt", "* For ImpREC 1.6 use= "
wrta "RLPack Report.txt", ImpREC2
wrta "RLPack Report.txt", "\r\n"
wrta "RLPack Report.txt", "IAT End = "
wrta "RLPack Report.txt", IATEnd
wrta "RLPack Report.txt", "\r\n"
wrta "RLPack Report.txt", "IAT Len = "
wrta "RLPack Report.txt", IATLength
eval "Needed Infos: OEP={RLPOEP} , RVA={ImpREC1} , IAT Start={IATStart} , IAT End={IATEnd} , Length={IATLength}"
msg $RESULT
msg "Script by ^_^. Thank you for using my script!"
ret
RLPWrite:
wrta "RLPack Report.txt", edi
wrta "RLPack Report.txt", " "
wrta "RLPack Report.txt", eax
wrta "RLPack Report.txt", " "
GN eax
wrta "RLPack Report.txt", $RESULT
wrta "RLPack Report.txt", "\r\n"
jmp RLPIATLoop
ret
Cancelled:
msg "Cancelled by user!?"
ret
NoRLPImp:
msg "Imports not found, click 'OK' to find OEP"
mov YesNo , 0
jmp RLPOepStart
ret
NoRLPOep:
msg "Can't find OEP, Sorry :("
ret

looploop 发表于 2010-2-2 22:59

什么东西，脚本吗

震汝陶 发表于 2010-5-23 12:56

震汝陶 发表于 2010-5-23 12:57

saker 发表于 2010-7-13 13:19

支持旧版本吗

hanji125 发表于 2010-7-18 01:45

不支持旧版吧

hrbwz 发表于 2010-7-30 12:35

支持一下

zzhhaa1 发表于 2010-9-14 08:58

:lol 收下了~谢谢大大分享啊！

ligx391 发表于 2012-4-7 16:00

谢谢了，下载看看

daiandy 发表于 2013-3-24 17:25

支持强大的哥

页: [1] 2

吾爱破解 - 52pojie.cn's Archiver

RLPack 1.21 (Basic Edition) OEP Finder + IAT Repair