eXPressor 1.8.0.1 Unpacker
/*//////////////////////////////////////////////////
eXePressor Unpacker 1.8.01
OS : XP SP2 Olly not use strong & fantom
/////////////////////////////////////////////////
*/
var fn
var i_st
var padr
var pf
var pend
var isz
var addr
var ldrb
var patch
var imb
var ipbase
var mi
var nm
var counter
var iatw
GMI eip,NAME
mov nm,$RESULT
eval "{nm}_U.exe"
mov nm,$RESULT
GMI eip,IDATABASE
mov ipbase,$RESULT
GMI eip,MODULEBASE
mov imb,$RESULT
mov mi,imb
rev mi
mov mi,$RESULT
eval " #0000{mi}#"
mov mi,$RESULT
GMI eip,CODEBASE
mov cb,$RESULT
GMI eip,CODESIZE
mov csz,$RESULT
GMI eip,ENTRY
mov oep,$RESULT
BC oep
gpa "GetProcAddress","kernel32.dll"
find $RESULT,#5F5BC9C2#
bp $RESULT+3
erun
erun
bc eip
rtu
nxtf:
find ipbase,mi
cmp $RESULT,0
je quit
mov ipbase,$RESULT+4
cmp [$RESULT+4],0
jne nxtf
mov i_st,[$RESULT+c]
mov oep,$RESULT-C
mov iatw,[$RESULT+54]
add iatw,imb
GMEMI eip, MEMORYBASE
mov ldrb,$RESULT
find ldrb,#742481BD54FDFFFF3B1032E3741881BD54FDFFFFAB1CA7D7740C81BD54FDFFFF3C7C33B67533EB01#
cmp $RESULT,0
je quit
mov patch,$RESULT
find ldrb,#8B4DF02BC88B45D08908EB01#
cmp $RESULT,0
je quit
mov padr,$RESULT+A
mov pend,$RESULT+22
find ldrb,#8945E8837DE800750733C0#
cmp $RESULT,0
je quit
mov pf,$RESULT
find ldrb,#405B5FC9C3558BEC81EC5001000053565733F68D511C8B028BF8C1CF0881E700FF00FF#
mov pendoep,$RESULT+4
fill patch,24,90
mov ,#EB#
bp padr
bp pf
bp pend
erun
mov ,#cc#
mov mh,
bp mh
erun
bc eip
add eip,0D
erun
jmp wrimp
proci:
bp pend
erun
cmp eip,pend
je end
cmp eip,padr
je mem_adr
cmp eip,pf
je wrimp
mem_adr:
mov addr,eax-1
mov ,#FF15#
mov ,fn
jmp proci
wrimp:
mov fn,eax
find iatw,fn
cmp $RESULT,0
je end
mov fn,$RESULT
jmp proci
end:
//pause
bp pendoep
cmt pendoep,"if Show Nag push try:)"
l:
erun
cmp oep,
jne l
mov oep,
add oep,imb
mov eip,oep
sub oep,imb
mov counter,imb
add counter,3C
mov counter,
add counter,imb
add counter,28
mov ,oep
add counter,58
mov ,i_st
dpe nm, eip
msg "File Unpacked"
ret
quit:
ret 顶起，呵呵
这个壳我也看了下，也脱了
这里有个问题，就是
H兄的这个方法是用在软件的试用期还没有结束的时候，用这个脚本脱壳可以成功，但是如果过了试用期，好像用这个方法，脱出来的程序不能运行，我遇到了这样的问题，不知道H兄能提供下帮助不？ 楼主很强大! 回复 2# huzhao23
这个是Pavka写的脚本,我没看啊,没去研究. 回复huzhao23
这个是Pavka写的脚本,我没看啊,没去研究.
Hmily 发表于 2010-1-21 11:50 http://www.52pojie.cn/images/common/back.gif
原来如此，我说怎么还是脱壳失败，他上次的脚本我就没跑成功，估计和系统相关吧 期待修改的腳本. 期待修改的腳本. 呵呵！只有看的份…… 这摸快就出1。8了 载入之后程序就直接运行了
页:
[1]
2