Enigma Protector virtual OEP restore By GIV
Hi.Support Delphi, VB6, C++ OEP.
Tested on XP SP3 only.
Developed back in 2015.
Tested just on a few files.
Can be faulty on some long OEP (Delphi).
I give no warranty so don't ask for support.
I have been developed on my own but now i am out of this business so don't ask too much. Some messages are in Romanian so to see what they mean just use a translator.
Script is attached.
Made in Romania.
// giv@reversing.ro
// Script for restore VM OEP on Enigma 5.xx VM'ed OEP
// Delphi files + VB6
bc
lc
bphwc
bpmc
dbh
GMI eip, CODEBASE
mov bazacod, $RESULT
GMI eip, CODESIZE
mov marimecod, $RESULT
VAR INTRARE
ask "Enter the EIP of the stolen OEP"
mov INTRARE, $RESULT
//mov INTRARE, 0041F372
BPHWS INTRARE
erun
bphwc INTRARE
ask "Enter compiler type: 1 for Delphi 2 for Visual Basic 3 for C++"
mov tipcompilator, $RESULT
cmp $RESULT,1
ifeq
jmp Delphi
endif
cmp $RESULT,2
ifeq
jmp vb6
endif
cmp $RESULT,3
ifeq
jmp C_plus
endif
//Target compiler select
mov delphi, 1
mov vb6, 0
mov cpp, 0
/////////////////
cmp delphi, 1
ifeq
jmp Delphi
endif
cmp vb6, 1
ifeq
jmp vb6
endif
cmp cpp, 1
ifeq
jmp C_plus
endif
Delphi:
log "PUSH EBP"
log "MOV EBP, ESP"
log "ADD ESP, -10"
BREAK:
bc
bphwc
bpmc
BPRM bazacod, marimecod
erun
cmp eip, INTRARE
ifeq
jmp BREAK
endif
cmp eip, bazacod+marimecod
ifa
jmp BREAK
endif
cmp eax, 01000000
ifa
jmp DWORD
endif
cmp , #FF25#, 2
ifeq
jmp BREAK
endif
mov valoareeax, eax
eval "MOV EAX, 00{valoareeax}"
LOG $RESULT, ""
eval "MOV ECX, 00{ecx}"
log $RESULT, ""
eval "MOV EDX, 00{edx}"
log $RESULT, ""
mov pozitie, eip
eval "CALL 0{pozitie}"
log $RESULT, ""
GASIRE_RET:
bpmc
cmp , #FF25#, 2
ifeq
jmp BREAK
endif
find eip, #C3#, 5
mov adresagasitaret, $RESULT
cmp adresagasitaret, 0
ifa
bp adresagasitaret
erun
bc adresagasitaret
esti
gci eip, COMMAND
mov stringoep, $RESULT
scmpi stringoep, "PUSH 0x0", 4
cmp $RESULT, 0
ifa
jmp Comanda_gci
endif
esti
jmp Comanda_gci
endif
find eip, #5?C?#, 1500
mov adresagasitaret, $RESULT
cmp adresagasitaret, 0
ifa
mov diferenta, adresagasitaret-eip
cmp diferenta, 35
ifb
cmp , #5BC3#, 2
ifeq
bpmc
bp adresagasitaret
erun
esti
esti
jmp Comanda_gci
endif
cmp , #5DC2#, 2
ifeq
bpmc
bp adresagasitaret
erun
esti
esti
jmp Comanda_gci
endif
msg "Diferenta prea mica"
endif
mov adresacomparare, adresagasitaret
add adresacomparare, 1
cmp , #C3#,1
ifneq
mov start, eip
add start, 35
find start,#E8????????C3#
bp $RESULT
erun
bc
find eip, #5?C?#
bp $RESULT
erun
bc
esti
esti
jmp Comanda_gci
//msg "Pauza C3"
endif
bp adresagasitaret
erun
bc adresagasitaret
esti
esti
jmp Comanda_gci
endif
find eip, #5?5?5?5?C3#,500
bpmc
mov adresagasitaret, $RESULT
cmp adresagasitaret, 0
ifa
bp adresagasitaret
erun
bc adresagasitaret
esti
esti
jmp Comanda_gci
endif
cmp adresagasitaret, 0
Continuare_ret:
bpmc
ifa
bp adresagasitaret
bpmc
erun
endif
bc adresagasitaret
esti
esti
Comanda_gci:
GCI eip, COMMAND
mov comanda, $RESULT
scmpi comanda, "PUSH 0x0", 4
ifneq
jmp GASIRE_RET
endif
jmp BREAK
DWORD:
/////////
bc
bphwc
/////////
mov gasire, eax
rev gasire
mov gasire, $RESULT
///////////////////
eval "{gasire}"
mov gasire, $RESULT
//////////////////
len gasire
cmp $RESULT, 7
ifeq
eval "0{gasire}"
mov gasire, $RESULT
jmp ansamblare_gasire
endif
len gasire
cmp $RESULT, 6
ifeq
eval "00{gasire}"
mov gasire, $RESULT
endif
//log gasire, ""
ansamblare_gasire:
eval "#{gasire}#"
mov gasire, $RESULT
findmem gasire, bazacod
mov adresa_p, $RESULT
cmp adresa_p, 0
ifeq
msg "Pointer negasit"
pause
endif
ifa
eval "MOV EAX, DWORD PTR[{adresa_p}]"
log $RESULT, ""
cmp ecx, 401000
ifa
eval "MOV ECX, 00{ecx}"
log $RESULT, ""
endif
cmp edx, 401000
ifa
eval "MOV EDX, 00{edx}"
log $RESULT, ""
endif
mov pozitie, eip
eval "CALL 0{pozitie}"
log $RESULT, ""
jmp GASIRE_RET
vb6:
findmem #5642??21#, bazacod
mov variabilapush, $RESULT
cmp variabilapush,0
ifeq
msg "Pattern not found for push value - VB6"
jmp Sfarsit
endif
eval "PUSH 00{variabilapush}"
LOG $RESULT, ""
asm eip, $RESULT
mov variabilacall, eip-6
eval "CALL 00{variabilacall}"
LOG $RESULT, ""
asm eip+5, $RESULT
jmp Sfarsit
C_plus:
bc
bphwc
bpmc
BPRM bazacod, marimecod
erun
MOV intrarecallc, eip
EVAL "CALL {intrarecallc}"
log $RESULT, ""
ASM INTRARE, $RESULT
bc
bphwc
bpmc
rtr
esti
BPRM bazacod, marimecod
erun
MOV jmpc, eip
EVAL "JMP {jmpc}"
log $RESULT, ""
ASM INTRARE+5, $RESULT
jmp Sfarsit
Sfarsit:
msg "Script is finished" 好的，谢谢 支持原创 谢楼主热心谢分享 哎。。看到这个就想起了朋友某宝买的美萍。。被二次加密过期后蛋疼得很。。。 收藏先谢谢分享
这个怎么运行呢 还要编译吗？
页:
[1]