MPRESS V0.71a-V0.77b.By.fly[CUG]脚本一个
在一蓑烟雨看见的。。。FLY 发的哦 偶就转了这壳说实话还真没见过（唉 孤陋寡闻啊！）
复制内容到剪贴板代码:
///////////////////////////////////////////////////////////////
// FileName: MPRESS V0.71a-V0.77b.By.fly.oSc
// Comment : MPRESS V0.71a-V0.77b.UnPacK
// Environment : WinXP SP2,OllyDbg V1.10,OllyScript V1.65
// Author : fly
// WebSite : http://unpack.cn
// Date : 2008.03.10 12:00 + 2008.03.13 18:00
///////////////////////////////////////////////////////////////
#log
dbh
var T0
var J1
var OEP
var Time
var Relocation
var RelocationVA
var RelocationSize
var RelocationTable
MSGYN "Plz Clear All BreakPoints + Make First Pause at:Entry Point Of Main Module ! "
cmp $RESULT, 0
je TryAgain
cmp $VERSION, "1.65"
jb CheckODbgScripVersion
bphwc
bc
//RelocationTable______________________________________
/*MPRESS V0.71a-V0.75b
003D71C558 pop eax
003D71C605 FE000000 add eax,0FE
003D71CB8B78 08 mov edi,dword ptr ds:
003D71CE8BD7 mov edx,edi
003D71D08B78 04 mov edi,dword ptr ds:
003D71D30BFF or edi,edi
003D71D574 53 je short 003D722A
003D71D78B30 mov esi,dword ptr ds:
003D71D903F0 add esi,eax
003D71DB2BF2 sub esi,edx
003D71DD8BEE mov ebp,esi
003D71DF8BC2 mov eax,edx
003D71E18B45 3C mov eax,dword ptr ss:
003D71E403C5 add eax,ebp
003D71E68B48 34 mov ecx,dword ptr ds:
003D71E92BCD sub ecx,ebp
003D71EB74 3D je short 003D722A
003D71EDE8 00000000 call 003D71F2
003D71F258 pop eax
003D71F305 DD000000 add eax,0DD
003D71F88B10 mov edx,dword ptr ds:
003D71FA03F2 add esi,edx
003D71FC03FE add edi,esi
003D71FE2BC0 sub eax,eax
003D7200AD lods dword ptr ds:
003D72013BF7 cmp esi,edi
003D720373 25 jnb short 003D722A
*/
/*MPRESS V0.77b
0040D2218B78 08 mov edi,dword ptr ds:
0040D2248BD7 mov edx,edi
0040D2268B78 04 mov edi,dword ptr ds:
0040D2290BFF or edi,edi
0040D22B74 42 je short 0040D26F
0040D22D8B30 mov esi,dword ptr ds:
0040D22F03F0 add esi,eax
0040D2312BF2 sub esi,edx
0040D2338BEE mov ebp,esi
0040D2358B48 10 mov ecx,dword ptr ds:
0040D2382BCD sub ecx,ebp
0040D23A74 33 je short 0040D26F
0040D23C8B50 0C mov edx,dword ptr ds:
0040D23F03F2 add esi,edx
0040D24103FE add edi,esi
0040D2432BC0 sub eax,eax
0040D245AD lods dword ptr ds:
0040D2463BF7 cmp esi,edi
0040D24873 25 jnb short 0040D26F
0040D24A8BD8 mov ebx,eax
0040D24CAD lods dword ptr ds:
0040D24D3BF7 cmp esi,edi
0040D24F73 1E jnb short 0040D26F
0040D2518BD0 mov edx,eax
0040D25383EA 08 sub edx,8
0040D25603D6 add edx,esi
0040D25866:AD lods word ptr ds:
0040D25A0AE4 or ah,ah
0040D25C74 0B je short 0040D269
0040D25E25 FF0F0000 and eax,0FFF
0040D26303C3 add eax,ebx
0040D26503C5 add eax,ebp
0040D2672908 sub dword ptr ds:,ecx
0040D2693BF2 cmp esi,edx
0040D26B73 D8 jnb short 0040D245
0040D26DEB E9 jmp short 0040D258
0040D26FC3 retn
*/
find eip, #8B78088BD78B78040BFF74??8B3003F02BF28BEE#
cmp $RESULT,0
//jne Relocation
//find eip, #2BCD74338B500C03F203FE2BC0AD3BF773258BD8AD3BF7731E8BD083EA0803D666AD0AE4740B25FF0F000003C303C529083BF273D8EBE9C3#
//cmp $RESULT,0
je EXE
//sub $RESULT,0A*
Relocation:
add $RESULT,8
mov RelocationTable,$RESULT
eob RelocationTable
log RelocationTable
bp RelocationTable
jmp EXE
RelocationTable:
bc RelocationTable
mov RelocationVA,ecx
eval "RelocationVA：{RelocationVA}"
Log RelocationVA
mov RelocationSize,edi
eval "RelocationSize：{RelocationSize}"
Log RelocationSize
jmp GoOn0
//J0______________________________________
/*MPRESS V0.71a-V0.77b
0040D30E33C0 xor eax,eax
0040D310EB DF jmp short 0040D2F1
0040D3125D pop ebp
0040D3138BC7 mov eax,edi
0040D31559 pop ecx
0040D3162BC1 sub eax,ecx
0040D3185F pop edi
0040D3195E pop esi
0040D31A5B pop ebx
0040D31BC3 retn
0040D31CE9 AB8EFFFF jmp 004061CC
*/
EXE:
find eip, #33C0EBDF5D8BC7592BC15F5E5BC3E9#
cmp $RESULT,0
je NoFind
add $RESULT,0E
mov J0,$RESULT
log J0
eob J0
bp J0
esto
GoOn0:
esto
J0:
cmp eip,RelocationTable
je RelocationTable
cmp eip,J0
jne GoOn0
bc
esti
//OEP______________________________________
/*MPRESS V0.71a-V0.75b
004062325F pop edi
0040623381C7 9AFFFFFFadd edi,-66
00406239B0 E9 mov al,0E9
0040623BAA stos byte ptr es:
0040623CB8 79000000 mov eax,79
00406241AB stos dword ptr es:
0040624283C4 28 add esp,28
004062455E pop esi
004062465F pop edi
004062475B pop ebx
004062485A pop edx
0040624959 pop ecx
0040624AE9 7DAEFFFF jmp 004010CC
*/
/*MPRESS V0.77b
0040617B5F pop edi
0040617C81C7 9DFFFFFFadd edi,-63
00406182B0 E9 mov al,0E9
00406184AA stos byte ptr es:
00406185B8 72000000 mov eax,72
0040618AAB stos dword ptr es:
0040618B83C4 28 add esp,28
0040618E61 popad
0040618FE9 38AFFFFF jmp 004010CC
*/
find eip, #5F81C7??FFFFFFB0E9AAB8??000000AB83C4285E5F5B5A59E9#
cmp $RESULT,0
jne OEP
find eip, #5F81C7??FFFFFFB0E9AAB8??000000AB83C42861E9#
cmp $RESULT,0
je NoFind
sub $RESULT,04
OEP:
add $RESULT,18
mov J1,$RESULT
log J1
eob J1
bp J1
esto
GoOn2:
esto
J1:
cmp eip,J1
jne GoOn2
bc J1
tick Time
eval "Time Since Script Startup：{Time} Microsecond"
log $RESULT
cmt eip,$RESULT
esti
//GameOver______________________________________
mov OEP,eip
eval "OEP VA：{OEP}"
log OEP
cmt eip, "This is the OEP! Found By: fly "
msg "Just : OEP ! Dump and Fix IAT. Good Luck"
ret
NoFind:
msg "Error! Don't find. "
ret
CheckODbgScripVersion:
msg "ODBGScript Version Need 1.65 or higher!"
ret
TryAgain:
msg " Plz Try Again!"
ret 这些是什么东西呢.. - -
看不懂,我是新手， 多多关照.. -0- MPRESS V0.71a-V0.77b.osc
。。。。一个自动脱壳的脚本。。。。。。
省去了
手工～～～ 哈哈，看不懂。先顶了。 这种壳手工脱就行，用不上脚本
页:
[1]