Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 12-31-2005, 23:26
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
asprotect script

This script should work on old and new asprotect protected target to find the oep if there are no stolen, otherwise it will land on the code section,right after the emulation of the stolen bytes. it makes life easier if you want to check the target few times to make a loader.if there are targets that script didn't work on , please notify me , I only tested it on 5.

Edited for Version check.
script is update to include more asprotect breeds.
updated on 2/1/2006
update on 7/1/2006 to correct an error by ollscript plugin
Attached Files
File Type: txt aspoepgen2.txt (1.1 KB, 53 views)

Last edited by britedream; 01-07-2006 at 17:24.
Reply With Quote
  #2  
Old 01-01-2006, 00:58
Shub-Nigurrath's Avatar
Shub-Nigurrath Shub-Nigurrath is offline
VIP
 
Join Date: Mar 2004
Location: Obscure Kadath
Posts: 820
Rept. Given: 49
Rept. Rcvd 391 Times in 86 Posts
Thanks Given: 24
Thanks Rcvd at 106 Times in 53 Posts
Shub-Nigurrath Reputation: 300-399 Shub-Nigurrath Reputation: 300-399 Shub-Nigurrath Reputation: 300-399 Shub-Nigurrath Reputation: 300-399
Hi britedream,
for which version of Ollyscript it has been written?
Mine Ollyscript 0.92 (compiled 16 Jun 2004), by Shag, reports an error about an undeclared variable: "codeb is not declared"

I'm probably using an old plugin.. ;-|
__________________
Ŝħůb-Ňìĝùŕřaŧħ ₪)
There are only 10 types of people in the world: Those who understand binary, and those who don't
http://www.accessroot.com
Reply With Quote
  #3  
Old 01-01-2006, 01:12
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
I used version 1.41. I will add version check Thanks for bringing this up..
Regards.
Reply With Quote
  #4  
Old 01-01-2006, 06:48
vodu
 
Posts: n/a
ODbgScript v1.41

Download link for Version 1.41:

hxxp://e3.epsylon.org/olly/ODbgScript.1.41.VC6.rar
Reply With Quote
  #5  
Old 01-01-2006, 21:52
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
Script is updated. Thanks.
Reply With Quote
  #6  
Old 01-06-2006, 15:18
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
error in ollyscript plugin

I corrected the script by obtaining the values directly as follow:

mov pe,400000+[400000+3c]
mov codes,[pe+100] // code size
mov codeb,400000+[pe+104] // code base
you can just correct the script as above or download the updated script. Thanks.

Last edited by britedream; 01-07-2006 at 17:32.
Reply With Quote
  #7  
Old 01-07-2006, 17:53
taos's Avatar
taos taos is offline
The Art Of Silence
 
Join Date: Aug 2004
Location: In front of my screen
Posts: 574
Rept. Given: 65
Rept. Rcvd 44 Times in 18 Posts
Thanks Given: 64
Thanks Rcvd at 78 Times in 33 Posts
taos Reputation: 44
Quote:
Originally Posted by britedream
This script should work on old and new asprotect protected target to find the oep if there are no stolen, otherwise it will land on the code section,right after the emulation of the stolen bytes. it makes life easier if you want to check the target few times to make a loader.if there are targets that script didn't work on , please notify me , I only tested it on 5.

Edited for Version check.
script is update to include more asprotect breeds.
updated on 2/1/2006
update on 7/1/2006 to correct an error by ollscript plugin
This is an exe that doesn't work with your script,doesn't stop at any point (running process).
Please, if you have time take a view to this exe.

Best Regards.
Attached Files
File Type: rar puchero.rar (936.9 KB, 5 views)
Reply With Quote
  #8  
Old 01-07-2006, 18:07
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
I checked the target and the script worked as it should, I updated the script today to bypass an error in the ollscript plugin.please download script and recheck it.

I had no feedback from anybody else so may be the script is working only on my pc. I hope someone had success with it.
thanks.

Last edited by britedream; 01-07-2006 at 22:17.
Reply With Quote
  #9  
Old 01-08-2006, 00:58
Shub-Nigurrath's Avatar
Shub-Nigurrath Shub-Nigurrath is offline
VIP
 
Join Date: Mar 2004
Location: Obscure Kadath
Posts: 820
Rept. Given: 49
Rept. Rcvd 391 Times in 86 Posts
Thanks Given: 24
Thanks Rcvd at 106 Times in 53 Posts
Shub-Nigurrath Reputation: 300-399 Shub-Nigurrath Reputation: 300-399 Shub-Nigurrath Reputation: 300-399 Shub-Nigurrath Reputation: 300-399
Hi britedream I tested on Archicrypt Stealth 4.2.1 the full version and seems not to work.
Here's the direct link
hxtp://www.archicrypt.com/cgi-bin/countdownen.cgi?Stealth4_Vollversion.zip

other targets worked fine..
__________________
Ŝħůb-Ňìĝùŕřaŧħ ₪)
There are only 10 types of people in the world: Those who understand binary, and those who don't
http://www.accessroot.com

Last edited by Shub-Nigurrath; 01-08-2006 at 01:03.
Reply With Quote
  #10  
Old 01-08-2006, 02:59
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
Hi Shub-Nigurrath
Thanks for reporting the target but the target needs to be register to continue to the oep,due to that , I couldn't test it.but if the script report that "script isn't working", then it will not work, if it didn't report, then it may work, it just need to add one more flag for this new breed.
if you can tell what the value of the ebp when you see fingerprint at the stack similar to this as you go on passing the exceptions.:
0012FF48 ASCII "F1BC5B13-6914" I might be able to include it in the script.



Regards.

Last edited by britedream; 01-08-2006 at 03:12.
Reply With Quote
  #11  
Old 01-08-2006, 05:22
stephenteh
 
Posts: n/a
no u do not need to register the program in order to reach the oep....

check location 0439C934, that is the original oep but it's has been "stolen" (VM)
0439C934 location has a long jump, go to that jump..... that's the start of vm or fake oep.....
Reply With Quote
  #12  
Old 01-08-2006, 07:18
Shub-Nigurrath's Avatar
Shub-Nigurrath Shub-Nigurrath is offline
VIP
 
Join Date: Mar 2004
Location: Obscure Kadath
Posts: 820
Rept. Given: 49
Rept. Rcvd 391 Times in 86 Posts
Thanks Given: 24
Thanks Rcvd at 106 Times in 53 Posts
Shub-Nigurrath Reputation: 300-399 Shub-Nigurrath Reputation: 300-399 Shub-Nigurrath Reputation: 300-399 Shub-Nigurrath Reputation: 300-399
exactly, the messagebox is part of the application and the OEP is reached in the way stephenteh told.
That application is anyway an interesting target..
__________________
Ŝħůb-Ňìĝùŕřaŧħ ₪)
There are only 10 types of people in the world: Those who understand binary, and those who don't
http://www.accessroot.com
Reply With Quote
  #13  
Old 01-08-2006, 12:09
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
very strange target, the target is loaded in high memory, this is why I thought it is still in asprotect when the nag shows and never stopped on default range of an exe [400000+codeoffset+codesize].

Last edited by britedream; 01-08-2006 at 12:51.
Reply With Quote
  #14  
Old 01-08-2006, 13:47
stephenteh
 
Posts: n/a
u shouldn't use fixed imagebase 400000, because this program loaded at location 4190000....u should use gmi to get the modulebase....
Reply With Quote
  #15  
Old 01-08-2006, 14:38
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
gmi has a problem with some asprotect target,you could do this :

mov pe1,eip
and pe1,ff0000
cmp pe1,400000
je go2
mov pe1,eip
and pe1,ffff0000

go2:
mov pe,pe1+[pe1+3c]

cmp pe1,[pe+34 ] // check to see if the imagebase you assumed is the right one.
je go
msg "wrong imagebase"
ret
go:

mov codes ,[pe+100]
mov codeb ,pe1+[pe+104]

but the target doesn't conform to main coding of the script, it isnot worth it to have a major change in the script for one odd target , if there are few of those , then I will update the script with their pattern. Thanks.
by the way, the imagebase of 400000 is the default where exe is usually loaded.we also can go to the extreme and for sure find the exact image base, but it will be long and isnot worth it. easy, if the imagebase is wrong ,just enter it manually.

Last edited by britedream; 01-08-2006 at 19:21.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
JavaFX Script Zipdecode General Discussion 0 12-18-2007 01:46
MS script decoder tbone General Discussion 2 10-08-2004 11:09
Thanks to hobgoblin, asprotect script is updated britedream General Discussion 5 05-11-2004 10:55


All times are GMT +8. The time now is 03:13.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2021 )