SDProtector Pro 1.12 OEP + Stolen Code Finder.txt

/* --------------------------------------------------------- SDProtector Pro 1.12 - OEP script for tutorial (haggar) --------------------------------------------------------- Script just finds stolen code. --------------------------------------------------------- */ var SDP_base var GetVersion var CreateFile var IsDebugger var Snapshot var SystemInfo var Unhandled var GetTick var ModHandle mov SDP_base,eip gpa "GetVersion","kernel32.dll" mov GetVersion,$RESULT findop GetVersion,#c3# mov GetVersion,$RESULT gpa "CreateFileA","kernel32.dll" mov CreateFile,$RESULT findop CreateFile,#C21C00# mov CreateFile,$RESULT gpa "IsDebuggerPresent","kernel32.dll" mov IsDebugger,$RESULT findop IsDebugger,#c3# mov IsDebugger,$RESULT gpa "CreateToolhelp32Snapshot","kernel32.dll" mov Snapshot,$RESULT findop Snapshot,#c20800# mov Snapshot,$RESULT gpa "GetSystemInfo","kernel32.dll" mov SystemInfo,$RESULT findop SystemInfo,#C20400# mov SystemInfo,$RESULT gpa "UnhandledExceptionFilter","kernel32.dll" find $RESULT,#50FF15????????85C00f8C# mov Unhandled,$RESULT gpa "GetTickCount","kernel32.dll" mov GetTick,$RESULT findop GetTick,#C3# mov GetTick,$RESULT gpa "GetModuleHandleA","kernel32.dll" mov ModHandle,$RESULT findop ModHandle,#c20400# mov ModHandle,$RESULT //-------- To the ZwQueryInformationProcess,custom IsDebuggerPresent ------- bp GetVersion esto esto esto esto mov eax,80000001 bc eip //------------------------- Temporary file check -------------------------- bp CreateFile esto bc eip sti find eip,#837C241C0C7376E8# bp $RESULT esto bc eip add eip,7d mov $RESULT,eip add $RESULT,32 bp $RESULT esto bc eip mov edi,1234 //--------------------- IsDebuggerPresent check ------------------------ bp IsDebugger esto bc eip mov eax,0 //--------------------- CreateToolhelp32Snapshot ------------------------ bp Snapshot esto bc eip mov eax,0 //---------------------- Kill Monitoring Threads ------------------------ bp SystemInfo esto bc eip sti mov $RESULT,esp add $RESULT,24 mov [$RESULT],0 sti sti mov [$RESULT],1 //------------------- UnhandledExceptionFilter trick -------------------- bp Unhandled esto mov eax,0 bc eip //--------------------- CreateFileA for drivers check ------------------- bp CreateFile esto //First time it opens itself. esto bc eip sti add eip,0cc //----------------- GetTickCount initialization stuff ------------------- bp GetTick esto mov eax,3 mov edx,2 mov esi,1 esto mov eax,3 mov edx,2 mov esi,1 sti sti sti sti sti sti sti sti sti sti sti mov eax,211 esto mov eax,3 mov edx,2 mov esi,1 bc eip //----------------- Registration, nag window , reg keys ------------------- bp GetVersion esto esto bc eip rtr sti rtr //----------------------- Find stolen OEP code ----------------------------- bp GetTick esto esto esto esto bc eip bp ModHandle esto esto bc eip sti find SDP_base,#58054BFFFFFF8038E90F85????FFFFC600E89D61FFE0# add $RESULT,14 bp $RESULT esto bc eip ret ret