Armadillo 5.xx OEP Finder (Standard Protection + Debug Blocker).txt

/////////////////////////////////////////////////////////////// // FileName : Armadillo.V5.X.eXe.Standard.Protection.oSc // Comment : Standard Only + Standard plus Debug Blocker // Environment : WinXP SP2,OllyDbg V1.10,OllyScript V1.65 // Author : fly[CUG] // WebSite : // Date : 2007-09-16 24:00 /////////////////////////////////////////////////////////////// #log dbh var Temp var bpcnt var Clear var MagicJMP var JmpAddress var fiXedOver var OpenMutexA var GetModuleHandleA var VirtualProtect var CreateFileMappingA var GetTickCount var CreateThread var FindOEP MSGYN "Plz Clear All BreakPoints And Set Debugging Option Ignore All Excepions Options And Add C000001D..C000001E in custom exceptions !" cmp $RESULT, 0 je TryAgain cmp $VERSION, "1.65" jb CheckODbgScripVersion BPHWC BC //OutputDebugStringA______________________________________ gpa "OutputDebugStringA", "KERNEL32.dll" mov [$RESULT], #C20400# //OpenMutexA______________________________________ gpa "VirtualProtect", "KERNEL32.dll" find $RESULT,#5DC21000# add $RESULT,1 mov VirtualProtect,$RESULT eob VirtualProtect bp VirtualProtect gpa "OpenMutexA", "KERNEL32.dll" mov OpenMutexA,$RESULT bp OpenMutexA esto OpenMutexA: eob KillOpenMutexA exec mov eax,[ESP+0C] pushad push eax push 0 push 0 CALL CreateMutexA popad jmp OpenMutexA ende KillOpenMutexA: bc OpenMutexA esti //VirtualProtect______________________________________ eob VirtualProtect GoOn0: esto VirtualProtect: cmp eip,OpenMutexA je OpenMutexA cmp eip,VirtualProtect jne GoOn0 bc VirtualProtect //CreateFileMappingA______________________________________ gpa "CreateFileMappingA", "KERNEL32.dll" find $RESULT,#C9C21800# mov CreateFileMappingA,$RESULT bp CreateFileMappingA eob CreateFileMappingA esto GoOn1: esto CreateFileMappingA: cmp eip,CreateFileMappingA jne GoOn1 bc CreateFileMappingA //GetModuleHandleA______________________________________ gpa "GetModuleHandleA", "KERNEL32.dll" find $RESULT,#C20400# mov GetModuleHandleA,$RESULT bp GetModuleHandleA eob GetModuleHandleA esto GoOn2: esto GetModuleHandleA: cmp eip,GetModuleHandleA jne GoOn2 cmp bpcnt,1 je VirtualFree cmp bpcnt,2 je Third /* 00139478 00E05325 RETURN to 00E05325 from kernel32.GetModuleHandleA 0013947C 00E30C04 ASCII "kernel32.dll" 00139480 00E31AD0 ASCII "VirtualAlloc" */ VirtualAlloc: mov Temp,esp add Temp,4 log Temp mov T0,[Temp] cmp [T0],6E72656B log [T0] jne GoOn2 add Temp,4 mov T1,[Temp] cmp [T1],74726956 jne GoOn2 bc OpenMutexA inc bpcnt jmp GoOn2 /* 00139478 00E05343 RETURN to 00E05343 from kernel32.GetModuleHandleA 0013947C 00E30C04 ASCII "kernel32.dll" 00139480 00E31AC4 ASCII "VirtualFree" */ VirtualFree: mov Temp,esp add Temp,4 mov T1,[Temp] cmp [T1],6E72656B jne GoOn2 add Temp,4 mov T1,[Temp] add T1,7 cmp [T1],65657246 log [T1] jne GoOn2 inc bpcnt jmp GoOn2 /* 001391C4 00DE7F54 RETURN to 00DE7F54 from kernel32.GetModuleHandleA 001391C8 00139340 ASCII "kernel32.dll" */ Third: mov Temp,esp add Temp,4 mov T1,[Temp] cmp [T1],6E72656B jne GoOn2 bc GetModuleHandleA esti //VirtualProtect2______________________________________ bp VirtualProtect eob VirtualProtect2 esto GoOn3: esto VirtualProtect2: cmp eip,VirtualProtect jne GoOn3 bc VirtualProtect esti find eip,#83C404E9????????C705????????????????83BD??????????7437# cmp $RESULT,0 je Armadillo.V5.X.Standard.Protection add $RESULT,8 mov Temp,$RESULT bp Temp eob Temp esto GoOn4: esto Temp: cmp eip,Temp jne GoOn4 bc Temp //GetTickCount______________________________________ mov bpcnt,0 gpa "GetTickCount", "KERNEL32.dll" find $RESULT,#0FACD018C3# cmp $RESULT,0 je NoFind add $RESULT,4 mov GetTickCount,$RESULT bp GetTickCount eob GetTickCount esto GoOn5: esto GetTickCount: cmp eip,GetTickCount jne GoOn5 esti find eip,#83780800744A68000100008D8D????FFFF518B95????FFFF# inc bpcnt log bpcnt cmp bpcnt,10 ja NoFind cmp $RESULT,0 je GoOn5 bc GetTickCount esti //MagicJMP______________________________________ /* 00E5AA7B 8B85 40C2FFFF mov eax,dword ptr ss:[ebp-3DC0] 00E5AA81 8378 08 00 cmp dword ptr ds:[eax+8],0 00E5AA85 74 4A je short 00E5AAD1 //MagiJmp 00E5AA87 68 00010000 push 100 00E5AA8C 8D8D 40C1FFFF lea ecx,dword ptr ss:[ebp-3EC0] 00E5AA92 51 push ecx 00E5AA93 8B95 40C2FFFF mov edx,dword ptr ss:[ebp-3DC0] 00E5AA99 8B02 mov eax,dword ptr ds:[edx] 00E5AA9B 50 push eax 00E5AA9C E8 2F7CFBFF call 00E126D0 00E5AAA1 83C4 0C add esp,0C 00E5AAA4 8D8D 40C1FFFF lea ecx,dword ptr ss:[ebp-3EC0] 00E5AAAA 51 push ecx 00E5AAAB 8D95 50C2FFFF lea edx,dword ptr ss:[ebp-3DB0] 00E5AAB1 52 push edx 00E5AAB2 E8 25080100 call 00E6B2DC 00E5AAB7 83C4 08 add esp,8 00E5AABA 85C0 test eax,eax 00E5AABC 75 11 jnz short 00E5AACF */ add $RESULT,4 mov MagicJMP,$RESULT log MagicJMP mov [MagicJMP],#EB# /* 00E5AAED E8 BE7CFBFF call 00E127B0 00E5AAF2 0FB6C0 movzx eax,al 00E5AAF5 99 cdq 00E5AAF6 B9 14000000 mov ecx,14 00E5AAFB F7F9 idiv ecx 00E5AAFD 8B85 4CD8FFFF mov eax,dword ptr ss:[ebp-27B4] 00E5AB03 8B8C95 E8D7FFFF mov ecx,dword ptr ss:[ebp+edx*4-2818> 00E5AB0A 8908 mov dword ptr ds:[eax],ecx 00E5AB0C 8B95 4CD8FFFF mov edx,dword ptr ss:[ebp-27B4] 00E5AB12 83C2 04 add edx,4 00E5AB15 8995 4CD8FFFF mov dword ptr ss:[ebp-27B4],edx 00E5AB1B E9 72010000 jmp 00E5AC92 */ find MagicJMP,#99B914000000F7F98B85????FFFF8B8C95????FFFF8908# cmp $RESULT,0 je NoFind add $RESULT,15 mov Clear,$RESULT mov [Clear],#9090# /* 00DFAE77 8B85 50D8FFFF mov eax,dword ptr ss:[ebp-27B0] 00DFAE7D 50 push eax 00DFAE7E E8 2DC30000 call 00E071B0 00DFAE83 83C4 04 add esp,4 00DFAE86 EB 03 jmp short 00DFAE8B 00DFAE88 D6 salc 00DFAE89 D6 salc 00D62407 8B95 A0AEFFFF mov edx,dword ptr ss:[ebp+FFFFAEA0] 00D6240D 52 push edx 00D6240E E8 11B30000 call 00D6D724 00D62413 83C4 04 add esp,4 00D62416 E9 92F6FFFF jmp 00D61AAD */ find Clear,#8B??????FFFF??E8????000083C404# cmp $RESULT,0 je NoFind add $RESULT,14 mov fiXedOver,$RESULT log fiXedOver eob fiXedOver bp fiXedOver esto GoOn6: esto fiXedOver: cmp eip,fiXedOver jne GoOn6 bc fiXedOver mov [MagicJMP],#74# mov [Clear],#8908# //CreateThread______________________________________ gpa "CreateThread", "KERNEL32.dll" find $RESULT,#C21800# mov CreateThread,$RESULT eob CreateThread bp CreateThread esto GoOn7: esto CreateThread: cmp eip,CreateThread jne GoOn7 bc CreateThread esti //FindOEP______________________________________ /* 00DBF2F1 2B4D DC sub ecx,dword ptr ss:[ebp-24] 00DBF2F4 FFD1 call ecx ; Armadill.004010CC 00DBF2F6 8945 FC mov dword ptr ss:[ebp-4],eax 00DBF2F9 8B45 FC mov eax,dword ptr ss:[ebp-4] 00DBF2FC 5E pop esi 00DBF2FD 8BE5 mov esp,ebp 00DBF2FF 5D pop ebp 00DBF300 C3 retn */ mov Temp,eip sub Temp,400 find Temp,#FFD18945FC8B45FC# cmp $RESULT,0 je NoFind mov FindOEP,$RESULT log FindOEP eob FindOEP bp FindOEP esto GoOn8: esto FindOEP: cmp eip,FindOEP jne GoOn8 bc FindOEP esti //GameOver______________________________________ tick time eval "Time since script startup : {time}" log $RESULT log eip cmt eip, "This is the OEP! Found By: fly[CUG] " MSG "Just : OEP ! Dump and Fix IAT. Good Luck " ret NoFind: MSG "Error! Don't find. " ret CheckODbgScripVersion: msg "ODBGScript Version Need 1.65 or Higher!" ret Armadillo.V5.X.Standard.Protection: msg "Sorry,Maybe it's not Armadillo.V5.X.Standard.Protection." ret TryAgain: MSG " Plz Try Again ! " ret