ActiveMark 5.4x Remove Selfchecks.txt

/* AM 5.4x selfcheck remover script by russiankid. It will finds and disables new AM selfcheck (which was added since AM v5.4). This script should be run at new EP (can be run on original target after upack script or on dumped target). */ /* the code that do the ckeck: 0050978D 8845 E0 MOV BYTE PTR SS:[EBP-20],AL 00509790 E8 BE170000 CALL dumped_.0050AF53 00509795 8DBE B4000000 LEA EDI,DWORD PTR DS:[ESI+B4] 0050979B 895D FC MOV DWORD PTR SS:[EBP-4],EBX 0050979E 57 PUSH EDI 0050979F E8 2FF00500 CALL dumped_.005687D3 005097A4 84C0 TEST AL,AL 005097A6 59 POP ECX 005097A7 75 0A JNZ SHORT dumped_.005097B3 005097A9 FF35 10DB4F00 PUSH DWORD PTR DS:[4FDB10] 005097AF 53 PUSH EBX 005097B0 57 PUSH EDI 005097B1 EB 41 JMP SHORT dumped_.005097F4 005097B3 399E 60010000 CMP DWORD PTR DS:[ESI+160],EBX 005097B9 74 43 JE SHORT dumped_.005097FE */ var FixAddr var SeqAddr find eip,#E8????????8DBEB4000000895DFC57E8# mov SeqAddr,$RESULT cmp SeqAddr,0 je SeqAddrNotFound add SeqAddr,10 mov FixAddr,[SeqAddr] add FixAddr,SeqAddr add FixAddr,4 mov [FixAddr],#B001C3# dec SeqAddr eval "New ActiveMark selfcheck fixed in the call at: {SeqAddr}" msg $RESULT ret SeqAddrNotFound: msg "Could not find sequence to fix!" ret