ExeCryptor 2.24 - 2.25 IAT Rebuilder

mycsy

/*
Script written by okdodo  2007/03
Tested for execryptor v2.24/v2.25

Ollyice: Ignore all exceptions (add 0EEDFADE,C0000005,C000001E)
HideOD : Check HideNtDebugBit and ZwQueryInformationProcess(method2)

Test Environment : Ollyice 1.1 + HideOD    
                   ODBGScript 1.51 under WINXP
Thanks :
         kanxue     - author of HideOD       
         hnhuqiong  - author of ODbgScript 1.51
*/

data:
    var hInstance
    var codeseg
    var vmseg
    var ep
    var oep
    var esptmp
    var _esp
    var iat_start
    var iat_end
    var iat_cur
    var addr
    var c_gpa
    var ibase
    var iend
    var temp
    var tmp
    var SBM
    var TOA
    var mbase
    var msize

code:
    bphwcall
    gpa "SetBkMode","GDI32.dll"
    mov SBM,$RESULT
    REV SBM
    mov SBM,$RESULT
    itoa SBM
    gpa "TextOutA","GDI32.dll"
    mov TOA,$RESULT
    REV TOA
    mov TOA,$RESULT
    itoa TOA

    gpa "VirtualFree","kernel32.dll"
    bphws $RESULT,"x"
    run
    bphwc $RESULT
    rtu
    gmi eip,MODULEBASE
    mov hInstance,$RESULT
    mov temp,$RESULT
    add temp,3c
    mov temp,[temp]
    add temp,hInstance
    add temp,28
    mov temp,[temp]
    add temp,hInstance
    mov ep,temp

    bc ep

    gmemi eip,MEMORYBASE
    mov codeseg,$RESULT

    find $RESULT,#2ECC9D#
    mov [$RESULT],#2ECC90#

    gpa "EnumWindows","user32.dll"
    mov [$RESULT],#8BC09C85C09D0578563412C20800#

    gpa "CreateThread","kernel32.dll"
    find $RESULT,#FF7518#
    mov [$RESULT],#6A0490#

    gpa "ZwCreateThread","ntdll.dll"
    bp $RESULT

loop1:
    esto
    cmp eip,$RESULT
    jne loop1
    bc $RESULT
    bp ep

bpep:
    run
    cmp eip,ep
    je loop2
    jmp bpep

loop2:
    bc ep
    mov esptmp,esp
    sub esptmp,4    

    mov temp,codeseg
    sub temp,1
    gmemi temp,MEMORYBASE
    mov vmseg,$RESULT
    gmemi temp,MEMORYSIZE
    bprm vmseg,$RESULT

loop3:    
    esto
    mov tmp,eip
    mov tmp,[tmp]
    cmp tmp,992C008A
    jne loop5
    mov oep,eax
    sti
    bprm oep,1

loop4:
    esto
    cmp eip,oep
    jne loop4
    jmp iat

loop5:
    cmp esp,esptmp
    jne loop3

iat:
    bpmc
    mov oep,eip
    cmt eip,"OEP?" 
    gmi eip, MODULEBASE
    mov ibase, $RESULT
    mov temp,ibase
    add temp,3C
    mov temp,[temp]
    add temp,ibase
    add temp,50
    mov iend,[temp]
    add iend,ibase
    
    mov count,0
    mov iatbase,0
    mov mbase,codeseg 
hwloop: 
    sub mbase,1 
    cmp mbase,ibase
    jb @iatinit
    gmemi mbase,MEMORYBASE
    mov mbase,$RESULT
    gmemi msize,MEMORYSIZE
    mov msize,$RESULT
    mov temp,mbase

    cmp iatbase,0
    jne vmsegloop
    eval #{SBM}#
    find temp,$RESULT,msize
    cmp 0,$RESULT
    je findTextOutA
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT
    jmp vmsegloop

findTextOutA:
    cmp iatbase,0
    jne vmsegloop
    eval #{TOA}#
    find temp,$RESULT,msize
    cmp 0,$RESULT
    je vmsegloop
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT

vmsegloop:
    find temp,#03C28B000345FC#
    mov tmp, $RESULT
    cmp tmp,0
    je check239
    add tmp,7
    bphws tmp,"x"
    mov temp,tmp
    mov c_gpa,tmp 
    inc count
    jmp vmsegloop

check239:
    cmp count,0
    jne hwloop

    mov mbase,codeseg 
hwloop1: 
    sub mbase,1 
    cmp mbase,ibase
    jb @iatinit
    gmemi mbase,MEMORYBASE
    mov mbase,$RESULT
    mov temp,mbase

    cmp iatbase,0
    jne vmsegloop1
    eval #{SBM}#
    find temp,$RESULT,msize
    cmp 0,$RESULT
    je findTextOutA1
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT
    jmp vmsegloop1

findTextOutA1:
    cmp iatbase,0
    jne vmsegloop1
    eval #{TOA}#
    find temp,$RESULT,msize
    cmp 0,$RESULT
    je vmsegloop1
    gmemi $RESULT,MEMORYBASE
    mov iatbase,$RESULT

vmsegloop1:
    find temp,#8B000345FC8945#
    mov tmp, $RESULT
    cmp tmp,0
    je hwloop1
    add tmp,5
    bphws tmp,"x"
    mov temp,tmp
    mov c_gpa,tmp 
    jmp vmsegloop1


@iatinit:
    cmp iatbase,0
    je @error
    gmemi iatbase,MEMORYSIZE
    mov iat_end,$RESULT
    add iat_end,iatbase
    sub iat_end,4
    mov _esp,esp
    mov iat_cur,iatbase
    sub iat_cur,4
    mov count,0

@imprec:  
    add iat_cur,4
    cmp iat_cur,iat_end
    ja @end
    mov addr,[iat_cur]
    cmp addr,0
    je @imprec
    cmp addr,ibase
    jb @imprec
    cmp count,0
    jne @next
    mov iat_start,iat_cur
    log iat_start

@next: 
    cmp addr,iend
    inc count
    mov temp,iat_cur
    ja @imprec
    cmp addr,iatbase
    jae next1
    jmp next2
next1: 
    cmp addr,iat_end
    jbe @end
next2:  
    mov esp,_esp
    mov eip,addr
    mov [esp],eip  
    esto    
    mov [iat_cur],eax    
    jmp @imprec

@end:
    bphwcall
    mov iat_end,temp
    log iat_end
    mov eip,oep 
    eval "IAT Start Address: {iat_start}   IAT End Address: {iat_end}"
    msg $RESULT   
    msg "Script ends ok!  Find the OEP manually and dump it~"
    ret

@error:
    bphwcall
    msg "ERROR!"
    ret