Scripts | Reverse Engineering b10g

Tools: WinXP SP2, OllyICE, OllyDbg Script 1.64.3
Notes:
- Use this script after stop at OEP.
- Some emulated functions need to be resolved manually:
GetCommandLineA
GetProcAddress
GetCurrentProcess
GetStartupInfoA
GetCurrentProcessId
**************************************************/

http://letitbit.net/download/36640a447194/HASP-HL-Envelope-IAT-Fixer.txt.html

TMD/WL Script for 1.9.0.0-2.0.3.0 November 19, 2008

Posted by reversengineering in Scripts, TOOLS.
add a comment

Target: Themida & WinLicense 1.9.0.0-2.0.3.0
Author: Computer_Angel

http://www.reaonline.net

version 0.8 – 2009.04.10

Thanks to:
+ the CUG Team Members (fxyang,fly, okodo … etc) – the base flow of script
+ 4VN Group
+ REA Team

History:
ver 0.8
+ Fix case 8930 mov dword ptr [eax], esi
ver 0.7
+ Support wl 2010
+ Fix case 8938 mov dword ptr [eax], edi
+ Fix bug IAT
ver 0.6
+ Support wl 1990
+ Fix bug in non-emulation api
ver 0.5
+ Support wl 1855,1900,1910,1920,1930,1940
+ Improve speed
ver 0.4
+ Optimize code
+ Fix bug when one ore moe import DLL : USER32 , KERNEL32, ADVAPI32 not used in protected program
ver 0.3
+ Fix flow for wl 1961,1950
ver 0.2
+ Optimize flow, support emulate/non emulate api
+ Stop at OEP
ver 0.1
+ Draft version for wl 1960 , just for emulate api

Things to improve:
+ Optimize the iat recover speed ??? Maybe inline asm will help
+ Support the prev version (<1855)
+ OEP Recover ???

http://letitbit.net/download/6bcbcb531757/TMDScript-1.9.6.0-ver-0.8-beta.rar.html

Obsidium 1.3.x.x Unpacking Script November 19, 2008

Posted by reversengineering in Scripts, TOOLS.
2 comments

/*
REA-TEAM – http://www.reaonline.net
Filename : Obsidium 1.3.x.x Unpacking Script.txt
Author : Unregistered !
Target : 1.3.x.x (Tested on Obsidium v1.3.5.5, v1.3.6.1, v1.3.6.3)
OS : Tested on XP SP2
Date : 04-November-2008
Credit :
* Special thanks Computer_Angel for “Obsidium IAT Fixer” script
Description :
* I have modified Computer_Angel’s Script to fix some Emulated API and some bugs…
Environment :
* OllyDBG 1.10 : Igrone All Exception
* OllyAdvance 1.26 beta 12 or higher :
+ Anti-Debug : Kill Anti-Attach + UnhandledExceptionFilter + Process32Next + Module32Next + CheckRemoteDebuggerPresent
+ Anti-Debug2 : IsDebuggerPresent
* Phantom 1.30 or higher :
+ Hide from PEB
+ Protect DRx
+ Patch ODBGString & FPU bugs
+ Hook BlockInput
+ Hook GetTickCount
+ Remove EP break
+ Custom handler exceptions
+ Change Olly caption
*/

http://letitbit.net/download/bb854c73004/Obsidium-1.3.x.x-Unpacking-Script.zip.html

new scripts for ollydbg October 23, 2008

Posted by reversengineering in Scripts, TOOLS.
1 comment so far

Themida and WinLicense

http://letitbit.net/download/4928e0115671/Themida-2.0.1.0-Fix-API-Virtual-Machine—IAT-Repair.txt.html

http://letitbit.net/download/b5c6e6457774/Themida—WinLicense-1.8.5.5—1.9.7.0-OEP-Finder—IAT-Repair.txt.html

http://letitbit.net/download/886f1b598276/Themida-2.0.1.0-Instruction-Logger.txt.html

SDProtector-Pro

http://letitbit.net/download/56df48238242/SDProtector-Pro-1.1x-Repair-IAT-Redirect.txt.html

ID-Application-Protector

http://letitbit.net/download/583d38418355/ID-Application-Protector-2.5-OEP-Finder.txt.html

new tutorial by Joker Italy September 18, 2008

Posted by reversengineering in MUPS, other protectors and packers, Scripts.
3 comments

Unpack SDProtector 1.16 + SCRIPT

Script SDProtector 1.16 IAT Redirect

http://letitbit.net/download/f45a8a827515/Script-SDProtector-1.16-IAT—Redirect.rar.html

http://letitbit.net/download/b3f419555648/Unpack-SDProtect-1.16—Script-By-Joker-Italy.rar.html

2 new script September 15, 2008

Posted by reversengineering in Scripts, TOOLS.
add a comment

MPress 0.71a – 1.27 OEP Finder + IAT Repair

ExeCryptor 2.xx OEP Finder + IAT Repair v1.02SC

http://letitbit.net/download/eac7c8846561/2-new-scripts.rar.html

new scripts September 12, 2008

Posted by reversengineering in Scripts, TOOLS.
add a comment

new scripts for

ASPROTECT 1.3X – 2.XX
Enigma Protector 1.51 Find + Fix Virtual Machine
EXE Lock 3.20 Password Finder
HaLV Crypter Unpacker
MPress 1.25 OEP Finder
NTkrnl Secure Suite and EXEStealth 3.16 OEP + IAT Repair v1.01
NTkrnl Secure Suite OEP Finder + IAT Repair v1.00
Software Compress 1.xx OEP Finder v1.00
Softwrap 6.xx – 7.xx OEP Finder + Fix Imports (Delphi & MSVC) v0.3
Ste@lth PE 2.1 – 2.2 OEP Finder v1.00
ZProtect 1.3 OEP Finder + IAT Repair
ZProtect 1.3 RepairScript_1_CALL REPAIR
ZProtect 1.3 Repairscript_2_IAT REPAIR
ZProtect 1.3 Repairscript_3_CALL REMAINING REPAIR
ZProtect 1.3 RepairScript_4_JUMPS REPAIR

http://letitbit.net/download/f72308135269/new-scripts-updated.rar.html

3 new script for armadillo September 7, 2008

Posted by reversengineering in Scripts, TOOLS.
1 comment so far

3 new script

Armadillo CRC Patcher – Standard Protection
Armadillo CRC Patcher – DebugBlocker Protection
Armadillo CRC Finder Script – Debug Blocker Protection

http://letitbit.net/download/f6cefb513909/Armadillo-CRC-Finder—patcher.rar.html

joker italy [Full MUP + (pack & unpack )] August 31, 2008

Posted by reversengineering in asprotect, MUPS, other protectors and packers, PACKER, PROTECTOR, Scripts, Themida, TOOLS.
2 comments

all manual unpacking

===============

ASProtect SKE 2.3 Unpacking DLL
Anti 007 2.5
AntiDote 1.4
AR Crypt Private
AT4RE Asm Protector
AT4RE Protector 1
BamBam 0.04
Berio 1.02
BeroEXEPacker 1.0
Cigicigi Crypter 1.0
CriptX MEW11
DCrypt Private 0.9b
DragonArmour

Dumped Asprotect Aspack

ElecKey 2.0
ExE Evil 1.0
EXESmasher 1.0
EXEStealth3.16
fEaRz Packer 0.3
Free Joiner Small 0.15
Gie Protector0.2
H4ck y0u.org Crypter
HAC Crew Crypter
HaLV Crypter
Hide&Protect
Hmimys Packer 1.3
Joker Protector 1.0.8
Joker Protector 1.1.3
KiAms Cryptor 1.4
KKrunchy023
lARP Lite Edition 2.0
Mal Packer 1.2
ModdedFogv1.1
Morphnah
MPack 0.0.3
Muckis Protector II
Nova Cipher 1.0
noX Crypt 1.1
Npack 1.1.800.2008
NtKrnlpacker Secure Suite Script
OSC Crypter
Pain Crew Protector 1.1
Pe Armour 0.765
Pepsi2
Poke Crypter
PolyBox 1.0

Polymorphic Crypter 0.1

Pirate Zylom

Pub Crypter
Russian Cryptor
Secure Shade 1.5
Sexe Crypter 1.1
SoftSentry 3.00
Software Compress ].4
StasFodioCrypter 1.0
Stealth PE 2.2

The Best Cryptor

Themida unleashed
The Zone Crypter
Tubby Crypt 1.1.0
Unamed Scrambler 2.5.2
Undetector 1.2
UPX+UNOpix Scrambler 1.10
USSR 0.31
Vb PowerWrap
VCrypt0.9b
WingsCrypt 1.0
WinUpack 0.399 uPack Mutanter 0.1
WL Crypt 1.0
Zylom Wrapper

PACK AND UNPACK
===============
stlpe20
EPack lite 1 4 final
AT4RE Protector 1 .0
DalKrypt 1.0
eXpresso.v1.4.5.1
FakeNinja PrivateRelase
fsg2.0
L0rD Crypter
NOmeR1
nPack v1.1.300.2006 Beta
Packman 1.0
Petite 2.3
Russian Cryptor ver1
SimbiOZ v2.1
SLVc0deProtector
Spack
tElock 0.99
WindOfCrypt

info:

5*36mg+1*19mg=170mg

uploading by REM

ALL TUTORS + FILES THAT UNPACKED BY Joker Italy

links:

http://depositfiles.com/files/7607608

http://depositfiles.com/files/7608013

http://depositfiles.com/files/7608532

http://depositfiles.com/files/7609143

http://depositfiles.com/files/7609669

http://letitbit.net/download/643660722146/joker-italy–Full-MUP—-pack—unpack—.part1.rar.html

http://letitbit.net/download/5dcce1873656/joker-italy–Full-MUP—-pack—unpack—.part2.rar.html

http://letitbit.net/download/077afd885650/joker-italy–Full-MUP—-pack—unpack—.part3.rar.html

http://letitbit.net/download/0a67b2765939/joker-italy–Full-MUP—-pack—unpack—.part4.rar.html

http://letitbit.net/download/bf4a0793237/joker-italy–Full-MUP—-pack—unpack—.part5.rar.html

Execryptor 2.x – 2.41 find VM EP – Stolen OEP by trickyboy August 11, 2008

Posted by reversengineering in Scripts, TOOLS.
add a comment

Execryptor 2.x – 2.41 find VM EP – Stolen OEP

Hi everyone, we know that Unpacker Execryptor by RSI (public version) can unpack a lot of target but sometimes it can’t find OEP (miss VC8 signature in public version)
Ex:
[Option: One-touch Trial + Protect Entry Point]

http://www.chrismc.de/development/xarp/XArp.exe

[Option: Not Compress section code, Not dynamic import]

http://dl.powerarchiver.com/2007/powarc1022.exe

So I modified Bypass AntiDebug script to find VM EP or Stolen OEP and you can input it into Unpacker Execryptor.

History:
version 1.1
+ find Stolen OEP some special target of Borland Delphi

http://www.diskinternals.com/files/Raid_Recovery.exe

Note:
1. OllyICE + Phantom plugin
2. ODBGScript V1.64+
3. Olly Advanced (Break on TLS Callback)
4. Check bypass all exception in Olly option: 00000000 – FFFFFFFF

Hope it useful!

Regards,

Trick.

from unpack.cn

link:

http://depositfiles.com/files/7152798

http://letitbit.net/download/e1ba81756459/Execryptor-2.x—2.41-find-VM-EP—Stolen-OEP-v1.1.rar.html