////////////////////////Ch鈚eau-Saint-Martin///////////////////////////////////////////////
// //////////////////
// FileName : WinLicense HWID & TRIAL Loader & Bypass Creater {U1} /////////////////
// Features : ////////////////
// Use this script to create a loader which can ///////////////
// bypass the HWID & TRIAL check in the packed //////////////
// WinLicense file. /////////////
// ////////////
// 1. Script inline磗 the HWID & TRIAL patch ///////////
// 2. Create磗 a extra file with all patches //////////
// for Advanced Loader Generator etc. /////////
// 3. Patch Method CISC & RISC (memory) ////////
// ///////
// //////
// Environment : WinXP,OllyDbg V1.10,OllyScript v1.65.4 /////
// Author : LCF-AT ////
// Date : 2009-07-03 ///
// //
// //
///////////////WILLST DU SPAREN,DANN MU逿 DU SPAREN!////////////////////
var GetLocalTime
var VirtualAlloc
var apibase
var apibase2
var LoadLibraryA
var rappa
var SECTEST
var HWID
var CALC
var ADDRESS
var TRIAL
var JUMP
var NEWPATCH
var JUMP_2
var BINARY
var BINARYJUMP
var FIRSTJUMP
var NULLER
var TESTER
var risc
var TALLA
var JUMP_B
var DEST
var A
var B
var C
var JUMP_start
var NAME
var M_BASE
var M_SIZE
var MEM_TEST
var MEMO
var EXTRAADDRESS
var FRG
/////////////////////////////
lc
dbh
BC
bpmc
bphwcall
dbh
GPI PROCESSNAME
mov NAME, $RESULT
gpi MAINBASE
mov M_BASE, $RESULT
gmi M_BASE, MODULESIZE
mov M_SIZE, $RESULT
add M_SIZE, M_BASE
mov M_SIZE, M_SIZE
start0:
mov $RESULT, 0
ask "Enter a address of free space if you alraedy have!If not then enter nothing and press a button"
cmp $RESULT, 0
je HAL_2
cmp $RESULT, FFFFFFFF
je ende_2
cmp $RESULT, 02
je ende_3
mov A, $RESULT
mov B, $RESULT
mov C, $RESULT
READSTR C, len
mov C, $RESULT
len $RESULT
mov C, $RESULT
cmp $RESULT, 0
ja ende_2
mov FRG, A
and FRG, ffff0000
mov FRG, FRG
cmp FRG, 0
je ende_2
mov FRG, A
////////////////////////////////////
HAL:
inc EXTRAADDRESS
////////////////////////////////////
HAL_2:
bpmc
gpa "GetLocalTime", "kernel32.dll"
mov GetLocalTime, $RESULT
find GetLocalTime, #C9C20400#
cmp $RESULT, 0
jne hessel
pause
hessel:
mov GetLocalTime, $RESULT+1
bphws GetLocalTime ,"x"
esto
bphwc GetLocalTime
sti
gpa "VirtualAlloc", "kernel32.dll"
mov VirtualAlloc, $RESULT
find VirtualAlloc, #C21000#
cmp $RESULT, 0
jne seiber
pause
seiber:
mov VirtualAlloc, $RESULT
bphws VirtualAlloc ,"x"
esto
bphwc VirtualAlloc
sti
mov apibase,eax
log apibase
gpa "LoadLibraryA", "kernel32.dll"
mov LoadLibraryA, $RESULT
find LoadLibraryA, #C20400#
cmp $RESULT, 0
jne wessel
pause
wessel:
mov LoadLibraryA, $RESULT
bphws LoadLibraryA ,"x"
esto
bphwc LoadLibraryA
sti
API_1:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE81B0000005DC21 000#
cmp $RESULT, 0
jne API_start
API_2:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE884FFFFFF5DC21 000#
cmp $RESULT, 0
jne API_start
API_3:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE878FFFFFF5DC21 000#
cmp $RESULT, 0
jne API_start
API_4:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE8090000005DC21 000#
cmp $RESULT, 0
jne API_start
API_5:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE8040000005DC21 000#
cmp $RESULT, 0
jne API_start
API_6:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE8????????5DC21 000#
cmp $RESULT, 0
je ende
mov apibase, $RESULT
inc rappa
inc apibase
cmp rappa, 2
je API_starta
jmp API_6
API_starta:
dec apibase
//////////////////////////
API_start:
mov apibase2, $RESULT
bphws apibase2 ,"x"
RAS:
esto
mov SECTEST, [esp]
cmp SECTEST, 0
je RAS
gmemi SECTEST, MEMORYBASE
mov SECTEST, $RESULT
find SECTEST, #B8010000008985????????C785????????01000000#
cmp $RESULT, 0
je RAS
mov HWID, $RESULT
add HWID, 0B
add HWID, 02
mov HWID, [HWID]
add HWID, ebp
mov HWID, HWID
mov CALC, ebp
log HWID
log [HWID]
//////////////////mov [HWID], 02
log ebp
bphws HWID, "w"
bphwc apibase2
RAS_2:
esto
mov [HWID], 02
mov TALLA, eip+06
cmp [TALLA], 0FFFFFFFF
je RAS_2
gmemi eip, MEMORYBASE
mov MEM_TEST, $RESULT
cmp M_BASE, MEM_TEST
ja TR1
cmp M_SIZE, MEM_TEST
jb TR1
jmp TR2
TR1:
eval "JUMP PATCH ADDRESS is OUTSIDE from our TARGET!YOU CAN碩 CREATE A LOADER WITH THIS SCRIPT!"
log $RESULT, ""
mov MEMO, $RESULT
jmp TR3
TR2:
eval "JUMP PATCH ADDRESS is INSIDE from our TARGET!YOU CAN CREATE A LOADER WITH THIS SCRIPT!"
log $RESULT, ""
mov MEMO, $RESULT
TR3:
mov [HWID], 02
mov risc, [eip]
and risc, 0ffff
mov risc, risc
cmp risc, A4F3 // RISC F3A4
je RISC
///////////////////////////jmp RAS_3A
mov TALLA, [eip]
and TALLA, 0ff
mov TALLA, TALLA
cmp TALLA, E9
je RAS_3
pause
pause
RAS_3:
esto
RAS_3A:
mov [HWID], 02
mov ADDRESS, eip
find SECTEST, #81BD????????00050000#
cmp $RESULT, 0
je RAS_3
mov ADDRESS, eip
mov TRIAL, $RESULT
log TRIAL
opcode ADDRESS
/////////////////////////READSTR [ADDRESS], 5
mov FIRSTJUMP, $RESULT
add TRIAL, 02
mov TRIAL, [TRIAL]
add TRIAL, CALC
mov TRIAL, TRIAL
log TRIAL
log [TRIAL]
mov [TRIAL], 500
///////////////////////////
PATCHERS:
bphwcall
gci ADDRESS, DESTINATION
cmp $RESULT, 0
jne RAS_4
pause
pause
RAS_4:
mov JUMP, $RESULT
mov NULLER, #00#
mov NEWPATCH, FRG
mov JUMP_2, FRG
cmp EXTRAADDRESS, 0
jne RAS_5S1
find eip, #0000000000000000000000000000000000000000000000000 000000000000000000000000000000000#
cmp $RESULT, 0
jne RAS_5
pause
pause
RAS_5:
mov NEWPATCH, $RESULT
mov JUMP_2, $RESULT
RAS_5S1:
mov [NEWPATCH], #81FAEEEEEEEE741581FAEEEEEEEE7405E9A7B73EEEC702000 50000EBF3C70202000000EBEB#
add NEWPATCH, 02
mov [NEWPATCH], HWID
add NEWPATCH, 08
mov [NEWPATCH], TRIAL
add NEWPATCH, 06
eval "JMP {JUMP}"
asm NEWPATCH, $RESULT
eval "JMP {JUMP_2}"
asm ADDRESS, $RESULT
eval "This are the bytes which you have to enter in Advanced Loader Generator!"
log $RESULT, ""
log "-----"
opcode ADDRESS
mov BINARYJUMP, $RESULT
find JUMP_2, #00000000#
cmp $RESULT, 0
jne RAS_6
pause
pause
RAS_6:
mov TESTER, $RESULT
sub TESTER, JUMP_2
mov TESTER, TESTER
READSTR [JUMP_2], TESTER
mov BINARY, $RESULT
eval "Advanced Loader Generator DATA! \r\n\r\nAddress First Original \r\nVA: {ADDRESS} \r\nBytes: {FIRSTJUMP} \r\nAddress First Patched \r\nVA: {ADDRESS} \r\nBytes: {BINARYJUMP} \r\n\r\nAddress Second Original \r\nVA: {JUMP_2} \r\nBytes: {NULLER} x {TESTER} HEX Value \r\nAddress Second Patched \r\nVA: {JUMP_2} \r\nBytes: {BINARY} \r\n\r\nNOTE: {MEMO}"
log "Advanced Loader Generator DATA!"
MSG $RESULT
log ADDRESS
log FIRSTJUMP, ""
log ADDRESS
log BINARYJUMP, ""
log JUMP_2
log NULLER, ""
log JUMP_2
log BINARY, ""
jmp FILE
ende:
msg "Can磘 find the API Base!Maybe your target still needs some dll file?"
pause
ret
FILE:
eval "ALG Patches for {NAME}.txt"
mov sFile, $RESULT
eval "Advanced Loader Generator Patches for {NAME}"
wrt sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
eval "NOTE: {MEMO}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Address First Original"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "VA: "
eval "{ADDRESS}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Bytes: "
eval "{FIRSTJUMP}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Address First Patched"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "VA: "
eval "{ADDRESS}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Bytes: "
eval "{BINARYJUMP}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Address Second Original"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "VA: "
eval "{JUMP_2}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Bytes: "
eval "{NULLER} x {TESTER} HEX Value"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Address Second Patched"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "VA: "
eval "{JUMP_2}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Bytes: "
eval "{BINARY}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "*************************"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "gRn @ LCF-AT"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
eval "Script finished!All patches are written into a new file now! \r\n\r\nPress run to start your app now if you like!"
msg $RESULT
pause
ret
/////////////////////////////////////////
/////////////////////////////////////////
RISC:
mov A, edi
sub A, 01
mov A, A
mov B, [A]
///////////////// cmp B, 02 // HWID
//////////////// jne RISC_3
mov HWID, A
mov HWVALUE, B
mov [HWID], 02
mov JUMP_start, eip
findop JUMP_start, #E9#
cmp $RESULT, 0
jne RISC_2
pause
pause
RISC_2:
mov JUMP_B, $RESULT
gci JUMP_B, DESTINATION
mov DEST, $RESULT
RISC_2A:
esto
mov [HWID], 02
find SECTEST, #81BD????????00050000#
cmp $RESULT, 0
je RISC_2A
mov TRIAL, $RESULT
log TRIAL
add TRIAL, 02
mov TRIAL, [TRIAL]
mov TRIAL, TRIAL
add TRIAL, CALC
mov TRIAL, TRIAL
log TRIAL
log [TRIAL]
mov [TRIAL], 500
///////////////////////////////
PATCHERS_2:
bphwcall
gci JUMP_B, DESTINATION
cmp $RESULT, 0
jne RAS_4S
pause
pause
RAS_4S:
mov JUMP, $RESULT
mov NULLER, #00#
mov NEWPATCH, FRG
mov JUMP_2, FRG
cmp EXTRAADDRESS, 0
jne RAS_5S2
find eip, #0000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 000000000#
cmp $RESULT, 0
jne RAS_5S
pause
pause
RAS_5S:
mov NEWPATCH, $RESULT
mov JUMP_2, $RESULT
RAS_5S2:
opcode JUMP_B
mov FIRSTJUMP, $RESULT
mov [NEWPATCH], #833DEEEEEEEE02751D813DEEEEEEEE000500007505E9657F6 2EEC705EEEEEEEE00050000EBEFC705EEEEEEEE02000000EBE 3#
add NEWPATCH, 02
mov [NEWPATCH], HWID
add NEWPATCH, 09
mov [NEWPATCH], TRIAL
add NEWPATCH, 0A
eval "JMP {JUMP}"
asm NEWPATCH, $RESULT
add NEWPATCH, 07
mov [NEWPATCH], TRIAL
add NEWPATCH, 0C
mov [NEWPATCH], HWID
mov ADDRESS, JUMP_B
eval "JMP {JUMP_2}"
asm ADDRESS, $RESULT
eval "This are the bytes which you have to enter in Advanced Loader Generator!"
log $RESULT, ""
log "-----"
opcode ADDRESS
mov BINARYJUMP, $RESULT
find JUMP_2, #00000000#
cmp $RESULT, 0
jne RAS_6S
pause
pause
RAS_6S:
mov TESTER, $RESULT
sub TESTER, JUMP_2
mov TESTER, TESTER
opcode JUMP_B
mov BINARYJUMP, $RESULT
READSTR [JUMP_2], TESTER
mov BINARY, $RESULT
eval "Advanced Loader Generator DATA! \r\n\r\nAddress First Original \r\nVA: {ADDRESS} \r\nBytes: {FIRSTJUMP} \r\nAddress First Patched \r\nVA: {ADDRESS} \r\nBytes: {BINARYJUMP} \r\n\r\nAddress Second Original \r\nVA: {JUMP_2} \r\nBytes: {NULLER} x {TESTER} HEX Value \r\nAddress Second Patched \r\nVA: {JUMP_2} \r\nBytes: {BINARY} \r\n\r\nNOTE: {MEMO}"
log "Advanced Loader Generator DATA!"
MSG $RESULT
log ADDRESS
log FIRSTJUMP, ""
log ADDRESS
log BINARYJUMP, ""
log JUMP_2
log NULLER, ""
log JUMP_2
log BINARY, ""
jmp FILE
////////////////////
RISC_3:
pause
pause
ende_2:
mov TT_1, 0
msg "You have to enter minimum 5 digits for the address and also no strings so try it again!"
jmp start0
ende_3:
ret
|
