-
Notifications
You must be signed in to change notification settings - Fork 109
/
FSG1.2.txt
82 lines (64 loc) · 1.13 KB
/
FSG1.2.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
//////////////////////////////////////////////////
// FileName : FSG1.2.txt
// Comment : OEP Find For FSG v1.2
// Author : _pusher_
// Date : 2015-07-02
//////////////////////////////////////////////////
//start
msg "FSG 1.2 OEP Finder"
msg "make sure you're at the entry point of the program before you continue"
pause
//clear breakpoints
bc
bphwc
//find oep jump
find cip,"8810" //some pattern
cmp $result,0
jne GoOn
find cip,"8816" //some pattern
cmp $result,0
je error
log "found decrypt place: {0}", $result
GoOn:
//go to decrypt loop
bp $result
//loop six times to decrypt enough to bpx
erun
erun
erun
erun
erun
erun
//clear breakpoints
bc
find cip,"BB" //some pattern
cmp $result,0
je error
bp $result
erun
bc
//find oep jump
find cip,"EB09FE??0F84" //some pattern
cmp $result,0
je error
log "found OEP Jump: {0}", $result+4
//go to OEP jmp
bp $result+4
erun
//clear breakpoints
bc
$dw = 4:[$result+6]
$dest = $result+4 + $dw + 6
log "OEP: {0}", $dest
//bpx on OEP and go to OEP
bp $dest
erun
//clear breakpoints
bc
//comment it
cmt cip,"OEP"
//finish script
ret
error:
msg "didn't find oep jump"
ret