/*
===============================================================
ActiveMARK™ 6.x - OEP finder script (v0.1) for Windows XP
===============================================================
*/

var addr
var EP1
var EP2
var EP3
var EP4

mov EP1,eip

//------------- Debugging trick on Windows XP ---------------
gpa "DebugActiveProcess","kernel32.dll"
cmp $RESULT,0
je NOT_WINDOWS_XP
mov [$RESULT],#33C0C20400#
NOT_WINDOWS_XP:

//------- ReadProcessMemory trick for detecting tools -------
gpa "ReadProcessMemory","kernel32.dll"
cmp $RESULT,0
je ERROR
mov [$RESULT],#33C0C21400#

//------------------ Let's find EP2 -------------------------
gpa "GetModuleHandleA","kernel32.dll"
cmp $RESULT,0
je ERROR
mov addr,$RESULT
findop addr,#C20400#
bp $RESULT
CHECK_HANDLE:
esto
cmp eax,00400000
jne CHECK_HANDLE
bc eip
sti
mov EP2,eip
sub EP2,3E

//--------------------- Let's find EP3 -----------------------
find eip,#FF25??????00#
cmp $RESULT,0
je ERROR
mov addr,$RESULT
add addr,6
find addr,#FF25??????00#
cmp $RESULT,0
je ERROR
bp $RESULT
esto
bc eip
sti
mov EP3,eip

//------------ Let's find EP4=OEP or stolen code -------------
FIND_PUSHAD:
sti
mov addr,[eip]
and addr,0FF
cmp addr,60
jne FIND_PUSHAD
sti
mov addr,esp
bphws addr,"r"
msg "ActiveMARK window will start now. Click 'Start Free Trial' link to continue script."
CHECK_EXCEPTION:
esto
cmp eip,70000000
ja CHECK_EXCEPTION
bphwc addr
mov EP4,eip
msg "If you are in the some AM section, in front of you is stolen code. Trace to find exact opcodes. Otherwise you are at OEP. Check log for some info."

//------------------- Log some info -----------------------
log "=================================================="
log " ActiveMARK™ 6.1 OEP SCRIPT"
log "=================================================="
log " "
log "Entry points of protection modules:"
log " "
log EP1
log EP2
log EP3
log " "
log "OEP or EP4 (stolen code):"
log " "
log EP4

ret
ERROR:
msg "Error in script! I couldn't find needed information."
ret