///////////////////////////////////////////////////////////////
// FileName    :  Armadillo V4.0-V5.X.Standard.Protection.oSc
// Comment     :  Standard Only + Standard plus Debug Blocker
// Environment :  WinXP SP2,OllyDbg V1.10,OllyScript V1.65
// Author      :  fly [CUG]
// WebSite     :  http://unpack.cn
// Date        :  2007-09-22 00:00
///////////////////////////////////////////////////////////////
#log
dbh

var T0
var T1
var Temp
var bpcnt
var MagicJMP
var JmpAddress
var fiXedOver
var OpenMutexA 
var GetModuleHandleA
var VirtualProtect
var CreateFileMappingA
var CreateThread
var FindOEP


MSGYN "Plz Clear All BreakPoints + Set Debugging Option Ignore All Excepions Options + Add C000001D..C000001E in custom exceptions !"
cmp $RESULT, 0
je TryAgain

cmp $VERSION, "1.65" 
jb CheckODbgScripVersion 

BPHWC
BC


//OutputDebugStringA______________________________________

gpa "OutputDebugStringA", "KERNEL32.dll"
mov [$RESULT], #C20400#


//OpenMutexA______________________________________

gpa "VirtualProtect", "KERNEL32.dll"
find $RESULT,#5DC21000#
mov VirtualProtect,$RESULT
eob VirtualProtect
bp VirtualProtect

gpa "OpenMutexA", "KERNEL32.dll"
mov OpenMutexA,$RESULT
bp OpenMutexA

esto

OpenMutexA:
eob KillOpenMutexA
exec
mov eax,[ESP+0C]
pushad
push eax
push 0
push 0
CALL CreateMutexA
popad
jmp OpenMutexA
ende

KillOpenMutexA:
bc OpenMutexA
esti


//VirtualProtect______________________________________

eob VirtualProtect
GoOn0:
esto

VirtualProtect:
cmp eip,OpenMutexA
je OpenMutexA
cmp eip,VirtualProtect
jne GoOn0
bc VirtualProtect


//CreateFileMappingA______________________________________

gpa "CreateFileMappingA", "KERNEL32.dll"
find $RESULT,#C9C21800#
mov CreateFileMappingA,$RESULT
bp CreateFileMappingA
eob CreateFileMappingA

esto
GoOn1:
esto

CreateFileMappingA:
cmp eip,CreateFileMappingA
jne GoOn1
bc CreateFileMappingA


//GetModuleHandleA______________________________________

gpa "GetModuleHandleA", "KERNEL32.dll"
find $RESULT,#C20400#
mov GetModuleHandleA,$RESULT
bp GetModuleHandleA
eob GetModuleHandleA

esto
GoOn2:
esto

GetModuleHandleA:
cmp eip,GetModuleHandleA
jne GoOn2
cmp bpcnt,1
je  VirtualFree
cmp bpcnt,2
je  Third

        
/*
00129528   00BE6DF3  RETURN to 00BE6DF3 from kernel32.GetModuleHandleA
0012952C   00BFBC1C  ASCII "kernel32.dll"
00129530   00BFCEC4  ASCII "VirtualAlloc"
*/

VirtualAlloc:        
mov Temp,esp
add Temp,4
log Temp
mov T0,[Temp]
cmp [T0],6E72656B
log [T0]
jne GoOn2
add Temp,4
mov T1,[Temp]
cmp [T1],74726956
jne GoOn2
bc OpenMutexA
inc bpcnt
jmp GoOn2


/*
00129528   00BE6E10  RETURN to 00BE6E10 from kernel32.GetModuleHandleA
0012952C   00BFBC1C  ASCII "kernel32.dll"
00129530   00BFCEB8  ASCII "VirtualFree"
*/

VirtualFree:
mov Temp,esp
add Temp,4
mov T1,[Temp]
cmp [T1],6E72656B
jne GoOn2
add Temp,4
mov T1,[Temp]
add T1,7
cmp [T1],65657246
log [T1]
jne GoOn2
inc bpcnt
jmp GoOn2


/*
0012928C   00BD5CE1  RETURN to 00BD5CE1 from kernel32.GetModuleHandleA
00129290   001293DC  ASCII "kernel32.dll"
*/         

Third:
mov Temp,esp
add Temp,4
mov T1,[Temp]
cmp [T1],6E72656B
jne GoOn2
bc GetModuleHandleA
esti


//MagicJMP______________________________________

/*
->Armadillo V4.X
00BD5CDB     FF15 B860BF00      call dword ptr ds:[BF60B8]       ; kernel32.GetModuleHandleA
00BD5CE1     8B0D AC40C000      mov ecx,dword ptr ds:[C040AC]
00BD5CE7     89040E             mov dword ptr ds:[esi+ecx],eax
00BD5CEA     A1 AC40C000        mov eax,dword ptr ds:[C040AC]
00BD5CEF     391C06             cmp dword ptr ds:[esi+eax],ebx
00BD5CF2     75 16              jnz short 00BD5D0A
00BD5CF4     8D85 B4FEFFFF      lea eax,dword ptr ss:[ebp-14C]
00BD5CFA     50                 push eax
00BD5CFB     FF15 BC62BF00      call dword ptr ds:[BF62BC]       ; kernel32.LoadLibraryA
00BD5D01     8B0D AC40C000      mov ecx,dword ptr ds:[C040AC]
00BD5D07     89040E             mov dword ptr ds:[esi+ecx],eax
00BD5D0A     A1 AC40C000        mov eax,dword ptr ds:[C040AC]
00BD5D0F     391C06             cmp dword ptr ds:[esi+eax],ebx
00BD5D12     0F84 2F010000      je 00BD5E47

->Armadillo V5.X
00DE7F4E     FF15 C0E0E200      call dword ptr ds:[E2E0C0] ; kernel32.GetModuleHandleA
00DE7F54     8B55 F4            mov edx,dword ptr ss:[ebp-C]
00DE7F57     8B0D 7CDFE300      mov ecx,dword ptr ds:[E3DF7C]
00DE7F5D     890491             mov dword ptr ds:[ecx+edx*4],eax
00DE7F60     8B55 F4            mov edx,dword ptr ss:[ebp-C]
00DE7F63     A1 7CDFE300        mov eax,dword ptr ds:[E3DF7C]
00DE7F68     833C90 00          cmp dword ptr ds:[eax+edx*4],0
00DE7F6C     75 5C              jnz short 00DE7FCA
00DE7F6E     8B4D F8            mov ecx,dword ptr ss:[ebp-8]
00DE7F71     8B51 08            mov edx,dword ptr ds:[ecx+8]
00DE7F74     83E2 02            and edx,2
00DE7F77     74 38              je short 00DE7FB1
00DE7F79     B8 0B000000        mov eax,0B
00DE7F7E     C1E0 02            shl eax,2
00DE7F81     8B0D 04BBE300      mov ecx,dword ptr ds:[E3BB04]
00DE7F87     8B15 04BBE300      mov edx,dword ptr ds:[E3BB04]
00DE7F8D     8B35 04BBE300      mov esi,dword ptr ds:[E3BB04]
00DE7F93     8B5E 78            mov ebx,dword ptr ds:[esi+78]
00DE7F96     335A 34            xor ebx,dword ptr ds:[edx+34]
00DE7F99     331C01             xor ebx,dword ptr ds:[ecx+eax]
00DE7F9C     83E3 10            and ebx,10
00DE7F9F     F7DB               neg ebx
00DE7FA1     1BDB               sbb ebx,ebx
00DE7FA3     F7DB               neg ebx
00DE7FA5     0FB6C3             movzx eax,bl
00DE7FA8     85C0               test eax,eax
00DE7FAA     75 05              jnz short 00DE7FB1
00DE7FAC     E9 1BFFFFFF        jmp 00DE7ECC
00DE7FB1     8D8D C8FEFFFF      lea ecx,dword ptr ss:[ebp-138]
00DE7FB7     51                 push ecx
00DE7FB8     FF15 D4E1E200      call dword ptr ds:[E2E1D4] ; kernel32.LoadLibraryA
00DE7FBE     8B55 F4            mov edx,dword ptr ss:[ebp-C]
00DE7FC1     8B0D 7CDFE300      mov ecx,dword ptr ds:[E3DF7C]
00DE7FC7     890491             mov dword ptr ds:[ecx+edx*4],eax
00DE7FCA     8B55 F4            mov edx,dword ptr ss:[ebp-C]
00DE7FCD     A1 7CDFE300        mov eax,dword ptr ds:[E3DF7C]
00DE7FD2     833C90 00          cmp dword ptr ds:[eax+edx*4],0
00DE7FD6     75 05              jnz short 00DE7FDD
//MagicJmp бя  ->NOP
00E37FD8     E9 EFFEFFFF        jmp 00E37ECC
00E37FDD     C785 BCFEFFFF 0000>mov dword ptr ss:[ebp-144],0
00E37FE7     C785 C0FEFFFF 0000>mov dword ptr ss:[ebp-140],0
00E37FF1     8B4D F8            mov ecx,dword ptr ss:[ebp-8]
00E37FF4     8B51 04            mov edx,dword ptr ds:[ecx+4]
00E37FF7     8995 C4FEFFFF      mov dword ptr ss:[ebp-13C],edx
00E37FFD     EB 0F              jmp short 00E3800E
*/

find eip,#39????0F84??010000#,100
cmp $RESULT,0
je ArmadilloV5.X
add $RESULT,3
mov MagicJMP,$RESULT
log MagicJMP
mov T0,$RESULT
add T0,2
mov T1, [T0]
add T1,4
add T1,T0
mov JmpAddress,T1
log JmpAddress
eval "jmp {JmpAddress}"
asm MagicJMP,$RESULT


/*
00BD5C8C     391D F0B0BF00      cmp dword ptr ds:[BFB0F0],ebx
00BD5C92     0F84 C4010000      je 00BD5E5C
*/

mov Temp,MagicJMP
sub Temp,100
find Temp,#39??????????0F84????0000#,100
cmp $RESULT,0
je NoFind
add $RESULT,6
mov T0,$RESULT
add T0,2
mov T1, [T0]
add T1,4
add T1,T0
mov fiXedOver,T1
log fiXedOver
eob fiXedOver
bp fiXedOver

esto
GoOn3:
esto

fiXedOver:
cmp eip,fiXedOver    
jne GoOn3
bc fiXedOver
eval "je {JmpAddress}"
asm MagicJMP,$RESULT
jmp Thread


ArmadilloV5.X:
find eip,#833C90007505E9??FEFFFF#
cmp $RESULT,0
je NoFind
add $RESULT,4
mov MagicJMP,$RESULT
log MagicJMP
mov [MagicJMP],#9090#

/*
->Standard.Protection
00E38255     E9 72FCFFFF        jmp 00E37ECC
00E3825A     EB 03              jmp short 00E3825F
00E3825C     D6                 salc
00E3825D     D6                 salc

->Minimum Protection
00D4754E     E9 72FCFFFF        jmp 00D471C5
00D47553     E9 03010000        jmp 00D4765B
00D47558     0FB615 3C3FD900    movzx edx,byte ptr ds:[D93F3C]
00D4755F     85D2               test edx,edx
00D47561     74 05              je short 00D47568
00D47563     E9 F3000000        jmp 00D4765B
00D47568     C785 DCFDFFFF 0000>mov dword ptr ss:[ebp-224],0
00D47572     C785 DCFDFFFF 0000>mov dword ptr ss:[ebp-224],0
00D4757C     EB 0F              jmp short 00D4758D
*/

find MagicJMP,#E9????????EB03D6D6#
cmp $RESULT,0
jne FindfiXedOver
find MagicJMP,#E9????????E9????00000F????????????85D2#
cmp $RESULT,0
je NoFind

FindfiXedOver:
add $RESULT,5
mov fiXedOver,$RESULT
log fiXedOver
eob fiXedOver
bp fiXedOver

esto
GoOn4:
esto

fiXedOver:
cmp eip,fiXedOver    
jne GoOn4
bc fiXedOver
mov [MagicJMP],#7505#


//CreateThread______________________________________

Thread:
gpa "CreateThread", "KERNEL32.dll"
find $RESULT,#C21800#
mov CreateThread,$RESULT
eob CreateThread
bphws CreateThread, "x"

esto
GoOn5:
esto

CreateThread:
cmp eip,CreateThread
jne GoOn5
bphwc CreateThread
esti


//FindOEP______________________________________

/*
00F9F9B3     2BCA               sub ecx,edx
00F9F9B5     FFD1               call ecx     ; Armadill.004436E0
*/

mov Temp,eip
sub Temp,400
find Temp,#2BCAFFD18BD8#
cmp $RESULT,0
jne BP
find Temp,#2BCAFFD189#
cmp $RESULT,0
jne BP
find Temp,#2BF9FFD7#
cmp $RESULT,0
jne BP
find Temp,#FFD18945FC8B45FC#
cmp $RESULT,0
je NoFind
jmp BPV5

BP:
add $RESULT,2
BPV5:
mov FindOEP,$RESULT
log FindOEP
eob FindOEP
bp FindOEP

esto
GoOn6:
esto

FindOEP:
cmp eip,FindOEP
jne GoOn6
bc FindOEP
sti


//GameOver______________________________________ 

log eip
cmt eip, "This is the OEP!  Found By: fly[CUG] "                              
MSG "Just : OEP !  Dump and Fix IAT.  Good Luck   "
ret                       

NoFind:
MSG "Error! Don't find.     "
ret

CheckODbgScripVersion:
msg  "ODBGScript Version Need 1.65 or higher!"
ret

TryAgain:
MSG " Plz  Try  Again   !   "
ret