//code by loveboom
//modify by skylly
//for svkp 1.3x - 1.4x

var x1
var x2
var x3
var x4
var x5
var x6
var x7
var x8
var x9

var cb
var cs
gmi eip,CODEBASE
cmp $RESULT,0
je err
mov cb,$RESULT
gmi eip,CODESIZE
cmp $RESULT,0
je err
mov cs,$RESULT

gpa "GetModuleHandleA","kernel32.dll"
cmp $RESULT,0
je err
add $RESULT,5
var gma
mov gma,$RESULT

msg "忽略所有异常"
var ep
mov ep,eip


var espval
sto
mov espval,esp

bp gma
lo:
esto
cmp eip,gma
jne lo
rtu
cmp eip,70000000    //如果还是在系统dll中
ja lo
bc gma
//判断是1.4x版本还是1.3x版本
var temp
mov temp,[eip]
and temp,FF
cmp temp,E8  //call
je svk13     //1.3x
cmp temp,5B //pop ebx
jne err      //未知壳
log "svkp 1.4x"
los:
//处理api加密

/*
//00B05775    2903            sub     dword ptr [ebx], eax
//00B05777    58              pop     eax
//00B05778    813B CC971025   cmp     dword ptr [ebx], 251097CC        //ExitProcess
//00B0577E    0F84 41170000   je      00B06EC5                         
//00B05784    813B C5B1662D   cmp     dword ptr [ebx], 2D66B1C5        //GetCommandLineA
//00B0578A    0F84 62180000   je      00B06FF2                         
//00B05790    813B 9404B2D9   cmp     dword ptr [ebx], D9B20494        //GetCommandLineW
//00B05796    0F84 AA1C0000   je      00B07446
//00B0579C    813B A41A86D0   cmp     dword ptr [ebx], D0861AA4        //GetCurrentProcess
//00B057A2    0F84 58210000   je      00B07900
//00B057A8    813B 706586B1   cmp     dword ptr [ebx], B1866570        //GetModuleHandleA
//00B057AE    0F84 C1240000   je      00B07C75                         
//00B057B4    813B 0E46769B   cmp     dword ptr [ebx], 9B76460E        //x1   SVKP_GetRegistrationInformation
//00B057BA    0F84 36280000   je      00B07FF6
//00B057C0    813B DB0793E6   cmp     dword ptr [ebx], E69307DB        //x2   SVKP_GetTrialDays
//00B057C6    0F84 76280000   je      00B08042
//00B057CC    813B 627B6CA5   cmp     dword ptr [ebx], A56C7B62        //x3   SVKP_GetTrialExecs  没进入过这个分支，不过估计是这个API
//00B057D2    0F84 BA280000   je      00B08092
//00B057D8    813B 664E96BB   cmp     dword ptr [ebx], BB964E66        //x4   SVKP_CheckTrial
//00B057DE    0F84 00290000   je      00B080E4
//00B057E4    813B 4506D75B   cmp     dword ptr [ebx], 5BD70645        //x5   SVKP_LockKeyboard
//00B057EA    0F84 43290000   je      00B08133
//00B057F0    813B 0DE0FC1D   cmp     dword ptr [ebx], 1DFCE00D        //x6   SVKP_UnLockKeyboard
//00B057F6    0F84 83290000   je      00B0817F
//00B057FC    813B 31DD0F00   cmp     dword ptr [ebx], 0FDD31          //x7   SVKP_KillDebugger
//00B05802    0F84 C6290000   je      00B081CE
//00B05808    813B 95B75126   cmp     dword ptr [ebx], 2651B795        //x8   SVKP_RebootComputer
//00B0580E    0F84 132A0000   je      00B08227                          
//00B05814    813B B482F64B   cmp     dword ptr [ebx], 4BF682B4        //x9   SVKP_GetHWInfo
//00B0581A    0F84 582A0000   je      00B08278                         
//00B05820    813B 0F1ACF4C   cmp     dword ptr [ebx], 4CCF1A0F        //GetVersion
//00B05826    0F84 972A0000   je      00B082C3
//00B0582C    813B 4A7687DF   cmp     dword ptr [ebx], DF87764A        //GetVersionExA
//00B05832    0F84 FC2D0000   je      00B08634
//00B05838    813B B8B8B2FB   cmp     dword ptr [ebx], FBB2B8B8        //????????      没进入过这个分支，一个相当奇怪的分支,代码超级简单
//00B0583E    0F84 56320000   je      00B08A9A
//00B05844    813B 8E5D2D57   cmp     dword ptr [ebx], 572D5D8E        //MessageBoxA
//00B0584A    0F84 86320000   je      00B08AD6
//00B05850    60              pushad

*/

var temp
find eip,#813BCC971025#
cmp $RESULT,0
je err
mov temp,$RESULT
add temp,6    
//ExitProcess
go temp
mov [temp],#EB3490909090#       //PATCH 1
cmt temp,"please wait while decrypt iat..."

find eip,#813B0F1ACF4C#
cmp $RESULT,0
je err
mov temp,$RESULT
add temp,6    
//GetVersion
mov [temp],#EB2890909090#       //PATCH 2

var nextapi
find eip,#8907618385#
cmp $RESULT,0
je err
mov nextapi,$RESULT
add nextapi,3



var delta
mov delta,esp
add delta,C
mov delta,[delta]
//记录壳保存api的地址


find eip,#813B0E46769B#
cmp $RESULT,0
je err
mov temp,$RESULT
add temp,6    
//x1

var addr
mov addr,temp
add addr,2
mov addr,[addr]
add addr,temp
add addr,6
mov x1,addr
bp x1

find eip,#813BDB0793E6#
cmp $RESULT,0
je err
mov temp,$RESULT
add temp,6    
//x2

var addr
mov addr,temp
add addr,2
mov addr,[addr]
add addr,temp
add addr,6
mov x2,addr
bp x2

find eip,#813B627B6CA5#
cmp $RESULT,0
je err
mov temp,$RESULT
add temp,6    
//x3

var addr
mov addr,temp
add addr,2
mov addr,[addr]
add addr,temp
add addr,6
mov x3,addr
bp x3

find eip,#813B664E96BB#
cmp $RESULT,0
je err
mov temp,$RESULT
add temp,6    
//x4

var addr
mov addr,temp
add addr,2
mov addr,[addr]
add addr,temp
add addr,6
mov x4,addr
bp x4

find eip,#813B4506D75B#
cmp $RESULT,0
je err
mov temp,$RESULT
add temp,6    
//x5

var addr
mov addr,temp
add addr,2
mov addr,[addr]
add addr,temp
add addr,6
mov x5,addr
bp x5

find eip,#813B0DE0FC1D#
cmp $RESULT,0
je err
mov temp,$RESULT
add temp,6    
//x6

var addr
mov addr,temp
add addr,2
mov addr,[addr]
add addr,temp
add addr,6
mov x6,addr
bp x6

find eip,#813B31DD0F00#
cmp $RESULT,0
je err
mov temp,$RESULT
add temp,6    
//x7

var addr
mov addr,temp
add addr,2
mov addr,[addr]
add addr,temp
add addr,6
mov x7,addr
bp x7

find eip,#813B95B75126#
cmp $RESULT,0
je err
mov temp,$RESULT
add temp,6    
//x8

var addr
mov addr,temp
add addr,2
mov addr,[addr]
add addr,temp
add addr,6
mov x8,addr
bp x8

find eip,#813BB482F64B#
cmp $RESULT,0
je err
mov temp,$RESULT
add temp,6    
//x9

var addr
mov addr,temp
add addr,2
mov addr,[addr]
add addr,temp
add addr,6
mov x9,addr
bp x9


hoho:
find eip,#890761#   //mov     [edi], eax;popad
cmp $RESULT,0
je err
mov [$RESULT],#618907#       //处理普通API函数


//00B05B7A    33C0            xor     eax, eax
//00B05B7C    64:8F00         pop     dword ptr fs:[eax]
find eip,#33C0648F00#     //IAT处理完毕
cmp $RESULT,0
je err
var iatok
mov iatok,$RESULT
bp iatok

//为sdk函数作准备
mov [ep],#33C040C20400C3#

lpiat:
esto
x1:
cmp eip,x1
jne x2
mov addr,edi
log addr
log "SVKP_GetRegistrationInformation"
bp nextapi
esto
bc nextapi
//mov [addr],ep     //空函数  这样补丁是不行滴,还是用那个dll来修复吧
jmp continue

x2:
cmp eip,x2
jne x3
mov addr,edi
log addr
log "SVKP_GetTrialDays"
jmp continue

x3:
cmp eip,x3
jne x4
mov addr,edi
log addr
log "SVKP_GetTrialExecs"
jmp continue

x4:
cmp eip,x4
jne x5
mov addr,edi
log addr
log "SVKP_CheckTrial"
jmp continue

x5:
cmp eip,x5
jne x6
mov addr,edi
log addr
log "SVKP_LockKeyboard"
bp nextapi
esto
bc nextapi
add ep,6
mov [addr],ep     //空函数
sub ep,6
jmp continue

x6:
cmp eip,x6
jne x7
mov addr,edi
log addr
log "SVKP_UnLockKeyboard"
bp nextapi
esto
bc nextapi
add ep,6
mov [addr],ep     //空函数
sub ep,6
jmp continue

x7:
cmp eip,x7
jne x8
mov addr,edi
log addr
log "SVKP_KillDebugger"
bp nextapi
esto
bc nextapi
add ep,6
mov [addr],ep     //空函数
sub ep,6
jmp continue

x8:
cmp eip,x8
jne x9
mov addr,edi
log addr
log "SVKP_RebootComputer"
bp nextapi
esto
bc nextapi
add ep,6
mov [addr],ep     //空函数
sub ep,6
jmp continue

x9:
cmp eip,x9
jne okiat
mov addr,edi
log addr
log "SVKP_GetHWInfo"
bp nextapi
esto
bc nextapi
add ep,3
//mov [addr],ep     //空函数      //这样补丁是不行滴，还是用原版的special.dll中的API来修复吧
sub ep,3


continue:
jmp lpiat

okiat:
bc x1
bc x2
bc x3
bc x4
bc x5
bc x6
bc x7
bc x8
bc x9
bc iatok
sti
sti
sti
sti

find eip,#81402000400000#     //add     dword ptr [eax+20], 4000    //add imagesize 4000
cmp $RESULT,0
je err
mov [$RESULT],#EB05#  //anti anti-dump

bphws espval,"r"
esto
esto
esto
bphwc espval
find eip,#FFE0E8# //jmp eax;call
cmp $RESULT,0
je err
go $RESULT
sto
cmt eip,"vm code start here,you must dump this section"
//msg "如果想看到fake oep,就继续脚本"
//pause
msg "这里就是vm oep"
bprm cb,cs
ti
bpmc
var cool
var cos
mov cool,eip
aoo:
sub cool,1
mov cos,[cool]
and cos,FF
cmp cos,90
jne ens
jmp aoo
ens:
add cool,1
cmt cool,"real oep"
eval "oep at:{cool},如果有sdk,自己查看日志窗口然后修复"
msg $RESULT

allok:
cmt eip,"fake OEP"
msg "如果有被exitprocess或messagebox替换的api,请继续脚本"
an eip
log delta
pause
//处理iat的替换加密
//jmp [API]
var adr
mov adr,delta
add adr,9343

loop1:
var addrcode
mov addrcode,[adr]
cmp addrcode,0
je deltahalf
var realcode
mov realcode,adr
sub realcode,4
mov realcode,[realcode]
mov [addrcode],realcode    //被exitprocess替代的API修复

sub adr,8
jmp loop1

deltahalf:
mov adr,delta
add adr,2BD0E

loop2:
var addrcode
mov addrcode,[adr]
cmp addrcode,0
je deltahalf2
var realcode
mov realcode,adr
sub realcode,4
mov realcode,[realcode]
mov [addrcode],realcode    //被MessageBox替代的API修复

sub adr,8
jmp loop2

deltahalf2:
//mov register,api
mov adr,delta
add adr,A152

loop3:
var addrcode
mov addrcode,[adr]
cmp addrcode,0
je deltahalf3

var opcode
mov opcode,adr
sub opcode,5
mov opcode,[opcode]
and opcode,FF
mul opcode,100
xor opcode,8B   //mov register

sub addrcode,2
mov [addrcode],opcode     //放入mov register的opcode
add addrcode,2

var realcode
mov realcode,adr
sub realcode,4
mov realcode,[realcode]
mov [addrcode],realcode    //被exitprocess替代的API修复

sub adr,9
jmp loop3

deltahalf3:
mov adr,delta
add adr,2CB1D

loop4:
var addrcode
mov addrcode,[adr]
cmp addrcode,0
je deltaok

var opcode
mov opcode,adr
sub opcode,5
mov opcode,[opcode]
and opcode,FF
mul opcode,100
xor opcode,8B   //mov register

sub addrcode,2
mov [addrcode],opcode     //放入mov register的opcode
add addrcode,2

var realcode
mov realcode,adr
sub realcode,4
mov realcode,[realcode]
mov [addrcode],realcode    //被MessageBox替代的API修复


sub adr,9
jmp loop4


deltaok:
an eip
ret

svk13:
log "svk 1.3x"
var eeip
mov eeip,eip
and eeip,FFFF0000


  find eeip,#EB02CD2058EB020FE88907#                         //find iat magic jmp
  mov addr,$RESULT
  asm addr,"pop eax"
  add addr,1
  mov [addr],#8b44241C#                                      //replace to "mov eax,DS:[ESP+1C]" action:fix import functions

var iatallok
find addr,#558BEC81EC80000000#
cmp $RESULT,0
je err
mov iatallok,$RESULT



lblcheck:
  find eeip,#813B706586B1EB03C7848B0F84#                      //fix API function "GetModuleHandleA"
  mov addr,$RESULT
  cmp addr,0
  jne lblfix0
  find eeip,#813BC5B1662DEB03C784E80F84#                     //Fix API function "GetCommandLineA"
  mov addr,$RESULT
  cmp addr,0
  jne lblfix0
  find eeip,#813BCC971025EB03C784E90F84#                       //Fix API function  "ExitProcess"
  mov addr,$RESULT
  cmp addr,0
  jne lblfix0
  find eeip,#813BA41A86D0EB03C7849A0F84#                     //Fix API function "GetCurrentProcess"
  mov addr,$RESULT
  cmp addr,0
  jne lblfix0
  find eeip,#813B4A7687DFEB02CD200F84#                    //Fix API function "GetVersionExA"
  mov addr,$RESULT
  cmp addr,0
  jne lblfix1
  find eeip,#813B0F1ACF4CEB02CD200F84#                  //Fix API function "GetVersion"
  mov addr,$RESULT
  cmp addr,0
  jne lblfix1

//到输入表处理结束
go iatallok

var temp
mov temp,eeip
sub temp,10000
find temp,#81402000400000#
//add     dword ptr [eax+20], 4000    //add imagesize 4000
cmp $RESULT,0
je err
mov [$RESULT],#EB05#  //anti anti-dump

cob
  bphws espval,"r"
  run
  run 
lbl3:
  bphwc espval

find eip,#C3E801000000# //retn;call
cmp $RESULT,0
je lblabort
go $RESULT
sto

lblend:
  cmt eip,"Script finished!"
  msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"
  ret

lblfix0:
  add addr,B
  mov [addr],#EB04#
  jmp lblcheck

lblfix1:
  mov addr,$RESULT
  add addr,A
  mov [addr],#EB04#
  jmp lblcheck

lblabort:
  msg "Error,script abort.Maybe target is not protect by SVKP1.3x or your forgot Ignore all exceptions."
  ret

