//
// metr0/SnD - PeSpin 1.32 Code Redirection Fix - March 2008
//
// The script is - in my eyes, at least - well commented. Just try to understand what
// it does, then the Code Redirection feature should be no problem anymore.
//
// I know the code is messy and not optimized, but I thought that it's in its most
// understandable state, it's easy to trace what it does.
//
// If you got any questions, do not hesitate to contact me (via PM on tuts4you or in
// #seekndestroy (EfNet).
//

var begin
var end
var tmp
var dest
var code
var dest2
var count

mov begin, 400000 // lowest possible jmp/call destination 
mov end, 40a000 // highest possible jmp/call destination 
mov start, 401000 // start here to search for jmps/calls

__jmpstart:
mov count, 0 // clear safety counter
mov tmp, start // set starting point

__findjmp:
findop tmp, #e9# // find first jmp
mov tmp, $RESULT
cmp tmp, 0
je __goon // if script couldn't find it, go on

inc tmp // get the destination of the jmp
mov dest, [tmp]
add dest, tmp
add dest, 4

cmp dest, begin // check if destination is in range
jbe __findjmp
cmp dest, end
jae __findjmp

findop dest, #e9# // check if destination has syntax
sub $RESULT, dest // ?? ?? ?? ?? ?? e9 ?? ?? ?? ?? (5 bytes stolen and jmp back)
cmp $RESULT, 5 // saying, distance to next jmp must be 5
jne __findjmp // if not go on searching

dec tmp // copy first stolen byte
mov al, [dest]
mov [tmp], al

inc tmp
inc dest

mov code, [dest] // copy last 4 stolen bytes, as dword
mov [tmp], code

inc count // increment safety counter (counts restored jmps)
jmp __findjmp // let the search go on

__goon:
cmp count, 0 // continue searching jmps as long as the counter is not 0
jne __jmpstart // (make sure all have been resolved, necessary!)

mov tmp, start // reset starting point

__findcall:
findop tmp, #e8# // search calls
mov tmp, $RESULT
cmp tmp, 0
je __end

inc tmp
mov dest, [tmp]
add dest, tmp
add dest, 4

cmp dest, begin // check range of destination
jbe __findcall
cmp dest, end
jae __findcall

findop dest, #e9# // check if call points to a jmp, else it's no stolen code
cmp dest, $RESULT
jne __findcall

inc dest 
mov dest2, dest
mov dest2, [dest2] // save destination of jmp in dest2
add dest2, dest // subtract the offset from jmp
add dest2, 4

sub dest2, tmp // calculate offset from call
sub dest2, 4

dec tmp
mov [tmp], #e8# // let there be a call

inc tmp
mov [tmp], dest2 // save new offset to destination
add tmp, 4

jmp __findcall // the search goes on :)

__end:
ret // finished