By CodeCracker

Attached new script for Obsidium, fixed ObsidiumIAT for dlls files;
Finding OEP for dll files is different: I’ve break hardware on execute to Rva 1000 – that address was called from OEP; I’ve returned from that until I found the real OEP.
Obsidium CodeDecrypt.txt – Olly script for decrypting code section.

ObsidiumIAT_v3.txt

/*
=============================================================================
 Obsidium IAT fixer by CodeExplorer
=============================================================================
 When you use this Olly script you should be at OEP
=============================================================================
*/
 
 
var addr
var pointer
var thunk
var temp
var ImportTableAddress
var ImportTableEnd
var ImportSize
var CurrentPos
var OLD_EIP
var OLD_ESP
var varEax
var varEbx
var varEcx
var varEdx
var varEsi
var varEdi
var varEsp
var varEbp
var varEip
var WhereAre
var MainModule
var CodeBase
var PossibleApi
var SearchWhat
var BufferKeep
var CurrentFailedCount
var FailedOn
var AdrsTest
var CurrentPosBak
var KernelBase
 
mov OLD_EIP,eip  // backup EIP
mov OLD_ESP,esp  // backup ESP
mov varEax,eax
mov varEbx,ebx
mov varEcx,ecx
mov varEdx,edx
mov varEsi,esi
mov varEdi,edi
mov varEsp,esp
mov varEbp,ebp
 
GMA "KERNEL32", MODULEBASE
mov KernelBase, $RESULT
 
mov CurrentFailedCount, 0
alloc 30
mov BufferKeep, $RESULT
 
GMI eip, MODULEBASE
cmp $RESULT,0
je SCRIPT_FINISHED
 
mov addr,$RESULT // 401000  // code base
mov MainModule,$RESULT
GMEMI addr, MEMORYSIZE
add addr,$RESULT
mov CodeBase, addr
 
LABEL_01:
find addr,#FF??????4000#     // call/jmp dword [...]
cmp $RESULT,0
jne FoundSomething
find addr,#FF15#     // call dword [...]
cmp $RESULT,0
jne FoundSomething
find addr,#FF25#     // jmp dword [...]
cmp $RESULT,0
jne FoundSomething
 
jmp SCRIPT_FINISHED
 
FoundSomething:
mov addr,$RESULT
 
cmp [addr+1], 15, 1  // call dword [...]
je IS_OK
 
cmp [addr+1], 25, 1  // jmp dword [...]
je IS_OK
jmp NextAddress
 
IS_OK:
mov addr,$RESULT
mov pointer,$RESULT
add pointer,2
mov pointer,[pointer]
mov thunk,[pointer]
 
GMI thunk, MODULEBASE // After this $RESULT is the address to the codebase of the module to which eip belongs
cmp $RESULT, 0
jz GetImportTable
 
NextAddress:
add addr,6
jmp LABEL_01
 
GetImportTable:
mov ImportTableAddress, pointer
BigLoop:
cmp [ImportTableAddress-8], 0, 4
jnz CheckNextOneIT
 
cmp [ImportTableAddress-4], 0, 4
jz FoundProperAddress
 
CheckNextOneIT:
sub ImportTableAddress, 4
jmp BigLoop
 
FoundProperAddress:
log ImportTableAddress
mov ImportTableEnd, ImportTableAddress
 
IAT_END_LOOP:
cmp [ImportTableEnd+4], 0, 4
jnz CheckNextIAT_END
 
cmp [ImportTableEnd+8], 0, 4
jz FoundIatEND
 
GMI [ImportTableEnd+8], MODULEBASE // After this $RESULT is the address to the codebase of the module to which eip belongs
cmp $RESULT, 0  // may be some import address after belonging to a module this means we didn't reached the end
jz CheckNextIAT_END  // if address after don't belong to a module we didn't reached the end
 
cmp $RESULT, MainModule // 400000  // if address belong to main module we reached the end
jz FoundIatEND
 
CheckNextIAT_END:
add ImportTableEnd, 4
jmp IAT_END_LOOP
 
FoundIatEND:
add ImportTableEnd, 4
log ImportTableEnd
mov ImportSize, ImportTableEnd
sub ImportSize, ImportTableAddress
log ImportSize
 
mov CurrentPos, ImportTableAddress
 
ThunkSearchLoop:
cmp [CurrentPos], 0
jz NextThunkAddress
 
GMI [CurrentPos], MODULEBASE // After this $RESULT is the address to the codebase of the module to which eip belongs
cmp $RESULT, 0  // if the thunk already belong to a module
jnz NextThunkAddress
 
//log CurrentPos
mov [BufferKeep], CurrentPos
Readstr [BufferKeep], 4
mov SearchWhat, $RESULT
buf SearchWhat
//log $RESULT
find CodeBase,$RESULT
//log $RESULT
cmp $RESULT, 0  // if no reference to that dword
jz TryResolveStrangeThunk
 
mov CurrentFailedCount, 0
call TraceAndFixApi
 
NextThunkAddress:
add CurrentPos, 4
cmp CurrentPos, ImportTableEnd
jnz ThunkSearchLoop
jmp SCRIPT_FINISHED
 
TryResolveStrangeThunk:
mov PreviousValue, CurrentPos
sub PreviousValue, 4
mov PreviousValue, [PreviousValue]
 
mov NextValue, CurrentPos
add NextValue, 4
 
cmp PreviousValue, 0
jz NextThunkAddress
GMI PreviousValue, MODULEBASE
cmp $RESULT, 0  // if the thunk don't belong to a module
jz NextThunkAddress
mov CModuleBase, $RESULT
cmp CModuleBase,KernelBase
jnz NextThunkAddress
 
// Now try to resolve next thunk:
mov CurrentPosBak, CurrentPos
add CurrentPos, 4
cmp [CurrentPos], 0
jz NextThunkAddress
 
GMI [CurrentPos], MODULEBASE // After this $RESULT is the address to the codebase of the module to which eip belongs
cmp $RESULT, 0  // if the thunk already belong to a module
jnz NextThunkAddress
 
//log CurrentPos
mov [BufferKeep], CurrentPos
Readstr [BufferKeep], 4
mov SearchWhat, $RESULT
buf SearchWhat
//log $RESULT
find CodeBase,$RESULT
//log $RESULT
cmp $RESULT, 0  // if no reference to that dword
jz NextThunkAddress
 
mov CurrentFailedCount, 0
call TraceAndFixApi
 
mov NextValue, [NextValue]
cmp NextValue, 0
jz NextThunkAddress
GMI NextValue, MODULEBASE
cmp $RESULT, 0  // if the thunk don't belong to a module
jz NextThunkAddress
cmp CModuleBase, $RESULT
jnz NextThunkAddress
 
log "We have something here!"
mov CurrentPos, CurrentPosBak
mov CurrentFailedCount, 0
call TraceAndFixApi
jmp NextThunkAddress
 
//jmp NextThunkAddress
//FailedOnThatThunk:
//inc CurrentFailedCount
//mov FailedOn,CurrentPos
//log FailedOn
 
 
TraceAndFixApi:  // input CurrentPos - resolved import will be writed at [CurrentPos]
mov eip,[CurrentPos]
OK_01:
sti  // step in
 
cmp [eip],93FF, 2         // FF93 94000000   CALL    DWORD PTR DS:[EBX+0x94]
jz FinnalyOK
 
mov temp,[eip]
and temp,0FFFFFF
cmp temp,0476FF         // FF7604  PUSH    DWORD PTR DS:[ESI+0x4]
jnz OK_01
 
OK_02:
sto  // step over
 
cmp [eip],93FF, 2         // FF93 94000000   CALL    DWORD PTR DS:[EBX+0x94]
jz FinnalyOK
 
mov temp,[eip]
and temp,0FFFFFF
cmp temp,0476FF         // FF7604  PUSH    DWORD PTR DS:[ESI+0x4]
jnz OK_02
 
OK_03:
sto  // step over
cmp [eip],93FF, 2         // FF93 94000000   CALL    DWORD PTR DS:[EBX+0x94]
jnz OK_03
 
FinnalyOK:
mov PossibleApi, [esp], 4
GMI PossibleApi, MODULEBASE
cmp $RESULT,0  // if has no module base step over
jz PossibleStepOver
cmp $RESULT,MainModule  // if module is main module step over
jz PossibleStepOver
cmp $RESULT,PossibleApi  // if a module base step over
jz PossibleStepOver
mov eax, PossibleApi  ; api address is on stack - dword ptr [esp]
jmp SetApiAddress
 
PossibleStepOver:
cmp PossibleApi,0  // if dword ptr [esp] is 0
jz OK_01  // jump back to search
 
log PossibleApi
sto  // step over
mov PossibleApi,eax
 
SetApiAddress:
mov WhereAre,eip
log WhereAre
log CurrentPos
 
mov [CurrentPos],PossibleApi
//log eax
 
ret
 
SCRIPT_FINISHED:
mov eax,varEax
mov ebx,varEbx
mov ecx,varEcx
mov edx,varEdx
mov esi,varEsi
mov edi,varEdi
mov esp,varEsp
mov ebp,varEbp
 
mov eip, OLD_EIP // restore eip
mov esp, OLD_ESP  // restore ESP
msg "Script finished!"

Obsidium CodeDecrypt.txt

var OLD_EIP
var OLD_ESP
var varEax
var varEbx
var varEcx
var varEdx
var varEsi
var varEdi
var varEsp
var varEbp
var varEip
 
var addr
var CodeBase
var FoundPlace
var ReturnAddress
var SecondPlace
var FoundCount
var ValueKept
 
var oldEsp
var OldEip
mov OLD_EIP,eip  // backup EIP
mov OLD_ESP,esp  // backup ESP
mov varEax,eax
mov varEbx,ebx
mov varEcx,ecx
mov varEdx,edx
mov varEsi,esi
mov varEdi,edi
mov varEsp,esp
mov varEbp,ebp
 
 
GMI eip, MODULEBASE
cmp $RESULT,0
je SCRIPT_FINISHED
 
mov addr,$RESULT // 401000  // code base
mov MainModule,$RESULT
GMEMI addr, MEMORYSIZE
add addr,$RESULT
mov CodeBase, addr
//  6D2B44EE    68 57000000     PUSH 0x57
// 6D2B44F3    FF15 A0E32B6D   CALL NEAR DWORD PTR DS:[0x6D2BE3A0]
 
SearchLoop:
find addr,#68??0000??FF15#
cmp $RESULT,0
je SCRIPT_FINISHED
mov FoundPlace, $RESULT
//bp FoundPlace
mov addr, FoundPlace
inc addr
 
mov ValueKept, FoundPlace
add ValueKept, 07
mov ValueKept, [ValueKept]
mov ValueKept, [ValueKept]
 
GMI ValueKept, MODULEBASE
cmp $RESULT,MainModule
jz SearchLoop
cmp $RESULT,0
jnz SearchLoop
 
mov ReturnAddress, FoundPlace
add ReturnAddress, 0B
 
bphws ReturnAddress, "x"
//BPMC
//bprm ReturnAddress, 1
 
pusha
mov oldEsp, esp
mov OldEip, eip
mov eip, FoundPlace
erun
 
ReturnAddressOk:
bphwc
mov esp, oldEsp
mov eip, OldEip
popa
 
fill FoundPlace, 0B, 90 // NOP 0Bh bytes
 
find addr,#68??0000??FF15#
cmp $RESULT,0
je SCRIPT_FINISHED
mov SecondPlace, $RESULT
 
mov ValueKept, SecondPlace
add ValueKept, 07
mov ValueKept, [ValueKept]
mov ValueKept, [ValueKept]
GMI ValueKept, MODULEBASE
cmp $RESULT,MainModule
jz SearchLoop
cmp $RESULT,0
jnz SearchLoop
 
fill SecondPlace, 0B, 90 // NOP 0Bh bytes
 
mov addr, SecondPlace
inc addr
 
inc FoundCount
 
jmp SearchLoop
 
 
SCRIPT_FINISHED:
mov eax,varEax
mov ebx,varEbx
mov ecx,varEcx
mov edx,varEdx
mov esi,varEsi
mov edi,varEdi
mov esp,varEsp
mov ebp,varEbp
 
mov eip, OLD_EIP // restore eip
mov esp, OLD_ESP  // restore ESP
msg "Script finished!"

扫码免费获取资源：