
///////////////////////////////////////////////////////////
//
//Arrives oep place, only tests in the arma 3.6-4.05 shells editions double thread regulation pattern
//Elects to neglect all exceptionally, carries out the script then
//  
//2005-8-20 14:04 by hnhuqiong
//
///////////////////////////////////////////////////////////

var tmp
var cm
var om
var gmh
var tadr
var neweip
var retascii
var lib
var magicjmp
var magicadr
var gct

gpa “CreateMutexA”, “kernel32.dll”
mov cm, $RESULT
gpa “OpenMutexA”, “kernel32.dll”
mov om, $RESULT
gpa “GetModuleHandleA”, “kernel32.dll”
mov gmh, $RESULT
gpa “LoadLibraryA”, “kernel32.dll”
mov lib, $RESULT
gpa “GetCurrentThreadId”, “kernel32.dll”
mov gct, $RESULT


start:                                 //Merge double thread regulation
bp om
esto

asm 401000, “pushad”
asm 401001, “pushfd”
 mov tmp, esp
 add tmp, c
 mov tadr, [tmp]
 eval “push {tadr}”
asm 401002, $RESULT
asm 401007, “xor eax, eax”
asm 401009, “push eax”
asm 40100a, “push eax”
 eval “call {cm}”
asm 40100b, $RESULT
asm 401010, “popfd”
asm 401011, “popad”
 eval “jmp {om}”
asm 401012, $RESULT

mov eip, 401000
esto 
fill 401000,20,00
bc om

gmhadr:                                      //Avoids the IAT encryption
BPHWS gmh, “x”
esto

find_ret:
mov tmp, esp
add tmp, 8
mov tmp, [tmp]
add tmp, 7
mov retascii, [tmp]
mov tmp, 65657246
cmp retascii, tmp
je find_ret_ok
jmp goonfind

goonfind:
esto
jmp find_ret

find_ret_ok:
esto
BPHWC gmh
rtu
find eip, # ff15 #
mov tmp, $RESULT
add tmp, 2
mov tmp, [tmp]
mov tmp, [tmp]
cmp lib, tmp
je magic_jmp_ok
jmp magic_jmp_no

magic_jmp_ok:
find eip, # 0f84 #
bp $RESULT
run




magic_jmp:

bc $RESULT
mov tmp, $RESULT
mov magicjmp, tmp
add tmp, 2
mov tmp, [tmp]
add tmp, 1
mov magicadr, tmp
mov [magicjmp], e9
add magicjmp, 1
mov [magicjmp], magicadr
bp gct

tmpoep:                                           //goto OEP
esto
cmp [esp], 01000000
jb find_oep
jmp tmpoep

find_oep:
bc gct
rtu
find eip, # ffd7 #
bp $RESULT
esto
bc $RESULT
sti
jmp end




magic_jmp_no:
msg “seeks the MAGIC_JMP defeat, please relate hnhuqiong@163.com”
jmp end




end:
cmt eip, “OEP arrives, might DUMP”
ret

