/////////////////////////////////////////////////////////
// Unpack PESpin v1.3 Beta2 unpackme
// By softworm 6/6/2005
//
// Run as a single process,reach the dump address,fixes some 
// replaced code(call into the virtual address space ) and
// Nanomites.

// Run the fixer.exe(No GUI available,replace the PID and recompile 
// it;-) to fix the replaced codes pointing to the PE header when 
// finished the script.


var	nCounter
var	addr
var	currOpcode
var	callee
var	iat


dbh

bphws	4089F7, "x"
run

bphwc	4089F7	// call CreateMutexA
mov	eax,0
sto
sto
sto
sto
mov	eax,0B7	// ޸GetLastErrorΪERROR_ALREADY_EXISTS

/////////////////////////////////////////////////////////////
//1. 00408A5E int 1
//   ֻ޸eip->408A7D

bphws	408A5E, "x"
run

bphwc	408A5E
mov	eip,408A7D


/////////////////////////////////////////////////////////////////
// 2. 004075C2   int3 SoftIceָ
//    softiceδʱ,Ϳ

bphws	4075C2, "x"
run
bphwc	4075C2
inc	eip
run

// ע쳣:004075CA  lea eax,eax
// ߳ԼSEH,ù,logԿ,fatherһ
// 407663


////////////////////////////////////////////////////////////////
// 3. 00407663  sub dword ptr ds:[edx],eax
//    childԼ

//bphws	407663, "x"
esto
//bphwc	407663

bp	407B75	// 407663쳣handler
esto
bc	eip
	

////////////////////////////////////////////////////////////////
// 4. 00405481    div ebx
//    childԼ

run
esto


///////////////////////////////////////////////////////////
// 5. 00405500   repe scas byte ptr es:[edi]
//    childԼ

esto


// 6. 004056AC   div bl

esto

// 7. 00407D0B   sti
//    childԼ
//    עchildϵʱ,esi->"\\.\SICE",SoftIce

esto


// 8. 00407D0B   sti(2)
//    childԼ

esto

// 9. 00407CCF   xlat byte ptr ds:[ebx+al]
//    childԼ

esto

// 10. 00407872 xlat byte ptr ds:[ebx+al]
//     childԼ

esto

// 11. 00405A43 mov dword ptr ds:[eax],ebx
//     childԼ

esto


//////////////////////////////////////////////////////////////////////////////
// 12. 00400161    FFFF            ???    ; Unknown command
//     childԼ

esto

// 13. 00408037    int3

bphws	409242, "x"
esto


// 14. 00409242    int1	
//     00409243    xchg edi,ebx
//     ޸childeip->40926C

bphwc	409242
mov	eip,40926C

log "get apis now"


// ڿ(409803)apiַ,Ƕ̬ڴ
// ĵַ(ָȡapi)

bp	406790		// eax->api
bp	405FCD		// apiַ
bphws	406AB2, "x" 	// dump

eob	lbl_get_api
eoe	lbl_get_api
run

lbl_get_api:

	cmp eip,406790
	jne lbl_save

	mov addr,eax
	mov [edx],eax	// apiַԭiat,޸callҪ
	log addr

	jmp lbl_continue
	
lbl_save:

	cmp eip,405FCD
	jne lbl_dump

	mov eax,addr
	log edi
		
lbl_continue:
	
	esto

lbl_dump:	

	bphwc 406AB2
	bc 406790
	bc 405FCD
	cob
	coe

	// ޸replaced codeȫŵFix
	// patch Nanomites,ʹԵ̷ʽ
	
	asm 401B13, "mov eax,[eax]"
	asm 401B25, "jnz 401B33"
	asm 401C72, "jnz 401C7D"
	asm 401B82, "mov esi,[eax]"
	asm 401B8A, "jnz 401BC6"
	asm 401B94, "jz 401B9A"
	asm 401B98, "jnz 401B8C"
	asm 401B9D, "jnz 401BA3"
	asm 401BA7, "jz 401BAD"
	asm 401BBE, "jz 401BD1"

	// 7Ϊûʵִе
	// asmopcode,mov

	//asm 401BEE,"mov eax,[ebp-14]"
	//asm 401BF1,"mov ecx,[eax]"
	//asm 401BF3,"mov ecx,[ecx]"

	mov [401BEE],#8B45EC8B088B0989#

	//asm 401C02,"mov esp,[ebp-18]"
	mov [401C02],#8B65E8FF#


	//asm 401CC0,"mov ecx,[ebp-10]"
	mov [401CC0],#8B4DF0E9#

	//asm 401D50,"mov ecx,[ebp-10]"
	mov [401D50],#8B4DF0E9#

	//asm 401D70,"mov ecx,[ebp-10]"
	mov [401D70],#8B4DF0E9#

	msg "Run fix and dump it;-)"
	ret





