컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 栢栢栢� 栢栢栢� 栢栢栢� 栢栢栢� 栢栢栢� 栢� 栢� 栢芳 栢芳 栢栢栢� 栢�袴栢� 栢�袴栢� 栢�袴谷芳 栢�袴袴� 栢�袴栢� 栢� 栢� 栢栢� 栢栢� 栢�袴栢� 栢栢栢�� 栢栢栢�� 栢� 栢� 栢� 栢� 栢� 栢� 栢� 栢�栢栢�栢� 栢栢栢�� 栢�袴暠 栢�袴栢� 栢� 栢� 栢� 栢� 栢� 栢� 栢� 栢뵌栢�송舫 栢�袴暠 栢� 栢� 栢� 휩栢栢排� 휩栢栢芳 栢栢栢�� 휩栢栢排� 栢� 훤� 栢� 栢� 훤� 훤� 훤� 훤袴袴� 훤袴袴� 훤袴袴� 훤袴袴� 훤� 훤� 훤� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[1.4.4]컴컴 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� � PROCDUMP SCRIPTING FOR DUMMIES � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� This doc is for the following people � People to dump to understand Script.txt � People to lazy to read through all Script.txt � People both to dump and lazy to read through Script.txt (Like me) 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 � Introduction to Procdump Scripting � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 To understand this you'll atleast have to have a working knowledge of proc- dump and some knowledge of Debugging Abbreviations (Damn, I can never spell that word correct :P). A Procdump script is a script that will help procdump unpack a win32 execu- table file (Yeah, only Win32). It is designed like most scripts on rows and stuff (geeh, I'm not a good writer, am I). Read below and you'll get it. Scripts in procdump are put in the ini file "Script.ini" in a section of it self with the title of the unpacker, like [Neolite] or something. They are built around lines with name Lx where x is the line number, so an empty basic script may look like this: [unpackername] L1= L2= L3= And so on... there is allso a statement called OPTLx wich set's default options for your script. But is that all you have to do to get it up and running? No, you have to add a new line in the [index] section with your name like: [index] P1=MyPackerName Yeah, the abbreviation in the start is Px instead of Lx here. So, how is the actuall Procdump script written? 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 � let's kick som phat script ass � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 Ok, we'll start of with a real life example before the walkthrough (might help you a bit): [Shrinker 3.2] L1=BPX 2672 L2=STEP OPTL1=00000000 OPTL2=01010001 OPTL3=01010001 OPTL4=00020000 OPTL5=00000000 As you see, a very simple script filled with options :P. Let's step through this line by line: [shrinker 3.2] <-- Well, the beginig section displaying name L1=BPX 2672 <-- First we see line 1 mark (L1) then the code wich in this case is a breakpoint on 2672. L2=STEP <-- What do we see here? L2 then the STEP command, wich basicly means that the step by step analysis is activated. OPTL1=00000000 <-- Options, don't have clue what this means :P OPTL2=01010001 <-- More options, still not a clue OPTL3=01010001 <-- Gosh, more options OPTL4=00020000 <-- Lotta options here OPTL5=00000000 <-- Take your best shot ;) Ok, I know I am not the best tutor in this, just check my Options knowledge... it SUX. well, this is basicly how a script is built up, nothing more, nothing less. So, here comes script reference: 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 � script definitions � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 Let's start of with saying that this is a modified version of the script.txt script definition, I didn't have the patience to write a new one. [1] Look 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 the Look function scans for a HEX string in the executable that is beeing unpacked. The Address, where this block is found, is stored so that u can set a breakpoint at this location. Usage: Look 0F,85 will search for a JNE long jump. U may want to set a Breakpoint via the BP command. [2] ADD 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Allows u to Add a value to the current Address in mem (ex: the one spotted by the look command or by the POS command). Usage: ADD 05 will add 05 to the value of the current adr. in memory. [3] DEC 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Allows you to Remove a value from the current adress in the memory (se above). Usage: DEC 05 will decrease 05 to the value of the current adr. in memory [4] REPL 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 This function apply a patch (HEX Sequence) at the current memory location (ex: the one spotted by look command). This may allow u to kick an ADT ;) IE. This function will change a definition in memory, such as je to jne or je to nop. Usage: REPL 90,90 will apply a double NOP starting at current memory location. REPL 75 will applay a JNE at the current memory location. [5] BP 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Set a breakpoint at current memory location. Usage: BP (No parmaters, just a simple breakpoint). [6] BPX 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Set a breakpoint at a given location. The location is depending on object start. Usage: If loaded executable starts at RVA 66000h, BPX 2672 will set a breakpoint at RVA 68672. So this means that to get the real adress where the breakpoint is applied, take starting RVA + BPX Value :P. [7] BPF (Break On Flag) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� This function will check each time breakpoint occurs if flag u passed on is set/unset. Breakpoint location is the current memory location. Unset쿞et� Meaning 컴컴컵컴컵컴컴컴컴컴컴컴컴 c � C � Carry flag. p � P � Positiv Flag. a � A � Above Flag. z � Z � Zero Flag. s � S � Sign Flag. d � D � Direction Flag. o � O � Overflow Flag. U can only test ONE flag. Usage: BPF z will break if Zero is false. Usefull after setting a value. [8] BPC 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Break at Local Eip until counter is reached. Usage: BPC 15 (Breakpoint 15h times at Local Eip). [authors notice:] Unclear about this one, kinda like wait I think, BP 15 will wait 15h. [9] BPV 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Break at Eip until value is reached in Registers. Usage: BPV EAX=5 Will break until EAX=5 in Registers. [10] MOVE 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Set Current EIP. Add param value to current EIP. BE CAREFULL WITH THIS !!!! NO CONTROL ARE DONE about the EIP. Try to use this instead of noping a loca- tion, IF there was a CRC check u will defeat it ;). Usage: MOVE 14 will move current EIP to EIP+14h, that is 14 adresses forward in current memory. [11] POS 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Set current memory location FOR ALL FUNCTIONS. The location is depending on object start. (This functions is allmost never used). Usage: POS 6599 will set memory location to Start RVA + 6599. [12] STEP -컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 This set the step by step analyzis. This is used to finished the trace generally. BEWARE: Step mode means each lines will be tested -> SLOW !!. So SET step mode as late as possible. Usage: STEP (No parameters). This is used as late as possible in the script. [13] OBJR 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� This set the base memory to start to scan. Affect LOOK command. Usage: OBJR (No parameters). Often used in begining of script to set base to start scan from. [14] BPREG 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Set a breakpoint at Register value. Not a very common command this either. Usage: BPREG (I think No parameters, correct me if I'm wrong). Allmost never used. [15] WALK 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Execute the next instruction and return control to ProcDump32. Usage: WALK (No parameters). Used often to jump over a few crap instructions. [16] EIP 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Say that next EIP has to be used as Original EntryPoint. Note : After a breakpoint, the next EIP is the breakpoint address itself ! Usage: EIP (No parameters). The current script will work from this RVA as Original Entry Point instead of the real original entry point. [17] HELP 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Execute a standalone helper file to help procdump. Used if procdump can't handle it. It executes the file and creates a temp .ini containing: � Pid Of The Process � All registers values (Including EIP) � Local EIP values It looks like this: [REG] Dr0=00000000 Dr1=00000000 Dr2=00000000 Dr3=00000000 Dr6=00000000 Dr7=00000000 SegGs=00000000 SegFs=00000FDF SegEs=00000167 SegDs=00000167 Edi=00000000 Esi=8161D244 Ebx=00000000 Edx=8161D2A4 Ecx=8161D264 Eax=0043E9B4 Ebp=00456000 Eip=00456264 SegCs=0000015F Flags=00000216 Esp=0068FE34 SegSs=00000167 Pid=FFC1E943 Local=00456264 Sending different options. Now this is really advanced and so so I won't go through it to good. Well, let's start from the beginning, Drx I don't have a clue :P. SEGxs I think gives the adresses of thoose segments (correct me please). Edi, Esi, Ebx... contains the registers values. Local is local EIP values, flags is flags for the current memory place and Pid is pid value. Usage: HELP ExternalUnpacker.Exe MyIniChoice.ini ExternalUnpacker is the name of your external unpacker (do'h) like upak.exe or something, MyIniChoice.ini is what you'd like to call the .ini, like prcommands.ini. 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 � we write our own script � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 Ok, not really, I'm to lazy to write one from the bottom up today, so we'll just snatch a script from "Script.ini". The script we will "make" is for Aspack 1.08.2. We'll start by making an entity in [index]: [index] ... P14=Aspack 1.08.2 ... Now, let's get down to scripting: ... [Aspack108.2] L1=OBJR <-- Set base memory for scan L2=LOOK E9 <-- Looking for Hex E9 L3=BP <-- Set a breakpoint there. L4=WALK <-- Jump through a function. L5=OBJR <-- Set base memory for scan. L6=LOOK E8,8A,02,00,00,E8 <-- Looks for thoose patterns. L7=BP <-- If found, set breakpoint. L8=MOVE 0F <-- Moves EIP to EIP + 0F L9=STEP <-- Enter step by step analysis. OPTL1=00000000 __ OPTL2=01010001 | OPTL3=01010001 <--| Thoose darn options :P OPTL4=00030000 | Gotta figure them out. OPTL5=00000000 |_ ... Ok, so what this basicly does (in text) is: Set base memory. If Hex E9 found set BPX on location. Execute next instruction. Set base memory. Look for pattern, If found set breakpoint. Move memory to memory + 0Fh and start step by step analysis. Hope this helped you a bit. If not, here comes a table :P 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 � Cheat Sheet (function index) � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 �袴袴袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴箇袴袴袴袴袴袴袴袴袴� � Function Name: � Type: � Description: � Usage: � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � ADD � Memory Editing � Add x to cur. mem � add x � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � BP � Breakpoint � Sets breakpoint at cur. mem � bp � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � BPX � Breakpoint � Sets breakpoint on adr. x � bpx x � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � BPREG � Breakpoint � Sets breakpoint with regval. � bpreg x � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � BPF � Breakpoint � Sets breakpoint on flag � bpf flag � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � BPC � Breakpoint � Sets breakpoint until... � bpc x � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � BPV � Breakpoint � Break until regval = regval � bpv � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � DEC � Memory Editing � Remove x from cur. mem � dec x � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � EIP � Memory Editing � Use next eip as oep � eip � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � HELP � External � Execute external helper � help exec inifile � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � OBJR � Memory Search � Search mem starting at cur...� objr searchstring � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � LOOK � Memory Search � Look for a hex value � look hex � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � MOVE � Memory Editing � eip = eip + param � move x � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � POS � Memory Editing � Set local adress value � pos x � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � REPL � Memory Editing � Modify h at cur. adress � repl hex � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � STEP � Memory Search � Exec. Step by step analysis � step � 勁袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴袴攷 � WALK � Memory Search � Exec. next instruction � walk � 勁袴袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴袴袴袴袴袴袴菰袴袴袴袴袴袴袴袴袴攷 � 같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같같 � 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 � Greetz and stuff � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 Well that's all from me! This "tutor" was written by: cokine achrya@hotmail.com efnet irc: #cracking4newbies, #c.i.a, #rsc Greetz fly out to: did-i-do: I luv u dood tKC: U rock! The PD Team: U rock even more :P All in C.i.A: Hmmmm.... :P All in RSC: We will succed. Numega: YOU REALLY ROCK! Everyone else: You rock to :P BuL-LeT: It should be BuL-L33T :P Quick greetz go to: sionide, d|shadow, iNC, the1, cerebri, mrnop, pingutm, delphic, RESURS, CLASS, PHROZEN CREW, UCF 2000, #cracking4newbies, Taz0r, |X-Men|, MANiFEST and... hmm... the whole swedish scene! C O K i N E - Blessed are thau bignosed