Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include <idc.idc>
- static searchBinary(name, binary, offset, length)
- {
- auto currentAddress, lastAddress;
- for(currentAddress=0; currentAddress != BADADDR; currentAddress=currentAddress+4)
- {
- currentAddress = FindBinary(currentAddress, SEARCH_DOWN, binary);
- if(currentAddress == BADADDR)
- {
- Message("%s not found!\n", name);
- break;
- }
- currentAddress = currentAddress - offset;
- MakeUnknown(currentAddress, length, 0);
- MakeCode(currentAddress);
- MakeFunction(currentAddress, currentAddress + length);
- if(MakeNameEx(currentAddress, name, SN_NOCHECK|SN_NOWARN) != 1)
- MakeNameEx(currentAddress, name, 0);
- Message("\t%s offset: 0x%08X\n", name, currentAddress);
- break;
- }
- }
- static findDemonware()
- {
- searchBinary("antiban1", "60 66 51 60 80 7F 07 58 7C 86 20 10 83 BF 05 C4", 0xAA0, 0x1B8);
- searchBinary("antiban2", "7C C4 30 2A 7C 26 18 00 40 82 00 0C 60 E3 00 00", 0x360, 0x1B8);
- searchBinary("antiban3", "50 C3 06 B4 90 7F 00 30 63 E3 00 00 4B FF F9 51", 0x2A77FC, 0x1B8);
- searchBinary("antiban4", "7C C5 FE 70 7C AC 32 78 7C 0C 28 50 54 0B 0F FE", 0x1CE768, 0x1B8);
- searchBinary("antiban5", "57 E4 95 78 7C 63 00 D0 7C CE 20 14 7C 92 20 14", 0x39DA90, 0x1B8);
- searchBinary("antiban6", "54 84 10 3A 7C 87 20 2E 7C C6 22 78 60 69 00 00", 0x158, 0x1B8);
- searchBinary("antiban7", "78 84 00 20 7D 07 40 2E 7C C6 42 78 40 82 FF D0", 0xD4, 0x1B8);
- searchBinary("antiban8", "7D 24 22 78 54 84 10 3A 7C 87 20 2E 7C A5 22 78", 0x124, 0x1B8);
- searchBinary("antiban9", "12 05 D1 25 7F E0 48 0C 11 E5 E1 25 12 AC 32 44", 0x1E5A48, 0x1B8);
- searchBinary("antiban10", "54 A6 15 BA 30 E3 00 08 38 60 00 00 78 E7 00 20", 0x2B8FF4, 0x1B8);
- searchBinary("antiban11", "60 84 AA AB 7C 84 E8 96 7C 84 16 70 54 85 0F FE", 0x24, 0x1B8);
- searchBinary("antiban12", "D8 21 00 70 80 81 00 74 90 9F 00 0C 4B F1 30 F9", 0x3CA4B0, 0x1B8);
- searchBinary("antiban13", "7C 63 26 30 54 63 07 FE 4E 80 00 20 2C 03 00 00", 0x4A68, 0x1B8);
- searchBinary("antiban14", "60 C5 04 80 30 DF 00 08 78 C6 00 20 F8 66 00 00", 0x218, 0x1B8);
- searchBinary("antiban15", "EC 83 BE BC D0 81 00 BC 41 86 00 30 EC 21 F0 28", 0xF3924, 0x1B8);
- }
- static main()
- {
- Message("Ban Bypass locator Script by: Notorious\n");
- findDemonware();
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement