//OllyScript infoUSA PowerFinder v9.1 registration bypass and export enable.
//by GoatCheez

//ASM addr, command
//-----------------
//Assemble a command at some address.
//Returns bytes assembled in the reserved $RESULT variable
//Example:
//	asm eip, "mov eax, ecx"

//FIND addr, what
//---------------
//Searches memory starting at addr for the specified value.
//When found sets the reserved $RESULT variable. $RESULT == 0 if nothing found.
//The search string can also use the wildcard "??" (see below).
//Example:
//	find eip, #6A00E8# // find a PUSH 0 followed by some kind of call
//	find eip, #6A??E8# // find a PUSH 0 followed by some kind of call


//GPA proc, lib
//-------------
//Gets the address of the specified procedure in the specified library.
//When found sets the reserved $RESULT variable. $RESULT == 0 if nothing found.
//Useful for setting breakpoints on APIs.
//Example:
//	gpa "MessageBoxA", "user32.dll" // After this $RESULT is the address of MessageBoxA and you can do "bp $RESULT".

//GMI addr, info
//--------------
//Gets information about a module to which the specified address belongs.
//"info" can be MODULEBASE, MODULESIZE, CODEBASE or CODESIZE (if you want other info in the future versions plz tell me).
//Sets the reserved $RESULT variable (0 if data not found).
//Example:
//	GMI eip, CODEBASE // After this $RESULT is the address to the codebase of the module to which eip belongs

//EVAL
//----
//Evaluates a string expression that contains variables.
//The variables that are declared in the current script can be enclosed in curly braces {} to be inserted.
//Sets the reserved $RESULT variable
//Example:
//	var x
//	mov x, 1000
//	eval "The value of x is {x}" // after this $RESULT is "The value of x is 00001000"


var tmp
var tmpAddr
var currentSearchAddress
var lastModuleBase
var patchRet
var patchJmp
var patchName
var searchJmp

MAIN:
mov searchJmp, "SEARCH_ENGINER_CIUDATABASE_HASMETER"
mov patchJmp, "PATCH_ENGINER_CIUDATABASE_HASMETER"
mov patchRet, "GETCURRENTMETERCOUNT"
mov patchName, "EngineR : CIuDatabase::HasMeter()"
JMP SEARCH_START

GETCURRENTMETERCOUNT:
mov searchJmp, "SEARCH_EXPORTRE_CIUEXPORTSETTINGS_GETCURRENTMETERCOUNT"
mov patchJmp, "PATCH_EXPORTRE_CIUEXPORTSETTINGS_GETCURRENTMETERCOUNT"
mov patchRet, "EXPORTEXPORT"
mov patchName, "ExportRe : CIuExportSettings::GetCurrentMeterCount()"
JMP SEARCH_START

EXPORTEXPORT:
mov searchJmp, "SEARCH_EXPORTRE_CIUEXPORT_EXPORT"
mov patchJmp, "PATCH_EXPORTRE_CIUEXPORT_EXPORT"
mov patchRet, "FINISHED"
mov patchName, "ExportRe : CIuExport::Export()"
JMP SEARCH_START


SEARCH_START:
mov currentSearchAddress, 0017F000

ENGINER_SEARCH_START:
add currentSearchAddress, 1000

cmp currentSearchAddress, 7FFFF000
JAE ERROR_LABEL_ENGINER

GMI currentSearchAddress, CODEBASE
mov lastModuleBase, $RESULT
cmp lastModuleBase, 0
JE ENGINER_SEARCH_START

JMP searchJmp
POST_SEARCH:
mov tmpAddr, $RESULT
GMI currentSearchAddress, CODESIZE
mov currentSearchAddress, $RESULT

GMI lastModuleBase, MODULEBASE
mov lastModuleBase, $RESULT
GMI lastModuleBase, MODULESIZE
mov currentSearchAddress, $RESULT
add currentSearchAddress, lastModuleBase

cmp tmpAddr, 0
JE ENGINER_SEARCH_START

JMP patchJmp

ERROR_LABEL_ENGINER:
eval "Unable to find {patchName}!"
MSG $RESULT
ret

////////////////////////////////////////////////////////////////////////////////////////////////////
SEARCH_ENGINER_CIUDATABASE_HASMETER:
find lastModuleBase, #64A1000000006AFF68????????506489250000000083EC0853568BF1FF15????????84C074288B1D????????6A0068????????68????????6A008BCEFFD350E8CAC60900#
JMP POST_SEARCH

PATCH_ENGINER_CIUDATABASE_HASMETER:
add tmpAddr, C1
ASM tmpAddr, "xor al, al"
JMP patchRet

////////////////////////////////////////////////////////////////////////////////////////////////////
SEARCH_EXPORTRE_CIUEXPORTSETTINGS_GETCURRENTMETERCOUNT:
find lastModuleBase, #8B4424048981c4000000C20400CCCCCC8B81C4000000C3CCCCCCCCCCCCCCCCCC8B442404898198000000C20400CCCCCC8B8198000000C3CCCCCCCC#
JMP POST_SEARCH

PATCH_EXPORTRE_CIUEXPORTSETTINGS_GETCURRENTMETERCOUNT:
add tmpAddr, 30
ASM tmpAddr, "mov eax, 7fffffff"
add tmpAddr, $RESULT
asm tmpAddr, "mov DWORD PTR DS:[ECX+98], EAX"
add tmpAddr, $RESULT
asm tmpAddr, "RETN"
jmp patchRet

////////////////////////////////////////////////////////////////////////////////////////////////////
SEARCH_EXPORTRE_CIUEXPORT_EXPORT:
find lastModuleBase, #558BEC6AFF68????????64A100000000506489250000000081EC1805000053568B750C85F6578BF98965F0897DD8750433C0EB038B462050FF15????????85C0741D#
JMP POST_SEARCH

PATCH_EXPORTRE_CIUEXPORT_EXPORT:
add tmpAddr, 10D
mov tmp, tmpAddr
add tmp, CC
eval "JMP {tmp}"
ASM tmpAddr, $RESULT
add tmpAddr, $RESULT
ASM tmpAddr, "NOP"
JMP patchRet

////////////////////////////////////////////////////////////////////////////////////////////////////
FINISHED:
MSG "Done!"
ret