Asprotect v1.23 import fixer

// ASProtect 1.23 IAT fix tool
#include"../Share/Simple/Simple.h"

enum IAT_RESULT {
    IAT_ZERO,
    IAT_NORMAL_API,
    IAT_FIXED,
    IAT_UNKNOWN,
    IAT_ERROR,
};

// ASProtect API Stub
AobScan aob_emulation_call(L"68 ?? ?? ?? ?? C3");
AobScan aob_jmp(L"E9");
AobScan aob_push_byte_push_dword_jmp(L"6A ?? 68 ?? ?? ?? ?? E9");
AobScan aob_push_byte_push_dword_emulation_call(L"6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3");
// ASProtect API Emulation
AobScan aob_emulation_GetCommandLineA(L"6A 00 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 58 8B 05 ?? ?? ?? ?? C3");
AobScan aob_emulation_LockResource(L"55 8B EC 8B 05 ?? ?? ?? ?? 8B 45 08 5D C2 04 00");
AobScan aob_emulation_GetCurrentProcessId_GetCurrentProcess(L"A1 ?? ?? ?? ?? C3");
AobScan aob_emulation_GetProcAddress(L"55 8B EC 8B 55 0C 8B 45 08 8B 0D ?? ?? ?? ?? 8B 09 3B C8 75 09 8B 04 95 ?? ?? ?? ?? EB 07 52 50 E8 ?? ?? ?? ?? 5D C2 08 00");
AobScan aob_emulation_GetModuleHandleA(L"55 8B EC 8B 45 08 85 C0 75 13 81 3D ?? ?? ?? ?? ?? ?? ?? ?? 75 07 A1 ?? ?? ?? ?? EB 06 50 E8 ?? ?? ?? ?? 5D C2 04 00");

IAT_RESULT FixIAT(DWORD dwAddress) {

    DWORD dwRealAddress = *(DWORD *)dwAddress;

    if (dwRealAddress == 0) {
        return IAT_ZERO;
    }

    HMODULE hDll = 0;
    if (GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, (LPCWSTR)dwRealAddress, &hDll)) {
        return IAT_NORMAL_API;
    }

    BYTE *mem = (BYTE *)dwRealAddress;

    // FIX PLZ
    try {
        // push + ret
        if (aob_emulation_call.Compare(dwRealAddress)) {
            dwRealAddress = *(DWORD *)&mem[1];
            *(DWORD *)dwAddress = dwRealAddress;
            return IAT_FIXED;
        }

        // jmp
        if (aob_jmp.Compare(dwRealAddress)) {
            dwRealAddress = (DWORD)&mem[0] + *(signed long int *)&mem[1] + 0x05;
            *(DWORD *)dwAddress = dwRealAddress;
            return IAT_FIXED;
        }

        // push + push + jmp
        if (aob_push_byte_push_dword_jmp.Compare(dwRealAddress)) {
            dwRealAddress = (DWORD)&mem[7] + *(signed long int *)&mem[8] + 0x05 - 0x07;
            *(DWORD *)dwAddress = dwRealAddress;
            return IAT_FIXED;
        }

        // push + push + push + ret
        if (aob_push_byte_push_dword_emulation_call.Compare(dwRealAddress)) {
            dwRealAddress = *(DWORD *)&mem[8] - 0x07;
            *(DWORD *)dwAddress = dwRealAddress;
            return IAT_FIXED;
        }

        // API Emulation
        if (aob_emulation_GetCommandLineA.Compare(dwRealAddress)) {
            *(DWORD *)dwAddress = (DWORD)GetCommandLineA;
            return IAT_FIXED;
        }

        if (aob_emulation_LockResource.Compare(dwRealAddress)) {
            *(DWORD *)dwAddress = (DWORD)LockResource;
            return IAT_FIXED;
        }

        if (aob_emulation_GetCurrentProcessId_GetCurrentProcess.Compare(dwRealAddress)) {
            if (*(DWORD *)(*(DWORD *)&mem[1]) == GetCurrentProcessId()) {
                *(DWORD *)dwAddress = (DWORD)GetCurrentProcessId;
                return IAT_FIXED;
            }
            if (*(DWORD *)(*(DWORD *)&mem[1]) == -1) {
                *(DWORD *)dwAddress = (DWORD)GetCurrentProcess;
                return IAT_FIXED;
            }
        }

        if (aob_emulation_GetProcAddress.Compare(dwRealAddress)) {
            *(DWORD *)dwAddress = (DWORD)GetProcAddress;
            return IAT_FIXED;
        }

        if (aob_emulation_GetModuleHandleA.Compare(dwRealAddress)) {
            *(DWORD *)dwAddress = (DWORD)GetModuleHandleA;
            return IAT_FIXED;
        }
    }
    catch (...) {
        return IAT_ERROR;
    }


    return IAT_UNKNOWN;
}

std::vector<DWORD> list_unknown_iat;

bool ASProtect_IAT_Fixer(DWORD dwIAT_Addr, DWORD dwIAT_Size, int &fixed) {
    int count_fixed = 0;
    int count_unknown = 0;
    int count_error = 0;

    list_unknown_iat.clear();

    for (DWORD dwAddress = dwIAT_Addr; dwAddress <= dwIAT_Addr + dwIAT_Size; dwAddress += sizeof(DWORD)) {
        IAT_RESULT ir = FixIAT(dwAddress);

        if (ir == IAT_FIXED) {
            count_fixed++;
        }
        else if (ir == IAT_UNKNOWN) {
            list_unknown_iat.push_back(dwAddress);
            count_unknown++;
        }
        else if (ir == IAT_ERROR) {
            count_error++;
            return false;
        }
    }
    return true;
}


enum SubControl {
    STATIC_IAT_ADDRESS = 101,
    STATIC_IAT_SIZE,
    EDIT_IAT_ADDRESS,
    EDIT_IAT_SIZE,
    BUTTON_FIX,
    EDIT_RESULT,
};

bool OnCreate(Alice &a) {
    a.StaticText(STATIC_IAT_ADDRESS, L"IAT Address (DWORD)", 30, 30);
    a.StaticText(STATIC_IAT_SIZE, L"IAT Size (DWORD)", 30, 60);

    a.EditBox(EDIT_IAT_ADDRESS, 150, 30, L"", 100);
    a.EditBox(EDIT_IAT_SIZE, 150, 60, L"", 100);
    a.Button(BUTTON_FIX, L"FIX!!!", 270, 90);
    a.TextArea(EDIT_RESULT, 5, 150, 390, 140);
    return true;
}

bool OnCommand(Alice &a, int nIDDlgItem) {
    if (nIDDlgItem == BUTTON_FIX) {
        std::wstring wIAT_Addr, wIAT_Size;
        wIAT_Addr = a.GetText(EDIT_IAT_ADDRESS);
        wIAT_Size = a.GetText(EDIT_IAT_SIZE);

        DWORD dwIAT_Addr = 0, dwIAT_Size = 0;
        swscanf_s(wIAT_Addr.c_str(), L"%X", &dwIAT_Addr);
        swscanf_s(wIAT_Size.c_str(), L"%X", &dwIAT_Size);

        std::wstring wText;
        wText = L"Input Value, Addr = " + DWORDtoString(dwIAT_Addr) + L", Size = " + DWORDtoString(dwIAT_Size);

        if (MessageBoxW(a.GetMainHWND(), wText.c_str(), L"Please input value", MB_YESNO) == IDYES) {
            int fixed = 0;
            if (!ASProtect_IAT_Fixer(dwIAT_Addr, dwIAT_Size, fixed)) {
                MessageBoxW(a.GetMainHWND(), L"Error", L"R.I.P", MB_OK);
            }
            else {
                std::wstring wMsg = L"OK! please open Scylla, fixed = " + std::to_wstring(fixed);
                MessageBoxW(a.GetMainHWND(), wMsg.c_str(), L"OK", MB_OK);

                std::wstring wResult = L"";
                for (auto v : list_unknown_iat) {
                    wResult += std::to_wstring(v) + L" :  " + std::to_wstring(*(DWORD *)v) + L"\r\n";
                }

                a.SetText(EDIT_RESULT, wResult);
            }
        }

        return true;
    }
    return true;
}

void aif_gui(HINSTANCE hInstance) {
    Alice a(L"aifgui", L"Asprotect v1.23 import fixer", 400, 300, hInstance);

    a.SetOnCreate(OnCreate);
    a.SetOnCommand(OnCommand);
    a.Run();
    a.Wait();
}


BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        DisableThreadLibraryCalls(hinstDLL);
        HANDLE hThread = CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)aif_gui, hinstDLL, NULL, NULL);

        if (hThread) {
            CloseHandle(hThread);
        }
    }
    return TRUE;
}