Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include "stdafx.h"
- #include "SDK.h"
- #include "DbgHelp.h"
- #include <Windows.h>
- #include <string>
- #include <iostream>
- HANDLE instructionFiles;
- LPPROCESS_INFORMATION process; // pointer returned by InitDebugEx
- long long address;
- DWORD bytesWriten;
- ULONG_PTR register_value;
- long long module_process;
- long long rva_to_breakpoint = 0x000016D6;
- void setInformation();
- void finishUnpack();
- void Unpack(char* name);
- void callbackEntryPoint();
- void callbackReadInstructionFromMemory();
- std::uint32_t start_address = 0, final_address = 0;
- bool first_read = true; // because it's not good the first characters
- int main(int argc, char **argv)
- {
- setInformation();
- Unpack(argv[1]);
- return 0;
- }
- void setInformation()
- {
- process = NULL;
- address = 0;
- register_value = 0;
- module_process = 0;
- // Set breakpoint type
- SetBPXOptions(UE_BREAKPOINT_INT3);
- // open file to save instructions
- instructionFiles = CreateFileA("vbscript.txt",
- GENERIC_WRITE,
- FILE_SHARE_READ,
- NULL,
- CREATE_ALWAYS,
- FILE_ATTRIBUTE_NORMAL,
- NULL
- );
- std::string header = ";=======================================\n";
- header += "; Program to obtain the instructions from challenge 9";
- header += "; of Flare-on\n";
- header += "; Author: F9\n";
- header += "; Based on framework TitanEngine\n";
- header += ";=======================================\n";
- WriteFile(instructionFiles, header.c_str(), header.length(), &bytesWriten, NULL);
- }
- void finishUnpack()
- {
- CloseHandle(instructionFiles);
- fprintf(stdout, "[!] Finished execution of program...!\n");
- }
- void Unpack(char* name)
- {
- process = (LPPROCESS_INFORMATION)InitDebugEx(name, NULL, NULL, callbackEntryPoint);
- if (process)
- {
- DebugLoop();
- finishUnpack();
- }
- else
- fprintf(stderr, "[-] Error running debugger for file %s! stop execution",name);
- }
- void callbackEntryPoint()
- {
- long long address_for_breakpoint = GetDebuggedFileBaseAddress();
- address_for_breakpoint += rva_to_breakpoint;
- bool result;
- fprintf(stdout, "[+] Base of debugged file: 0x%X\n", GetDebuggedFileBaseAddress());
- fprintf(stdout, "[+] Address for breakpoint: 0x%X\n", address_for_breakpoint);
- void *instruction = Disassemble((LPVOID)address_for_breakpoint);
- fprintf(stdout, "[+] Instruction to set breakpoint: %s\n", instruction);
- result = SetBPX(address_for_breakpoint, UE_BREAKPOINT, callbackReadInstructionFromMemory);
- if (!result)
- {
- fprintf(stderr, "[-] Error setting breakpoint\n");
- StopDebug();
- }
- }
- void callbackReadInstructionFromMemory()
- {
- DWORD address_of_code= GetContextData(UE_ESP);
- address_of_code += 0x4;
- DWORD address_of_instruction, bytes_read, bytesWriten;
- ReadProcessMemory(process->hProcess, reinterpret_cast<LPCVOID>(address_of_code), &address_of_instruction, 4, &bytes_read);
- fprintf(stdout, "[+] Address with decrypted script: 0x%X\n", address_of_instruction);
- if (first_read)
- {
- first_read = false;
- return;
- }
- if ((address_of_instruction >= start_address) && (address_of_instruction < final_address)) // if address is between those lines
- return; // return
- start_address = address_of_instruction;
- // Read from that memory until you find 0x0A
- std::string string_ascii;
- std::uint8_t value = 0;
- std::uint32_t index = 0;
- while (value != 0x0A)
- {
- ReadProcessMemory(process->hProcess, reinterpret_cast<LPCVOID>(address_of_instruction + index), &value, 1, &bytes_read);
- string_ascii += value;
- index += 2;
- }
- string_ascii += value;
- final_address = start_address + index;
- printf("%s", string_ascii.c_str());
- WriteFile(instructionFiles, string_ascii.c_str(), string_ascii.length(), &bytesWriten, NULL);
- }
Advertisement
Add Comment
Please, Sign In to add comment