Fare9

Flareon5 Challenge9 get script with TitanEngine

Oct 6th, 2018
539
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 3.64 KB | None | 0 0
  1. #include "stdafx.h"
  2. #include "SDK.h"
  3. #include "DbgHelp.h"
  4. #include <Windows.h>
  5. #include <string>
  6. #include <iostream>
  7.  
  8. HANDLE instructionFiles;
  9. LPPROCESS_INFORMATION process; // pointer returned by InitDebugEx
  10. long long address;
  11. DWORD bytesWriten;
  12. ULONG_PTR register_value;
  13. long long module_process;
  14.  
  15. long long rva_to_breakpoint = 0x000016D6;
  16.  
  17. void setInformation();
  18. void finishUnpack();
  19. void Unpack(char* name);
  20. void callbackEntryPoint();
  21. void callbackReadInstructionFromMemory();
  22.  
  23. std::uint32_t start_address = 0, final_address = 0;
  24. bool first_read = true; // because it's not good the first characters
  25.  
  26. int main(int argc, char **argv)
  27. {
  28.     setInformation();
  29.     Unpack(argv[1]);
  30.  
  31.     return 0;
  32. }
  33.  
  34.  
  35. void setInformation()
  36. {
  37.     process = NULL;
  38.     address = 0;
  39.     register_value = 0;
  40.     module_process = 0;
  41.     // Set breakpoint type
  42.     SetBPXOptions(UE_BREAKPOINT_INT3);
  43.  
  44.     // open file to save instructions
  45.     instructionFiles = CreateFileA("vbscript.txt",
  46.         GENERIC_WRITE,
  47.         FILE_SHARE_READ,
  48.         NULL,
  49.         CREATE_ALWAYS,
  50.         FILE_ATTRIBUTE_NORMAL,
  51.         NULL
  52.     );
  53.  
  54.     std::string header = ";=======================================\n";
  55.     header += "; Program to obtain the instructions from challenge 9";
  56.     header += "; of Flare-on\n";
  57.     header += "; Author: F9\n";
  58.     header += "; Based on framework TitanEngine\n";
  59.     header += ";=======================================\n";
  60.     WriteFile(instructionFiles, header.c_str(), header.length(), &bytesWriten, NULL);
  61. }
  62.  
  63. void finishUnpack()
  64. {
  65.     CloseHandle(instructionFiles);
  66.     fprintf(stdout, "[!] Finished execution of program...!\n");
  67. }
  68.  
  69. void Unpack(char* name)
  70. {
  71.     process = (LPPROCESS_INFORMATION)InitDebugEx(name, NULL, NULL, callbackEntryPoint);
  72.  
  73.     if (process)
  74.     {
  75.         DebugLoop();
  76.         finishUnpack();
  77.     }
  78.     else
  79.         fprintf(stderr, "[-] Error running debugger for file %s! stop execution",name);
  80. }
  81.  
  82. void callbackEntryPoint()
  83. {
  84.     long long address_for_breakpoint = GetDebuggedFileBaseAddress();
  85.     address_for_breakpoint += rva_to_breakpoint;
  86.     bool result;
  87.  
  88.     fprintf(stdout, "[+] Base of debugged file: 0x%X\n", GetDebuggedFileBaseAddress());
  89.     fprintf(stdout, "[+] Address for breakpoint: 0x%X\n", address_for_breakpoint);
  90.  
  91.     void *instruction = Disassemble((LPVOID)address_for_breakpoint);
  92.  
  93.     fprintf(stdout, "[+] Instruction to set breakpoint: %s\n", instruction);
  94.     result = SetBPX(address_for_breakpoint, UE_BREAKPOINT, callbackReadInstructionFromMemory);
  95.     if (!result)
  96.     {
  97.         fprintf(stderr, "[-] Error setting breakpoint\n");
  98.         StopDebug();
  99.     }
  100. }
  101.  
  102. void callbackReadInstructionFromMemory()
  103. {
  104.     DWORD address_of_code= GetContextData(UE_ESP);
  105.     address_of_code += 0x4;
  106.     DWORD address_of_instruction, bytes_read, bytesWriten;
  107.  
  108.     ReadProcessMemory(process->hProcess, reinterpret_cast<LPCVOID>(address_of_code), &address_of_instruction, 4, &bytes_read);
  109.  
  110.     fprintf(stdout, "[+] Address with decrypted script: 0x%X\n", address_of_instruction);
  111.  
  112.     if (first_read)
  113.     {
  114.         first_read = false;
  115.         return;
  116.     }
  117.  
  118.     if ((address_of_instruction >= start_address) && (address_of_instruction < final_address)) // if address is between those lines
  119.         return; // return
  120.  
  121.     start_address = address_of_instruction;
  122.     // Read from that memory until you find 0x0A
  123.     std::string string_ascii;
  124.     std::uint8_t value = 0;
  125.     std::uint32_t index = 0;
  126.  
  127.     while (value != 0x0A)
  128.     {
  129.         ReadProcessMemory(process->hProcess, reinterpret_cast<LPCVOID>(address_of_instruction + index), &value, 1, &bytes_read);
  130.         string_ascii += value;
  131.         index += 2;
  132.     }
  133.  
  134.     string_ascii += value;
  135.    
  136.     final_address = start_address + index;
  137.  
  138.     printf("%s", string_ascii.c_str());
  139.  
  140.     WriteFile(instructionFiles, string_ascii.c_str(), string_ascii.length(), &bytesWriten, NULL);
  141. }
Advertisement
Add Comment
Please, Sign In to add comment