DeJunk.ini
资源名称:OllyICE.rar [点击查看]
上传用户:bjwsw2004
上传日期:2014-10-10
资源大小:2404k
文件大小:15k
源码类别:
破解
开发平台:
MultiPlatform
- ; DeJunk v1.10 的特征文件。此文件附属于 DeJunk 程序,请不要删除!!!
- ; 简要说明:
- ; [OPTION]下有4项描述项目: "PrePatName" / "ActivePatList"
- ;
- ; MENU 显示在OLLYDBG右键菜单用的项目,必须有相应的 ActivePatList?,就是说有3项菜单的话,就应该有ActivePatList1,ActivePatList2,ActivePatList3,以些类推
- ;
- ; SCANSIZE 右键菜单中的快捷搜索大小(字节)
- ;
- ; PrePatName 描述花指令特征模板(以后简称特征模板)名称的前缀,一般不需要改动.
- ;
- ; ActivePatList? 描述花指令特征模板名称的后缀列表.
- ; 在列表中出现的名称后缀将分别和特征模板名称的前缀合并成一个完整的花指令特征模板名称
- ; 在列表中合并得到的特征模板名称,将被程序激活使用.
- ;
- ; [模板名前缀+模板名后缀]下只有两项描述项目: "S" / "R"
- ;
- ; S 描述花指令的特征字节串,对于可为任意值的字节可以使用 ?? 代替,最长为200字节,不要超过
- ; R 描述是否需要进行替换的标志, ??为保留原来的字节, 其它为替换成相应字节.
- ;
- ; 使用时注意事项:
- ; 1) 使用 DeJunk 程序前可以通过设置 ActivePatList 来达到只搜索部分花指令特征的目的.
- ; 这对于特征文件中有太多的特征信息时非常有用.
- ; 2) 可以通过改变 PrePatName 达到屏蔽掉不希望使用的某些种类的花指令特征时非常有用.
- ; 比如你可以对不同程序中提取的花指令特征模板命名不同的前缀名称,这样你可以有效地管 理花指令特征信息.
- ; 3) 尽量把字节数多的特征信息放在 ActivePatList 后缀列表的前面,因为有些特征信息是包含或者重叠关系,
- ; 一旦字节数少的特征模板匹配成功,程序不会继续匹配其他特征模板.而一般字节数少的特征模板更容易被匹配,
- ; 并且也容易成为被其他特征模板包含.
- ;
- ;
- [OPTION]
- ; 这是显示在OLLYDBG中的菜单项,以 | 分开,前面为序号与 ActivePatList? 对应
- MENU = 1 ObSiDiUm | 2 幻影花指令(DBPE) | 3 SVK V1.32 | 4 常用花指令 | 5 PELock 1.0 | 6 ACProtect(UltraProtect) | 8 Alex Protector | 9 AsProtect | 10 PEsPin |
- ;右键菜单中选择后进行搜索的大小(十进制)
- SCANSIZE = 1024
- PrePatName = "CODE"
- ;这个对应第1项菜单
- ActivePatList1 = _jmp01,_jmp02,_jmp03,_jmp04,
- ;这个对应第2项菜单,以此类推
- ActivePatList2 = _T1,_T2,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22
- ;这个对应第3项菜单,以此类推
- ActivePatList3 = _jmp01,_jmp02,_jmp03,
- ActivePatList4 = _T1,_T2,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22
- ActivePatList5 = _jmp01,_jmp02,_jmp03,1,2,3,4,5,6,7,8,9,10,11,12,13,_call05,_call06,
- ActivePatList6 = 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,_jmp01,_jmp11,_jmp12,_jmp13,_jmp15,_call00,_call01,_call04
- ActivePatList7 = _T1,_T2,hying1,hying2,hying3,hying4,hying5,hying6,hying7,hying8,hying9,hying10,hying11,hying12,hying13
- ActivePatList8 = _Alex1,_Alex2,_Alex3,_Alex4,_Alex5,_Alex6,_Alex7,_Alex8,
- ActivePatList9 = _ASPR_jmp01,_ASPR_jmp02,_ASPR_jmp03,_ASPR_jmp04,_ASPR_jmp05,_ASPR_jmp06,_ASPR_jmp07,_jmp02,_ASPR_jmp08
- ActivePatList10 = _Pes1,_jmp01,_jmp02,_call0111,_PESPIN1,_Pespin_jne01,_pESPIN_JMP01,_PesPin_Call02,_PesPin_jmp02,_PesPin_Call01,_PesPin_STC01,_call021,_PesPin_jmpEsp01,_PesPin_STC02
- ActivePatList11 =_JDPack1,_JDPack2,_JDPack3,_JDPack4,_JDPack5,_JDPack6,_JDPack7,_JDPack8,_JDPack9,_JDPack10,_JDPack11,_JDPack12,_JDPack13,_JDPack14,_JDPack15,_JDPack16
- ;这个字串最长500字节,不要超过.
- [CODE_T1]
- ; pushf
- ; push 0Ah
- ;loc_1: jnb loc_3
- ; jmp loc_2
- ; _TWO_BYTE_JUNKCODE_
- ;loc_2: call loc_4
- ; _TWO_BYTE_JUNKCODE_
- ;loc_3: jnb loc_2
- ; _TWO_BYTE_JUNKCODE_
- ;loc_4: add esp,4
- ; jmp loc_5
- ; _TWO_BYTE_JUNKCODE_
- ;loc_5: dec dword ptr [esp]
- ; jno loc_6
- ; _ONE_BYTE_JUNKCODE_
- ;loc_6: jns loc_1
- ; jp loc_7
- ; _ONE_BYTE_JUNKCODE_
- ;loc_7: add esp,4
- ; popf
- ; jmp loc_8
- ; _ONE_BYTE_JUNKCODE_
- ;loc_8: ......
- S = 9C6A??730BEB02????E806000000????73F7????83C404EB02????FF0C247101??79E07A01??83C4049DEB01??
- R = 909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090
- [CODE_T2]
- ; pushf
- ; jb loc_3
- ;loc_1: jmp loc_2
- ; _ONE_BYTE_JUNKCODE_
- ;loc_2: call loc_4
- ; _TWO_BYTE_JUNKCODE_
- ;loc_3: jb loc_1
- ; _ONE_BYTE_JUNKCODE_
- ;loc_4: add esp,4
- ; popf
- ; jmp loc_5
- ; _ONE_BYTE_JUNKCODE_
- ;loc_5: ....
- S = 9C720AEB01??E805000000????72F4??83C4049DEB01??
- R = 9090909090909090909090909090909090909090909090
- [CODE1]
- ; jo label
- ; jno label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 70037101??
- R = 9090909090
- [CODE2]
- ; jb label
- ; jnb label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 72037301??
- R = 9090909090
- [CODE3]
- ; je label
- ; jne label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 74037501??
- R = 9090909090
- [CODE4]
- ; jbe label
- ; ja label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 76037701??
- R = 9090909090
- [CODE5]
- ; js label
- ; jns label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 78037901??
- R = 9090909090
- [CODE6]
- ; jpe label
- ; jpo label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 7A037B01??
- R = 9090909090
- [CODE7]
- ; jl label
- ; jge label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 7C037D01??
- R = 9090909090
- [CODE8]
- ; jle label
- ; jg label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 7E037F01??
- R = 9090909090
- /////////////////////////////////////////
- //以下几种是 CODE1 - CODE8 的倒装形式
- /////////////////////////////////////////
- [CODE9]
- ; jno label
- ; jo label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 71037001??
- R = 9090909090
- [CODE10]
- ; jnb label
- ; jb label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 73037201??
- R = 9090909090
- [CODE11]
- ; jne label
- ; je label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 75037401??
- R = 9090909090
- [CODE12]
- ; ja label
- ; jbe label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 77037601??
- R = 9090909090
- [CODE13]
- ; jns label
- ; js label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 79037801??
- R = 9090909090
- [CODE14]
- ; jpo label
- ; jpe label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 7B037A01??
- R = 9090909090
- [CODE15]
- ; jge label
- ; jl label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 7D037C01??
- R = 9090909090
- [CODE16]
- ; jle label
- ; jg label
- ; db _junkcode
- ;label: ....
- ; ....
- S = 7F037E01??
- R = 9090909090
- /////////////////////////////////////////
- /////////////////////////////////////////
- [CODE17]
- ; call label_1
- ; db _junkcode,_junkcode
- ; jmp label_4
- ;label_1: pop eax
- ; jmp label_2
- ; db _junkcode,_junkcode
- ;label_2: add eax,2
- ; jmp label_3
- ; db _junkcode
- ;label_3: push eax
- ; ret
- ; db _junkcode
- ;label_4: ....
- ; ....
- S = E804000000????EB0E58EB02????83C002EB01??50C3??
- R = 9090909090909090909090909090909090909090909090
- [CODE18]
- ; push ecx
- ; xor ecx,ecx
- ; jcxz label
- ; db _junkcode
- ;label: pop ecx
- ; ....
- ; ....
- S = 5131C9E301??59
- R = 90909090909090
- [CODE19]
- ; jl label_1
- ;label_2: jmp label_3
- ; db _junkcode
- ;label_1: jz label_2
- ;label_3: ....
- ; ....
- S = 7C03EB03??74FB
- R = 90909090909090
- [CODE20]
- ; call label_1
- ; db _junkcode,_junkcode,_junkcode
- ;label_1: add esp,4
- ; jmp label_2
- ; db _junkcode,_junkcode,_junkcode
- ;label_2: jmp label_3
- ; db _junkcode,_junkcode
- ;label_3: ....
- ; ....
- S = E803??????83C404EB03??????EB02????
- R = 9090909090909090909090909090909090
- [CODE21]
- ; call label_1
- ; db _junkcode
- ; jmp label_4
- ; db _junkcode
- ;label_1: pop edi
- ; jmp label_2
- ; db _junkcode
- ;label_2: inc edi
- ; jmp label_3
- ; db _junkcode
- ;label_3: jmp edi
- ; db _junkcode
- ;label_4: ....
- S = E804000000??EB0C??5FEB01??47EB01??FFE7??
- R = 9090909090909090909090909090909090909090
- [CODE22]
- ; call label_1
- ; db _junkcode,_junkcode
- ; jmp label_4
- ;label_1: pop ecx
- ; jmp label_2
- ; db _junkcode,_junkcode
- ;label_2: add ecx,2
- ; jmp label_3
- ; db _junkcode
- ;label_3: push ecx
- ; ret
- ; db _junkcode
- ;label_4: ....
- ; ....
- S = E804000000????EB0E59EB02????83C102EB01??51C3??
- R = 9090909090909090909090909090909090909090909090
- [CODE_jnz01]
- S = 7501??
- R = 909090
- [CODE_jmp01]
- S = EB01??
- R = 909090
- [CODE_jmp02]
- S = EB02????
- R = 90909090
- [CODE_jmp03]
- S = EB03??????
- R = 9090909090
- [CODE_jmp04]
- S = EB04????????
- R = 909090909090
- [CODE_jmp05]
- S = EB05??????????
- R = 90909090909090
- [CODE_jmp06]
- S = EB06????????????
- R = 9090909090909090
- [CODE_jmp07]
- S = EB07??????????????
- R = 909090909090909090
- [CODE_jmp08]
- S = EB08????????????????
- R = 90909090909090909090
- [CODE_jmp09]
- S = EB09??????????????????
- R = 9090909090909090909090
- [CODE_jmp11]
- S = E901000000??
- R = 909090909090
- [CODE_jmp12]
- S = E902000000????
- R = 90909090909090
- [CODE_jmp13]
- S = E903000000??????
- R = 9090909090909090
- [CODE_jmp14]
- S = E904000000????????
- R = 909090909090909090
- [CODE_jmp15]
- S = E905000000??????????
- R = 90909090909090909090
- [CODE_call04]
- ; call label_1
- ; db _junkcode
- ;label_1: add esp,4
- S = E801000000??83C404
- R = 909090909090909090
- [CODE_telock_call02_1]
- S = E802000000????3006465A
- R = 9090909090909030064690
- [CODE_telock_call02_2]
- S = E802000000E800E8000000005E2BC9587402????
- R = 90909090909090E8000000005E2BC99090909090
- [CODE_call00]
- ; push eax
- ; call label_1
- ; db _junkcode
- ;label_1: pop eax
- ; pop eax
- S = 50E801000000??5858
- R = 909090909090909090
- [CODE_call01]
- ; call label_1
- ; db _junkcode
- ;label_1: add dword ptr ss:[esp],6
- ; ret
- S = E801000000??83042406C3
- R = 9090909090909090909090
- [CODE_call02]
- ; call label_1
- ; db _junkcode,_junkcode
- ; db _junkcode,_junkcode
- ;label_1: add esp,4
- S = E802000000????83C404
- R = 90909090909090909090
- [CODE_call03]
- ; call label_1
- ; db _junkcode,_junkcode
- ; db _junkcode,_junkcode
- ; db _junkcode,_junkcode
- ;label_1: add esp,4
- S = E803000000??????83C404
- R = 9090909090909090909090
- [CODE_clc_jnb01]
- ; CLC
- ; JNB label_1
- ; db _junkcode
- ;label_1:
- S = F87301??
- R = 90909090
- [CODE_clc_jnb02]
- ; CLC
- ; JNB label_1
- ; db _junkcode
- ; db _junkcode
- ;label_1:
- S = F87302????
- R = 9090909090
- [CODE_slc_jb01]
- ; CLC
- ; JNB label_1
- ; db _junkcode
- ; db _junkcode
- ;label_1:
- S = F97201??
- R = 90909090
- [CODE_slc_jb02]
- ; CLC
- ; JNB label_1
- ; db _junkcode
- ; db _junkcode
- ;label_1:
- S = F97202????
- R = 9090909090
- [CODE_??]
- ;loc_3: .....
- ; jmp loc_5
- ; db 5 dup(?)
- ;loc_2: pop ecx
- ; jp loc_3
- ; jmp loc_4
- ; db 1 dup(?)
- ;loc_4: jnp loc_3
- ; db 1 dup(?)
- ;loc_1: push ecx
- ; jmp loc_2
- ; db 7 dup(?)
- ;loc_0: jmp loc_1
- ; db ? dup(?)
- ;loc_8: //正常指令.....
- ; jmp loc_10
- ; db 5 dup(?)
- ;loc_7: pop ecx
- ; jp loc_8
- ; jmp loc_9
- ; db 1 dup(?)
- ;loc_9: jnp loc_8
- ; db 1 dup(?)
- ;loc_6: push ecx
- ; jmp loc_7
- ; db 7 dup(?)
- ;loc_5: jmp loc_6
- ; db ? dup(?)
- ;loc_10: .....
- [CODE_??]
- ; jmp label
- ; db _junkcode
- ;label: ....
- ; ....
- [CODE_call05]
- ; call label_1
- ; db _junkcode
- ;label_1: POP [ESP-4]
- S = E801000000??8F4424FC
- R = 90909090909090909090
- [CODE_call06]
- ; call label_1
- ; db _junkcode
- ;label_1: LEA ESP, [ESP+4]
- S = E801000000??8D642404
- R = 90909090909090909090
- /////////////////////////////////////////
- /////////////////////////////////////////
- ActivePatList8 =_Alex1,_Alex2,_Alex3,
- [CODE_Alex1]
- S = EB03EB03??EBFBE801000000??83C404
- R = 90909090909090909090909090909090
- [CODE_Alex2]
- S = EB05??F00FC7C8
- R = 90909090909090
- [CODE_Alex3]
- S = 85D275D661
- R = ????9090??
- [CODE_Alex4]
- S = 0F312BC3
- R = 9090????
- [CODE_Alex5]
- S = 0F318BD8
- R = 9090????
- [CODE_Alex6]
- S = 0F3103C3
- R = 9090????
- [CODE_Alex7]
- S = 0F31EB01C7
- R = 9090909090
- [CODE_Alex8]
- S = 0F31EB01C9
- R = 9090909090
- /////////////////////////////////////////
- /////////////////////////////////////////
- [CODE_ASPR_jmp01]
- S = 2EEB01??
- R = 90909090
- [CODE_ASPR_jmp02]
- S = 65EB01??
- R = 90909090
- [CODE_ASPR_jmp03]
- S = F2EB01??
- R = 90909090
- [CODE_ASPR_jmp04]
- S = F3EB01??
- R = 90909090
- [CODE_ASPR_jmp05]
- S = 26EB02????
- R = 9090909090
- [CODE_ASPR_jmp06]
- S = 3EEB02????
- R = 9090909090
- [CODE_ASPR_jmp07]
- S = F3EB02????
- R = 9090909090
- [CODE_ASPR_jmp08]
- S = EB01??
- R = 909090
- /////////////////////////////////////////
- /////////////////////////////////////////
- [CODE_alex_push01]
- S =60EB03EB03??EBFBE801000000??83C4040F318BD8EB03EB03??EBFBE801000000??83C4048BCAEB03EB03??EBFBE801000000??83C4040F312BC3EB03EB03??EBFBE801000000??83C4041BD10F3103C3EB03EB03??EBFBE801000000??83C40413D10F312BC3EB03EB03??EBFBE801000000??83C404EB05??????????EB03EB03??EBFBE801000000??83C4041BD1EB03EB03??EBFBE801000000??83C40485D275D661
- R =909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090
- [CODE_alex_call01]
- S =E824000000EB01E98B44240CEB03EB03C7EBFBE801000000A883C4048380B80000000233C0EB01E9C35883C404EB03EB03C7EBFBE801000000A883C4045064FF350000000064892500000000EB01??FFFF
- R =909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090
- /////////////////////////////////////////
- /////////////////////////////////////////
- [CODE_Pes1]
- ; jmp label1
- ;
- S =EB04??EB04??EBFB??
- R =909090909090909090
- [CODE_call0111]
- ; call label1
- ; db _junkcode
- S =E801000000??
- R =E80100000090
- [CODE_PESPIN1]
- S =E803000000EB04??EBFB??
- R =E803000000909090909090
- [CODE_Pespin_jne01]
- S =7501??
- R =909090
- [CODE_Pespin_JMP01]
- S =EB04??EB04??EBFB??
- R =909090909090909090
- [CODE_PesPin_jmp02]
- S = EB07??EB01??EB04??EBF8??
- R = 909090909090909090909090
- [CODE_PesPin_Call01]
- S = 60E803000000??EB0A58EB01??40EB01??FFE061
- R = 9090909090909090909090909090909090909090
- [CODE_PesPin_Call02]
- ; Call _label1
- ; db _junkcode
- ; db _junkcode
- ; db _junkcode
- ; db _junkcode
- ; db _junkcode
- ; db _junkcode
- ; ADD SS:[ESP],0C
- ; RETN
- S = E803000000????????????8304240CC3??
- R = 9090909090909090909090909090909090
- [CODE_PesPin_jmpEsp01]
- S = 5A588D642404FF6424FC??
- R = 5A588D642404FF6424FC90
- [CODE_PesPin_STC01]
- S = F97208????F983042417C3E804000000??F57311EB06??72ED??EB07F5720EF572F8??EBEC83042407F5FF3424C3
- R = 90909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090
- [CODE_PesPin_STC02]
- ; STC
- ; JB SHORT 00404F4D
- ; _Junkcode,_Junkcode
- ; ADD DWORD PTR SS:[ESP],17
- ; RETN
- ; CALL 00404F56
- ; _Junkcode
- ; CMC
- ; JNB SHORT 00404F67
- ; JMP SHORT 00404F5E
- ; _Junkcode
- ; JB SHORT 00404F48
- ; _Junkcode
- ; JMP SHORT 00404F65
- ; CMC
- ; JB SHORT 00404F6F
- ; CMC
- ; JB SHORT 00404F5C
- ; _Junkcode
- ; JMP SHORT 00404F53
- ; ADD DWORD PTR SS:[ESP],7
- ; CMC
- ; PUSH DWORD PTR SS:[ESP]
- ; RETN
- S = F97207????83042417C3E804000000??F57311EB06??72ED??EB07F5720EF572F8??EBEC83042407F5FF3424C3
- R = 909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090