/*
//////////////////////////////////////////////////
Назначение скрипта : Позволяет получить все хеши в пропатченном файле
Author : Djeck
OS : OllyDbg 1.10, Plugin Phantom, WinXP-Win7
Date : 12.11.2013
/////////////////////////////////////////////////
*/

var FILE_EXIST
var FILE_NAME
var ORIGINAL_EIP
var FILE_BUFF
var BUFF_SIZE
var CRC_ADDRESS
var PATCHED_HASH_FILENAME
var INFO

var START_HASH_ADDRESS
var HASH
var ADDRESS
var MODIFIED_HASH

mov FILENAME, "Original_CRC.txt"
mov PATCHED_HASH_FILENAME, "Patched_CRC.txt"
mov BUFF_SIZE, 80000

BC
BPMC
BPHWC

cmp $VERSION, "1.82"
je START_SCRIPT
ja START_SCRIPT
msg "Update your ODBG-Script plugin!!! Minimum version 1.82"
ret

START_SCRIPT:
mov ORIGINAL_EIP, eip
CALL FIND_FILES // check file exist
cmp FILE_EXIST, -1
je FILE_NOT_EXIST
// Load Original_Hash file
alloc BUFF_SIZE
mov FILE_BUFF, $RESULT
cmp FILE_BUFF, 0
je NOT_ALLOC
lm FILE_BUFF, 00, FILENAME
cmp [FILE_BUFF], 73696854, 4 // check file markers
jne CORRUPTED_FILE
mov START_HASH_ADDRESS, FILE_BUFF+58
ask "Enter place where hash save"
mov CRC_ADDRESS, $RESULT
cmp CRC_ADDRESS, 0
je FINISH
bphws CRC_ADDRESS, "x"
bphws esp-4, "r"

GO_EIP:
run
cmp eip, CRC_ADDRESS
jne GO_EIP

wrt PATCHED_HASH_FILENAME, "This file contents Modified HASH VMProtect"
wrta PATCHED_HASH_FILENAME, "------------------------------------------------------------------------"

COMPARE_HASH:
cmp eip, CRC_ADDRESS
jne FINISH
mov MODIFIED_HASH, eax
mov HASH, [START_HASH_ADDRESS], 8 // get original hash
atoi HASH
mov HASH, $RESULT

ADDRESS_POINTER:
inc START_HASH_ADDRESS
cmp [START_HASH_ADDRESS], 72646441, 4
jne ADDRESS_POINTER
add START_HASH_ADDRESS, 9

mov ADDRESS, [START_HASH_ADDRESS], 8 // get address for hash

HASH_POINTER:
inc START_HASH_ADDRESS // new pointer
cmp [START_HASH_ADDRESS], 00000000000000000000, 10 // end file
je COMPARE
cmp [START_HASH_ADDRESS], 3A435243, 4
jne HASH_POINTER
add START_HASH_ADDRESS, 5

// compare old and modified hash
COMPARE:
cmp MODIFIED_HASH, HASH
je CONTINUE_COMPARE

eval "Modified CRC: {MODIFIED_HASH} Original CRC: {HASH} Address: {ADDRESS}"
mov INFO, $RESULT
wrta PATCHED_HASH_FILENAME, INFO
mov eax, HASH

CONTINUE_COMPARE:
cmp eip, CRC_ADDRESS
jne FINISH
run
jmp COMPARE_HASH

FINISH:
bc
bphwc
free FILE_BUFF
mov eip, ORIGINAL_EIP
msg "Script Finished"
ret

// search file Original_CRC.txt
////////////////////////////////////////////////////////////////////////////////
FIND_FILES:
var FindFile
var FILE_NAME_ALLOC
var BUFFER

alloc 1000
mov FILE_NAME_ALLOC, $RESULT
cmp FILE_NAME_ALLOC, 0
je NOT_ALLOC
alloc 1000
mov BUFFER, $RESULT
cmp BUFFER, 0
je NOT_ALLOc
mov [FILE_NAME_ALLOC], FILENAME
gpa "FindFirstFileA", "kernel32.dll"
mov  FindFile, $RESULT
pusha
mov eax, BUFFER
mov ecx, FILE_NAME_ALLOC
mov edi, FindFile
exec
  push eax
  push ecx
  call edi
ende
  mov FILE_EXIST, eax
popa  
free FILE_NAME_ALLOC
free BUFFER
ret
////////////////////////////////////////////////////////////////////////////////

CORRUPTED_FILE:
msg "File corrupted"
free FILE_BUFF
ret

NOT_ALLOC:
msg "Error Alloceted memory"
ret

FILE_NOT_EXIST:
msg "File Original_CRC.txt not found. First run script Read_CRC.osc"
ret