PELock Blog

; declare variables
        var     string_ptr
        var     file_name
        var     file_index
        var     file_size
        var     x
 
; set breakpoint at the instruction where we
; intercepts decrypted strings
        bp     401020
 
; initialize file_index variable
        mov     file_index, 0
 
; run application after setting the breakpoint
again:
        run
 
; if we're here, it means application hit the breakpoint
; continue to execute script after breakpoint is hit
; (don't stop in OllyDbg)
        cob
 
; pointer to the encrypted string is stored
; at [ebp-14] let's grab it
        mov     x, ebp
        sub     x, 14
        mov     x, [x]
 
        mov     string_ptr, x
 
; strings are null terminated, let's find its
; size so we can dump it (LEN command didn't work
; here, it always returns 0FFh)
        find    string_ptr, #00#
 
        cmp     $RESULT, 0
        je      skip_file
 
; calculate string size
        mov     x, $RESULT
        sub     x, string_ptr
 
        mov     file_size, x
 
; format file name for decrypted string, name it using
; file_index value and .txt extension, eval works almost
; like wsprintf
        eval    "C:\Test\{file_index}.txt"
        mov     file_name, $RESULT
 
; dump memory area to the file
        dm      string_ptr, file_size, file_name
 
; log action
        eval    "{file_index} - VA = {string_ptr},
                 SIZE = {file_size}"
        log     $RESULT;
 
; increase index value
        inc     file_index
 
skip_file:
 
; run application again after dumping
        jmp     again