Some Infoīs
------------------------
3985 29121B07   CMP DWORD PTR SS:[EBP+const],EAX
0F84            JE popad <-- patch to Jump / prevent ZwTerminateProcess after nopping of Magic Jumpīs


3985????????0F84   // Binary string to search after a loaded section.
-
-
-
-
---------------------------------------------------------------------------------
**** Iat Redirection / most used method / nop and jump / not always possible ****
---------------------------------------------------------------------------------
cmp eax, 10000


0F84            JE 00xxxxxx   1       // Magic Jump / 4 times / nop all four / Break-API in EAX
0F84            JE 00xxxxxx   2
0F84            JE 00xxxxxx   3
0F84            JE 00xxxxxx   4

0F84??0?0000      // Binary string to search after a loaded section.
-
-
-
-
Write a script to get the whole IAT and fix all VM / JMPīs / Callīs too
---------------------------------------------------------------------------------
**** OEP / VM OEP ****
---------------------------------------------------------------------------------
77F6E8E3 ZwFreeVirtualMemory     B8 53000000     MOV EAX,53                      // Win XP
77F6E8E8                         BA 0003FE7F     MOV EDX,7FFE0300
77F6E8ED                         FFD2            CALL EDX
77F6E8EF                         C2 1000         RETN 10 <--         use HWBP

Memory BP on access / codesection

or

77E57CB7 GetProcessHeap          64:A1 18000000  MOV EAX,DWORD PTR FS:[18]      // Win XP
77E57CBD                         8B40 30         MOV EAX,DWORD PTR DS:[EAX+30]
77E57CC0                         8B40 18         MOV EAX,DWORD PTR DS:[EAX+18]
77E57CC3                         C3              RETN  <-----        use HWBP

Memory BP on access / codesection

or

Manualy search / run target and pause in olly / follow down into stack ...etc
---------------------------------------------------------------------------------
**** Full stolen code / Code-Replace ****
---------------------------------------------------------------------------------
Do a compiler compare with the same like your target
Use a other app with the same infoīs
Use DIE (detect it easy) to get the info

Exsample:
Microsoft Visual C++ | C/C++
LinkerInfo:  6.0

Add VM sectionīs if necessary.
Code-Repair can prevent adding of VM sectionīs.
Code-Replace:Use Memory Bp on access on TM / WL section and the codesection / switching to get in and output
Anti-Dump:Mostly used in Delphi coded targetīs.
Fill all wrong dwords / values with 00000000
--------------------------------------------------------------------------------
Today Unpack:

WinLicense_UnPack Me!.exe

Short Exsample for this UnpackMe

POP DWORD PTR DS:[EDX]      // move [esp] to [EDX]      - [esp] is API or VM Address - EDX is API Address
MOV BYTE PTR DS:[EDX],CH    // mov CH one byte to [EDX] - CH to [EDX] // E8 / E9 in CH copy of direct API call
POP DWORD PTR DS:[EDX]      // 
POP DWORD PTR DS:[EAX]      // move [esp] to [EAX]      - [esp] is API or VM Address - EAX is API Address

STOS BYTE PTR ES:[EDI]      // move AL to [EDI]   // AL 90
STOS BYTE PTR ES:[EDI]      // move AL to [EDI]   // AL E8 / E9
STOS DWORD PTR ES:[EDI]     // move DWORD in EAX to [EDI]

So for all other TM / WL appīs there can be a lot of other instructions used to write,check,doublecheck and
rewrite of the IAT and the VM callīs and jumpīs.

-------------------
-------------------

- Find OEP / Near OEP / stolen code
-
- Find IAT / Magic Jump / Use GDI32 - API will not redirect in TM / WL
-
- Get Full IAT / Fix VM API callīs and jumpīs / Use Script
-
- Repair stolen code / find input and output / log results
-
- Delete useless sectionīs to reduce the target size



00404A2A              33C0                    XOR EAX,EAX         ; Near OEP / sub routine

00401E6E              05 9EA03E72             ADD EAX,723EA09E    ; OEP ? stolen

0085889C             /0F84 EA000000           JE 0085898C         ; First Magic Jump

-----------------------
00403F6C    56                      PUSH ESI                                       ; WinLicen.0085C0A7

004046F9    55                      PUSH EBP

004130A8  77E5C938  kernel32.GetCommandLineA

0041D81C  00152368  ASCII ""K:\WL\WinLicense_UnPack Me!.exe""

004045C7    51                      PUSH ECX                                       ; ntdll.77F41254

0041D0F0  029923A0  ASCII "ALLUSERSPROFILE=C:\Dokumente und Einstellungen\All Users"

0040437A    55                      PUSH EBP

004042C1    53                      PUSH EBX                                       ; WinLicen.0085A4AD

0040204E    A1 18D84100             MOV EAX,DWORD PTR DS:[41D818]

0040F63A    6A 0C                   PUSH 0C------------- wrong my fault

004130A4  77E4177A  kernel32.GetStartupInfoA

00404269    833D 0CD84100 00        CMP DWORD PTR DS:[41D80C],0

004131C4  77E59F93  kernel32.GetModuleHandleA

0040AC77    FF7424 10               PUSH DWORD PTR SS:[ESP+10]

004131C8  77E5A5FD  kernel32.GetProcAddress

0040ECA0  - E9 9C354400             JMP 00852241                                   ; WinLicen.00852241


0040ECC5    FF7424 10               PUSH DWORD PTR SS:[ESP+10]

0040207B    6A 00                   PUSH 0