Tạo script c.r.a.c.k hàng loạt file easy

import os
path = "."
os.chdir(path)

def mod(file,namefile):
    data = b''
    with open(file, "rb") as f:
        byte = f.read(1)
        while byte != b"":
            data += byte
            byte = f.read(1)
    mod = data.replace(b'u\x1e',bytes.fromhex('9090'))
    with open(f"{namefile}-p.exe", "wb") as b:
        b.write(mod)

for file in os.listdir():
    if file.endswith(".exe"):
        file_path = f"{path}\{file}"
        nameF = os.path.splitext(file)[0]
        mod(file_path,nameF)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

import os
import zipfile
import struct
import pefile
import io


def rshift(val, n):
    """
    Implements arithmetic right shift on 32 bits
    """
    return (val % 0x100000000) >> n

def process(buf):
    # Load the Pe file
    pe = pefile.PE(data=buf, fast_load=True)

    # RVA of Entry Point
    ep = pe.OPTIONAL_HEADER.AddressOfEntryPoint

    imagebase = pe.OPTIONAL_HEADER.ImageBase

    # $+1F  >|.  A1 00304000       mov eax,dword ptr [403000]
    # $+24  >|.  B9 EDA7A8A1       mov ecx,A1A8A7ED
    eax = pe.get_dword_at_rva(pe.get_dword_at_rva(ep + 0x1f + 1) - imagebase)
    ecx = pe.get_dword_at_rva(ep + 0x24 + 1)

    # $+29  >|.  E8 CFFFFFFF       call <op_sub>
    fn_offs = struct.unpack('<i', pe.get_data(ep + 0x29 + 1, length = 4))[0]

    # function rva = instruction address + length + func offset from imagebase
    fn_rva = 0x29 + 5 + fn_offs 

    # Get the first byte of the function (op_sub)
    func_byte = ord(pe.get_data(rva = ep+fn_rva, length=1))

    # Perform the operation based on the function byte

    # op_xor
    # 31C8            xor eax,ecx
    # C3              ret
    if func_byte == 0x31:
        eax ^= ecx

    # op_add
    # 01C8            add eax,ecx
    # C3              ret
    elif func_byte == 0x1:
        eax += ecx

    # op_sub
    # 29C8            sub eax,ecx
    # C3              ret
    elif func_byte == 0x29:
        eax -= ecx

    else:
        raise 'Error'

    # $+36  >|.  8A0D 07304000     mov cl,byte ptr [403007]
    # $+3C  >|.  D3F8              sar eax,cl
    # $+3E  >|.  25 FF000000       and eax,0FF
    cl = ord(pe.get_data(pe.get_dword_at_rva(ep+0x36+2)-imagebase, 1))

    return chr(rshift(eax, cl) & 0xFF)

if __name__ == '__main__':
    output = io.StringIO()
    path = "256exes"
    os.chdir(path)
    for file in os.listdir():
        if file.endswith(".exe"):
            file_path = f"./{path}/{file}"
            nameF = os.path.splitext(file)[0]
            dir = os.path.join(os.getcwd(), file)
            with open(dir, "rb") as f:
                buf = f.read(fname)
                output.write(process(buf))
    rs = output.getvalue()
    print(rs)
    print('Done!!')
    
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83