Informe Anti-Reversing — LicenseGuard.exe

import idaapi, ida_bytes, idc

# Parchea BeingDebugged checks (mov rax, gs:[60]; movzx eax, [rax+2]; test al,al; jnz)
PEB_CHECKS = [
    0x14001A230,   # check #1
    0x14001A290,   # check #2 (redundante)
    0x14002A100,   # check en módulo .prot post-decrypt
]

NTGLOBAL_CHECKS = [
    0x14001A250,   # NtGlobalFlag & 0x70
    0x14002A120,
]

def patch_jnz_to_jmp_past(addr, offset=2):
    """Convierte JNZ (75 XX) en JMP SHORT ignorando el branch"""
    orig = ida_bytes.get_byte(addr)
    if orig == 0x75:  # JNZ
        ida_bytes.patch_byte(addr, 0xEB)   # JMP SHORT
        print(f"Patched JNZ→JMP at 0x{addr:X}")
    else:
        print(f"[WARN] Expected JNZ at 0x{addr:X}, got 0x{orig:02X}")

for addr in PEB_CHECKS + NTGLOBAL_CHECKS:
    # La instrucción JNZ está 5 bytes después del test al,al
    patch_jnz_to_jmp_past(addr + 5)

print("[+] PEB / NtGlobalFlag checks patched.")

import idc, idautils, ida_bytes, ida_name

XOR_KEY = [0x4C, 0x49, 0x43, 0x4B]   # "LICK"
DATA_SEG = 0x140040000
DATA_END = 0x14004FFFF

def decrypt_xor_string(ea):
    result = []
    i = 0
    while True:
        b = ida_bytes.get_byte(ea + i)
        dec = b ^ (XOR_KEY[i % 4] ^ i)
        if dec == 0: break
        result.append(chr(dec))
        i += 1
        if i > 512: break   # sanity
    return "".join(result)

count = 0
for ea in idautils.Strings():
    if DATA_SEG <= int(ea) <= DATA_END:
        dec = decrypt_xor_string(int(ea))
        if len(dec) > 3:
            ida_name.set_name(int(ea), f"str_{dec[:24].replace(' ','_')}")
            idc.set_cmt(int(ea), f'[DECRYPTED] "{dec}"', 0)
            count += 1

print(f"[+] Decrypted and renamed {count} strings.")

import idc, ida_bytes, idc, idautils

# Direcciones de los JG/JA post-RDTSC encontradas en el análisis estático
TIMING_JUMPS = [
    (0x14002B158, "rdtsc_check_main"),
    (0x14002B1A0, "qpc_check_main"),
    (0x14003A280, "rdtsc_check_prot"),
]

for addr, name in TIMING_JUMPS:
    opcode = ida_bytes.get_byte(addr)
    if opcode in (0x7F, 0x77):   # JG / JA short
        # Convertir en JMP SHORT al siguiente bloque (omite detected branch)
        dest_off = idc.get_operand_value(addr, 0)
        ida_bytes.patch_byte(addr, 0xEB)
        print(f"[+] Patched timing JG→JMP at 0x{addr:X} ({name})")
    else:
        print(f"[WARN] Unexpected opcode 0x{opcode:02X} at 0x{addr:X}")

print("[+] All RDTSC/QPC timing checks neutralized.")