[Script] X64重定位表修复---X64DBG脚本分享

//////////////////////////////////////////
var addfile1
var addfile2
var hwndfile1
var hwndfile2
var sizefile1
var sizefile2
var lpCreateFileA
var lpGetFileSize
var lpVirtualAlloc
var lpReadFile
var store
var addreloc
var reloc
var sizereloc
//bc
///////////////////////////////////////
gpa "CreateFileA","kernel32.dll"
mov lpCreateFileA ,$RESULT
gpa "GetFileSize","kernel32.dll"
mov lpGetFileSize ,$RESULT
gpa "VirtualAlloc","kernel32.dll"
mov lpVirtualAlloc ,$RESULT
gpa "ReadFile","kernel32.dll"
mov lpReadFile,$RESULT        
/////////////////////////////////
alloc 1000
mov store,$RESULT
mov rip,store+30
//fill store,90,0x200
/////////////////read file/////////////////////
mov 8:[store],2E32007461642E31
mov 8:[store+8],746164  
mov 8:[store+10],lpCreateFileA
mov 8:[store+18],lpGetFileSize
mov 8:[store+20],lpVirtualAlloc
mov 8:[store+28],lpReadFile
mov 8:[store+30], C03360EC83485340
mov 8:[store+38], 45FFFFFFC10D8D48
mov 8:[store+40], 894803408D44C933 
mov 8:[store+48], 2024448944302444  
mov 8:[store+50], 00000080282444C7 
mov 8:[store+58], AD15FF80000000BA
mov 8:[store+60], 48E88B4890FFFFFF 
mov 8:[store+68], 6C89486674FFF883
mov 8:[store+70], FFCD8B48D2333824
mov 8:[store+78], F06348FFFFFF9B15
mov 8:[store+80], 7489484E74FFFE83
mov 8:[store+88], D68B48C933484024
mov 8:[store+90], B94100001000B841
mov 8:[store+98], FFD68B4800000004
mov 8:[store+a0], D88B48FFFFFF7B15
mov 8:[store+a8], 4489482674C08548
mov 8:[store+b0], D08B48C68B444824
mov 8:[store+b8], 202444C748CD8B48
mov 8:[store+c0], 244C8D4C00000000
mov 8:[store+c8], 85FFFFFF5915FF50
mov 8:[store+d0], 90909090900575C0
mov 8:[store+d8], 9090909090909090
bp store+d8
bp store+d3
run
cmp rip,store+d8
jne exit
mov addfile1,[rsp+48]
mov hwndfile1,[rsp+38]
mov sizefile1,[rsp+50]
fill store+3b,C7,1
mov rip,store+30
run
cmp rip,store+d8
jne exit
mov addfile2,[rsp+48]
mov hwndfile2,[rsp+38]
mov sizefile2,[rsp+50]
cmp sizefile1,sizefile2
jne exit              
mov rsi,addfile1
mov r8,4:[rsi+3c]
mov r8,[rsi+r8+30]
mov rdi,addfile2
mov r9,4:[rdi+3c]
mov r9,[rdi+r9+30]
mov rbx,sizefile1-1008
mov rcx,1000
mov rbp,addfile1
///////////////find reloc///////////////////////
////////////////////////////////////////////
//bc
fill store+30,90,100
mov 8:[store+30],  7EC02B490E048B48 
mov 8:[store+38],  2B490F048B485011 
mov 8:[store+40],  7424043B48067EC1 
mov 8:[store+48],  CB3B48C1FF485839 
mov 8:[store+50],  670D7400FA83DE7E 
mov 8:[store+58],  890000000A55148D 
mov 8:[store+60],  EB00558944EB0455 
mov 8:[store+68],  8D67117400FA833F 
mov 8:[store+70],  55890000000A5514 
mov 8:[store+78],  89D23348EA034804 
mov 8:[store+80],  F00025C18B480045 
mov 8:[store+88],  58DA7500453BFFFF 
mov 8:[store+90],  00000FFF25C18B48 
mov 8:[store+98],  4489480000A0000D 
mov 8:[store+a0],  9090A4EBC2FF0855 
mov 8:[store+a8],  9090909090909090 
bp store+a8
mov rip,store+30
run
pause
pause
mov rax,rsi
not rax
add rax,rbp
inc eax
mov sizereloc,eax
and eax,fffff000
shr eax,c
inc eax
shl eax,c
mov reloc,eax
alloc $reloc
mov rdi,$RESULT
mov addreloc,rdi
mov rcx,sizereloc
fill store+30,90,100
mov rip,store+30
bp store+34
mov 2:[store+30],A4F3
run
savedata "reloc.bin",addreloc,reloc
exit:
pause
ret