ahmadmansoor / advancedscript Goto Github PK

The 3 of 4 youtube videos are unavailable:
https://www.youtube.com/watch?v=hku8Is8-Z34
https://www.youtube.com/watch?v=37gTCNIAIAM
https://www.youtube.com/watch?v=SKustnN7qEY

The video is available:
https://www.youtube.com/watch?v=gQxlbC8RnRg

hi,_ there

Simple script here:

varx int,vA,0
varx str,vE,"C:\abc.txt"
varx array,vB[1],0
movx $A,1234
ReadFile $vE,$vB[0]
ReadFile "C:\abc.txt",$vB

it always returns

not ended with .txt
this Line have error
ReadFile $vE,$vB[0]

any suggestion?

want to unpack the latest VMProtected exe and load OEP ?

Bhai jaan,
Mere paas aik suaal hai,
Do you have any idea about extracting code from Visual C++ PE ?

Here' what Detect-It-Easy say:

PE: library: MFC(-)[static]
PE: compiler: Microsoft Visual C++(2008)[libcmt]
PE: linker: Microsoft Linker(9.0)[EXE32]

Main ne bera serach kia aur abhi tang aagya hoo,
Aap in kamo main maher lagte ho,
Hosakta hai ap juaab de sako.

Here what I get from searching ?

Code Detector == Detect-It-Easy
.NET code extractors == dnspy + ilspy
Dissemblers == PEiD
Visual C++ code extractors ==????????????????????????????????????????

Maafi chahta hoo ulte seedhe suaal kerne ke lie,
Mager shaht zroorat mehsoos hoi hai abhi.
THANKS :)

Please paste any address from text Section, what is this ?

is it above or the other two below xD sorry

hello,Ahmadmansoor！！
I'm very sorry, but my code ability is very poor。how to use Undocumented command?
like StrCompx or logx and so on.
And How to use AdvancedScript set the condition bp of string like OD
bp CreateFileW,[UNICODE[esp+4]]=="C:\test.exe"

1.The grammar is complicated

The original grammar：
mov FixAddr,ref.addr(i)
Plug-in Syntax：
mov eax,ref.addr($i)
setx $FixAddr,{eax}

The original grammar：
mov FunOffset,[FixAddr+2]
Plug-in Syntax：
mov eax,[$FixAddr+2]
setx $FunOffset,{eax}

....

2.Grammar is getting Messier
//setx( Not belonging to C grammar )
setx and movx
//if( There is a big difference between C grammar )
if and cmp

3.By the way, BUG was discovered.

//Always the same value

Ahmad,
This is a cool tool. I am learning it now. I have 2 issues.
current env:
AdvancedScript version 4.3
x64dbg snapshot_2020-01-21_20-41.zip
win10 64bit

1. When saving the script it saves the format info.
   After saving......
   After Saving.txt

{\rtf1\ansi\ansicpg1252\deff0\deflang1033{\fonttbl{\f0\fnil\fcharset0 Microsoft Sans Serif;}}
{\colortbl ;\red0\green128\blue128;\red0\green0\blue0;\red255\green0\blue255;\red255\green69\blue0;\red0\green255\blue0;}
\viewkind4\uc1\pard\cf1\f0\fs29 varx\cf2 \cf3 int\cf2 ,\cf4 x\cf2 ,0\cf0\par
\cf1 varx\cf2 \cf3 str\cf2 ,\cf4 modulebase\cf2 ,oleaut32\cf0\par
\cf1 setx\cf2 \cf4 $x\cf2 ,\cf5 ads.SectionBegin\cf2 ({cip})\cf0\par
\cf1 setx\cf2 \cf4 $x\cf2 ,\cf5 ads.SectionEnd\cf2 ({cip})\cf0\par
\cf1 setx\cf2 \cf4 $x\cf2 ,\cf5 ads.sectionsize\cf2 ({cip})\cf0\par
\cf1 setx\cf2 \cf4 $x\cf2 ,\cf5 ads.exebase\cf0\par
\cf1 setx\cf2 \cf4 $modulebase\cf2 , \cf5 ads.modulebase\cf2 (\cf4 $modulebase\cf2 )\cf0\par
\cf1 setx\cf2 \cf4 $modulebase\cf2 , \cf5 ads.modulebase\cf2 (0000000077727981)\cf0\par
\cf1 varx\cf2 \cf3 str\cf2 ,\cf4 path\cf0\par
\pard\cf1 setx\cf2 \cf4 $path\cf2 ,\cf5 ads.exefolderpath\cf0\fs29\par

Typed script.

Issue 2. When copy and past from another editor. it messes up

Thanks you for take a look.

hi, new question.

ads.exefolderpath get exe folder path

From help file, thought that return value should not contain executable name, but everytime it does not. Such as:

varx str,vFolder
setx $vFolder,ads.exefolderpath
setx $vFolder,ads.exename
==> C:\Windows\notepad.exe