Gamerz Online

Made tonight, cost me a bottle of coca'cola ^^ i hope u'll enjoy it.
Not really spent a lot of time to clean the code so :/ sorry ?
the plw is in attachment here : dcp.rar

Code:

/*
    IDA plugin for PnkBstr

    Copyright 2010 (ThiSpawn on gamedeception.com) - All Rights Reserved

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program.  If not, see .
*/

#include 

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

#include 

#define MAX_FUNC_SIZE 0xFFFF

char g_func_buf[MAX_FUNC_SIZE + 1];
char g_masks[19];
bool g_fixed = 0;
bool g_errors = 0;

//----------------------------------------------
//  FUNCTION : get_crefs
//  fill vector with cref_to addresses
//----------------------------------------------
bool get_crefs(std::vector& vea, ea_t ea)
{
 xrefblk_t xb;
 func_t *last;

 if (!xb.first_to(ea, XREF_ALL))
 {
  msg("no ref\n");
  return false;
 }
 if (get_func(xb.from)){
  vea.push_back(xb.from);
  last = get_func(xb.from);
 }
 else
 {
  msg("please fix sub at ea : %08X\n", xb.from);
  g_errors = 1;
 }
 while (xb.next_to()) {
  if (get_func(xb.from) && last != get_func(xb.from))
  {
   vea.push_back(xb.from);
   last = get_func(xb.from);
  }
  else if (!get_func(xb.from))
  {
   msg("please fix sub at ea : %08X\n", xb.from);
   g_errors = 1;
  }
 }

 return true;
}

FILE* ask_out_file()
{
    char* filename;
    FILE* file;
    filename = askfile_c(1, "*.txt", "Enter the name of the out file:");
    file = qfopen(filename, "w");
    if ( !file ) {
        warning("Could not open %s for writing!\n", filename);
    } else {
        msg("Using: %s\n", filename);
    }
    return file;
}

char g_decrypted[0x100];

char* decrypt(func_t *func)
{
 func_tail_iterator_t tail_iter(func);
 asize_t size = 0;
 ea_t ea, max_ea;
 char *pcur = g_func_buf;
 bool first_done1 = false;
 bool first_done2 = false;
 uval_t buf_adr;
 uval_t msk_adr;
 char *p_center_mask = &g_masks[10];

 do
 {
  size += tail_iter.chunk().size();
 } while (tail_iter.next());
 
 if (size > MAX_FUNC_SIZE)
 {
  msg("function too long\n");
  return g_decrypted;
 }

 tail_iter.main();
 do
 {
  ea = tail_iter.chunk().startEA;
  max_ea = tail_iter.chunk().endEA;
  while (ea < max_ea)
  {
   decode_insn(ea);
   asize_t cmd_size = cmd.size;
   get_many_bytes(ea, pcur, cmd_size);
   // leave func if other things than string decryption
   if ((cmd.itype != NN_push) &&
    (cmd.itype != NN_pop) &&
    (cmd.itype != NN_leave) &&
    (cmd.itype != NN_retn) &&
    (cmd.itype != NN_mov) &&
    (cmd.itype != NN_xor))
   {
    msg("sub complex at ea : %08X\n", func->startEA);
    return g_decrypted;
   }
   //-------------------------------
   // to replace buf adresses ------
   if ((cmd.itype == NN_mov) && (cmd.Operands[0].type == o_mem))
   {
    uval_t val = cmd.Operands[0].addr;
    //msg("ea:%08X type:%d\n", ea, cmd.Operands[0].type);
    if (!first_done1)
    {
     first_done1 = true;
     buf_adr = val;
     //msg("haaaaaa : %08x\n", buf_adr);
    }
    *(DWORD*)(pcur + cmd.Operands[0].offb) = (DWORD)((uval_t)g_decrypted + val - buf_adr);
   }
   //-----------------------------
   // to replace used values ------
   if ((cmd.itype == NN_mov) && (cmd.Operands[0].type == o_reg) && (cmd.Operands[1].type == o_mem))
   {
    uval_t val = cmd.Operands[1].addr;
    //msg("ea:%08X offb:%d\n", ea, cmd.Operands[1].offb);
    if (!first_done2)
    {
     first_done2 = true;
     msk_adr = val;
     //msg("hoooooo : %08x\n", msk_adr);
    }
    *(DWORD*)(pcur + cmd.Operands[1].offb) = (DWORD)(p_center_mask + val - msk_adr);
    *(char*)(p_center_mask + val - msk_adr) = get_byte(val);
   }
   //----------------------------
   ea += cmd_size;
   pcur += cmd_size;
  }
 } while (tail_iter.next());

 //it's time to execute it
 DWORD pfaddr = (DWORD)g_func_buf ;
 ((char* (__cdecl*)())pfaddr)();
 //msg("%s\n", g_decrypted);
 if (g_fixed)
  add_long_cmt(func->startEA, 0, "%s", g_decrypted);

 return g_decrypted;
}

void decrypt_all() // modify addr of the masks base
{
 std::vector callers;
 std::vector::iterator it;
 ea_t ea;
 
 if (askbuttons_c(NULL,NULL,"format",0,"Have you selected the first byte mask for decryption ?\n If NOT please clic \"no\" then find a decrypt function\n then jump to one of the bytes used as masks.\nFinally select the first one. I coded the plugin to use refs on the five firsts.") < 1)
  return;

 FILE *out_file = ask_out_file();
 if (!out_file)
  return;

 DWORD base = get_screen_ea();

 for (int i = 0; i < 5; i++)
 {
  qfprintf(out_file, "mask %d :\n", i + 1);
  msg("mask %d :\n", i + 1);
  get_crefs(callers, base + i);
  for (it = callers.begin(); it < callers.end(); it++)
  {
   ea = *it;
   func_t *func = get_func(ea);
   qfprintf(out_file, "%08X : %s\n", func->startEA, decrypt(func));
  }
  callers.clear();
 }
}

//----------------------------------------------
//  PLUG-IN FUNCTIONS
//----------------------------------------------

int IDAP_init()
{
 if (inf.filetype != f_PE)
  return PLUGIN_SKIP;

 return PLUGIN_KEEP;
}

void IDAP_term()
{
 // nothing to clear
}

void IDAP_run(int arg)
{ 
 //func_t *func = get_func(get_screen_ea());
 //decrypt(func);
 info("comments will be added to function during analysis if\n you've done a prior analysis WITHOUT ANY MORE fix to do !!!");
 g_errors = 0;
 decrypt_all();
 if (!g_errors)
  g_fixed = 1;
}

char IDAP_comment[] = "PnkBstr hidden string DeCrypter";
char IDAP_help[] = "";
char IDAP_name[] = "PB DeCrypter";
char IDAP_hotkey[] = "Alt-W";

plugin_t PLUGIN =
{
 IDP_INTERFACE_VERSION, 
 0,
 IDAP_init,
 IDAP_term,
 IDAP_run,
 IDAP_comment,
 IDAP_help,
 IDAP_name,
 IDAP_hotkey
};

//----------------------------------------------