bc
bpmc
bphwcall

GPI MAINBASE                          //获取mainbase（00400000） （.text）
mov DOS_HEADER , $RESULT
mov E_LFANEW   , [DOS_HEADER + 3C]
mov NT_HEADER  , DOS_HEADER  + E_LFANEW
mov SEC_HEADER , NT_HEADER   + F8 

mov SEC_ADRESS , [SEC_HEADER  + C]
add SEC_ADRESS , DOS_HEADER
mov Sec1_Addr  , SEC_ADRESS             //取地址
mov SEC_SIZE   , [SEC_HEADER  + 8]
mov Sec1_Size  , SEC_SIZE               //取大小

add SEC_HEADER , 28
mov SEC_ADRESS , [SEC_HEADER  + C]
add SEC_ADRESS , DOS_HEADER
mov Sec2_Addr  , SEC_ADRESS
mov SEC_SIZE   , [SEC_HEADER  + 8]
mov Sec2_Size  , SEC_SIZE

bprm Sec_Addr  , Sec1_Size              //内存断点
esto                                    
bprm Sec_Addr  , Sec2_Size
esto
bprm Sec1_Addr , Sec1_Size
esto
bpmc
mov OEP        , eip
msg "Reached OEP!"                   //到OEP

AskIATStart:
                                                             //0047D024 IAT表起始
ask "Please Enter Start of IAT, In This DEMO : 0047D024"
cmp $RESULT    , 0
je AskIATStart
mov IAT_START  , $RESULT

AskIATStart:
                                                             //0047D5FC IAT表结束
ask "Please Enter End of IAT, In This DEMO : 0047D5FC"
cmp $RESULT    , 0
je AskIATStart
mov IAT_START  , $RESULT

mov PTR_IAT    , IAT_START
Fix_IAT:
mov ADR_IAT    , [PTA_IAT]
cmp ADR_IAT    , 0             //判断是否为0
je Fix_Next                    
gn  ADR_IAT                    //判断是否需要修复
cmp $RESULT    , 0
jne Fix_Next
mov eip        , ADR_IAT       //把eip地址换为IAT地址
rtr
sti
mov [PTR_IAT]  , eip
Fix_Next
add PTR_IAT    , 4
cmp PTR_IAT    , IAT_END
ja Finish
jmp Fix_IAT

Finish:
mov eip        , OEP
msg "All Fixed"
ret