See tutor with notepad,Font Fixedsys Regular size 9.
Well,sometimez in the life of a reverser comes a great day.Well this is
one of them.I introcude U the manuall unpacking tutorial for Armadillo
for latest version at that time 4.05.Well here is startz...
Toolz Used: Olly v1.10,commandline Plug,HideOlly Plug,Ollydump Plug,
LordPE and NO IMPREC.
Yes,as U heared.No Import Rebuilding using ImpRec or other toolz.The
way we will do it is manually and extremelly easy and can be done for
ALL packerz at that time.Well,I packed a crackme with a downloaded
version of armadillo.The thing is that it is a demo version,but
all features that I checked as protections in options work just fine.
So,the only difference from the registered version using the options I
choosen (and I will say later who are these options) is just a nug
screen when the protected file starts.
Well if U go in Dillo'z menu Protection->Edit Project U will see the
protection options.I 've chosen those:
All otherz options as they are when U open Dillo for first time.
In the zip U will find a packed and a clean version of the exe.Well open
the packed version of the exe and load it in Olly.Then make sure that U
have placed NO breakpoints of any kind and U have only checked in Debugging
Options the Ignore memory Access Violations in KERNEL32.Well,these options
in Dillo I set give two anti-debugging protections.The first is the usual
call at IsDebuggerPresent API but becasue of the HideOlly plug we don't have
a problem.The second is a call at OutPutDebugString API which prints a string
in a debugger,if he is running.The thing is that Olly v1.10 has a format stack buffer
overflow (bug) and if U give as a string something like %x this will trigger the
overflow and will make Olly crash (check article at cd1K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4y4W2j5%4g2J5K9i4c8W2j5h3#2Q4x3X3g2U0L8$3#2Q4x3V1k6%4K9h3&6V1L8%4N6K6L8Y4c8X3L8$3y4#2M7#2)9J5c8U0g2K9f1o6m8z5x3o6m8p5c8V1g2Q4x3X3g2Z5N6r3#2D9i4K6t1&6
We will defeat this using this trick:In Olly code window,right click and Search for
Name in all modules.Find OutPutDebugString and double click on it and U are at the
memory location where the code of that API starts.Do not place a breakpoint of
any kind there,because Dillo'z enable memory patching protection will find it(and
other optionz maybe).So U should be here at start of OutPutDebugString:
U see that it ends with a RETN 4.So just enter this opcode as the first at 77E949B7
(your addresses may be different due to different version of Windowz) and this is a memory
patch that Dillo won't catch,because it's in OS memory location.Now start pressing Shift+F9
so many times till the prog executes.How many times was it?In me was 31 times.Now restart Olly
and do the anti-debbuging trick all over,start pressing Shift+f9 so many times as before
minus 2.For me this is 29 times.Don't mind if during this a nug screen apprearz,just press
OK.U should be HeRe:
Now,place a memory breakpoint on access at the code section of your program,that U will
see pushing the "M" button in Olly (for me it was located at address 401000 with size of
1000).Now press one more time Shift+F9 and U are at OEP.This should look like this:
Remove the memory breakpoint and dump the file with OllyDump plugin.Try to load in
Olly the dumped file,or to open it with LordPe.Well,it is not regignized as a valid
PE file becasue Dillo has destroyed the PE header as an anti-dumping trick.Well this is
easy to be fixed.When U are at OEP see the PE header pressing the "M" button in Olly.This
is just before the program's code (for me it has start address 400000 and Size 1000).Now
open a second Olly and load the packed file.See also its header.Well,compare with your
eyes the two headers and make the header of the exe that is at OEP the same with the
header that has the packed file(and not in reverse order).Easy to be done since only
some bytes of the header (not much) have chenged.When done,dump again the exe that is
at OEP,and close the session of the second Olly U recently opened.
Now try to open the new dumped file with Olly.It opens just fine.But when running it
crashes.Well,time for some IAT rebuilding.In this case IMPRec will not fix many
thunks in IAT.And this is being done because not only redirects the API calls and]
it erases the IAT (remember the option Enable import elimination I used? ;) but also
splices the code in many parts of memory OUT of the image memory dump of the prog in
memory (remember also the Enable strategic code splicing option I used? ;).This is done
by allocating memory space using Virtualalloc and same kind of API's.So those parts of
the code (that is actually taken from the original code segment) are not in the dumped
file that Ollu Dump Plugin produced.So new the idea is this:
I will dump the part of memory that has been allocated by the protector and contains
the exe's code and I will dump also the part of memory that has been allocated and
containz the ABSOLUTE api addresses of iat (since at the time of the dumping all
ABSOLUTE api addresses the exe uses,either taked from original IAT of the redirected
should be present somewhere in memory).Then I will fill the space between the last
segment of the exe and the Virtual address that those dumped segments
with other segments (not dumped,I will create them with LordPE).Those are useless but
need for filling the memory addresses when the exe is being running.So,at the end I will
have as a dump a BIGGER file than the protected(because of all this space of segments)
but will be an exactly copy of memory,so it will run just fine.But where are those two
segments in ourcase?Well this is the way to find out:
So,we can assume that becasue the Base Address of our exe is at 00400000 this
part of code is the spliced code from Dillo.So the segment that has code
that has been sliced from Dillo is located at 00ACXXXX,and if U see in memory
map pressing the "M" button in Olly,this is the segment that has address
AB0000 and size 4E000.So first in Olly right click on the segment in memory
image (pressing "M" button) and set access->Full access.If U don't do so
then it will not be dumped.Now open lordPE,select the process and dump partial
this segment.Now where is the segment of valid API addresses?Well
we stoped tracing at 00AC8C70,continue tracing using F7 and enter the call at
00AC8C7A.We are HeRe:
Well,these are the valid absolute IAT addresses.So if we trace with F7 once
more we will jamp at api 77C43600.So,this is the same segment we dumped
before.No more dumping.
Open now lordPE.U remember that the dumped section had as started address
the address AB0000?So,create a new segment and make the Virtual size and
the Raw size so big,that now,adding a section from file (choosing the dumped
section before) the Raw Offset and Virtual Offset will be AB0000-ImageBase.For
ImageBase=0040000 Roffset and Voffset are same 6B0000.So,when it will run this
segment will go at AB0000 and the exe will find its spliced code and the
IAT addresses there.The segments in memory when we are at OEP in Olly are:
Memory map
Address Size Owner Section Contains Type Access Initial Mapped as
00010000 00001000 Priv RW RW
00020000 00001000 Priv RW RW
000E4000 00001000 Priv RW Guar RW
000E5000 0004B000 stack of mai Priv RW Guar RW
00130000 00001000 Map R R
00140000 00016000 Priv RW RW
00240000 00006000 Priv RW RW
00250000 00001000 Map RW RW
00260000 00016000 Map R R \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
00280000 00034000 Map R R \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
002C0000 00041000 Map R R \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
00310000 00006000 Map R R \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
00320000 00006000 Map R E R E
003E0000 00002000 Map R E R E
003F0000 00001000 Priv RW RW
00400000 00001000 packed Imag R RWE
00401000 00001000 packed CODE Imag R RWE
00402000 00001000 packed DATA Imag R RWE
00403000 00001000 packed .idata Imag R RWE
00404000 00001000 packed .reloc Imag R RWE
00405000 00040000 packed .text code Imag R RWE
00445000 00010000 packed .adata Imag R RWE
00455000 00010000 packed .data data,imports Imag R RWE
00465000 00010000 packed .reloc1 relocations Imag R RWE
00475000 00030000 packed .pdata Imag R RWE
004A5000 00007000 packed .rsrc resources Imag R RWE
004B0000 00103000 Map R R
005C0000 000D4000 Map R E R E
008C0000 00001000 Priv RW RW
008D0000 0000E000 Priv RW RW
008E0000 00003000 Map R R \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls
008F0000 0000E000 Priv RW RW
00900000 00051000 Map R R
00960000 00001000 Map RW RW
00970000 00010000 Map RW RW
009B0000 00001000 Priv RW RW
00AB0000 0004E000 Priv RW RW
00B00000 0000C000 Priv RW RW
00B10000 00002000 Map R R
00B20000 00018000 Priv RW RW
00B40000 000A4000 Priv RW RW
00BF4000 00001000 Priv RW RW
00C04000 00001000 Priv RW RW
00C20000 00006000 Priv RW RW
00C30000 00003000 Priv RW RW
00C70000 00001000 Map RW RW
00C80000 00001000 Map RW RW
00C90000 00001000 Priv RW RW
00CD1000 00002000 Priv RW RW
00E90000 00011000 Map R R \Device\HarddiskVolume1\WINDOWS\system32\c_1253.nls
00EB0000 00001000 Priv RW RW
00F30000 00001000 Priv RW RW
00F40000 00007000 Map RW RW
00FC0000 00004000 Priv RW RW
00FD0000 00003000 Priv RW RW
0110D000 00003000 Priv RW Guar RW
01300000 00002000 Map R R
01310000 00010000 Priv RW RW
5AD70000 00001000 uxtheme PE header Imag R RWE
5AD71000 0002C000 uxtheme .text code,imports Imag R RWE
5AD9D000 00001000 uxtheme .data data Imag R RWE
5AD9E000 00004000 uxtheme .rsrc resources Imag R RWE
5ADA2000 00002000 uxtheme .reloc relocations Imag R RWE
666F0000 00001000 inetmib1 PE header Imag R RWE
666F1000 00005000 inetmib1 .text code,imports Imag R RWE
666F6000 00003000 inetmib1 .data data Imag R RWE
666F9000 00001000 inetmib1 .rsrc resources Imag R RWE
666FA000 00001000 inetmib1 .reloc relocations Imag R RWE
70A70000 00001000 SHLWAPI PE header Imag R RWE
70A71000 0005B000 SHLWAPI .text code,imports Imag R RWE
70ACC000 00001000 SHLWAPI .data data Imag R RWE
70ACD000 00002000 SHLWAPI .rsrc resources Imag R RWE
70ACF000 00005000 SHLWAPI .reloc relocations Imag R RWE
71950000 00001000 comctl_1 PE header Imag R RWE
71951000 00088000 comctl_1 .text code,imports Imag R RWE
719D9000 00001000 comctl_1 .data data Imag R RWE
719DA000 00054000 comctl_1 .rsrc resources Imag R RWE
71A2E000 00006000 comctl_1 .reloc relocations Imag R RWE
71AA0000 00001000 WS2HELP PE header Imag R RWE
71AA1000 00004000 WS2HELP .text code,imports Imag R RWE
71AA5000 00001000 WS2HELP .data data Imag R RWE
71AA6000 00001000 WS2HELP .rsrc resources Imag R RWE
71AA7000 00001000 WS2HELP .reloc relocations Imag R RWE
71AB0000 00001000 WS2_32 PE header Imag R RWE
71AB1000 00011000 WS2_32 .text code,imports Imag R RWE
71AC2000 00001000 WS2_32 .data data Imag R RWE
71AC3000 00001000 WS2_32 .rsrc resources Imag R RWE
71AC4000 00001000 WS2_32 .reloc relocations Imag R RWE
71AD0000 00001000 WSOCK32 PE header Imag R RWE
71AD1000 00003000 WSOCK32 .text code,imports Imag R RWE
71AD4000 00003000 WSOCK32 .rsrc data,resourc Imag R RWE
71AD7000 00001000 WSOCK32 .reloc relocations Imag R RWE
71BF0000 00001000 SAMLIB PE header Imag R RWE
71BF1000 0000D000 SAMLIB .text code,imports Imag R RWE
71BFE000 00001000 SAMLIB .data data Imag R RWE
71BFF000 00001000 SAMLIB .rsrc resources Imag R RWE
71C00000 00001000 SAMLIB .reloc relocations Imag R RWE
71C20000 00001000 NETAPI32 PE header Imag R RWE
71C21000 00046000 NETAPI32 .text code,imports Imag R RWE
71C67000 00003000 NETAPI32 .data data Imag R RWE
71C6A000 00001000 NETAPI32 .rsrc resources Imag R RWE
71C6B000 00003000 NETAPI32 .reloc relocations Imag R RWE
71F60000 00001000 snmpapi PE header Imag R RWE
71F61000 00004000 snmpapi .text code,imports Imag R RWE
71F65000 00001000 snmpapi .data data Imag R RWE
71F66000 00001000 snmpapi .rsrc resources Imag R RWE
71F67000 00001000 snmpapi .reloc relocations Imag R RWE
73420000 00001000 MSVBVM60 PE header Imag R RWE
73421000 000FD000 MSVBVM60 .text code,imports Imag R RWE
7351E000 0000D000 MSVBVM60 ENGINE code Imag R RWE
7352B000 00007000 MSVBVM60 .data data Imag R RWE
73532000 00031000 MSVBVM60 .rsrc resources Imag R RWE
73563000 00010000 MSVBVM60 .reloc relocations Imag R RWE
74720000 00001000 MSCTF PE header Imag R RWE
74721000 0003A000 MSCTF .text code,imports Imag R RWE
7475B000 00002000 MSCTF .data data Imag R RWE
7475D000 00004000 MSCTF .rsrc resources Imag R RWE
74761000 00003000 MSCTF .reloc relocations Imag R RWE
763B0000 00001000 comdlg32 PE header Imag R RWE
763B1000 0002C000 comdlg32 .text code,imports Imag R RWE
763DD000 00004000 comdlg32 .data data Imag R RWE
763E1000 00011000 comdlg32 .rsrc resources Imag R RWE
763F2000 00003000 comdlg32 .reloc relocations Imag R RWE
76670000 00001000 SETUPAPI PE header Imag R RWE
76671000 00071000 SETUPAPI .text code,imports Imag R RWE
766E2000 00002000 SETUPAPI .data data Imag R RWE
766E4000 0006E000 SETUPAPI .rsrc resources Imag R RWE
76752000 00005000 SETUPAPI .reloc relocations Imag R RWE
76B20000 00001000 ATL PE header Imag R RWE
76B21000 0000A000 ATL .text code Imag R RWE
76B2B000 00003000 ATL .rdata imports,expo Imag R RWE
76B2E000 00002000 ATL .data data Imag R RWE
76B30000 00003000 ATL .rsrc resources Imag R RWE
76B33000 00002000 ATL .reloc relocations Imag R RWE
76D40000 00001000 MPRAPI PE header Imag R RWE
76D41000 00012000 MPRAPI .text code,imports Imag R RWE
76D53000 00001000 MPRAPI .data data Imag R RWE
76D54000 00001000 MPRAPI .rsrc resources Imag R RWE
76D55000 00001000 MPRAPI .reloc relocations Imag R RWE
76D60000 00001000 iphlpapi PE header Imag R RWE
76D61000 00011000 iphlpapi .text code,imports Imag R RWE
76D72000 00001000 iphlpapi .data data Imag R RWE
76D73000 00003000 iphlpapi .rsrc resources Imag R RWE
76D76000 00001000 iphlpapi .reloc relocations Imag R RWE
76E10000 00001000 adsldpc PE header Imag R RWE
76E11000 00021000 adsldpc .text code,imports Imag R RWE
76E32000 00001000 adsldpc .data data Imag R RWE
76E33000 00001000 adsldpc .rsrc resources Imag R RWE
76E34000 00001000 adsldpc .reloc relocations Imag R RWE
76E40000 00001000 ACTIVEDS PE header Imag R RWE
76E41000 00023000 ACTIVEDS .text code,imports Imag R RWE
76E64000 00008000 ACTIVEDS .data data Imag R RWE
76E6C000 00001000 ACTIVEDS .rsrc resources Imag R RWE
76E6D000 00002000 ACTIVEDS .reloc relocations Imag R RWE
76E80000 00001000 rtutils PE header Imag R RWE
76E81000 00009000 rtutils .text code,imports Imag R RWE
76E8A000 00001000 rtutils .data data Imag R RWE
76E8B000 00001000 rtutils .rsrc resources Imag R RWE
76E8C000 00001000 rtutils .reloc relocations Imag R RWE
76F60000 00001000 WLDAP32 PE header Imag R RWE
76F61000 00020000 WLDAP32 .text code,imports Imag R RWE
76F81000 00008000 WLDAP32 .data data Imag R RWE
76F89000 00001000 WLDAP32 .rsrc resources Imag R RWE
76F8A000 00002000 WLDAP32 .reloc relocations Imag R RWE
77120000 00001000 OLEAUT32 PE header Imag R RWE
77121000 00081000 OLEAUT32 .text code,imports Imag R RWE
771A2000 00002000 OLEAUT32 .data Imag R RWE
771A4000 00001000 OLEAUT32 .rsrc resources Imag R RWE
771A5000 00006000 OLEAUT32 .reloc relocations Imag R RWE
771B0000 00001000 OLE32 PE header Imag R RWE
771B1000 000F9000 OLE32 .text code,imports Imag R RWE
772AA000 00006000 OLE32 .orpc code Imag R RWE
772B0000 00007000 OLE32 .data data Imag R RWE
772B7000 00002000 OLE32 .rsrc resources Imag R RWE
772B9000 0000E000 OLE32 .reloc relocations Imag R RWE
77340000 00001000 COMCTL32 PE header Imag R RWE
77341000 00066000 COMCTL32 .text code,imports Imag R RWE
773A7000 00001000 COMCTL32 .data data Imag R RWE
773A8000 0001F000 COMCTL32 .rsrc resources Imag R RWE
773C7000 00004000 COMCTL32 .reloc relocations Imag R RWE
773D0000 00001000 SHELL32 PE header Imag R RWE
773D1000 001E0000 SHELL32 .text code,imports Imag R RWE
775B1000 0001C000 SHELL32 .data data Imag R RWE
775CD000 005E0000 SHELL32 .rsrc resources Imag R RWE
77BAD000 0001A000 SHELL32 .reloc relocations Imag R RWE
77C10000 00001000 msvcrt PE header Imag R RWE
77C11000 00047000 msvcrt .text code,imports Imag R RWE
77C58000 00007000 msvcrt .data data Imag R RWE
77C5F000 00001000 msvcrt .rsrc resources Imag R RWE
77C60000 00003000 msvcrt .reloc relocations Imag R RWE
77D40000 00001000 USER32 PE header Imag R RWE
77D41000 0005B000 USER32 .text code,imports Imag R RWE
77D9C000 00002000 USER32 .data data Imag R RWE
77D9E000 0002B000 USER32 .rsrc resources Imag R RWE
77DC9000 00003000 USER32 .reloc relocations Imag R RWE
77DD0000 00001000 ADVAPI32 PE header Imag R RWE
77DD1000 00067000 ADVAPI32 .text code,imports Imag R RWE
77E38000 00005000 ADVAPI32 .data data Imag R RWE
77E3D000 0001B000 ADVAPI32 .rsrc resources Imag R RWE
77E58000 00005000 ADVAPI32 .reloc relocations Imag R RWE
77E60000 00001000 kernel32 PE header Imag R RWE
77E61000 00076000 kernel32 .text code,imports Imag R RWE
77ED7000 00003000 kernel32 .data data Imag R RWE
77EDA000 00066000 kernel32 .rsrc resources Imag R RWE
77F40000 00006000 kernel32 .reloc relocations Imag R RWE
77F50000 00001000 ntdll PE header Imag R RWE
77F51000 0006E000 ntdll .text code,exports Imag R RWE
77FBF000 00004000 ntdll ECODE code Imag R RWE
77FC3000 00005000 ntdll .data data Imag R RWE
77FC8000 0002C000 ntdll .rsrc resources Imag R RWE
77FF4000 00003000 ntdll .reloc relocations Imag R RWE
78000000 00001000 RPCRT4 PE header Imag R RWE
78001000 00070000 RPCRT4 .text code,imports Imag R RWE
78071000 00006000 RPCRT4 .orpc code Imag R RWE
78077000 00001000 RPCRT4 .data data Imag R RWE
78078000 00001000 RPCRT4 .rsrc resources Imag R RWE
78079000 00005000 RPCRT4 .reloc relocations Imag R RWE
7E090000 00001000 GDI32 PE header Imag R RWE
7E091000 0003C000 GDI32 .text code,imports Imag R RWE
7E0CD000 00001000 GDI32 .data data Imag R RWE
7E0CE000 00001000 GDI32 .rsrc resources Imag R RWE
7E0CF000 00002000 GDI32 .reloc relocations Imag R RWE
7F6F0000 00007000 Map R E R E
7FFB0000 00024000 Map R R
7FFDD000 00001000 Priv RWE RWE
7FFDE000 00001000 data block o Priv RWE RWE
7FFDF000 00001000 Priv RWE RWE
7FFE0000 00001000 Priv R R
U see that after the last section of the exe starting at 004A5000 (.rsrc),there
is allocated memory till address AB0000 where the segment we need is.The memory
dump after creating the two new segments and loading the exe into Olly is:
Memory map
Address Size Owner Section Contains Type Access Initial Mapped as
00010000 00001000 Priv RW RW
00020000 00001000 Priv RW RW
0012D000 00001000 Priv RW Guar RW
0012E000 00002000 stack of mai Priv RW Guar RW
00130000 00001000 Map R R
00140000 00004000 Priv RW RW
00240000 00006000 Priv RW RW
00250000 00001000 Map RW RW
00260000 00016000 Map R R \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
00280000 00034000 Map R R \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
002C0000 00041000 Map R R \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
00310000 00006000 Map R R \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
00320000 00006000 Map R E R E
003E0000 00002000 Map R E R E
003F0000 00001000 Priv RW RW
00400000 00001000 unpacked PE header Imag R RWE
00401000 00001000 unpacked CODE Imag R RWE
00402000 00001000 unpacked DATA Imag R RWE
00403000 00001000 unpacked .idata Imag R RWE
00404000 00001000 unpacked .reloc Imag R RWE
00405000 00040000 unpacked .text code Imag R RWE
00445000 00010000 unpacked .adata Imag R RWE
00455000 00010000 unpacked .data data,imports Imag R RWE
00465000 00010000 unpacked .reloc1 relocations Imag R RWE
00475000 00030000 unpacked .pdata Imag R RWE
004A5000 00007000 unpacked .rsrc resources Imag R RWE
004AC000 00604000 unpacked .NewSec Imag R RWE
00AB0000 0004E000 unpacked dumped1. Imag R RWE
00B00000 00103000 Map R R
00C10000 000D4000 Map R E R E
00F10000 00001000 Priv RW RW
77D40000 00001000 USER32 PE header Imag R RWE
77D41000 0005B000 USER32 .text code,imports Imag R RWE
77D9C000 00002000 USER32 .data data Imag R RWE
77D9E000 0002B000 USER32 .rsrc resources Imag R RWE
77DC9000 00003000 USER32 .reloc relocations Imag R RWE
77DD0000 00001000 ADVAPI32 PE header Imag R RWE
77DD1000 00067000 ADVAPI32 .text code,imports Imag R RWE
77E38000 00005000 ADVAPI32 .data data Imag R RWE
77E3D000 0001B000 ADVAPI32 .rsrc resources Imag R RWE
77E58000 00005000 ADVAPI32 .reloc relocations Imag R RWE
77E60000 00001000 kernel32 PE header Imag R RWE
77E61000 00076000 kernel32 .text code,imports Imag R RWE
77ED7000 00003000 kernel32 .data data Imag R RWE
77EDA000 00066000 kernel32 .rsrc resources Imag R RWE
77F40000 00006000 kernel32 .reloc relocations Imag R RWE
77F50000 00001000 ntdll PE header Imag R RWE
77F51000 0006E000 ntdll .text code,exports Imag R RWE
77FBF000 00004000 ntdll ECODE code Imag R RWE
77FC3000 00005000 ntdll .data data Imag R RWE
77FC8000 0002C000 ntdll .rsrc resources Imag R RWE
77FF4000 00003000 ntdll .reloc relocations Imag R RWE
78000000 00001000 RPCRT4 PE header Imag R RWE
78001000 00070000 RPCRT4 .text code,imports Imag R RWE
78071000 00006000 RPCRT4 .orpc code Imag R RWE
78077000 00001000 RPCRT4 .data data Imag R RWE
78078000 00001000 RPCRT4 .rsrc resources Imag R RWE
78079000 00005000 RPCRT4 .reloc relocations Imag R RWE
7E090000 00001000 GDI32 PE header Imag R RWE
7E091000 0003C000 GDI32 .text code,imports Imag R RWE
7E0CD000 00001000 GDI32 .data data Imag R RWE
7E0CE000 00001000 GDI32 .rsrc resources Imag R RWE
7E0CF000 00002000 GDI32 .reloc relocations Imag R RWE
7F6F0000 00007000 Map R E R E
7FFB0000 00024000 Map R R
7FFDE000 00001000 data block o Priv RWE RWE
7FFDF000 00001000 Priv RWE RWE
7FFE0000 00001000 Priv R R
So we forced the loader to allocate so much space in memory and with those
memory locations as start (and proper sizes) by creating a useless actually
for running segment (.NewSec),but after that is the so much useful segment
that containz the absolute API calls and the spliced code of the exe (dumped1.).
Now try to run it.It still does not run.Why?Becuase Dillo added a last protection.
If U see the dll's that are loaded ("M" button) when U are at OEP in Olly are more that the dll's
loaded when U load the clear dumped file.So,we have to inject some code to the exe,use
LoadLibraryA to load any missing dll's and then Jamp at OEP.In my case the only dll
that has to be loaded is msvcrt.dll.So here is the code I patched,before jamping at OEP:
Well the final exe is 10 MB's because of the segment .NewSec we added,in order
the addresses to be good.When zipped,the size becomes almost equal with the packed
file,because the segment .NewSec we added is not actually a "working" segment but
uses only for the proper addressing allocation.So it is filled with 00's by LordPE
and zip compresses it in a large amount (up to 97%).We could have used also
VirtuallAlloc and not have put the .NewSec segment,and just copy the dumped1. segment
at AB0000.I tried it but I couldn't use VirtuallAlloc to allocate for a specific memory
location as start (here AB0000).But U can try it.
Now the exe runz perfectly.Have in mind that by that way the exe may not run
in other version of Windows that the system U unpacked it at,because the new IAT
containz the ABSOLUTE addresses of the API's that exe uses in that particular system.
But who carez?We have unpacked it,nice and clean...
This is the End.I think this is the Best Tutor I ever WroTe ;) U may also think this ;)
