Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   How can I break the *.so file that main program call for? (https://forum.exetools.com/showthread.php?t=15333)

bridgeic 10-30-2013 10:13

How can I break the *.so file that main program call for?
 
1 Attachment(s)
I have a ruby script test.rb, encrypted with a software.

After encryption, when run with "ruby.exe test.rb", it will call a *.so file to decrypt the file and then execute the file.

My question is how to break at the *.so file when debug "ruby.exe test.rb" with ollydbg?

Attachement content:
org\test.rb => original ruby script
output\encrypt_test.rb => encrypted ruby script
output\rgloader\rgloader192.mingw.so => ruby.exe will call this file to decript encrypt_test.rb

ruby download: h**p://rubyforge.org/frs/download.php/75127/rubyinstaller-1.9.2-p290.exe

Thanks in advance,
bridgeic

Av0id 10-30-2013 21:06

in this case SO is renamed DLL, just put breaks on export calls or use generic approach with CreateFileExA/W

PS. i guess it's blowfish based and to decrypt it you must have a license file

N0P 10-30-2013 21:07

easy way-> patch _rgloader_load in rgloader192.mingw.so to ebfe(infinite loop) then run script and attach olly :)

bridgeic 10-30-2013 22:54

Quote:

Originally Posted by N0P (Post 87681)
easy way-> patch _rgloader_load in rgloader192.mingw.so to ebfe(infinite loop) then run script and attach olly :)

Dear NOP,

Many many thanks.

I never hear this method before(sorry, forgive my ignorance. :) ),

I search "ollydbg + ebfe" in Google, and finally, I found it, with patch the entrance to "ebfe", I can break at rgloader192.mingw.so now, and can debug it now, thanks again.

bridgeic 10-30-2013 22:56

Quote:

Originally Posted by Av0id (Post 87680)
in this case SO is renamed DLL, just put breaks on export calls or use generic approach with CreateFileExA/W

PS. i guess it's blowfish based and to decrypt it you must have a license file

Yes, really need a license, I use evaluation license on test.

> just put breaks on export calls or use generic approach with CreateFileExA/W

Sorry, I still haven't understood it, I'll do some search/study first, thanks a lot.


All times are GMT +8. The time now is 16:27.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX