Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   Dumping images with newer SoftICE versions (https://forum.exetools.com/showthread.php?t=9539)

bone 04-26-2006 06:11

Dumping images with newer SoftICE versions
 
For those non experts out there:

If you've ever run into an image that you can't seem to get past anti-debugger measures in Olly; want the unpacking speed offered by SoftICE, but don't have a compatible version for use with IceDump (aka Driver Studio 3.2), the !suspend/!dump functions of IceExt cause errors, or if you're really lazy like I am, and do not want to patch anti-debugging code; IceExt, !protect on :) ...

Here's a relatively easy technique get a pretty PE to view in IDA using SICE, Process Explorer, PE Tools, and ImpRec.

... Step to your unpacked entrypoint in SICE
... Turn "CODE ON"
... Make note of the first two bytes of the real entrypoint.
... Edit the address in EIP with those two bytes to store them in the command buffer. (EB 401038 55 8B, or whatever the address/bytes are...)
... Assemble "JMP EIP" at EIP. (A EIP, JMP EIP)
... F5 out of SICE
... Use a process management tool like Process Explorer or PsTools to suspend the target.
... CTRL+D back into SICE
... Change contexts back to the target. (addr target_pid)
... Up arrow the command buffer to find the EB command you issued before, and issue it again. (EB 401038 55 8B)
... Make sure everything is proper by viewing the address in the disassembly listing. (U 401038)
... F5 out of SICE and dump/repair imports using Pe Tools and Imprec, or using whatever friendly dumping/repair tools you prefer.


You can always just edit the bytes in your dump after the EBFE step, but for lazy people like me, this is a cleaner faster method not having to calculate rva's to the bytes on disk.

cjack 02-18-2007 03:27

Thank's for your trick bone, very nice ;-)

NeOXOeN 02-18-2007 05:11

this trick has been used for 50 years :P


bye

deroko 02-20-2007 03:23

he only forgot to mention that you should set priority in ProcessExplorer or TaskManager to idle so jmp $ won't kill your CPU :)


All times are GMT +8. The time now is 01:00.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX