Armadillo 2.85 Custom + CopyMem & Nanomites

[TmC]

Hi...thanks to all for suggestions. I tried the tutorial and the attaching, but no luck.

Here is what i did:

No need to bp on debugger present, olly is not detected anyway.
Bp on WaitForDebugEvent, and click follow in dump (pDebugEvent 0012EFF8)
Bc on WaitForDebugEvent
Bp on WriteProcessMemory: no break.

The programs do not break on WriteProcessMemory. Looking in the processlist i can already see 2 processes on break on WaitForDebugEvent.

So i Bp on WriteProcessMemory first: it breaks two times, but in the dump window i cannot see three equal values(like tutorial says) so, cannot find oep.

Do someone of you know what i'm doing wrong?

As for the attaching of the decrypted son to see the version, i can't attach anything, olly says 'Cannot attach to proces xxxxx'.

[gabri3l]

you cannot attach to the process because it is being debugged. You need to stop the debugger(father thread) first. Check out hxxp://www.absolutelock.de/construction/files/infobase/New/arma_debugblocker/tutorial.html
for information on how to detach the child process. This will allow you to attach to the child process to search for version number and remove debug protection.


Or you can use the OpenMutexA trick to stop it from creating a new thread. When your program is loaded in Olly. Search-> All intermodular calls. DoubleClick on the first OpenMutexA and you will be taken to that call in the program. You will see a call to OpenMutexA, then an test underneath it, then a jump. Reverse the jump in Olly. EX: JNE->JE. Then go back to the intermodular calls and doubleclick on the second openmutexA. Again, reverse the jump after the test. Now set a breakpoint on the jump you changed.


Press RUN. When you get to your breakpoint type "BC CreateThread" in the commandbar. Press F9 again. And continue from mephisto's tutorial just after you fix the debugger check in the child process and hit your first BP on CreateThread. This is helpful because now arma does not create a second thread so there is no attaching to be done and it will work on OS's other than XP.

[TmC]

After Hours spent in debugging and tracing i paste here what did I do. It's my first attempt to dump any kind of packed program so i'm a bit proud of it.
+ Load executable(vbowatch.exe) in OllyDbg.
+ Bp WriteProcessMemory 2 times until find buffer(vbowatch.00426a94).
+ Found Buffer and follow in dump.
+ Change 2 bytes (558B, EBFE) to put child in loop.
+ CTRL+F9 and Bp WaitForDebugEvent.
+ Break on WaitForDebugEvent and Step until RETN
+ Trace into RETN (to TEST EAX,EAX)
+ Assemble PUSH PID, CALL DebugActiveProcessStop
+ Fire up new Olly and Attach to process
+ Run with F9 and Pause with F12
+ Replaced previously modified bytes with original
+ Bp CreateThread and Run
+ Appears Armadillo Nag, Click OK and Break on CreateThread
+ CTRL+F9 one time and trace into RETN 18
+ Found CALL EDI and Breakpoint on it.
+ Trace into CALL EDI and found OEP(402a6d-ImageBase=2a6d)
NOW I RAN LORDPE AND THE TWO PROCESSES WERE NOT IN LORDPE'S LIST. RAN PROCDUMP AND WHEN TRIED TO DUMP THE PROCESS IT CRASHED. SO I DUMPED WITH OLLYDUMP WITHOUT IMPORT REBUILDING.
+ Fired up ImpRec and typed OEP
+ Clicked on Get Imports(2 invalid thunks)
+ On invalid imports, selected, right mouse and 'trace level 1(Disasm)'
+ All imports are ok now. Tried to Fix Dump: Imprec gives error.
+ Back to LordPE selected RebuildPE.
+ Back to ImpRec. It says DUMP SUCCESFULLY FIXED.
+ I run the executable:
ON LOAD, ENCRYPT AND EXIT THE PROGRAM CRASHES
----------------------------------------------------
Do someone has an idea why?
Attached is the file. I did not try the other target...will try tomorrow.

TEN MINUTES LATES: I HAD TO BE TIRED....Load the program again into olly and tried to click on exit.

Guess? CC INT3 (Nanomites)
Now i know why it crashes, even though nanomites throw access violations...shouldn't crash the program in that way.
Tomorrow i will give a look at them.

Hi, it crashes not because of CC but there seem to be a problem with the Stack. After some tracing, it crashes at 00402E1D because it trying to return to 00000000.
For some reason at this address, there are some leftover bytes or maybe from unneeded Push 0.
0012FFC0 00 00 00 00 ....

00402E14   E8 9F000000      CALL <JMP.&user32.EndDialog>
00402E19   61               POPAD
00402E1A   33C0             XOR EAX,EAX
00402E1C   C9               LEAVE
00402E1D   C2 1000          RETN 10

[TmC]

You mean on exit or in all crashes?
Do you have any hints to solve? Nopping PUSH 0 does not change situation.

[TmC]

I'm trying to handle nanomites but i came accross a question: When must I handle nanomites? Before or after handling CopyMem2?
After it sounds silly, but before does not allow me to handle copymem.

I should save...but how can i save the changes i made and reload the executable from the beginning?

I have not seen any nanomites in the target. You fix nanomites last.

Here is where the problem happens. Try this:
1. Load target in Olly
2. In Commandbar type BP MessageBoxA
3. Press F9 so it runs
4. Go to the target and press Exit
5. It will break in Olly at 77D8050B > 8BFF MOV EDI,EDI
6. Press CTRL-F9
7. You will hear a beep. Go back to Target and press OK
8. Olly will pause at 77D80551 C2 1000 RETN 10
9. Press F8 and Olly returns here 00402E0A 83F8 01 CMP EAX,1
10. Scroll down 8 lines and place a breakpoint at 00402E1D C2 1000 RETN 10
11. Press F9 8 times and it should break at 00402E1D.
This is where it will crash because the return will take it to invalid 00000000 address. This makes be believe, there is a problem with stack.

If I manually Popped the 8 zeros of the Stack, it exit without errors.

Originally Posted by TmC

I'm trying to handle nanomites but i came accross a question: When must I handle nanomites? Before or after handling CopyMem2?
After it sounds silly, but before does not allow me to handle copymem.
I should save...but how can i save the changes i made and reload the executable from the beginning?