Dillo protected DLL

[5Alive]

I read that DLL Stripper 1.6 works on Armadillo up to 3.6, then Lunar stopped writing for its as far as I know. Anyone know if it can be used with success on dumped but not fixing the IAT?

I also tried the Olly scripts:
MEPHiST0s - ARMADiLLO DETECTiVE v1.00 for olly script
Armadillo Standard+Strategic Code Splicing Script by AvAtAr

Neither of which appear to find the OEP. What I was hoping to do was make a working dump after running either script, then study the script to see how to do it by hand then hopefully write a tut for other noobs.

Hmm, okay I found the call EDI part of the code which should reveal the OEP.
Olly reports that I am trying to place a BP outside the code section.

What am I doing wrong please?


5aLIVE

ollydbg warns bp not on code section

ollydbg puts out that warning based on its analysis
ollydbg during analysis has marked that page as data not code
so data are not supposed to be executed in normal course of things
so ollydbg warns when you are trying to set a break point
which it assumes to be data

you can ignore that warning if you are sure it is code and sure it would be executed click yes and set break point there

now if it was not code and was data
like "helloWorld" and you wrongly set up a break point a messagebox
using that data can look like
hell#world 0 replaced by 0xcc and shown as it is

or may be you have push 401057 and you set a bp on the byte 57

now if this was used as code some where else
mov r32,this bytes
mov thatplace,r32

it would become push 4010cc (coz 57 was replaced by your break point 0xcc
and it was copied verbatim and it will bring disastourous results
like ollydbg warns

hope you understand what i say