Obsidium protection scheme as a target!

[ahmadmansoor]

No my friend it should work fine .
I test it here ( win 7.0 x64) with this options :
hxxp://s000.tinyupload.com/?file_id=55501563102665112295
maybe ur Antivirus make some trouble .

@ahmadmansoor can you share your "exetools ollydbg"

[cybercoder]

Obsidium is fun to unpack if you have a lot of time.. crypted calls, sometimes direct calls to api's. Took me a long time the first time..

[Carbon]

I don't have much time at the moment, but this is what I found so far:

Breakpoint on CreateFileW is very good.

After some breaks:

0018FD8C     757A3F66  /CALL to CreateFileW from kernel32.757A3F61
0018FD90     00C882F0  |FileName = "\\\\.\\VBoxGuest"
0018FD94     C0000000  |Access = GENERIC_READ|GENERIC_WRITE
0018FD98     00000003  |ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE
0018FD9C     00000000  |pSecurity = NULL
0018FDA0     00000003  |Mode = OPEN_EXISTING
0018FDA4     40000080  |Attributes = NORMAL|OVERLAPPED
0018FDA8     00000000  \hTemplateFile = NULL

Obsidium is checking for Virtual Box VM! If Obsidium is run under VBox, some anti-debug stuff will be disabled. I guess it is a hardware anti-debug check. Maybe something with HWBP.

Yeh, this is a hot trick in general...

here is the vbox check

00383929 83F8 FF CMP EAX,-1
0038392C 74 20 JE 0038394E

don't let it jump and enjoy less anti-debug

[Mr.reCoder]

Hi,
now I used your tricks to set HWBP in IAT and successfully found where IAT writes.
See this viedo! password: exetools.com
time to trace! use shift-f9 to run!
I used win7-32bit and ScyllaHideOlly1 and fresh-unchanged copy of olly.
B.R.

[mm10121991]

on DP Animation Maker
you can restore IAT with my script
just change the line
"je @dx2" to "jne @dx2"
still,you have to do the vm.

@mm10121991 awesome stuff can you tell me something about vm short explain i don know about that what i need to do. i know its lame to you tell me all but i wanna learn obsidium is hard to unpack thx.

[Mr.reCoder]

Hi,
there is no problem with IAT. main problem is VM unvirtualize or decrypttion.
also there is changes in calling some IAT functions with EDI,ESI,EBX,EBP. like:

006DF06A  MOV ESI,0x5D2C2BD9
006DF06F  NOP
006DF070  CALL ESI

but original code is:

006DF06A  MOV ESI,DWORD PTR DS:[0x6F9EB4]
006DF070  CALL ESI

calling with register is a common method in VC++ compilers. I wrote a little script to restore original code. (change code section address, IAT start and end addresses if desired. (target EditorGIF.exe))

VAR CONST
VAR CODE_SECTION
VAR IAT_START
VAR IAT_END

MOV IAT_START,006F9000
MOV IAT_END,006FA2A8
MOV CODE_SECTION,00401000

FINDCMD CODE_SECTION, "MOV R32,CONST;NOP"
MOV LINE,0
DONEXTCALL:
INC LINE
GREF LINE
MOV C_ADDR,$RESULT
CMP C_ADDR,0
JE DONE
MOV CONST,[C_ADDR+1]
FIND IAT_START,CONST
CMP $RESULT,0
JE DONEXTCALL
CMP $RESULT, IAT_END
JG DONEXTCALL
CMP [C_ADDR],0BF,1
JNE NOEDI
EVAL "MOV EDI, DWORD PTR DS:[{$RESULT}]"
ASM C_ADDR,$RESULT
NOEDI:
CMP [C_ADDR],0BB,1
JNE NOEBX
EVAL "MOV EBX, DWORD PTR DS:[{$RESULT}]"
ASM C_ADDR,$RESULT
NOEBX:
CMP [C_ADDR],0BE,1
JNE NOESI
EVAL "MOV ESI, DWORD PTR DS:[{$RESULT}]"
ASM C_ADDR,$RESULT
NOESI:
CMP [C_ADDR],0BD,1
JNE NOEBP
EVAL "MOV EBP, DWORD PTR DS:[{$RESULT}]"
ASM C_ADDR,$RESULT
NOEBP:
JMP DONEXTCALL 
DONE:
RET

[SinaDiR]

Obsidium unpacking:
1.use ObsiduimOEP.asm to find OEP;{Tnx to mm10121991}
2.use Mr.reCoder Script;
3.use attached file;{Mr.reCoder script fixed}
4.use ObsiduimIATFixer.asm;
5.enjoy. file was unpacked but vm not fixed.

[giv]

Here is some advice.
Instead of manual imput of code base VA:

MOV CODE_SECTION,00401000

just use:

gmi eip, CODEBASE
mov CODE_SECTION, $RESULT

Is more safe IMHO.

[cybercoder]

You can also use universal import fixer to find direct calls and fix them.

[the_beginner]

Originally Posted by SinaDiR

Obsidium unpacking:
1.use ObsiduimOEP.asm to find OEP;{Tnx to mm10121991}
2.use Mr.reCoder Script;
3.use attached file;{Mr.reCoder script fixed}
4.use ObsiduimIATFixer.asm;
5.enjoy. file was unpacked but vm not fixed.

can someone upload this script somewhere for me please, I can not download any files since few days, I don't know why, 2 weeks ago there was no problem
Thanks in advance