Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 06-23-2005, 18:31
lordnasty lordnasty is offline
Friend
 
Join Date: Sep 2004
Posts: 31
Rept. Given: 5
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 18
Thanks Rcvd at 1 Time in 1 Post
lordnasty Reputation: 0
Problem unpacking a Morphined .exe

Hi to all,
i have some problem to unpack an exe file that PEid tell me that is packed with:

Morphine 1.4 - 2.7 -> Holy_Father & Ratter/29A

So i follow the GOOD tutorial made by KaGra.
So after i find the "magic" jump "JMP EAX" to the OEP, i stop and dump using Ollydump putting the new OEP and uncheck "Rebuild Import".
After i use the PE Editor of LordPe and look to Sections.
I have 4 sections the bit .text section and 3 sections (with size 1000 each).
Automatically Ollydump put me the total size of the sections so i delete the 3 sections and utomatically i have the size - 3000 big (the 3 sections * 1000).
After i check the size of the .text section and VirtualSize = Rawsize = and is .text section size - 1000 (the PE header size).
I save all but the app not start (error: ReadProcessMemory or WriteProcessMemory partially complete).

Please can help to understand what i mistake?
Ah .. the ImageBase is a strange 19F0000 (not the usually 01000000 or 00400000).
THX
NaSTy
Reply With Quote
  #2  
Old 06-24-2005, 13:54
nskSem
 
Posts: n/a
Try to see that, here is sources and executeble of Morphine 2.7:
wasm.ru/baixado.php?mode=tool&id=188
Reply With Quote
  #3  
Old 06-24-2005, 17:58
lordnasty lordnasty is offline
Friend
 
Join Date: Sep 2004
Posts: 31
Rept. Given: 5
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 18
Thanks Rcvd at 1 Time in 1 Post
lordnasty Reputation: 0
Thanks,
the problem is that i want to understand how to fix the original Image Base and the size .
Also why the Morphine can encrypt one file several times.
Please tell me advices about.
Thanks

NaSTy
Reply With Quote
  #4  
Old 06-27-2005, 02:28
vodu
 
Posts: n/a
Quote:
Originally Posted by lordnasty
Thanks,
the problem is that i want to understand how to fix the original Image Base and the size .
NaSTy
Morphine packs all data file inside ".text" section. Try to find this file data inside ".text" section after passing second decrypting loop and find original PE header, then create your custom PE header according to its.

Quote:
Originally Posted by lordnasty
Thanks,
Also why the Morphine can encrypt one file several times.
NaSTy
It use polymorphism encryption that cause to face every time different ways.
Reply With Quote
  #5  
Old 06-27-2005, 07:24
lordnasty lordnasty is offline
Friend
 
Join Date: Sep 2004
Posts: 31
Rept. Given: 5
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 18
Thanks Rcvd at 1 Time in 1 Post
lordnasty Reputation: 0
Yes Vodu,
i just resolved in way that you have explained.

To find this "original" value, i track the sections table information in Olly using the VirtualAlloc/return bp.
Then with the original values i have fixed the right RawOffset/Rawsize VirtualOffset/VirtualSize.

Thanks a lot for your advice too.

NaSTy
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Armadillo 8.6 unpacking problem eAGLe_eYe General Discussion 8 03-11-2013 22:43
Unpacking problem Pompeyfan General Discussion 16 01-11-2004 19:40
Manual Unpacking problem Nilrem General Discussion 15 01-10-2004 17:41


All times are GMT +8. The time now is 09:35.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )