Exetools  

Go Back   Exetools > General > General Discussion

Notices

Closed Thread
 
Thread Tools Display Modes
  #1  
Old 10-04-2017, 03:42
Benten Benten is offline
Friend
 
Join Date: Sep 2017
Location: Oh that's personal stuff, Don't want MI6 at my Mom's face
Posts: 24
Rept. Given: 0
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 12
Thanks Rcvd at 13 Times in 9 Posts
Benten Reputation: 3
Thumbs up [Help] Armadillo 9.66 dumping target with splices - [Now Working]

Hi there,

This is my first post here, forgive me if something is horribly wrong please

OK, here we go, it's an armadillo 9.66 protected target and I have unpacked the previous version of this target, which was last week, but it didn't came with the splices on. So that was rather easy to come by. Now that the splices are on, I find it quite hard to get through and needs a gentle nudge towards the right direction now. Please follow this video so you could see what I have done so far.

As Promised the Videos are here,
Quote:
1. Armadillo Minimal protection + Splices (Full Manual no tools except Scylla)

Notes: Here in first video, you may choose a different section there is an Armadillo section with size 10,000. Choosing .BSS is not good its a mistake, and it makes the dump huge(275MB). But choosing .yvjtgm or .pbscxm (Haven't tried it) makes the dump really smaller (23.6MB)

2. Armadillo Debug Blocker (Full Manual no tools except Scylla)


May be I bite something a bit more than a newbie like me could chew. Please let me know of your valuable comments.

[Update1]
Use the "Armadillo_CodeSplicing.exe" tool in AKT as suggested by Mr. Exodia. It worked wonders..
Mr. SmilingWolf is a kind, cool person and a great guy.. he was the first one to help me with this protection..

[Update2]
I've managed to do it manually cool huh?.

[Issues]
Got some issues guys. Stupid Dump fails on different PC(I mean the VM), now it fails in my PC too after restart. So Suggestions guys. I think its because I put the splice in BSS section, stupid me. but other sections don't have enough space what am I supposed to do then.

>>>While you guys where enjoying your silence I was really struggling with my limited ability from my sickbed, then Mr.Haggar Happened. God<<<

[Update3]
Guys I just Fixed that loading issue on restart right now.

Notes:
It has been a real challenge and a very demanding journey till now. Really learned how much I have to learn. Found some great guys (I mean Mr. Exodia and Mr. SmilingWolf commented on my post how awesome is that). I am sick and tired so now am gonna take some time and make a video(so all links 've got to go down for a while ) to share my attempts. Oh my God, Awesomeee..

Respects,
Ben

Last edited by Benten; 10-22-2017 at 23:02.
  #2  
Old 10-04-2017, 03:54
mr.exodia mr.exodia is offline
Retired Moderator
 
Join Date: Nov 2011
Posts: 784
Rept. Given: 492
Rept. Rcvd 1,122 Times in 305 Posts
Thanks Given: 90
Thanks Rcvd at 711 Times in 333 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
Download Armadillo Key Tool v0.4 (https://github.com/mrexodia/akt/releases/tag/v0.4) and launch Armadillo_CodeSplicing.exe

You can use this to move the code splices to another section (I recommend .pdata, usually the second-last section).
The Following 2 Users Say Thank You to mr.exodia For This Useful Post:
Benten (10-04-2017), TechLord (10-08-2017)
  #3  
Old 10-05-2017, 14:55
cybercoder cybercoder is online now
Friend
 
Join Date: Aug 2005
Posts: 114
Rept. Given: 2
Rept. Rcvd 11 Times in 8 Posts
Thanks Given: 22
Thanks Rcvd at 46 Times in 31 Posts
cybercoder Reputation: 11
Or use arminline
The Following User Says Thank You to cybercoder For This Useful Post:
niculaita (10-06-2017)
  #4  
Old 10-06-2017, 23:45
mr.exodia mr.exodia is offline
Retired Moderator
 
Join Date: Nov 2011
Posts: 784
Rept. Given: 492
Rept. Rcvd 1,122 Times in 305 Posts
Thanks Given: 90
Thanks Rcvd at 711 Times in 333 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
Yeah that is if you want corrupt code +1 (SmilingWolf made a fixed version though).
  #5  
Old 10-08-2017, 06:14
cybercoder cybercoder is online now
Friend
 
Join Date: Aug 2005
Posts: 114
Rept. Given: 2
Rept. Rcvd 11 Times in 8 Posts
Thanks Given: 22
Thanks Rcvd at 46 Times in 31 Posts
cybercoder Reputation: 11
Either way it has source code to play with..
  #6  
Old 10-08-2017, 06:23
mr.exodia mr.exodia is offline
Retired Moderator
 
Join Date: Nov 2011
Posts: 784
Rept. Given: 492
Rept. Rcvd 1,122 Times in 305 Posts
Thanks Given: 90
Thanks Rcvd at 711 Times in 333 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
https://bitbucket.org/mrexodia/splicerebase
The Following User Says Thank You to mr.exodia For This Useful Post:
Benten (10-08-2017)
  #7  
Old 10-08-2017, 08:08
cybercoder cybercoder is online now
Friend
 
Join Date: Aug 2005
Posts: 114
Rept. Given: 2
Rept. Rcvd 11 Times in 8 Posts
Thanks Given: 22
Thanks Rcvd at 46 Times in 31 Posts
cybercoder Reputation: 11
Here's the source for arminline 0.96f..
Attached Files
File Type: rar ArmInline Source (Eng).rar (36.3 KB, 20 views)
The Following User Says Thank You to cybercoder For This Useful Post:
Benten (10-08-2017)
  #8  
Old 10-10-2017, 17:56
Benten Benten is offline
Friend
 
Join Date: Sep 2017
Location: Oh that's personal stuff, Don't want MI6 at my Mom's face
Posts: 24
Rept. Given: 0
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 12
Thanks Rcvd at 13 Times in 9 Posts
Benten Reputation: 3
Thumbs up Target Unpacked

Mr. Exodia is awesome. I am a big fan of yours.

Every word you said is true... Arminline works only in windows 7 and the code gets corrupted. Also it doesn't work in Win 10. (No offense please Mr. Admiral)

Armadillo_CodeSplicing.exe from AKT works fine. Awesomeeee

Now its unpacked.. all good

ExeTools dosen't load properly in my country that's why the comments got delayed.. Now am in vodafone n/w

Last edited by Benten; 10-10-2017 at 19:06.
  #9  
Old 10-11-2017, 18:53
DCA's Avatar
DCA DCA is offline
VIP
 
Join Date: Aug 2005
Posts: 137
Rept. Given: 36
Rept. Rcvd 29 Times in 13 Posts
Thanks Given: 20
Thanks Rcvd at 37 Times in 16 Posts
DCA Reputation: 29
For next time you could always try Armageddon van ARTeam. (just search this forum)
Great tool and easy to use :-)
  #10  
Old 10-12-2017, 00:20
Benten Benten is offline
Friend
 
Join Date: Sep 2017
Location: Oh that's personal stuff, Don't want MI6 at my Mom's face
Posts: 24
Rept. Given: 0
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 12
Thanks Rcvd at 13 Times in 9 Posts
Benten Reputation: 3
Thanks for the suggestion, but Armag3ddon V2.2 fails at this target. And I am doing it for learning so using tools to the minimum is what I preffer. Idea is to do it manually and learn.

Last edited by Benten; 10-12-2017 at 00:44.
The Following User Gave Reputation+1 to Benten For This Useful Post:
DCA (10-13-2017)
Closed Thread

Tags
armadillo, armadillo unpacking, splices

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Dumping Armadillo protected DLL? FEARHQ General Discussion 10 02-09-2005 11:08
Dumping Armadillo 3.0-3.6 without CopyMem II chaboyd General Discussion 17 11-21-2004 06:20
Dumping sfld General Discussion 2 03-20-2004 23:56


All times are GMT +8. The time now is 19:28.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )