Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 04-06-2007, 10:03
Maltese
 
Posts: n/a
CRC problem... Alien Registry Viewer

I'm having a hard time getting past a CRC check. I have attached a txt file with notes that should help narrow it down quicker.

The program is called Alien Registry Viewer and is available here:

Code:
hxxp://www.lastbit.com/getprg.asp?id=arv
I feel I'm very close...but something hasn't hit me yet.
Attached Files
File Type: txt Alien.txt (2.6 KB, 13 views)
Reply With Quote
  #2  
Old 04-07-2007, 11:59
Maltese
 
Posts: n/a
I believe I have narrowed it even closer.

During the check, it loads a resource "VR" , 97h or 151 dec. (ResourceHack)

Here you see a bunch of encrypted hex data. This is what I believe it is comparing it to.

This is the routine that loads the resource data and is what looks like the first time data changes between original exe and modded exe.

Snippet:
41D250 MOV EAX,DWORD PTR SS:[ESP+4] ; start of find resource
41D254 MOV ECX,DWORD PTR SS:[ESP+8]
41D258 PUSH ESI
41D259 PUSH EDI
41D25A MOV EDI,DWORD PTR SS:[ESP+18] ; VR, 97
41D25E PUSH EAX ; /ResourceType
41D25F PUSH ECX ; |ResourceName
41D260 PUSH EDI ; |hModule
41D261 CALL DWORD PTR DS:[<&KERNEL32.FindResour>; \FindResourceA
41D267 MOV ESI,EAX
41D269 TEST ESI,ESI
41D26B JE SHORT Alien_Re.0041D297
41D26D PUSH EBX
41D26E MOV EBX,DWORD PTR SS:[ESP+18]
41D272 TEST EBX,EBX
41D274 JE SHORT Alien_Re.0041D280
41D276 PUSH ESI ; /hResource
41D277 PUSH EDI ; |hModule
41D278 CALL DWORD PTR DS:[<&KERNEL32.SizeofReso>; \SizeofResource
41D27E MOV DWORD PTR DS:[EBX],EAX
41D280 PUSH ESI ; /hResource
41D281 PUSH EDI ; |hModule
41D282 CALL DWORD PTR DS:[<&KERNEL32.LoadResour>; \LoadResource
41D288 TEST EAX,EAX
41D28A POP EBX
41D28B JE SHORT Alien_Re.0041D297
41D28D PUSH EAX ; /nHandles
41D28E CALL DWORD PTR DS:[<&KERNEL32.LockResour>; \SetHandleCount
41D294 POP EDI
41D295 POP ESI
41D296 RETN
41D297 POP EDI
41D298 XOR EAX,EAX
41D29A POP ESI
41D29B RETN

I've attached the code from the resource below as an attachement.

Here is THE code that does all the calling:
41449A PUSH Alien_Re.004030D0 ; ASCII "VR"
41449F CALL Alien_Re.00415A60
4144A4 ADD ESP,0C
4144A7 TEST EAX,EAX
4144A9 JE SHORT Alien_Re.00414525 ; good: no jump
4144AB PUSH EDI
4144AC MOV EDI,Alien_Re.00402FF8
4144B1 OR ECX,FFFFFFFF
4144B4 XOR EAX,EAX
4144B6 REPNE SCAS BYTE PTR ES:[EDI] ; EDI = 403014 (MODDED) 403000 (CLEAN)
4144B8 LEA EAX,DWORD PTR SS:[EBP-134] ; EAX = 13FB54
4144BE NOT ECX ; this routine moves most into stack
4144C0 PUSH EAX ; /Arg3
4144C1 PUSH ECX ; |ecx = 8 with clean exe, 1C with modded exe
4144C2 PUSH Alien_Re.00402FF8 ; |Arg1 = 00402FF8
4144C7 CALL Alien_Re.00420050 ; \Alien_Re.00420050
4144CC ADD ESP,0C
4144CF MOV ECX,DWORD PTR SS:[EBP-14] ; ECX == 1A800
4144D2 MOV EDX,DWORD PTR SS:[EBP-10] ; EDX == 43A500
4144D5 PUSH ECX
4144D6 PUSH EDX
4144D7 MOV ECX,Alien_Re.00426858
4144DC MOV BYTE PTR SS:[EBP-4],1
4144E0 CALL Alien_Re.0040D660
4144E5 MOV EAX,DWORD PTR DS:[426860] ; EAX == 1A800
4144EA MOV ECX,DWORD PTR DS:[426864] ; ECX == D4FFC0
4144F0 LEA EDX,DWORD PTR SS:[EBP-134]
4144F6 PUSH EDX ; /Arg3
4144F7 PUSH EAX ; |Arg2 => 00000000
4144F8 PUSH ECX ; |Arg1 => 00000000
4144F9 CALL Alien_Re.0042009D ; \Alien_Re.0042009D
4144FE MOV EAX,DWORD PTR DS:[426864] ; EAX == ptr ASCII "MZP" with clean, nothing with modded
414503 ADD ESP,0C
414506 PUSH EAX ; /Arg1 => 00000000
414507 CALL Alien_Re.0041E290 ; \Alien_Re.0041E290
41450C MOV DWORD PTR DS:[426884],EAX ; ^--- calls virtual Alloc = crash

It appears that it's not just a CRC check... it appears that ultimately the crash is due to an unknown address. There are 2 instances where Sicilia and MZP are listed with the clean version, but with the modded one, neither show up.

And again for reference, here is where the exception is thrown - ala crash.

41E299 MOV EAX,DWORD PTR SS:[EBP+8]
41E29C MOV ESI,DWORD PTR DS:[EAX+3C]
41E29F ADD ESI,EAX
41E2A1 PUSH 4 ; /Protect = PAGE_READWRITE
41E2A3 PUSH 1000 ; |AllocationType = MEM_COMMIT
41E2A8 MOV EAX,DWORD PTR DS:[ESI+50] ; crash is here, ptr = ???
41E2AB PUSH EAX ; |Size
41E2AC PUSH 0 ; |Address = NULL
41E2AE CALL <JMP.&KERNEL32.VirtualAlloc> ; \VirtualAlloc

*Removed attachment... see last post

Last edited by Maltese; 04-11-2007 at 02:47. Reason: more data
Reply With Quote
  #3  
Old 04-09-2007, 03:51
taos's Avatar
taos taos is offline
The Art Of Silence
 
Join Date: Aug 2004
Location: In front of my screen
Posts: 573
Rept. Given: 65
Rept. Rcvd 44 Times in 18 Posts
Thanks Given: 61
Thanks Rcvd at 78 Times in 33 Posts
taos Reputation: 44
As you said in your alien.txt, you can patch in memory but not in disk, so try a loader. Diabloo has one of the best...
__________________
omnino lo qui quae que quod somos es pulvis en el ventus.
TAOS

-The opposite of courage in our society is not cowardice, but conformity-
Reply With Quote
  #4  
Old 04-11-2007, 02:48
Maltese
 
Posts: n/a
Thanks taos,

I suspected as much. I was hoping to not have to use a loader... but it sure is a lot easier.

Here's the loader... in case anyone is interested.
Attached Files
File Type: rar alien.registry.viewer.loader.v1.0.build.186-loader.rar (14.0 KB, 6 views)

Last edited by Maltese; 04-11-2007 at 09:59.
Reply With Quote
  #5  
Old 04-12-2007, 13:52
alephz alephz is offline
VIP
 
Join Date: May 2002
Location: Israel
Posts: 390
Rept. Given: 127
Rept. Rcvd 291 Times in 93 Posts
Thanks Given: 180
Thanks Rcvd at 69 Times in 23 Posts
alephz Reputation: 200-299 alephz Reputation: 200-299 alephz Reputation: 200-299
Quote:
Originally Posted by Maltese
I'm having a hard time getting past a CRC check.
As always, lastbit use some kind of MD5 protection.
From CC report:
2 0001E9D8 .0041F5D8 67452301 MD4, MD5, SHA-160, RIPEMD-128, RIPEMD-160 (Init)
3 0001E9DF .0041F5DF EFCDAB89 MD4, MD5, SHA-160, RIPEMD-128, RIPEMD-160 (Init)
4 0001E9E6 .0041F5E6 98BADCFE MD4, MD5, SHA-160, RIPEMD-128, RIPEMD-160 (Init)
5 0001E9ED .0041F5ED 10325476 MD4, MD5, SHA-160, RIPEMD-128, RIPEMD-160 (Init)
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Registry Problem The Boss General Discussion 16 07-07-2005 09:13


All times are GMT +8. The time now is 12:43.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2020 )