Exetools  

Go Back   Exetools > General > General Discussion

Notices

Closed Thread
 
Thread Tools Display Modes
  #31  
Old 11-03-2017, 03:55
mr.exodia mr.exodia is offline
Retired Moderator
 
Join Date: Nov 2011
Posts: 784
Rept. Given: 490
Rept. Rcvd 1,122 Times in 305 Posts
Thanks Given: 89
Thanks Rcvd at 714 Times in 333 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
I changed "push 100" to "push 0", put a breakpoint on the first occurrence of EB03, run, revert the patch to not trigger crc checks and you get a 'clean' IAT. You still have to move the IAT with a tool like UIF though...

The push 100 is a call that decrypts a buffer I believe, but I didn't look at it for a long time.
The Following User Says Thank You to mr.exodia For This Useful Post:
Benten (11-04-2017)
  #32  
Old 11-04-2017, 06:24
Benten Benten is offline
Friend
 
Join Date: Sep 2017
Location: Oh that's personal stuff, Don't want MI6 at my Mom's face
Posts: 24
Rept. Given: 0
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 12
Thanks Rcvd at 13 Times in 9 Posts
Benten Reputation: 3
Hey guys,

We had hell of a party yesterday.

OK back to business, I believe the reason scylla won't find useful imports is because there is a memory bridge and the IT needs to be rebuild manually.

Code:
At the OEP there are no more splices jmp, and the seemingly innocent API Calls, 
like the one below:

At the OEP

Now if we follow the first call to GetModuleHandleA, we land at the bridge:

The Infamous Bridge

Now if you follow the first long Jmp we land here:

The thing I believe is an Emulation.
That's where I am right now. We have this thing discussed in the AndreaGeddon PDF, which I uploaded a while ago.

Code:
We get a description on how to defeat this and a program too, 
but the call's we saw are a new thing I guess,

AndreaGeddon IAT Rebuilding
May be this is where I should stop (A newbie's definitely not gonna make it), but I am definitely gonna try.
Also I am trying to replace the ECDSA parameters to register this app and then dump it. Like Mr.Exodia told me to do, but that takes a lot of learning as well.

Ok guys our FAQ lnk's down, if admin guys see this please fix it; Also can we have a shout box too, it's really cool to have one. And a signature too, I mean I have to edit and add that respect line every time I post

Last edited by Benten; 11-04-2017 at 06:44. Reason: Respects to Mr. Exodia & Mr. SmilingWolf
  #33  
Old 11-04-2017, 21:23
mr.exodia mr.exodia is offline
Retired Moderator
 
Join Date: Nov 2011
Posts: 784
Rept. Given: 490
Rept. Rcvd 1,122 Times in 305 Posts
Thanks Given: 89
Thanks Rcvd at 714 Times in 333 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
Replacing the ECDSA parameters doesn't require you to know anything. AKT has a plugin that comes with the latest version, just drag your exe in the inline tab and let it do the work for you.

As for that 'bridge' it doesn't affect anything for me (seems to be a thing they did themselves, it's not an arma feature afaik). I used UIF to rebuild the imports and just checked the box for direct addresses and that did it.
The Following 3 Users Say Thank You to mr.exodia For This Useful Post:
abhi93696 (11-05-2017), Benten (11-05-2017), niculaita (11-04-2017)
  #34  
Old 11-05-2017, 00:22
Benten Benten is offline
Friend
 
Join Date: Sep 2017
Location: Oh that's personal stuff, Don't want MI6 at my Mom's face
Posts: 24
Rept. Given: 0
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 12
Thanks Rcvd at 13 Times in 9 Posts
Benten Reputation: 3
Thanks Mr.Exodia, you are really awesome and so kind and generous. I will definitely try it. Thanks for being a constant source of inspiration. super

So good to know that bridge is nothing, saved a lot of time. I was about to reconfigure AndreaGeddon Code.

Last edited by Benten; 11-05-2017 at 00:26. Reason: Respects to Mr. Exodia & Mr. Smiling Wolf, Regards to all Exe tools friends and family.
The Following 2 Users Say Thank You to Benten For This Useful Post:
abhi93696 (11-08-2017), niculaita (11-05-2017)
  #35  
Old 11-07-2017, 00:47
mr.exodia mr.exodia is offline
Retired Moderator
 
Join Date: Nov 2011
Posts: 784
Rept. Given: 490
Rept. Rcvd 1,122 Times in 305 Posts
Thanks Given: 89
Thanks Rcvd at 714 Times in 333 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
Quote:
Originally Posted by Benten View Post
Oh the GIV Target and Script, its just Minimal protection no IT Elimination. When it comes to real stuff even Mr.Exodia seems confused (Oh no Offense please). He just said it himself (not just @3Mins, 38th Sec of this video), watch this old tut.
I just put myself through watching (part of) that tutorial (christ hearing my own 15 y/o voice was cringy) and I indeed mentioned both IAT elimination and redirection there in the same sentence. Had absolutely no clue what I was doing, but I probably meant to say that VirtualProtect is called to allow the code to be changed for import redirection (since it redirects to a random page it has to rewrite every absolute reference to the IAT).

As for bad tutorials, at the time I thought I was improving upon existing tutorials which was obviously not the case perhaps it would be a good idea to set up some wiki somewhere so everybody can contribute and improve?
The Following User Says Thank You to mr.exodia For This Useful Post:
Benten (11-07-2017)
  #36  
Old 11-07-2017, 15:22
Benten Benten is offline
Friend
 
Join Date: Sep 2017
Location: Oh that's personal stuff, Don't want MI6 at my Mom's face
Posts: 24
Rept. Given: 0
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 12
Thanks Rcvd at 13 Times in 9 Posts
Benten Reputation: 3
Quote:
Originally Posted by mr.exodia View Post
I just put myself through watching (part of) that tutorial (christ hearing my own 15 y/o voice was cringy) and I indeed mentioned both IAT elimination and redirection there in the same sentence. Had absolutely no clue what I was doing, but I probably meant to say that VirtualProtect is called to allow the code to be changed for import redirection (since it redirects to a random page it has to rewrite every absolute reference to the IAT).

As for bad tutorials, at the time I thought I was improving upon existing tutorials which was obviously not the case perhaps it would be a good idea to set up some wiki somewhere so everybody can contribute and improve?

Mr. Exodia, that was the nicest thing I've ever came across in my whole life. Now your place in my heart got even higher. Your tutorials, and the work you've done is so inspiring that I got into this unpacking thing. Now the way you commented above simply shows the world how better a person you are.

God Bless you. And thank you for not taking any offense.

As far as EZCD is concerned, I can't do it. I did some in lining and stuff but that didn't worked out so well for me. I've tried it for 2 days no sleep, now I look like a bloody mess. Also I believe that the EZCD is using ENHWID, cause I followed the Security.dll and found the below.

I tried your tut below, but with windows 10 & x64Dbg the certificates are loaded after LocalAlloc, I believe. So I am unable to put a memory break just like you've done it. so that's also struck.
Attached Files
File Type: rar Armadillo_ECDSA_Patching.rar (18.06 MB, 42 views)

Last edited by Benten; 11-07-2017 at 16:20. Reason: Respects to Mr. Exodia, Mr Smiling Wolf & Regards to Friends and Family @ ExeTools.
The Following User Gave Reputation+1 to Benten For This Useful Post:
mr.exodia (11-08-2017)
The Following User Says Thank You to Benten For This Useful Post:
abhi93696 (11-08-2017)
  #37  
Old 11-08-2017, 03:08
mr.exodia mr.exodia is offline
Retired Moderator
 
Join Date: Nov 2011
Posts: 784
Rept. Given: 490
Rept. Rcvd 1,122 Times in 305 Posts
Thanks Given: 89
Thanks Rcvd at 714 Times in 333 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299


Sleeping is more important than reversing this app... Regardless, every Armadillo app always calculates all hardware id types from what I know.

That tutorial is also a bit shit, but the LocalAlloc method was only to locate the 'certificate' functions (ReadByte, ReadWord, ReadDword). It might make more sense to try to follow along with what AKT is doing to see how it works (you can always do it on some unpackme later to learn how it works better).

The relevant (terrible) code for the ECDSA_Replace plugin starts at https://github.com/mrexodia/akt/blob/master/plugins/Arma_InlineHelper_Plugin_ECDSA_Replace/src/main.cpp#L115

Basically what the plugin does is hook that function, wait until a certain DWORD is found (part of the project ID I believe) and it will then just alter the ASCII of the ECDSA parameters before it's read into BigNumbers. This is similar how the 'certificates' tab of AKT works, but then it reads instead of writes.

Note that you cannot register EZ CD through their registration dialog (probably it calls their server/does validation or something). You can use the EnableRegister plugin and call "ezcd.exe REGISTER" from the command line to get the stock Armadillo registration dialog.
The Following 2 Users Say Thank You to mr.exodia For This Useful Post:
abhi93696 (11-08-2017), Benten (11-09-2017)
  #38  
Old 11-09-2017, 14:25
Benten Benten is offline
Friend
 
Join Date: Sep 2017
Location: Oh that's personal stuff, Don't want MI6 at my Mom's face
Posts: 24
Rept. Given: 0
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 12
Thanks Rcvd at 13 Times in 9 Posts
Benten Reputation: 3
Thankyou Mr. Exodia :)

Mr.Exodia, you are right about the sleep, I just messed up a lot of things. Sleeping is very important.

And thanks to all your support, I got past the Registration part. Will update a video soon. It took a bit longer than expected, but I got it eventually. You've taken care of all of it didn't you? awesome

AKT is an awesome tools and it deserves good video tuts for itself, I will try whatever I can.

That Rep. is worth more than anything in my life, it brings a lot of honor to be at the receiving end and I am not sure if I am worthy of such an honor. Thank you Mr. Exodia, for making it so special. And a big big thank you for being there for me, when I need it the most.

stay awesome
Big Faannn
Ben

Last edited by Benten; 11-09-2017 at 14:36. Reason: Respects to Mr. Exodia, Mr Smiling Wolf & Regards to Friends and Family @ ExeTools.
The Following User Gave Reputation+1 to Benten For This Useful Post:
mr.exodia (11-10-2017)
  #39  
Old 11-13-2017, 19:02
Benten Benten is offline
Friend
 
Join Date: Sep 2017
Location: Oh that's personal stuff, Don't want MI6 at my Mom's face
Posts: 24
Rept. Given: 0
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 12
Thanks Rcvd at 13 Times in 9 Posts
Benten Reputation: 3
Guys,

I am going to close this thread in awhile, so if anybody has got anything to ask this is the time.

EZCD is done. I was just a mere instrument and the Lords (Mr. Exodia & Mr Smiling Wolf) spend their valuable time to teach me and help me, can't thank them enough.

I still can't believe they talked to me, awesoomee

So that is it guys I will put all the good tutorials I used to learn Armadillo in one place, just let me learn a few more unpackme's.
The Following User Says Thank You to Benten For This Useful Post:
abhi93696 (11-14-2017)
Closed Thread

Tags
armadillo, armadillo unpacking, import elimination, tutorial request

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 22:28.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )