Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 04-24-2005, 14:50
codeX codeX is offline
{RES} Cracker
 
Join Date: Dec 2004
Location: C:\WINDOWS\SYSTEM32
Posts: 163
Rept. Given: 1
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 3
Thanks Rcvd at 1 Time in 1 Post
codeX Reputation: 0
Question Armadillo in Polyphonic Wizard v3.5

Hi,

I'm working on Polyphonic Wizard v3.5, from

h**p://www.polyphonicwizard.com

PEiD says it's packed with Armadillo 3.78.I've found the OEP and dumped it.In Imprec it shows a number of invalid trunks and i managed to fix a few of them.Then i cut the remaining trunks and fixed the dump.To my surprise this VB app runs.

Now the problem is when i choose exit or click on Close button it crashes

saying

Quote:
The instruction at "0x00fada7a" referenced memory at "0x00fada7a". The memory could not be "read".
What can be the problem? Thanks in advance for help.
Reply With Quote
  #2  
Old 04-24-2005, 15:50
stephenteh
 
Posts: n/a
as far as i know arma protected vb program only have 1 invalid api... that's __vbaEnd
so probably u never fix that api...
Reply With Quote
  #3  
Old 04-27-2005, 04:42
AdamD
 
Posts: n/a
While we have an active topic within reason, I'll pop my question in here.

I too have been trying to unpack an application that shows Armadillo 3.78 as the packer. I have found what I believe is the Entry point and used ollydump to dump the file. I'm stuck trying to use Imprec to rebuild the IAT, and seem to be getting no where fast. I've tried my best to use imprec with this packer, though I don't think I fully understand what to do. I can't run the dumped exe because of this, so I just opened it in olly to use imprec on the dumped file. Is this the correct way about going at this? Perhaps someone can help me with this subject.

Thank you.
Reply With Quote
  #4  
Old 04-27-2005, 05:46
_veDc
 
Posts: n/a
Hi,

maybe this thread:
_http://forum.exetools.com/showthread.php?t=6664 -> Armadillo 4.xx standard unpacking by DappA
will help you .. covers IAT stuff ... i hope it works for you ...

_veDc

EDIT: Just deleted the not working URL Tag .. sorry ..

Last edited by _veDc; 04-27-2005 at 19:02.
Reply With Quote
  #5  
Old 04-28-2005, 06:47
baatazu
 
Posts: n/a
Why version 3.5 while 4 is already out? For educational purposes?
Reply With Quote
  #6  
Old 04-28-2005, 13:09
AdamD
 
Posts: n/a
Quote:
Originally Posted by _veDc
Hi,

maybe this thread:
_http://forum.exetools.com/showthread.php?t=6664 -> Armadillo 4.xx standard unpacking by DappA
will help you .. covers IAT stuff ... i hope it works for you ...

_veDc

EDIT: Just deleted the not working URL Tag .. sorry ..
Though the IAT rebuild is completely different it seems, I'm not finding anything that is stated. I'll post an attachment for all to look at, maybe someone will enlighten me.

EDIT: Added required dll to the attachment.
Attached Files
File Type: zip zclient.zip (683.2 KB, 135 views)

Last edited by AdamD; 04-29-2005 at 04:46.
Reply With Quote
  #7  
Old 04-28-2005, 14:17
lownoise
 
Posts: n/a
Talking Try This..

hxxp://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=6&topic=1105
Reply With Quote
  #8  
Old 04-28-2005, 22:35
AdamD
 
Posts: n/a
Finding the OEP isn't what I'm looking for. I can't figure out how to rebuild the IAT with the tutorial posted. The OEP for my attached file is 00029B73
Reply With Quote
  #9  
Old 04-29-2005, 03:58
lownoise
 
Posts: n/a
Quote:
Originally Posted by AdamD
Finding the OEP isn't what I'm looking for. I can't figure out how to rebuild the IAT with the tutorial posted. The OEP for my attached file is 00029B73
Sorry AdamD i was Referring to the original post from codeX
btw yor attachment doesn't work
Reply With Quote
  #10  
Old 04-29-2005, 04:49
AdamD
 
Posts: n/a
I fixed the attachment by adding a required dll to the zip file. This is a client that is initialized by web browser, so when ran just executed by itself, it has no gui without javascript running their gui dlls. Any help is appreciated, this has been a big challenge for me.
Reply With Quote
  #11  
Old 04-29-2005, 14:17
lownoise
 
Posts: n/a
AdamD Verified your OEP ;-) , program is protected with code splicing this is the main problem for the rebuild of the IAT. Probable you already know this information.
If i've time i'll look at the IAT problem
Reply With Quote
  #12  
Old 04-30-2005, 01:45
codeX codeX is offline
{RES} Cracker
 
Join Date: Dec 2004
Location: C:\WINDOWS\SYSTEM32
Posts: 163
Rept. Given: 1
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 3
Thanks Rcvd at 1 Time in 1 Post
codeX Reputation: 0
Thankx friends....

stephenteh , i'm gonna to test that api __vbaEnd.

But I got a lot of invalid trunks and all of which can be disassebled in Imprec.
Reply With Quote
  #13  
Old 04-30-2005, 08:28
Vepergen
 
Posts: n/a
codeX i have done version 4.02. But i can't test it. Can you test it for me ? See your PM for link ..
Reply With Quote
  #14  
Old 05-01-2005, 00:14
Peter[Pan]
 
Posts: n/a
This armadillo used in this app, is very basic, need to fix IAT (Its VB, so Only __vbaEnd) + CODE SPLICE, then just the silly "Armaccess.dll" Bug.

If its needed i can write a little tut for this app as i have some free time this weekend.

Cya.
Reply With Quote
  #15  
Old 05-01-2005, 16:01
codeX codeX is offline
{RES} Cracker
 
Join Date: Dec 2004
Location: C:\WINDOWS\SYSTEM32
Posts: 163
Rept. Given: 1
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 3
Thanks Rcvd at 1 Time in 1 Post
codeX Reputation: 0
Hi Vepergen,

I'm using XP with visual studio installed . But it give's the error i've PMed you.

@Peter[Pan]

Yes it's very basic protection. I've to fix
Quote:
00407E28 -FF25 50104000 JMP DWORD PTR DS:[401050]
to give the __vbaEnd. Cab i fix it from olly?
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Conditional BPs made easy (wizard style) Rhodium General Discussion 5 01-04-2006 00:17


All times are GMT +8. The time now is 10:29.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )