See this tutor in notepad,Font Fixedsys Regular size 10
Toolz Used: Olly v1.10,PEid v0.93,Ollydump Plugin and ImpRec.
Well,hallo U riderz of the StorM.This is an easy tutor I decide
to write,because I saw that many of U were interested in unpacking
this protector,althought I dont know the reason why.The way up to
the OEP is really easy (only an anti-debugging trick makes this
tutor a little hard for newbiez) and the IAT rebuilding is pretty
simple too.So,download MagicCursor2000 v2.2.1.1 from www.madentec.com
(this version is the most revent now,January 2005).Install the software.
Now use the PEid tool and U can see that is under the protection of
Crunch/PE Heuristic -> Bit-Arts [Overlay].Now open Olly and load the
target.U should be HeRe :
Be sure that in Debugging Options the only checked option is
Ignore memory access violations in KERNEL32.Now press F9 to run and U are at
a screen.Press Continue and Olly breaks at an exception,here:
Try to continue the execution of the target with Shift+F9 and U will get a message
saying Starting Error.This is an anti-debugging trick.So,load again the file
and when U get an exception look at the eax register.It has a value.This is
the value of the exception the prog on purpose trigered.If U also see at the
down left side of Olly,it says Exception ... use ... to pass exception to
program.And XXXXXXXX is the number of exception,for me was C0000008.Now check an
opcode up from there where Olly broke (this is at 77F5109D).What has happened here?
Well this is the anti-debug trick:The prog being debugged,our target,caused an
exception using RtlRaiseException API and in eax is the value of that.Then uses another
API that is called SetUnhandledExceptionFilter.This last API will set up a memory
location that the prog will jamp at if not being debuged.If being debuged it won't
jamp there,and continue its execution to a routine that sends the error message in
screen and in other cases makes the program crash.Here is also the reference of
SetUnhandledExceptionFilter API from msn:
SetUnhandledExceptionFilter
The SetUnhandledExceptionFilter function enables an application to supersede
the top-level exception handler of each thread and process.
After calling this function, if an exception occurs in a process that is not being
debugged, and the exception makes it to the unhandled exception filter, that filter
will call the exception filter function specified by the lpTopLevelExceptionFilter
parameter.
lpTopLevelExceptionFilter
[in] Pointer to a top-level exception filter function that will be called
whenever the UnhandledExceptionFilter function gets control, and the process is not
being debugged. A value of NULL for this parameter specifies default handling within
UnhandledExceptionFilter.
So after the exception that paused Olly,we will make eax zero and the prog will
not handle an exception,as it will think that there is not one actually.So make eax
zero and press F9.Well,it runs jut fine.Anti-debugging trick defeated.Now we have
to go to OEP.Restart the prog again with Olly and start tracing manually,using F7
till the first PUSHAD opcode.After executing it U are HeRe:
Now press on ESP a right click->Follow in Dump.Now in data window under code
highlight the first 4 bytes U see,right click and the breakpoint hardware on
access Dword.We do that because there is a POPAD opcode just before the magic
jamp at OEP,and the same thing the the prog has at PUSHAD after we set the
hardware breakpoint and the POPAD just before the Jamp at OEP,is the same
stack pointer value (well,assuming no complicated other opcodes that mess
stack up=>indicates a hard to unpack sheme,but this is not one of them).
Now,press F9 and then the screen apears,Continue,now the anti-debug thing and
press F9.When Olly pauses,richt click on code and choose Analysis->Analize code.
U should be here:
004840E5 . 5D POP EBP ; MagicCur.<ModuleEntryPoint>
004840E6 . 8B85 86340000 MOV EAX,DWORD PTR SS:[EBP+3486]
004840EC . 5D POP EBP
004840ED . FFE0 JMP EAX
004840EF BE DB BE
004840F0 86 DB 86
004840F1 34 DB 34 ; CHAR '4'
004840F2 00 DB 00
004840F3 00 DB 00
Well,at 004840ED jamps at OEP.So,trace with F7 and execute the JMP EAX and U
should be HeRe:
Now delete the hardware breakpoint U earlier set and dump the process with Olly
Plugin without having checked the Rebuild Import option checked.Now open IMpreC
and select the process,enter as OEP the value 00408FB2-00400000=8FB2 and then
IAT autosearch and Get Imports.Now,press Show invalid,good,no invalid thunk.So
proceed and Fix Dump.Now run the fixed file and...it Workz!
Well,that was it about this packer.Maybe to See ya in Dillo'z Copymem defeating tutor
...But I'm not sure...
楼上的是GOOGLE翻译吧...翻译的还真像
