Jump to content
Tuts 4 You

Leaderboard

  1. kao

    kao

    Full Member+


    • Points

      24

    • Content Count

      2,321


  2. TobitoFatito

    TobitoFatito

    Full Member


    • Points

      20

    • Content Count

      34


  3. CodeExplorer

    CodeExplorer

    Moderator


    • Points

      17

    • Content Count

      3,106


  4. Teddy Rogers

    Teddy Rogers

    Administrator


    • Points

      12

    • Content Count

      8,882



Popular Content

Showing content with the highest reputation since 06/02/2020 in all areas

  1. 13 points
    awesome_msil_Out.exe Approach: 1. Necrobit is a jit protection, so we use Simple MSIL Decryptor by CodeCracker , and it shall be ran on NetBox 2. Code virtualization is a relatively new feature of .net reactor, added in version 6.2.0.0. Here is the approach i took (i did this about 6 months ago so my memory is kinda rusty ) : (Click spoiler to see hidden contents)
  2. 6 points
    I am referring to threads and posts like these: If a solution is selectively provided only to the OP by PM then it defeats the whole purpose of the Crackme/Unpackme section. In such cases, the solution provider should not even be acknowledged unless they provide working steps for everyone to learn from. This forum is a learning platform and if solution providers are expected to share the methodologies that they used for the solution. Here is yet another thread where the posts from the solution providers who gave vague steps was approved: Basically another thread containing "show-off" posts by the solution poster. Nothing practical provided and no proper steps were shown. I mean, take this for example (from this post): EXAMPLE 2 Basically useless. It's like saying that to climb the Himalayas one needs will-power, good training, a lof of good mountaineering tools, food packs etc and that one has to read up a lot of good manuals and practice on smaller mountains first... Only posts in the Challenges section which detail proper steps which are actually reproducible should be approved by the mods. OR... ALL POSTS there should be approved from anyone. Why just approve the "show-off" posts? Are we expected to "beg" the solution poster via PM for the steps? I am quite sure that my post may get deleted, since any posts which speak the truth seem to get selective get deleted these days, but nevertheless I wanted to bring up this point! Another example of an approved post where NO STEPS were provided:
  3. 4 points
    In my opinion that solution will be acceptable only if the tool used is public.
  4. 4 points
    This is really the key point that probably should be the requirement for a post to be accepted. A solution should be reproducible, not a list of private tools that are used. Private tools are, as their name implies, private, and by definition that means it is everything but reproducible (unless this tool is shared with the reader of the solution). The only person benefiting from such a reply is the respondent themselves in the form of an ego boost. Not very productive if you'd ask me.
  5. 4 points
    It's a really good question. The answer really depends. Let me give you few recent examples. Example #1: Extreme Coders names the tools and explains HOW to solve the crackme. A lot of effort is required but all the tools can be found via Google. So I have zero issues with the solution. Example #2: Prab names the tools but no explanation is given. "x86 retranslater" definitely cannot be found not on Google. "Clean control flow" tells the obvious thing but it doesn't explain HOW to do that. What's the point of such solution? The only thing reader will learn from this is that he needs a magic wand that he can't have.
  6. 4 points
    View File Reactor v6.3 Try to unpack or alternatively provide a serial. Protections used: Necrobit Antitampering Antidebug Obfuscation Code Virtualization + Shield with SNK Submitter whoknows Submitted 06/10/2020 Category UnPackMe (.NET)  
  7. 2 points
    Pawning 40 CTFs simultaneously
  8. 2 points
    My work machine has normally running MS Teams (2GB right there..), Outlook (250MB), Chrome with 40+ tabs (6+GB), Visual Studio, 1-2 VMware Guests and IDA. Would I expect it to magically work with 8GB of RAM? F*ck no! Sure, you can find a tool that hacks around and maybe reduces the symptoms. But it doesn't fix the problem. The actual problem is that your machine is severely under-powered for that sort of a workload. Another 8GB of RAM would be a proper way to solve those issues. And it costs ~40EUR - which is less than 1-2 hours of your time you probably spent googling for such "tool".
  9. 2 points
    https://docs.microsoft.com/en-us/dotnet/api/system.string.concat Get the next 50 elements and concat them, then repeat. If you want to add a delimiter for every text use Join instead. https://docs.microsoft.com/en-us/dotnet/api/system.string.join?view=netcore-3.1#System_String_Join_System_String_System_String___ You should consider taking a programming course.
  10. 2 points
    I was facing the Same thing from long time. Here I've raised my Voice - that It makes no sense to upload Cleaned file or saying that I used de4dot modded Private bla bla bla. Some People are like, Read the Assembly language or see de4dot or VM and you will know. Oh Ghosh does it make any sense? No there's a no sense of saying this. Consider, Someone ask me How to Decrypt the encrypted Password? So Should I answer him Remember the Table of 2 to 30 or learn Counting and Alphabet. It's make no sense. Mostly Comments are like "I use My Private Tools" "I used modded de4dot" I used "Lamp of Aladdin" I used "Poseidon Trident 🔱" OH God, If You can't share or can't atleast explain little bit manual stuff, Then the Solution is utter nonsense and useless. I also think, We should allow solutions which actually are descriptive.
  11. 2 points
    Thanks to "Extreme Coders", I've never programmed in python before, but after reading all your public material and following the recommended steps in this thread I've been able to desofuscate the code. If they tell you how to do it you will understand it, but if they guide you and you have to discover how to do it you will learn martisor_unpacked.py
  12. 2 points
    Is this a hidden feature of the protection or does the app just not work?
  13. 2 points
    Not necessary to unpack to get the key. Key: Steps :
  14. 1 point
    CSRF tokens https://stackoverflow.com/a/33829607 https://www.hhutzler.de/blog/using-curl/ https://www.google.com/search?q=curl+login+with+CSRF -- On all modern login system there are 'validation' like this... What I have done in the past, is to use CefSharp library (or even the plain WebBrowser of .NET frm), load the page @ browser set the values to inputboxes and submit the form to the server by clicking the submit button by JS code. ex document.querySelector('.ovm-ClassificationBarButton-18'); restoreTAB.click();
  15. 1 point
    _PyEval_EvalFrameDefault executes a code object on the Python frame. To dump the code object to a file you need to use PyMarshal_WriteObjectToFile / PyMarshal_WriteObjectToString at an appropriate place within the function. DnSpy has nothing to do with Python. It's just a piece of string inserted there on purpose.
  16. 1 point
    truly, lost you... pasting some functions for GET/POST, maybe is helpful function make_post_request($url, $params, $json) { $curl = curl_init(); curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_POST, true); if (!$json) { curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($params)); } else { $params = json_encode($params); curl_setopt($curl, CURLOPT_POSTFIELDS, $params); curl_setopt($curl, CURLOPT_HTTPHEADER, array('Content-Type: application/json; charset=UTF-8', 'X-Accept: application/json')); } // display header // curl_setopt( $curl , CURLOPT_HEADER, 1 ) ; curl_setopt( $curl , CURLOPT_CUSTOMREQUEST , 'POST'); curl_setopt( $curl , CURLOPT_SSL_VERIFYPEER , false ) ; // <-- u searching for this ? curl_setopt( $curl , CURLOPT_RETURNTRANSFER , true ) ; curl_setopt( $curl , CURLOPT_TIMEOUT , 5 ) ; $response = curl_exec($curl); // http status code // $status = curl_getinfo($c, CURLINFO_HTTP_CODE); // var_dump($status); curl_close($curl); return json_decode($response); } function make_get_request($url, $params) { $c = curl_init(); $url .= '?' . http_build_query($params); curl_setopt($c, CURLOPT_URL, $url); curl_setopt($c, CURLOPT_RETURNTRANSFER, true); // curl_setopt($c, CURLOPT_HEADER, true); /* curl_setopt($c, CURLOPT_FOLLOWLOCATION, true); curl_setopt($c, CURLINFO_HEADER_OUT, true);*/ curl_setopt($c, CURLOPT_HTTPHEADER, array('Content-Type: application/json')); $response = curl_exec($c); /* $status = curl_getinfo($c, CURLINFO_HTTP_CODE); var_dump($status);*/ curl_close($c); return json_decode($response); } once user login, store info to session variable at any page you can get any info stored. ex. ata login page $r is a recordset $_SESSION['mail'] = $_POST['email']; $_SESSION['u'] = $r['fullname']; $_SESSION['id'] = $r['user_id']; $_SESSION['level'] = $r['user_level_id']; then on any page, u can read the variable $_SESSION[??] //always u have to use @ the top @session_start(); what is the need? you are on HTTP and what ? ref curl w/o https : serverfault.com/a/469825
  17. 1 point
    Well it's true though right? Every OS upgrade adds more background services, more memory consumption. They always seek to maximally utilize the resources. You basically need a multi core with high RAM to do anything interesting nowadays. By forcing hardware upgrades, they sell more licenses so there is justification for this business strategy. My father told me in the 1970s these same things went on. So it's much older. They never rewrote the code to be more efficient because they wanted the system always busy so they could justify its use and further upgrades. Some things never change Does not leave us consumers with much options. As you correctly point out, tools like this are never as reliable or well understood as the OS choosing to be more efficient or flexible. To prove it further, Microsoft does not do much to stop Win10 cracks. But put a minimal Win10 with the bloat stripped out and they will DMCA it at light speed. Priorities! Instead of designing to run on certain hardware configurations as claimed, they in reality design it not to run on certain hardware specs.
  18. 1 point
    We say this with every iteration of Windows. Recalling XP being bloated... 🤔 Ted.
  19. 1 point
    @akkaldama: I use browser tabs as bookmarks for commonly used staff. Browser tab is one click away, bookmark is "..."->"Bookmarks->Find the folder and click->Scroll down and click. Way too slow. If you want details, most of it is Kibana, Apache Impala queries and company internal system dashboards/interfaces. And I didn't say it's "normal", I said that it's unreasonable to expect that to work without a proper amount of RAM. EDIT: oh I see.. It should be "has usually/commonly running". Sorry for my Engrish.
  20. 1 point
    Seems like a tool to keep the cache empty. May be better to leave it to the OS to manage memory... Ted.
  21. 1 point
    Bed_ControlFlow_Remover.rar x86_Retranslater.rar I can't give you the rest of em ( i don't have permission to share them, hope you understand me).
  22. 1 point
    This is just a follow up as all too often someone makes a post about something then that is it nothing else. I was fortunate enough to chat with someone on another forum and i was able to make a dump of the bios, and he was able to give me the original password in a couple of minutes, and this has got me interested in the bios dump itself and what it contains. Yes i could have attempted to use CmosPwd 5 or try to reset it with pulling Cmos out for 20 mins, but I'm not sure that would work anymore. The old trick of mistyping the password 3 times to get the code followed by using bios-pw does not work on these newer bios, you still have 3 attempts but no longer do you get a code just a freeze/lock which then means you have to restart the device and start over
  23. 1 point
    Used it quite a lot - the speed will depend largely on your GPU though I suggest you take the time to read through the different attack types. Some of the custom permutations and things are super powerful - I usually have more success with those on a small, well thought out dict (<5MB) than just using a massive dictionary file.
  24. 1 point
    etc etc https://torrentfreak.com/removing-annoying-windows-10-features-is-a-dmca-violation-microsoft-says-200611/ cheers B
  25. 1 point
    Is everything going PRIVATE or knowledge stopped being shared ? Unpacking => Private ... Tutorials(Patching , keygens) ==> Private ... New techniques ==> Private ... knowledge ==> Private .. So what we left for the others for this Scene ?? The only thing that left is nothing some old books and old school techniques and nothing else... Why ?
  26. 1 point
    Bro i agree with your each word my full vote for you and also @BlackHat words also... I need to tell one thing for all if past reverse they don't let some revering learning sufft then new reverse will never born..
  27. 1 point
    https://www.bleepingcomputer.com/news/security/expiring-ssl-certs-expected-to-break-smart-tvs-fridges-and-iots/ bonus On Systemic Debt - hxxps://thedailywtf.com/articles/on-systemic-debt linux xrdp – an open source RDP server - hxxps://github.com/neutrinolabs/xrdp
  28. 1 point
    Thanks @Teddy Rogers I agree with you but posts saying things like "He shared the solution with me via PM" and such should not be approved. That way, anyone would not be able to show-off that they solved it. If they want their post(s) to be featured on the Challenge threads as having solved something, then the requirement should strictly be that they should post a solution that anyone would be able to replicate. If any special tools are required, then unless they are willing to share the tools, their post should not be accepted. That way, one would either have to post a proper solution along with the tools used or, if they do not want to share their tools, remain silent. I am sure that some would not want to share their tools but in that case they should not get the opportunity to make posts that just serve to boost their ego. If they are not willing to share their "private tools" that they used to arrive at the solution, then their solution (or even their post which just shows the final answer without the steps or tools) should not be approved at all. Otherwise, one could just say that they used a "private tool" for every crackme/unpackme (when in reality, they just used public tools), in order to avoid detailing the steps. So, unless they are willing to share the "private tools", it does make their answer any more useful to the rest of us. While we do not expect an essay or a full video tut of very detailed steps, a person with a reasonable knowledge of RE should be able to replicate the solution with the "steps" that they provide. For example, just saying that they used DnSpy and IL Spy to solve it would be rather useless... I would say that this is more like solving a trigonometry or an algebra problem back in high school where one is expected to provide the "steps" that they performed to arrive at the solution. One would be expected to provide just enough detail so that anyone reading it would be able to (reasonably) understand how to solve similar problem.
  29. 1 point
    As I mentioned in the same topic the solution that was posted was light in detail and never approved. Had it been approved it would have been considered a show off post. I can't force people to post acceptable solutions and I can't stop them sharing them via PM. Your other points are valid and I agree. I would like to get your opinion, if someone posted a solution that they used tool a then tool b is that solution still acceptable? Ted.
  30. 1 point
  31. 1 point
    How these Unpacking Posts are getting approved ? It is clearly written in the Rules that the solution of challenge will not be accepted if you don't describe the steps. Here everyone showing that they have cleaned it but no one is telling how ? so literally this is not a valid contribution to the forum if you don't descibe how it has been done. Just uploading files of cleaned is not all about unpacking. I think everyone must need to describe the steps or approach he has done to clean it. If I sound rude, I am sorry but this is what i feel.
  32. 1 point
    This is a notification of intent to cease and close the Blogs section of the site in a months time. The reasons for the change are; lack of use, activity and popularity, and for the most part the forum categories have been and are more than capable to host similar blog like content in the future. This notification gives you the opportunity to copy any information from Blogs that you wish to retain and/ or repost in the appropriate forum... Ted. Backups - Blogs.rar
  33. 1 point
    I once post it in a China forum, you can visit it in https://www.52pojie.cn/thread-762832-1-1.html by Google Translator I try my best to introduce it using English 1. download x64dbg and download the symbol file of clr.dll (mscorwks.dll if runtime is .net2.0~.net3.5) 2.set a breakpoint at "SystemDomain::ExecuteMainMethod" in clr.dll/mscorwks.dll and run 3.use MegaDumper (I use my ExtremeDumper based on codecracker's megadumper https://github.com/wwh1004/ExtremeDumper) to dump the main module when the program break at "SystemDomain::ExecuteMainMethod" 4.fix pe header and maybe you shoud also fix .net header This way is more complex than use MegaDumper only and directt dump the assembly. But if the assembly is packed with native stub and protected with anti dump (ConfuserEx and others) or protected with whole #US encryption (DNGuardHVM and others), maybe this way is good to dump assemblies. If you can not understand it, you can reply me. Best wish.
  34. 1 point

    64 downloads

    Today I release - finally - the series of unpacking tutorials about manually unpacking The Enigma Protector. I will discuss all protections of Enigma which are fully detailed as possible. I have to say thanks to LCF-AT, she helped me a lot with this. Introduction ~ 9:28 Unpacking with patterns ~ 33:03 Finding patch-places without patterns ~ 19:56 Dealing with SDK API's & Custom Emulated API's ~ 28:23 Internal & External VM's (Using Plugin) ~ 5:40 Enigma's Registration Scheme ~ 15:37 EN-DE-Cryption ~ 33:21 Inline patching + Final Words ~ 11:56
  35. 1 point
    Hello everyone , I hope you're doing good , I've been searching for a while about how to write a plugin for OllyDbg , with the help of the (plugin api unit) I was able to make a simple plugin that retreives the value of the flag (BeingDebugged) which is used by the function (IsDebuggerPresent) . now the problem is that i still can't change that byte . The function WriteProcessMemory isn't working , can you give me some help please , here's the full code : thanks in advance library AADebug; uses SysUtils, plugin, windows, Classes; {$R *.res} type PEB = record Reserved1: array [0 .. 1] of Byte; BeingDebugged: Byte; Reserved2: Byte; Reserved3: array [0 .. 1] of Pointer; Ldr: Pointer; Reserved4: array [0 .. 102] of Byte; Reserved5: array [0 .. 51] of Pointer; PostProcessInitRoutine: Pointer; Reserved6: array [0 .. 127] of Byte; Reserved7: Pointer; SessionId: ULONG; end; PROCESS_BASIC_INFORMATION = record Reserved1: Pointer; PebBaseAddress: Pointer; Reserved2: array [0 .. 1] of Pointer; UniqueProcessId: cardinal; Reserved3: Pointer; end; resourcestring PLUGIN_NAME = 'Anti IsDebuggerPresent'; var g_hwndOlly: HWND; // OllyDbg Window Handle ProcessBasicInfo : PROCESS_BASIC_INFORMATION; Length:cardinal; EB : PEB; function ODBG_Plugininit(ollydbgversion:Integer;hWndOlly:HWND;features:PULONG):Integer;cdecl; begin g_hwndOlly := hWndOlly; Addtolist(0, 0, pchar(PLUGIN_NAME)); Result := 0; end; function ODBG_Plugindata(name: PChar): integer; cdecl; begin StrLCopy(name, PChar(PLUGIN_NAME), 32); Result := PLUGIN_VERSION; end; function NtQueryInformationProcess(ProcessHandle: THANDLE; ProcessInformationClass: DWORD; ProcessInformation: Pointer; ProcessInformationLength:ULONG; ReturnLength: PULONG): LongInt; stdcall; external 'ntdll.dll'; procedure Getinfo; var debugee,PID : THandle; buffer : byte; begin buffer := $00; PID := PluginGetValue(VAL_PROCESSID); debugee := OpenProcess(PROCESS_ALL_ACCESS,False,PID); NtQueryInformationProcess(debugee,0,@ProcessBasicInfo,sizeof(ProcessBasicInfo),@length); readprocessmemory(debugee,ProcessBasicInfo.PebBaseAddress,@EB,sizeof(EB),length); writeprocessmemory(debugee,@EB.beingDebugged,@buffer,sizeof(buffer),length); messagebox(g_hwndOlly,pchar('BeingDebuggedFlag : '+ inttostr(EB.beingDebugged)),pchar('info'),MB_ICONINFORMATION); end; procedure ODBG_Pluginaction(origin:Integer; action:Integer; pItem:Pointer);cdecl; begin if (origin = PM_MAIN) then begin Getinfo; end; end; exports ODBG_Plugininit name '_ODBG_Plugininit', ODBG_Plugindata name '_ODBG_Plugindata', ODBG_Pluginaction name '_ODBG_Pluginaction'; begin end.
  36. 1 point
    You're writing to the wrong address. It should be something like: WriteProcessMemory(debugee,pointer(dword(ProcessBasicInfo.PebBaseAddress) + 2),@buffer,sizeof(buffer),length); Since Delphi doesn't have a pretty way to get field offset, I had to hardcode the "2" instead of writing something prettier like "offsetof(PEB, BeingDebugged)". You could do some of the ugly tricks mentioned here: https://stackoverflow.com/questions/14462103/delphi-offset-of-record-field but to me it's not worth the effort.
  37. 1 point
    What makes you question either of these? Private: There are occasionally some techniques, practices (and tools) kept private to stay ahead of the game. Nothing has changed much over the years in this regard as far as I can tell. Knowledge: As @kao already mentioned most of the core techniques and information is out there to be discovered (in these forums for example). It only needs a willing and proactive individual to expand and develop on this information. As everyone seems to have their own blog (or YouTube channel) these days these generally seem to be the new format for tutorials. One day... when all my children have grown up and left home I can get my life back and get back to RCE and making traditional tutorials. Hopefully the RCE world will be an entirely new and interesting place to explore... 👍 Ted.
  38. 1 point
    This forum is overrun by lazy-ass noobs who don't really want to learn. They want to have a youtube video and automagic tool for everything. Ready-made tools are private for this exact reason. People who want to learn will find the necessary information to learn the basics. And once you show you've done your homework, knowledge and techniques are being shared freely. Maybe not 100% public but via PMs and chat.
  39. 1 point
  40. 1 point
    hello, I apologize if it has nothing to do with this post, I'm decompressing with ManagedJiterFr4.exe but I get the following errors why? how can i solve? this if i try with unpackme
  41. 1 point
    You don't need to know correct key to get the flag: Is that what you're looking for? How-to: 1) Run and dump from memory; 2) (optional) Fix imports with Scylla; 3) Load dump in IDA; 4) Find WndProc and see how WM_COMMAND is handled; 5) The key check is very convoluted but it all ends up here: ... lots of horrible operations with entered key .. strncpy(buffer, encryptedFlag, 25); for ( n = 0; n < 25; ++n ) { v3 = buffer[n]; v4 = HIDWORD(v3) ^ HIDWORD(v20) ^ HIDWORD(v21) ^ HIDWORD(v22) ^ HIDWORD(v23) ^ HIDWORD(v11); v8[2 * n] = v3 ^ v20 ^ v21 ^ v22 ^ v23 ^ v11; v8[2 * n + 1] = v4; decryptedFlag[n] = v8[2 * n]; } // check last 2 bytes of decrypted flag result = 24; if ( decryptedFlag[24] == 'Z' ) { result = 23; if ( decryptedFlag[23] == 'C' ) ... Xor key for all bytes is the same. You know encrypted flag. You know last 2 bytes of decrypted flag. So, you can deduce XOR key and decrypt the flag.
  42. 1 point
    password: "viva la revolution" How the password verified? Here, check my entered password against the correct one, both encrypted. Obviously, the encrypted password at RVA 00011054 is 18 characters long. But, what is the encryption or decryption algorithm? Don't dive into that, instead I assume the algorithm is symmetrical. This time, I entered the right length password "123456789012345678". At entry of the subroutine, Ecx=004FF534, we can find the entered password at allocated buffer 008F0000: Copy and paste with the correct cipher password from RVA 00011054: 008F0000 12 EC C5 CB AC FC 86 96 23 7C 7D 57 46 5C 43 4F 008F0010 56 2D 2A 00 Run to the end of loop at 01323461, we got: 008F0000 12 76 69 76 61 20 6C 61 20 72 65 76 6F 6C 75 74 .viva la revolut 008F0010 69 6F 6E 00 ion.
  43. 1 point
    Beds Protector ? I found is Babel Protector .
  44. 1 point
    Run the program, put any fake password, click on "Check password" wrong msg will be prompted, open up process hacker, right click on the file process -> properties -> net module -> strings -> scan/dump and then you have a .txt file with all strings extracted from memory. Seek for the wrong msg prompt text and nearby is the password.
  45. 1 point
    Yep. That is one of the sections. It may be more on larger files. BTW. Here is my script for recover VM'ed Enigma OEP. Is written back in 2015 and i don't know if is fail proof because i did not use/test for more than a year ago. // giv@reversing.ro // Script for restore VM OEP on Enigma 5.xx VM'ed OEP // Delphi files + VB6 bc lc bphwc bpmc dbh GMI eip, CODEBASE mov bazacod, $RESULT GMI eip, CODESIZE mov marimecod, $RESULT VAR INTRARE ask "Enter the EIP of the stolen OEP" mov INTRARE, $RESULT //mov INTRARE, 0041F372 BPHWS INTRARE erun bphwc INTRARE ask "Enter compiler type: 1 for Delphi 2 for Visual Basic 3 for C++" mov tipcompilator, $RESULT cmp $RESULT,1 ifeq jmp Delphi endif cmp $RESULT,2 ifeq jmp vb6 endif cmp $RESULT,3 ifeq jmp C_plus endif //Target compiler select mov delphi, 1 mov vb6, 0 mov cpp, 0 ///////////////// cmp delphi, 1 ifeq jmp Delphi endif cmp vb6, 1 ifeq jmp vb6 endif cmp cpp, 1 ifeq jmp C_plus endif Delphi: log "PUSH EBP" log "MOV EBP, ESP" log "ADD ESP, -10" BREAK: bc bphwc bpmc BPRM bazacod, marimecod erun cmp eip, INTRARE ifeq jmp BREAK endif cmp eip, bazacod+marimecod ifa jmp BREAK endif cmp eax, 01000000 ifa jmp DWORD endif cmp [eip], #FF25#, 2 ifeq jmp BREAK endif mov valoareeax, eax eval "MOV EAX, 00{valoareeax}" LOG $RESULT, "" eval "MOV ECX, 00{ecx}" log $RESULT, "" eval "MOV EDX, 00{edx}" log $RESULT, "" mov pozitie, eip eval "CALL 0{pozitie}" log $RESULT, "" GASIRE_RET: bpmc cmp [eip], #FF25#, 2 ifeq jmp BREAK endif find eip, #C3#, 5 mov adresagasitaret, $RESULT cmp adresagasitaret, 0 ifa bp adresagasitaret erun bc adresagasitaret esti gci eip, COMMAND mov stringoep, $RESULT scmpi stringoep, "PUSH 0x0", 4 cmp $RESULT, 0 ifa jmp Comanda_gci endif esti jmp Comanda_gci endif find eip, #5?C?#, 1500 mov adresagasitaret, $RESULT cmp adresagasitaret, 0 ifa mov diferenta, adresagasitaret-eip cmp diferenta, 35 ifb cmp [adresagasitaret], #5BC3#, 2 ifeq bpmc bp adresagasitaret erun esti esti jmp Comanda_gci endif cmp [adresagasitaret], #5DC2#, 2 ifeq bpmc bp adresagasitaret erun esti esti jmp Comanda_gci endif msg "Diferenta prea mica" endif mov adresacomparare, adresagasitaret add adresacomparare, 1 cmp [adresacomparare], #C3#,1 ifneq mov start, eip add start, 35 find start,#E8????????C3# bp $RESULT erun bc find eip, #5?C?# bp $RESULT erun bc esti esti jmp Comanda_gci //msg "Pauza C3" endif bp adresagasitaret erun bc adresagasitaret esti esti jmp Comanda_gci endif find eip, #5?5?5?5?C3#,500 bpmc mov adresagasitaret, $RESULT cmp adresagasitaret, 0 ifa bp adresagasitaret erun bc adresagasitaret esti esti jmp Comanda_gci endif cmp adresagasitaret, 0 Continuare_ret: bpmc ifa bp adresagasitaret bpmc erun endif bc adresagasitaret esti esti Comanda_gci: GCI eip, COMMAND mov comanda, $RESULT scmpi comanda, "PUSH 0x0", 4 ifneq jmp GASIRE_RET endif jmp BREAK DWORD: ///////// bc bphwc ///////// mov gasire, eax rev gasire mov gasire, $RESULT /////////////////// eval "{gasire}" mov gasire, $RESULT ////////////////// len gasire cmp $RESULT, 7 ifeq eval "0{gasire}" mov gasire, $RESULT jmp ansamblare_gasire endif len gasire cmp $RESULT, 6 ifeq eval "00{gasire}" mov gasire, $RESULT endif //log gasire, "" ansamblare_gasire: eval "#{gasire}#" mov gasire, $RESULT findmem gasire, bazacod mov adresa_p, $RESULT cmp adresa_p, 0 ifeq msg "Pointer negasit" pause endif ifa eval "MOV EAX, DWORD PTR[{adresa_p}]" log $RESULT, "" cmp ecx, 401000 ifa eval "MOV ECX, 00{ecx}" log $RESULT, "" endif cmp edx, 401000 ifa eval "MOV EDX, 00{edx}" log $RESULT, "" endif mov pozitie, eip eval "CALL 0{pozitie}" log $RESULT, "" jmp GASIRE_RET vb6: findmem #5642??21#, bazacod mov variabilapush, $RESULT cmp variabilapush,0 ifeq msg "Pattern not found for push value - VB6" jmp Sfarsit endif eval "PUSH 00{variabilapush}" LOG $RESULT, "" asm eip, $RESULT mov variabilacall, eip-6 eval "CALL 00{variabilacall}" LOG $RESULT, "" asm eip+5, $RESULT jmp Sfarsit C_plus: bc bphwc bpmc BPRM bazacod, marimecod erun MOV intrarecallc, eip EVAL "CALL {intrarecallc}" log $RESULT, "" ASM INTRARE, $RESULT bc bphwc bpmc rtr esti BPRM bazacod, marimecod erun MOV jmpc, eip EVAL "JMP {jmpc}" log $RESULT, "" ASM INTRARE+5, $RESULT jmp Sfarsit Sfarsit: msg "Script is finished"
  46. 1 point
    Hacking Android Apps Using Backup Techniques http://resources.infosecinstitute.com/android-hacking-security-part-15-hacking-android-apps-using-backup-techniques/ Cracking Android App Binaries http://resources.infosecinstitute.com/android-hacking-security-part-17-cracking-android-app-binaries/ Android Application hacking with Insecure Bank Part 4 http://resources.infosecinstitute.com/android-application-hacking-with-insecure-bank-part-4/ Android Application hacking with Insecure Bank – Part 3 http://resources.infosecinstitute.com/android-application-hacking-with-insecure-bank-part-3/ Android Application hacking with Insecure Bank Part 2 http://resources.infosecinstitute.com/android-application-hacking-insecure-bank-part-2/ Android Application hacking with Insecure Bank Part 1 http://resources.infosecinstitute.com/android-application-hacking-insecure-bank-part-1/ Understanding Disk Encryption on Android and iOS http://resources.infosecinstitute.com/understanding-disk-encryption-android-ios/ Getting Started with Android Forensics http://resources.infosecinstitute.com/getting-started-android-forensics/ Penetration Testing Apps for Android Devices http://resources.infosecinstitute.com/pen-test-apps-android-devices/ Android Hacking and Security, Part 3: Exploiting Broadcast Receivers http://resources.infosecinstitute.com/android-hacking-security-part-3-exploiting-broadcast-receivers/ Android Hacking and Security, Part 2: Content Provider Leakage http://resources.infosecinstitute.com/android-hacking-security-part-2-content-provider-leakage/ Android Hacking and Security, Part 1: Exploiting and Securing Application Components http://resources.infosecinstitute.com/android-hacking-security-part-1-exploiting-securing-application-components/ Android Application Security Testing Guide: Part 2 http://resources.infosecinstitute.com/android-app-sec-test-guide-part-2/ Android Application Security Testing Guide: Part 1 http://resources.infosecinstitute.com/android-application-security-testing-guide-part-1/ Exploiting Debuggable Android Applications http://resources.infosecinstitute.com/android-hacking-security-part-6-exploiting-debuggable-android-applications/ Android App Permissions and Security: What You Need to Know http://resources.infosecinstitute.com/android-app-permissions-security-need-know/ Security and Hacking apps for Android devices http://resources.infosecinstitute.com/security-hacking-apps-android/ Android Forensics: Cracking the Pattern Lock Protection http://resources.infosecinstitute.com/android-forensics-cracking-the-pattern-lock-protection/ Sniffing Network Traffic on Android http://resources.infosecinstitute.com/sniffing-network-traffic-android/ Creating a kewl and simple Cheating Platform on Android https://deepsec.net/docs/Slides/2014/Creating_a_kewl_and_simple_Cheating_Platform_on_Android_-_Milan_Gabor-Danijel_Grah.pdf Racing with DROIDS http://2014.zeronights.org/assets/files/slides/racingwithdroids.pdf Steroids for your App Security Assessment http://2014.zeronights.org/assets/files/slides/grassi.pdf Hey, we catch you - dynamic analysis of Android applications https://pacsec.jp/psj14/PSJ2014_Wenjun_Hey- We Catch You - Dynamic Analysis of Android Applications.pdf An Infestation of Dragons: Exploring Vulnerabilities in the ARM TrustZone Architecture https://pacsec.jp/psj14/PSJ2014_Josh_PacSec2014-v1.pdf Making Android's Bootable Recovery Work For You http://matasano.com/research/eko2014_recovery.pdf Mobile Hacking – Reverse Engineering the Android OS http://www.slideshare.net/EC-Council/hacker-halted-2014-reverse-engineering-the-android-os MAN IN THE BINDER: HE WHO CONTROLS IPC, CONTROLS THE DROID https://www.blackhat.com/docs/eu-14/materials/eu-14-Artenstein-Man-In-The-Binder-He-Who-Controls-IPC-Controls-The-Droid.pdf Hide Android Applications in Images https://www.blackhat.com/docs/eu-14/materials/eu-14-Apvrille-Hide-Android-Applications-In-Images.pdf BREAKING “SECURE” MOBILE APPLICATIONS http://conference.hitb.org/hitbsecconf2014kul/materials/D2T1 - Dominic Chell - Breaking Secure Mobile Applications.pdf TACKYDROID: Pentesting Android Applications in Style http://conference.hitb.org/hitbsecconf2014kul/materials/D2T2 - Chris Liu and Matthew Lionetti - TackyDroid.pdf Android Forensics: The Joys of JTAG https://ruxcon.org.au/assets/2014/slides/tty0x80-Ruxcon Presentation-12th-October-2014-for-release.pdf Enter The Snapdragon! https://www.hacktivity.com/en/downloads/archives/319/ A distributed approach to malware analysis https://speakerdeck.com/nviso/a-distributed-approach-to-malware-analysis-brucon-0x06-daan-raman Bypassing wifi pay-walls with Android http://www.slideshare.net/rootedcon/pau-olivafora-rootedcon2014 Play Flappy Bird while you pentest Android in style http://hitcon.org/2014/downloads/P1_10_Chris Liu - Matthew Lionetti - TackyDroid Slides.pptx On the Feasibility of Automa3cally Generating Android Component Hijacking Exploits http://hitcon.org/2014/downloads/P1_09_Daoyuan Wu - On the Feasibility of Automatically Generating Android Component Hijacking Exploits.pdf Peeking into Your App without Actually Seeing it: UI State Inference and Novel Android Attacks https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-chen.pdf ASM: A Programmable Interface for Extending Android Security https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-heuser.pdf Android Packers:Separating from the pack http://www.fortiguard.com/paper/Android-Packers--Hacktivity2014/ Sprobes: Enforcing Kernel Code Integrity on the TrustZone Architecture http://mostconf.org/2014/slides/s2p3-slides.pdf A Systematic Security Evaluation of Android's Multi-User Framework http://mostconf.org/2014/slides/s3p3-slides.pptx Enter Sandbox: Android Sandbox Comparison http://mostconf.org/2014/slides/s3p1-slides.pdf Exploiting the Bells and Whistles: Uncovering OEM Vulnerabilities in Android http://thecobraden.com/uploads/Valletta - CarolinaCon X - Exploiting the Bells and Whistles.pdf Execute this! Looking into code-loading techniques on Android http://warsaw2014.honeynet.org/slides/honeynet2014-day1-Sebastian.pdf Post-Mortem Memory Analysis of Cold-Booted Android Devices http://www.homac.de/publications/Post-Mortem-Memory-Analysis-of-Cold-Booted-Android-Devices-slides.pdf Tricks for image handling in Android http://www.slideshare.net/tyronenicholas/devoxx-images-android Pentesting Android Applications http://www.slideshare.net/clviper/pentesting-android-applications Rage Against the Virtual Machine: Hindering Dynamic Analysis of Android Malware http://www.syssec-project.eu/m/documents/eurosec14/RATVM.pdf Pre-installed Android application poisoning https://speakerdeck.com/owaspjapan/pre-installed-android-application-poisoning-number-appsecapac2014 AirBag: Boosting Smartphone Resistance to Malware Infection http://yajin.org/papers/ndss14_airbag.pdf SMV-Hunter: Large Scale, Automated Detection of SSL/TLS Man-in-the-Middle Vulnerabilities in Android Apps https://www.utdallas.edu/~zxl111930/file/NDSS14b.pdf AppSealer: Automatic Generation of Vulnerability-Specific Patches for Preventing Component Hijacking Attacks in Android Applications http://sycurelab.ecs.syr.edu/~mu/AppSealer-ndss14.pdf Execute This! Analyzing Unsafe and Malicious Dynamic Code Loading in Android Applications https://anonymous-proxy-servers.net/paper/android-remote-code-execution.pdf DREBIN: Effective and Explainable Detection of Android Malware in Your Pocket http://filepool.informatik.uni-goettingen.de/publication/sec//2014-ndss.pdf Reverse Engineering, Pentesting and Hardening of Android Apps https://speakerd.s3.amazonaws.com/presentations/25bc54e0728001318b20063debaef239/DroidconIT2014.pdf Predatory Hacking of Mobile: Real Demos http://www.rsaconference.com/writable/presentations/file_upload/mbs-w03-predatory-hacking-of-mobile-real-demos-v2.pdf Touchlogger on iOS and Android http://www.rsaconference.com/writable/presentations/file_upload/mbs-w01-touchlogger-on-ios-and-android-v2.pdf Beginners Guide to Reverse Engineering Android Apps http://www.rsaconference.com/writable/presentations/file_upload/stu-w02b-beginners-guide-to-reverse-engineering-android-apps.pdf Mobile Analysis Kung Fu, Santoku Style http://www.rsaconference.com/writable/presentations/file_upload/anf-w03-mobile-analysis-kung-fu-santoku-style_v2.pdf Android FakeId Vulnerability https://bluebox.com/technical/blackhat-fake-id-talk-material-and-follow-up/
  47. 1 point
    Frankly speaking, it's a challenging experiment I've never done before. I decided to take a try.On the WM_INITDIALOG message, a thread of which the lpStartAddress is 00401233 was created. The ThreadProc takes care of all the VK_1 ~ VK_7 keystrokes. This thread function itself is a loop, exits if user32.EndDialog flag set. vKey Functions00401259 E8 9F000000 CALL 004012FD ; VK_10040126F E8 E9000000 CALL 0040135D ; VK_200401285 E8 3F010000 CALL 004013C9 ; VK_30040129B E8 95010000 CALL 00401435 ; VK_4004012B1 E8 EB010000 CALL 004014A1 ; VK_5004012C7 E8 41020000 CALL 0040150D ; VK_6004012E0 E8 94020000 CALL 00401579 ; VK_7004012FD E9 24850000 JMP 004098260040135D E9 4F9B0000 JMP 0040AEB1004013C9 E9 2BC30000 JMP 0040D6F900401435 E9 3CD40000 JMP 0040E876004014A1 E9 C26B0000 JMP 004080680040150D E9 CD7E0000 JMP 004093DF00401579 E9 A9730000 JMP 00408927You can see, all jumps go to the ".vmp0" section, which means these functions are mutated or virtualized. Let's dive into several subroutines to look for something fun. As HellSpider stated, "most of the virtualized blocks of code are quite similar with each other." Procedures almost the same, call user32.wsprintfA to get the message and user32.MessageBoxA to display it. We focus mainly on how the "Control value" generated and on different features in the subroutine. ************* 004012FD VK_1 ************* Control Value: 0x04E6509A This part is for mutation demo, relative ease. Lots of branches VMProtect produced. Basically, all forks do identical operation, the result can be reached simply by tracing the main routine only. After demutation, the equivalent asm instructions look like: 004012FD C8 000100 ENTER 0x100, 0x000401301 60 PUSHAD00401302 9C PUSHFD00401303 BB 06000000 MOV EBX, 0x600401308 B8 E1020000 MOV EAX, 0x2E10040130D 33D2 XOR EDX, EDX0040130F F7FB IDIV EBX ; 05:7A00401311 83C2 03 ADD EDX, 0x3 ; 0800401314 92 XCHG EAX, EDX00401315 33C2 XOR EAX, EDX ; 7200401317 33D2 XOR EDX, EDX ; <- this seems useless00401319 69C0 B5000B00 IMUL EAX, EAX, 0xB00B5 ; 04E6509A0040131F 8D5C24 24 LEA EBX, [ESP+0x24]00401323 50 PUSH EAX ; Control value00401324 68 03214000 PUSH 0x402103 ; ASCII "VMProtect Mutation block has been executed!",CR,LF,CR,LF,"Control value: 0x%08X"00401329 53 PUSH EBX ; lpOut0040132A E8 E7020000 CALL 00401616 ; <JMP.&user32.wsprintfA>0040132F 83C4 0C ADD ESP, 0xC00401332 6A 40 PUSH 0x40 ; uType, combination of flags: MB_OK|MB_ICONASTERISK|MB_APPLMODAL00401334 68 5C204000 PUSH 0x40205C ; Title = "DevirtualzeMe"00401339 53 PUSH EBX ; Text: the message to be displayed0040133A FF75 08 PUSH DWORD PTR [EBP+0x8] ; hWnd of owner0040133D E8 F2020000 CALL 00401634 ; <JMP.&user32.MessageBoxA>00401342 9D POPFD00401343 61 POPAD00401344 C9 LEAVE00401345 C2 0400 RETN 0x4It can be considered as a template of the rest subroutines, only the algorithms of Control Value are different from each other. The only doubt here is Control Value algo. What is the mutation? "replacing the source instruction with its analog (or a certain instruction sequence), which gives the same result as the source instruction.", VMProtect officially claimed. So, I'm not very sure whether the control value algo does exist. Maybe the control value just PUSHed out there. It's hard to say, need HellSpider to confirm this.Note: the above patch works only when key '1' pressed, never stroke other number key, it crashes certainly. This area is full of the VM interpreter/handler code. ************* 0040135D VK_2 ************* Control Value: 0x0546416E Algorithm: 0000281B (= 00000009 ^ 00002812)0000281B ROR 3 = 60000503Low Byte 03 ^ 45(IMM) = 4660000546 SHL 10 = 0546000005460000 | 416E = 0546416EThis function is simply virtualized without additional options. Again, similar to mutation, it's also difficult to identify the primitive constants used in a target before getting protected. The only thing I can do is to guess from the hardcode immediates in this portion of virtualized bytecode. This part roughly covers 0x229 virtual machine instructions, not so complicated. ************* 004013C9 VK_3 ************* Control value: 0x0D619F21 Since virtualized with the "VM integrity check option", it's much sophisticated than the above. It's a painful journey, you’re gonna get brain-burned from this stuff!We trace the Control Value first. Here is an excerpt of virtual instructions executed for the Control Value calculation: HIWORD------StepNum. vEIP vOpcode Operand-------- ---- ------- -------000000C1 00407674: vPushImm4 8D175218000000C2 0040766F: vPushImm4 0040849E000000C3 0040766A: vPushImm4 ABD7E33F000000C4 00407665: vPushImm4 0040A816000000C5 00407660: vReadMemDs4 54281CC8 = [0040A816]000000C6 0040765F: vAdd4 54281CC8 + ABD7E33F = 00000007000000C8 0040765C: vPopReg4 vR1 00000007000000C9 0040765A: vReadMemDs4 72E8B450 = [0040849E]000000CA 00407659: vAdd4 72E8B450 + 8D175218 = 00000668000000CC 00407656: vPopReg4 vR14 00000668 dw [0040A816] = 54281CC8 + IMM32 ABD7E33F = 00000007 dw [0040849E] = 72E8B450 + IMM32 8D175218 = 00000668000000EE 0040761E: vIdiv4 00000000 00000668 / 00000007 = Q000000EA R00000002000001A7 004088E2: vAdd4 000000EA + 00000007 = 000000F10000029F 004088E2: vAdd4 000000EA + 000000F1 = 000001DB000003A3 00407FF9: vPushImm1 00000059000003A5 00407FF2: vPushImm4 80F30437000003C0 00407FB5: vReadMemDs4 7F0D323A = [00409269]000003C1 00407FB4: vAdd4 7F0D323A + 80F30437 = 00003671 dw [00409269] = 7F0D323A + IMM32 80F30437 = 00003671000003C4 00407FAF: vNand4 000001DB ~& 00003671 = FFFFC804000003C8 00407FAA: vNand4 FFFFC804 ~& FFFFC804 = 000037FB => 000001DB | 00003671 = 000037FB000003CB 00407FA5: vReadMemDs1 000000A9 = [0040882C]000003CC 00407FA4: vAdd1 000000A9 + 00000059 = 00000002 <- shift count b [0040882C] = A9 + IMM 59 = 02000003D1 00407F9D: vShrd 000037FB 000037FB >> 00000002 = C0000DFE 000037FB shrd 02 = C0000DFE <- *** byte3 0x0D shows up000003D4 00407F98: vPushImm1 00000059 IMM 59000003D5 00407F96: vPushImm4 0040862E000003D6 00407F91: vReadMemDs1 00000046 = [0040862E] b [0040862E] = 46000003D7 00407F90: vPushImm1 0000006F000003D8 00407F8E: vPushImm4 0040ADD1000003D9 00407F89: vReadMemDs1 000000A1 = [0040ADD1] b [0040ADD1] = A1000003DA 00407F88: vPushImm2 00006D8A000003DB 00407F85: vPushImm4 00410569000003DC 00407F80: vPushImm1 00000074 IMM 74000003DD 00407F7E: vPushImm4 0040BFD3000003DE 00407F79: vReadMemDs1 000000EC = [0040BFD3] b [0040BFD3] = EC + IMM8 74 = 60000003DF 00407F78: vAdd1 000000EC + 00000074 = 00000060000003E1 00407F75: vPushReg1 vR13LB 000000FE here vR13=C0000DFE(Step #000003D1)000003E2 00407F73: vPushReg1 vR13LB 000000FE000003E3 00407F71: vNand1 000000FE ~& 000000FE = 00000001000003E4 00407F70: vPopReg4 vR0 00000202000003E5 00407F6E: vNand1 00000001 ~& 00000060 = 0000009E000003E6 00407F6D: vPopReg4 vR0 00000282000003E7 00407F6B: vPushImm1 000000C9000003E8 00407F69: vPushImm4 00407567000003E9 00407F64: vReadMemDs1 000000D6 = [00407567]000003EA 00407F63: vAdd1 000000D6 + 000000C9 = 0000009F b [00407567] = D6 + IMM8 C9 = 9F000003EB 00407F62: vPopReg4 vR10 00000287000003EC 00407F60: vPushReg1 vR13LB 000000FE000003ED 00407F5E: vNand1 000000FE ~& 0000009F = 00000000000003EE 00407F5D: vPopReg4 vR7 00000246000003EF 00407F5B: vNand1 00000000 ~& 0000009E = 00000061 => 9F ^ FE = 61 <- *** byte2000003F0 00407F5A: vPopReg4 vR1 00000202000003F1 00407F58: vPopReg1 vR13LB 00000061 now vR13=C0000D61000003F2 00407F56: vReadMemDs2 00009276 = [00410569]000003F3 00407F55: vAdd2 00009276 + 00006D8A = 00000000000003F4 00407F54: vPopReg4 vR1 00000257000003F5 00407F52: vPushReg2 vR13LW 00000D61000003F6 00407F50: vPopReg4 vR1 00000D61000003F7 00407F4E: vAdd1 000000A1 + 0000006F = 00000010 b [0040ADD1] = A1 + IMM8 6F = 10 <- shift count000003F8 00407F4D: vPopReg4 vR10 00000213000003F9 00407F4B: vPushReg4 vR1 00000D61000003FA 00407F49: vShl4 00000D61 << 00000010 = 0D610000000003FB 00407F48: vPopReg4 vR5 00000206000003FC 00407F46: vPopReg4 vR0 0D610000 <- *** HIWORDLOWORD------000003FD 00407F44: vAdd1 00000046 + 00000059 = 0000009F b [0040862E] = 46 + IMM8 59 = 9F <- *** byte1000003FE 00407F43: vPushImm1 00000098000003FF 00407F41: vPushImm4 0040921D00000400 00407F3C: vReadMemDs1 00000089 = [0040921D] b [0040921D] = 89 + IMM8 98 = 21 <- *** byte000000401 00407F3B: vAdd1 00000089 + 00000098 = 0000002100000402 00407F3A: vPopReg4 vR10 00000A1700000403 00407F38: vPopReg1 vR0LB 00000021 now, vR0=0D61002100000404 00407F36: vPopReg4 vR10 00000A8600000405 00407F34: vPopReg1 vR0HB 0000009F now, vR0=0D619F21At this point we already have 0x405 steps, not yet including the two API calls. The computation process can be summarized and simplified as: 00000668 IDIV 00000007 => Quotient: 000000EA, Remainder: 00000002000000EA * 2 + 00000007 = 000001DB000001DB | 00003671 = 000037FB000037FB ROR 00000002 = C0000DFEC0000DFE ^ 9F = C0000D61C0000D61 SHL 00000010 = 0D6100000D610000 | 9F21 = 0D619F21The very important concept "VM integrity check" in VMProtect appears in the second half of virtualized code. There is an integrity check table. Each record in the table has a size of 9 bytes: DWORD - encrypted checking address RVABYTE - checking lengthDWORD - negative of the Valid HashChecking procedure: 1) generating a random number by vRdtsc handler 2) modulus operating the total records count of the table 3) multiplying it by the record size, got record offset in the table 4) decrypting address RVA in the record 5) computing the Hash by getHash(vCheck) handler 6) the result Hash + Valid Hash(NEG) + return address of vRet HandlerNoted here, the last step is the so-called "Silent Check"! No comparison, just a ADD operation! This implies that, if the integrity check failed, vRet will be lead to some unknown address, finally causing the application crash. Virtual instructions of this block: 00000444 00407EAC: vRdtsc 0000107E:804F0139 only LOWORD used00000451 00407E94: vNand2 32AA ~& FEC6 = 0111 ~32AA & 0139 = 011100000459 00407E83: vNand2 CDF1 ~& 0139 = 32060000045B 00407E80: vNand2 3206 ~& 0111 = CCE800000464 00407E6D: vDiv2 CCE8 / 002D = Q 048D R 001F CCE8 % 2D0000046B 00407E5E: vMul2 001F * 0009 = 00000117 idx * size = record ptr0000047B 00407E3A: vAdd4 0040642A + 00000117 = 00406541 offset in table0000048B 00407E17: vReadMemDs1 000000FA = [00406545] length: FA...000004C9 00407D95: vAdd4 B6B2EBF7 + 494D6A88 = 0000567F Offset RVA000004D0 00407D84: vAdd4 00400000 + 0000567F = 0040567F +Modulebase...000004D5 00407D7C: vCheck offset: 0040567F, length: 000000FA, Hash: A7563B85000004DE 00407D68: vReadMemDs4 58A9C47B = [00406546] NEG Hash stored in table000004DF 00407D67: vAdd4 58A9C47B + A7563B85 = 00000000 SHOULD BE ZERO!!!000004E0 00407D66: vPopReg4 vR3 00000257000004E1 00407D64: vAdd4 00000000 + 00401616 = 00401616 <- *** Silent Check000004E2 00407D63: vPopReg4 vR9 00000202 Address SHOULD BE Call user32.wsprintfA!!!000004E3 00407D61: vPushReg4 vR5 00000206000004E4 00407D5F: vPushReg4 vR0 0D619F21000004E5 00407D5D: vPushReg4 vR8 00000000000004E6 00407D5B: vPushReg4 vR2 00400000000004E7 00407D59: vPushReg4 vR15 000000EA000004E8 00407D57: vPushReg4 vR10 00C2FE84000004E9 00407D55: vPushReg4 vR7 00406541000004EA 00407D53: vPushReg4 vR4 004121F0000004EB 00407D51: vPushReg4 vR11 00C2FFA8000004EC 00407D4F: vPushReg4 vR0 0D619F21000004ED 00407D4D: vPushReg4 vR9 00000202000004EE 00407D4B: vRet 00401616 | <JMP.&user32.wsprintfA> [esp+00]: 0040E362 return address after call [esp+04]: 00C2FE84 out buffer [esp+08]: 004021A2 ASCII "VMProtect Virtualization (+ VM integrity check) block has been executed!",CR,LF,CR,LF,"Control value:..." [esp+0C]: 0D619F21 Control valueRandom Memory Check Table-------------------------Table address: 0040642A, Items: 0000002DItem. Offset <- Decrypt Length Hash Read <- NEG Hash Calc.#00000001: 00401302|BA017BA2 00000057 516DF676|AE92098A 516DF676#00000002: 00401362|BA0D7BA2 00000065 3290E84D|CD6F17B3 3290E84D...#00000020: 0040567F|B3B11BA2 000000FA A7563B85|58A9C47B A7563B85...#0000002C: 00406226|B025FBA2 000000FB 3C31C786|C3CE387A 3C31C786#0000002D: 00406321|B0055BA2 000000F6 A19E32E3|5E61CD1D A19E32E3Decrypt Algo. for Offset RVA: shrd 1F, ~, ++, shld 12, ~, ^6BA308FF, +B6B2EBF7Thereafter, the "VM Integrity Check" performed two times, each just before calling user32.MessageBoxA and vRet to return address of VK_3 subroutine.Have fun, see you.MistHill
  48. 1 point
    Small modification of ragdog's idea: 1) breakpoint on LoadBitmapA; 2) look at parameters to the call: 0012F740 00AC119D /CALL to LoadBitmapA from 00AC1198 0012F744 00AC0000 |hInst = 00AC0000 0012F748 00AC3000 \RsrcName = "MyBitmap" So, the DLL is loaded at address AC0000. 3) Dump memory at address AC0000. I used PETools, so it calculated size of dump automatically (EC000 bytes). But you can always use other tool and dump more memory, it won't hurt. 4) Open dump with CFF and use its resource editor function to extract BMP.
  • Newsletter

    Want to keep up to date with all our latest news and information?
    Sign Up
×
×
  • Create New...