Jump to content
Tuts 4 You

[UnpackMe] VI_Protect Unpackme


Gladiator

Recommended Posts

Unpacking this one is quite easy but the problem is that none of the currently aviable import fixers can fix the IAT successfully. Neither on Win XP x86 nor Win 7 x64.

  • ImpREC: Detects wrong ImageBase.
  • CHimpRC: Detects wrong ImageBase.
  • Imports Fixer: Says "The process doesn't exist anymore!", but it does.
  • Scylla: Detects right ImageBase but crashes whils fixing the dump

Thats very frustrating. Anyone got a solution?

Link to comment

@ Magician

No problem but you should better throw this protection in the trash. :) The problem is that the full target is already there which is original and not protected.Some kind of wrapper or so.You only need to catch the real place and then only dump it with the right PE datas and thats all.

So you had already used better protections in the past. :)

greetz

  • Like 1
Link to comment

Nice unpackme.

How do you fake the process image path? I know there is some PEB trick, but usually it is still possible to get the image path with NtQueryInformationProcess and ProcessImageFileName.

Link to comment

Hi,

here a small script. :)

pause
bphwc
bc
// VI Protect UnpackMe direct dumper
// Start script at EP
var A
var MZ
mov A, eip
////////////////////
LOOP:
sti
cmp eip, A
je LOOP
bphws esp, "r"
esto
bphwc
bp eip+0BA
esto
bc
bp eip+35
run
bc
cmt eip ,"IsDebuggerPresent PEB | JMP if NOT"
add eip, 101
mov A, eip
bp eip+15
run
bc
add eip, 94
mov A, eip
////////////////////
LOOP2:
sti
cmp eip, A
je LOOP2
mov A, eip
mov MZ, esi
pusha
mov eax, [esi+3C]
add eax, MZ
mov eax, [eax+50]
dm esi, eax, "Unpacked_AT.exe"
popa
ret

greetz

  • Like 1
Link to comment

It's the infamous RunPE method which is why import tools have troubles to find the real executable's path (the process is started as your default browser and then unmapped).

Edited by metr0
  • Like 1
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...