Jump to content
Tuts 4 You

PandaObfuscator, with custom VM


CodeOfDark

Recommended Posts

Difficulty : 2-3
Language : .NET
Platform : Windows
OS Version : Windows7+
Packer / Protector : PandaObfuscator (Modded Confuser) with Custom VM

Description :

Just basic UnpackMe, want to see if my obfuscator good/bad

Screenshot :

image.png.62b851da8d9494b35a6bcf1106e63030.png

GetMe.7z

Link to post
  • 2 months later...
tathanhdinh

I'm cannot resolve the challenge yet, it's indeed very hard (at least for me). I would like just to know whether I've got the correct partial result or not.

I've managed to "dump" the key checking procedure, which locates on several non-contiguous pages (!?). The attached image is a part of it (I don't know how to capture all the function). I've found that there is a loop which reads each chararacter (input key is a wide string, each char is 2 bytes) by the instruction

movz ecx, [eax + ebx * 2]

the character is then checked with several values (e.g. "-", etc). But I still cannot go further.

panda_obfuscator.png

Edited by tathanhdinh
code reformat (see edit history)
Link to post
  • 3 weeks later...
  • 1 year later...
BataBo

I'm sure I'm late to the party,the password is:VGhpcyBTaW1wbGUgQ3JhY2tNZQ0kQnkgQ29kZU9mRGFyaw==

Link to post
  • 2 months later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...