_genuine
November 19th, 2009, 03:25
Alright so ive read almost everything i can find on yoda cryptor 1.xx modified, and it all seemed to be easy enough to unpack..my target however seems to have something extra that i cant really understand in my initial analysis of it.
So here we go, just so i give enough information ill go thru the steps of how im 'supposed' to get to the oep.
Opened up the target (removed all exceptions in Olly except the ignore exceptions in kernel).
Here is my entry point.
Using the ESP trick i single stepped over the PUSHAD and set a HW breakpoint on ESP.
I shift+f9 once and i reach the point where Yoda cryptor sets up its exception handler code to cause an exception. Right here. (To note, in another paper regarding this packer there is the technique of Shift+F9 until the program runs, then rerun the number of Shoft+f9 -1 times to reach this as well.).
In the SEH chain in olly we will see where this SEH record lies in, after stepping into the code and raising the exception. Inm y case it is here, and i set a breakpoint on this exceptionhandler.
In this code where the line
00C1E70C |. 89B8 B8000000 MOV DWORD PTR DS:[EAX+B8],EDI ; ntdll.7C910228
EDI will contain 00401000..which is supposed ! to be the OEP, but this is not the case in my target..According to popular papers. this should continue execution to the OEP. Wait for it...
After the bp is set there and we reach the exception handler code. We will ALT+F9 to return to code after the handler. which will be 00401000.
the code here is strange.
it Calls this RETN, and the RETN just terminates the application..
This where that ends..now somewhere in all my analysis i thought i found a place where the OEP was, lying in some addresses in the 007XXXXXX range..when i remember how i got there ill update this thread but if anyone who does know about yoda cryptor and can realize some thing here id like some input or feedback, thanks.
So here we go, just so i give enough information ill go thru the steps of how im 'supposed' to get to the oep.
Opened up the target (removed all exceptions in Olly except the ignore exceptions in kernel).
Here is my entry point.
Code:
00C1E060 bots.<ModuleEntryPoint> $ 60 PUSHAD
00C1E061 . E8 00000000 CALL bots.00C1E066
00C1E066 $ 5D POP EBP ; kernel32.7C817077
00C1E067 . 81ED 0F1E4000 SUB EBP,bots.00401E0F
00C1E06D . B9 57090000 MOV ECX,957
00C1E072 . 8DBD 571E4000 LEA EDI,DWORD PTR SS:[EBP+401E57]
00C1E078 . 8BF7 MOV ESI,EDI ; ntdll.7C910228
00C1E07A > AC LODS BYTE PTR DS:[ESI]
Using the ESP trick i single stepped over the PUSHAD and set a HW breakpoint on ESP.
I shift+f9 once and i reach the point where Yoda cryptor sets up its exception handler code to cause an exception. Right here. (To note, in another paper regarding this packer there is the technique of Shift+F9 until the program runs, then rerun the number of Shoft+f9 -1 times to reach this as well.).
Code:
00C1E739 . 50 PUSH EAX ; bots.00C1E6E8
00C1E73A ? 33C0 XOR EAX,EAX ; OEP Or Next Shell To Get,Please dumped it,Enjoy!
00C1E73C . 64:FF30 PUSH DWORD PTR FS:[EAX]
00C1E73F ? 64:8920 MOV DWORD PTR FS:[EAX],ESP
00C1E742 ? EB 01 JMP SHORT bots.00C1E745
00C1E744 ? 8700 XCHG DWORD PTR DS:[EAX],EAX ; bots.00C1E6E8
00C1E746 . 0000 ADD BYTE PTR DS:[EAX],AL
In the SEH chain in olly we will see where this SEH record lies in, after stepping into the code and raising the exception. Inm y case it is here, and i set a breakpoint on this exceptionhandler.
Code:
00C1E6E8 |. 55 PUSH EBP
00C1E6E9 |. 8BEC MOV EBP,ESP
00C1E6EB |. 57 PUSH EDI ; ntdll.7C910228
00C1E6EC |. 8B45 10 MOV EAX,[ARG.3]
00C1E6EF |. 8BB8 C4000000 MOV EDI,DWORD PTR DS:[EAX+C4]
00C1E6F5 |. FF37 PUSH DWORD PTR DS:[EDI]
00C1E6F7 |. 33FF XOR EDI,EDI ; ntdll.7C910228
00C1E6F9 |. 64:8F07 POP DWORD PTR FS:[EDI] ; 0012FFE0
00C1E6FC |. 8380 C4000000 0>ADD DWORD PTR DS:[EAX+C4],8
00C1E703 |. 8BB8 A4000000 MOV EDI,DWORD PTR DS:[EAX+A4]
00C1E709 |. C1C7 07 ROL EDI,7
00C1E70C |. 89B8 B8000000 MOV DWORD PTR DS:[EAX+B8],EDI ; ntdll.7C910228
00C1E712 |. B8 00000000 MOV EAX,0
00C1E717 |. 5F POP EDI ; 0012FFE0
00C1E718 |. C9 LEAVE
00C1E719 \. C3 RETN
In this code where the line
00C1E70C |. 89B8 B8000000 MOV DWORD PTR DS:[EAX+B8],EDI ; ntdll.7C910228
EDI will contain 00401000..which is supposed ! to be the OEP, but this is not the case in my target..According to popular papers. this should continue execution to the OEP. Wait for it...
After the bp is set there and we reach the exception handler code. We will ALT+F9 to return to code after the handler. which will be 00401000.
the code here is strange.
Code:
00401000 68 01A0C000 PUSH bots.00C0A001
00401005 E8 01000000 CALL bots.0040100B
0040100A C3 RETN
0040100B C3 RETN
it Calls this RETN, and the RETN just terminates the application..
This where that ends..now somewhere in all my analysis i thought i found a place where the OEP was, lying in some addresses in the 007XXXXXX range..when i remember how i got there ill update this thread but if anyone who does know about yoda cryptor and can realize some thing here id like some input or feedback, thanks.
