Hi All,
I've been reading the reversing book written by Eldad Eilam and stepping through a malware reversing exercise which he conducted with a trojan called HackArmy.

Now I have understood how it works and even managed to interact with it, so I have learned a bit there. There are two points though where I am a little confused. I'll try and explain:

1) The original executable is called Webcam Shots.scr. This runs for a while; then copies itself to the System32 directory and terminates itself. The new executable (now called ZoneLockup.exe) starts running [Can see this with ProcessMonitor]. However the exact same process fails in a debugger. As in, if I step through the code with Olly, I can trace it till the Exit call of the first process but it does NOT automatically start the ZoneLockup process. I then have to attach Olly manually to the new process and continue. Is this normal behavior? Why is there a difference?

2) While stepping through the ZoneLockup process, the binary suddenly locks up. Olly says [Bottom left - status bar] that the process is currently in Dnsapi.dll or Secur32.dll or some other system DLL. I cannot Step Over, Step Into or Run the program. It just hangs. I can only restart the program in Olly. Why does this happen? When the Exe works perfectly outside; why should it hang in a debugger? I am not too sure this is 'debugger aware' malware either as it did let me do a lot of other stuff.

Here is the link for the Code download if you're interested -
http://media.wiley.com/product_ancillary/17/07645748/DOWNLOAD/574817_code_updtd_07_12_2005.zip

You will find the malware in question in the Chapter 8 folder and the program you need to decrypt it in Chapter 6.

Thanks
Arvind

I will answer the first question. Your first Olly has access and debugs the PROCESS Webcam Shots.scr. It has access to its memory space, ist threads everything.

ZoneLockup.exe is a new, independent, detached process, started by the Operating system. Your fisrt olly, standing on the Webcam Process memory space has no access to ZoneLockup memory space, therads, for the same reason it cannot access any other process running in the system at a given time. So you have to use a second debugger, attach it to that second PROCESS to gain access.

When you want to catch a daughter process, spawned from a mother process at the entry point for debugging purposes, you have to play some more sophisticated tricks. look up the unpacking techniques for Armadillo and you will see examples of what I am talking about.

*As in, if I step through the code with Olly, I can trace it till the Exit call of the first process but it does NOT automatically start the ZoneLockup process

Can you show me the code?

*While stepping through the ZoneLockup process, the binary suddenly locks up. Olly says [Bottom left - status bar] that the process is currently in Dnsapi.dll or Secur32.dll or some other system DLL. I cannot Step Over, Step Into or Run the program. It just hangs.

Can you show me the picture?

Thanks naides. That seems to make sense. Except that in the book.. he wrote it as if Olly would automatically switch to the second process.

@esther: Have attached the screenshots that you asked for.
1.png - Just before Olly exits for the first time. You can see the Exit call underneath.
2.png - Just so you see that Zonelockup is a child of Webcamshots
3.png - Look at the bottom left corner. It shows that the process has terminated.
4.png - Closed Olly and then attached it to Zonelockup and it hangs in Secur32.dll. Again look at the bottom left corner.

One thing worth mentioning might be that this program tries to talk to an IRC server throughout - I actually set one up and checked it out. Right now though I have disabled the n/w card so traffic doesn't go out. I don't think the 2 things are related, but just thought I'd mention it all the same.

Hope this helps.

Thnx
Arvind

Hi,
1) There are things you can check out on ollydbg,if its checked it might affect on hangs when debugging multi-threaded programs(credits to opcode0x90)
Debugging Options, uncheck Registers -> Decode SSE Registers

I'm on windows xp with sp2 on vmware 6.05,ollydbg 1.10,this what I did,.Just start up with ollydbg and load Webcam Shots.scr in the debugger and then run it in ollydbg.The program terninates and then I attached the "ZoneLockup" and it paused at ntdll.DbgBreakpoint,I used
Ctr+F9 twice and it breaks at 0402952 which is in now in "ZoneLockup",it didn't freezes like you did when attaching process on "ZoneLockup".There might be other things affect the hang like OS,system,etc...

1.png-when you FIRST time run Webcam Shots.scr,ShellExecuteA function will execute "ZoneLockup" and then Webcam Shots.scr will exit process and then terminates


4.png- As I said above unchecked the registers if its checked and give a try

Hope it helps