Log in

View Full Version : armadillo 2.60


kalisto
June 30th, 2002, 15:53
Do anyone knows something about armadillo 2.60 beta-1 public build 1285.
How to get OEP? (signiture byte). This version is quite new.
Foxthree put it in OEP finder + suport for win ME.
Splay do you now something about this version.

foxthree
July 1st, 2002, 09:23
What's new in this version (apart from cosmetics, I mean). The entrypoint bytes are absolutely the same as in 2.5x. May be I just add new entry in Packer list .

Signed,
-- FoxThree

kalisto
July 1st, 2002, 11:23
Well foxthree I play today with armadillo-notepad and find small difference in signiture bytes:
03F9 ADD EDI,ECX
E8 41EFFFFF CALL 008CF21B
50 PUSH EAX
FFD7 CALL EDI==OEP
armadillo 2.51(2.52):
03 F9 E8 A9(2D) EE FF FF 50
OEP finder won`t find OEP with old 2.51 - 2.52 signiture byte.
enjoy




kalisto
July 2nd, 2002, 12:38
Ok I try to unpack notepad-armadillo but I don't know when to dump. I read something about writeprocessmemory, resume thread but still no idea where to set breakpoint. I know I must break after decryption routine when whole text section is decrypted and then dump file.
So I need some hint.

Cunegonde
August 8th, 2002, 03:33
Hello!

What is this tool please ? I planed to write a similar tool, it seems that someone already did it

foxthree
August 8th, 2002, 10:30
... foxthree.cjb.net

Signed,
-- FoxThree