Introduced in v3.50, Armadillo now has the option:

"Strategic Code Splicing"

No idea if you guys managed to get a hold of a .exe protected with it, but seen as iam a Registered User of Armadillo
No Iam not a Shareware Author ...

I present to you a Small Program in Three Parts:

Hello_Armadillo.exe
Hello_Original.exe
Hello_Dumped.exe

And a Quick Analasis of what i managed to dig up.
Lets Begin:

Armadillo Used: v3.50a.xxxx (Custom Build)

No iDea if Chad can Trace My Build with the xxxx's so i leave em out.

Options i Used to Protect are:


[Project]
BitmapSeconds=0
CertificateCount=1
Compression=0
IniStyle=ArmadilloV3
InterceptLibsOption=0
Name=helloworld
NoInfo=1
NoMonitorThread=1
NoRegister=1
NoReportClockBack=1
NoReportClockForward=1
NoStandardProtections=1
ProtectDataAfter=0
ShowLoading=0
SoftICEDetect=0
TargetFile=C:\masm32\Hello.exe
UseCodeSplicing=1
Version=100


So basically a No Debug Blocker Program, with Code Splicing.

I dump and Fix IAT like any Armadillo.
(Too long to put full Steps, but view Ricardos FTP for *GREAT* tutorials)

Any my analasis begins:

Orginal Code:


Function: RandomSerial (Taken from a old Keygen )

00401106 /$ 60 PUSHAD
00401107 |. 6A 00 PUSH 0 ; /Style = MB_OK|MB_APPLMODAL
00401109 |. 68 13304000 PUSH Hello.00403013 ; |Title = "Error"
0040110E |. 68 19304000 PUSH Hello.00403019 ; |Text = "Hello World!"
00401113 |. 6A 00 PUSH 0 ; |hOwner = NULL
00401115 |. E8 20000000 CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
0040111A |. 61 POPAD
0040111B \. C3 RETN


Dumped Code:


Function: RandomSerial

00401106 $-E9 F5EE2D02 JMP 021D0000
0040110B ? 0FCB BSWAP EBX
0040110D ? 66:93 XCHG AX,BX
0040110F . 93 XCHG EAX,EBX ; |
00401110 . 93 XCHG EAX,EBX ; |
00401111 . 66:93 XCHG AX,BX ; |
00401113 . 0FCB BSWAP EBX ; |
00401115 . E8 20000000 CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
0040111A . 61 POPAD
0040111B . C3 RETN




Address: 021D0000

021D0000 60 PUSHAD
021D0001 6A 00 PUSH 0
021D0003 68 13304000 PUSH 403013 ; ASCII "Error"
021D0008 F7D0 NOT EAX
021D000A 0FCB BSWAP EBX
021D000C 53 PUSH EBX
021D000D 66:93 XCHG AX,BX
021D000F 87DB XCHG EBX,EBX
021D0011 66:93 XCHG AX,BX
021D0013 8BF6 MOV ESI,ESI
021D0015 5B POP EBX
021D0016 0FCB BSWAP EBX
021D0018 F7D0 NOT EAX
021D001A 68 19304000 PUSH 403019 ; ASCII "Hello World!"
021D001F 6A 00 PUSH 0
021D0021 -E9 E51023FE JMP Hello_Ar.0040110B


So from the Orginal Code We can Tell:


021D0008 F7D0 NOT EAX
021D000A 0FCB BSWAP EBX
021D000C 53 PUSH EBX
021D000D 66:93 XCHG AX,BX
021D000F 87DB XCHG EBX,EBX
021D0011 66:93 XCHG AX,BX
021D0013 8BF6 MOV ESI,ESI
021D0015 5B POP EBX
021D0016 0FCB BSWAP EBX
021D0018 F7D0 NOT EAX

Is the code that needs Removing, Nothing Special, but at
least he implemented it in a differnt way, than the Asprotect Clones
Going around.

Maybe in a real application it is more fun to play with the Code Splicing
but maybe its not

Sorry about any Spelling / Grammer (English is not my First Language)

-Billy

Cool, thanks for sharing your analysis.

it seems that the author has written a kind of polymorphic engine? i don't see really the benefit of this feature. it would have been better if he made something to hide the adresses of your "hello world" and "error" strings.

like a translation of

push address_helloworld

to

mov eax,(address_helloworld XOR 0x12345678)
xor eax,0x12345678
push eax

that would make cracking shareware apps a little harder...

Yep, only benifit i can find from using this option is the amount of times it does it, my code was just 1 function , with 1 call, imgine a entire shareware app ?

could get awfully boring copying and pasting all them bytes

THen again i didnt even look if there is another way to fix em.

Once again, big DEAL. All you really have to do is look for JMP instructions that jump outside the original code section. Then grab all that code an remap it to a new section, and edit the original jump. Just leave all the junk code in there, it doesn't hurt anything after all.

-nt20

It might be at least tedious to do this, and it would require automated tools specifically for this purpose (i.e. no more simple manual dump + IAT fix, but then again, the same goes for nanomites and friends, I'm just saying) not to mention if the jump code itself was obfuscated/encrypted and/or the relocated code was mutated in a context (address) sensititive manner.

Oops, probably shouldn't have said that, guess we'll see it in the next Armadillo version...

I don't think creating a context sensitive code would help hide much - you'd have to have a look up table somewhere, and look at the nanomites and the tables they use. One only has to find the tables and decrypt one of them and you now have the nanos by the balls.

This "code splicing" is a feature taken not from ASprotect, but from DilloDumper itself DilloDumper would allocate virtual memory space in the other process, inject new code, and then modify key original instructions in the packed program to jump to the new code. Although it used CALL instructions, it was the same effect. Legal action is pending

*Note this is sarcasm, this type of "protection" has been used all over the place, most likely beginning with SafeDisc*

Also, ACProtect uses this same style technique to break code up into smaller blocks. My ACProtect unpacker cleanly repairs these flaws with ease.

There's ALWAYS a pattern.

-nt20