hello there.

a few notes on how to set about manually unpacking a file that's been packed with steelbytes
exe32pack 1.36-1.38 (www.steelbytes.com)

first of all, you need to set a "jammer" on the file that stops the packer loader jumping to
the original entry point after the unpacking's finished.
there's several ways to do this.. but the safest is probably like so:

we need to find in the file, 4 bytes which the loader refers to when jumping to the original
entry point. we can change this value to get the loader to jump to any point in vmem we want..
so we set this value to jump to our "jammer" (explained later).

ok, first get some section information about the target. here's an example..

object    offset    size      v-offset  v-size    flags
.text	  00000000  00000000  00001000  000096B0  C0000080
.bss	  00000000  00000000  0000B000  0000094C  C0000080
.data	  00000000  00000000  0000C000  00001700  C0000080
.idata	  00000000  00000000  0000E000  00000B64  C0000080
.rsrc	  00000400  00000AEC  0000F000  000015CC  400000C0
.reloc	  00000000  00000000  00011000  00001040  C0000080
	  00001000  00009433  00013000  0000B8FB  600000E0

pep	  0001300C -> offset 0000100C

.. this is calc.exe compressed with exe32pack 1.36. as you can see, the program entry point
is at 1300c, which is 0x0c bytes from the start of the last section. the last section is the
exe32pack loader, or unpacker. we need to look at this section with a hexeditor..

0000100C 3BC0 7402 8183 553B C074 0281 8353 3BC9 7401 BC56 ;.t...U;.t...S;.t..V
00001020 3BD2 7402 8185 57E8 0000 0000 3BDB 7401 BE5D 8BD5 ;.t...W.....;.t..]..
00001034 81ED CC8D 4000 3BE4 7402 8187 2B95 DD8E 4000 81EA ....@.;.t...+...@...
00001048 2C00 0000 80BD 188F 4000 0074 188B 85FD 8E40 0003 ,.......@..t.....@..
0000105C 8507 8F40 003B C974 01BA 05EC 0400 00FF E03B C974 ...@.;.t.........;.t
00001070 01BA 523B ED74 01B8 8D85 308F 4000 503B C974 0281 ..R;.t....0.@.P;.t..
00001084 83FF 950C 8F40 008D 9D21 8F40 0053 3BC9 7402 8183 .....@...!.@.S;.t...
00001098 50FF 9510 8F40 008B D88B B5F1 8E40 005A 523B F674 P....@.......@.ZR;.t
000010AC 0281 8103 F28B 060B C074 285A 523B ED74 0281 836A .........t(ZR;.t...j
000010C0 0054 6A40 FF76 048B 063B C974 0281 8703 C250 3BF6 .Tj@.v...;.t.....P;.
000010D4 7401 B9FF D358 83C6 08EB D28F 8507 8F40 003B F674 t....X.........@.;.t
000010E8 0281 81C6 8518 8F40 0001 8B85 078F 4000 3BC9 7402 .......@......@.;.t.
000010FC 8183 8BB5 F98E 4000 03F0 3BC9 7401 BB8B BDFD 8E40 ......@...;.t......@
00001110 0003 F88B 8D01 8F40 003B C974 0281 83E8 7500 0000 .......@.;.t....u...
00001124 3BC9 7401 BB8B 85FD 8E40 0003 8507 8F40 003B C974 ;.t......@.....@.;.t
00001138 0281 83FF E000 3001 004E 5300 0000 0040 0000 E000 ......0..NS....@....
0000114C 0000 0000 004E AF01 0000 1001 008A AF01 0033 C401 .....N...........3..
00001160 00A9 1400 0001 0100 0000 0090 F8AE 0100 0DAF 0100 ....................
00001174 0000 0000 0000 0000 0000 0000 0056 6972 7475 616C .............Virtual
00001188 5072 6F74 6563 7400 4B45 524E 454C 3332 0055 8BEC Protect.KERNEL32.U..

.. ok. at the pep + 0x135, is the original entry point.. see it? =)

00001138 0281 83FF E000 3001 004E 5300 0000 0040 0000 E000 ......0..NS....@....
                               ^^^^^^^^^^
knowing where this value is in the loader was just a matter of knowing the original entrypoint
before the file was packed.. ;) in this case, the oep is 0000534e.
now, we need to change this value to jump to a "jammer", or a line of code that just jumps to
it's own address; this is so we can make a clean dump, ie - dump the file after it's
unpacked and before any of it's memory has been altered in the course of runtime.
where do we put our jammer??.. it doesn't matter. but you need to make sure that the jammer
isn't overwritten or otherwise changed.
you can be pretty sure a loader won't overwrite it's own memory.. so we need a location somewhere
in the loader's memory space. if we look at the code at the pep..

   :0041300C cmp eax, eax
   :0041300E je 00413012
   :00413010 add dword ptr [ebx+74C03B55], 53838102
   :0041301A cmp ecx, ecx
   :0041301C je 0041301F
   :0041301E mov esp, 74D23B56

.. cmp eax, eax..? o_O
maybeb someeone was drunkk whene they codeded tis.
we can squeeze in a 2-byte operation here.

change the code at the pep to..

   :0041300C jmp PACKED.00413012
   :0041300E jmp PACKED.0041300E
   :00413010 add dword ptr [ebx+74C03B55], 53838102
   :0041301A cmp ecx, ecx
   :0041301C je 0041301F
   :0041301E mov esp, 74D23B56

.. you can see our jammer at 41300e. and no overwrite of other memory (important!). the bytes
at 413010 might be needed for something. even if it's just to confuse people. =)
the opcodes for these two lines are..

EB04                          jmp 00413012
EBFE                          jmp 0041300E

.. so just hex-edit those four bytes at the pep in the file (100c)..

0000100C EB04 EBFE 8183 553B C074 0281 8353 3BC9 7401 BC56 ;.t...U;.t...S;.t..V
         ^^^^^^^^^

k, next thing is; change the oep value to jump to our jammer..

00001138 0281 83FF E000 3001 000E 3001 0000 0040 0000 E000 ......0..NS....@....
                               ^^ ^^^^

.. easy. now just run the file so it unpacks and jams. then dump it with procdump or lord pe and
set the pep to 534e.
next, we need to set the section sizes.. exe32pack sets the section size/offset to 0 on most of
the sections (not resources if i remember..). because we've dumped the file, we need to set the
offsets/sizes on all sections to the same lengths/addresses as the virtual offsets/virtual sizes.

finally, we probably want to set execute/code flags on all the sections.. this makes the program
disassembleable (?? =/) with win32dasm and prevents crash errors due to sections being flagged
as data or some shit. this is made easy with lordpe, but usually just setting all the flags to
E0000020 works.

- snyper

http://k-line.cjb.net/

