scriptkiddy
01-27-2011, 12:42 AM
Armadillo 8:
1: Tries to debug itself, creates a mutex when this happens. I counter this by forcing OpenMutexA to return 1
2: I have found the entrypoint and put a hardware breakpoint on it. Several IAT jumps are redirected by the protector, such as GetModuleHandleA.
3: I put a hwbp on GetModuleHandleA address and here is what happens:
Packer makes memory with VirtualAllocEx and VirtualProtect to write to it
Packer uses GetProcAddress to fill up a different address which I have found does not effect the IAT whatsoever.
Packer then wipes the memory it allocates
Packer then creates the memory it allocates again
Packer then creates the memory it allocates
Packer then calls the OEP and my hardware breakpoint address is completely different and rendered useless.
What can I do? Can someone give me advice? I have spent the last 8 hours trying to unpack this unpack me, but ive been having no luck, I have also checked out tutorials and in the tutorial their HWBP is accessed and they see where it is redirected. But mine just deletes itself, recreates itself, deletes itself again throws a bunch of exceptions, calls CreateThread and then goes to the OEP.
1: Tries to debug itself, creates a mutex when this happens. I counter this by forcing OpenMutexA to return 1
2: I have found the entrypoint and put a hardware breakpoint on it. Several IAT jumps are redirected by the protector, such as GetModuleHandleA.
3: I put a hwbp on GetModuleHandleA address and here is what happens:
Packer makes memory with VirtualAllocEx and VirtualProtect to write to it
Packer uses GetProcAddress to fill up a different address which I have found does not effect the IAT whatsoever.
Packer then wipes the memory it allocates
Packer then creates the memory it allocates again
Packer then creates the memory it allocates
Packer then calls the OEP and my hardware breakpoint address is completely different and rendered useless.
What can I do? Can someone give me advice? I have spent the last 8 hours trying to unpack this unpack me, but ive been having no luck, I have also checked out tutorials and in the tutorial their HWBP is accessed and they see where it is redirected. But mine just deletes itself, recreates itself, deletes itself again throws a bunch of exceptions, calls CreateThread and then goes to the OEP.