Results 1 to 5 of 5

Thread: Arma is breeding like a rabbit!

  1. #1
    Naides is Nobody
    Join Date
    Jan 2002
    Location
    Planet Earth
    Posts
    1,647

    Arma is breeding like a rabbit!

    I need some suggestions here.

    I've been dealing with an Armadillo protection and I am a little at a lost, so I am asking for help from more seasoned unpackers here, because it has me stumped.


    It starts with a typical debug blocker, which is, in the surface, simple to pass: bp on writeprocmemory etc. . .

    Then when I try to find the OEP of the son process, I have hit a wall:
    At the lower memory addresses of the program I saw the sections CODE, DATA, BSS, suggesting this is a Delphi program, but the sections are filled with zeros, and even after the app is up and running, remained filled with zeros. uh mm, no unpacking taking place?

    Also the son process, even after detached from the "father" remained operating as a debugger breaking every few seconds on WaitForDebugEvent. . .

    Who are you debugging?

    Then I realized that the "son" app has spawn a new process (The grandson) which is running the show. If I dump the grandson process while fully running in memory, I can see unpacked, functional code inside the CODE section. Trying to detach the grandson from the son only results in a new generation: the kid spawns a new process, declares itself the debugger of the great-grandkid and I am back to square one.

    So: the debug blocker trick has matured. If the application finds itself orphan, meaning detached from the father, it becomes a father(being under Olly as a debugger does not prevent that behavior) If it finds itself under the father as a debugger, it abstains from sex, unpacks itself and runs.

    This is a problem of the rooster the chicken and the egg, and I find it intriguing, and challenging.

    I am asking the local unpacker gurus if they have seen this strain of Arma and some suggestions on how to solve this catch. . .

  2. #2
    Administrator dELTA's Avatar
    Join Date
    Oct 2000
    Location
    Ring -1
    Posts
    4,206
    Blog Entries
    5
    In this situation I'd try to locate/breakpoint the related APIs like e.g. CreateProcess etc, and trace backwards from there to find the am-I-an-orphan-wohoo-finally-I-can-start-fucking-around-without-my-father-interfering test, and then patch it in memory with a WriteProcessMemory call injected into the father, before finally killing him off.

    (Or to sum it up, in the way of reducing someone's sexdrive, nothing beats having their father molest them under the influence of injected substance, and then killing him off in plain sight while still being "attached" to them.

    (Ok, perhaps a bit tasteless, but it was all in the name of good cracking. )
    "Give a man a quote from the FAQ, and he'll ignore it. Print the FAQ, shove it up his ass, kick him in the balls, DDoS his ass and kick/ban him, and the point usually gets through eventually."

  3. #3
    Poor dillo :-$
    Real ones don't need source

  4. #4
    Naides is Nobody
    Join Date
    Jan 2002
    Location
    Planet Earth
    Posts
    1,647
    Hey Nico,
    In this family soap opera you would be The Prime Progenitor, The Ultimate Ancestor??

    The answer to the question was provided by Deroko, and lost with the 5 days of postings that vanished when the Server crashed.

    Because of my inexperience, I was closing the father after I detached the son, but before I let the son run again. So, when the father dies also die the mutex that the son uses to determine its role in the family. . .

  5. #5
    In this family soap opera, i am an uncle ;-)
    Or was anyway
    Real ones don't need source

Similar Threads

  1. ARTeam: Arma Raider 3.3 by Nieylana
    By Shub-nigurrath in forum Tools of Our Trade (TOT) Messageboard
    Replies: 3
    Last Post: March 4th, 2010, 20:33
  2. Arma protected DLL questions
    By 5aLIVE in forum OllyDbg Support Forums
    Replies: 6
    Last Post: October 20th, 2005, 13:58
  3. about Arma again
    By Xinner in forum OllyDbg Support Forums
    Replies: 7
    Last Post: September 13th, 2005, 02:54
  4. Seems like Arma detects virtual PCs..
    By Shub-nigurrath in forum Malware Analysis and Unpacking Forum
    Replies: 7
    Last Post: August 25th, 2004, 11:14

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •