|
ARTeam Tutorial Visit:
http://cracking.accessroot.com
|
http://forum.accessroot.com Unpacking Yoda's cryptor 1.x/modified |
|
Information |
Unpacking yoda's cryptor 1.x / modified |
|
Target |
X-Attack |
|
Available |
|
|
Tools |
|
|
Protection |
Yoda's cryptor 1.x / modified |
|
level |
Beginner |
|
Category |
Unpacking |
|
Author |
Teerayoot - 28 July 2004 |
|
Requirements |
Windows XP, IE 5.5 and above for best viewing |
|
0.
Introduction
|
|
Hi all ,this is my first tut on ARTeam. This target is a VB application you can scan with PEiD to identify the target here is the evidence
Ok let's go on unpacking... |
|
1.
Unpacking Yoda's cryptor 1.x (modified)
|
Fire up OllyDbg and open the target you will land on EP of the target
now go to Modules Window (press Alt+E) you will see the "MSVBVM60" not load yet ,hmm i need to set BP inside that modules . Hit F9 run OllyDbg now ours modules loaded
ok when MSVBVM60 loaded i need to set BP inside that ... Press Ctrl+N to
Ok all setting done now restart OllyDbg and hit F9 again you will be land on the ThunRTMain that i previous set . Now press Alt+K go to Stack Window you will see the caller like
You see the caller that is a OEP ,you got it ! double click on that call
Select on 0040118C address and press Ctrl+* to move origin that address Ok we pause on the original entry point of the program ,we are ready to
Let's go on the Dumping ....
|
|
2. Dumping
The Target
|
As usual ,invoke OllyDump plugin and dump at that OEP
Let's go on IAT rebuilding....
|
|
3.
Rebuilding the IAT
|
|
Fire up Import Recontructor and select ours target
You see all functions we gets are all valid so let's select Fix Dump to fix ours dumped file.
Congratulation you are Done on manual unpacking yoda's cryptor 1.x / modified |
|
4. Conclusion
|
|
Lesson Learnt You learnt how easy to unpack VB apps packed/crypted program.
|
|
8. Greetingz
|
|
[MAIN TEAM] [Teerayoot] Any comments, suggestion PM me . |