View Single Post
  #4  
Old 12-10-2004, 20:11
ricnar456 ricnar456 is offline
Friend
 
Join Date: May 2002
Posts: 290
Rept. Given: 1
Rept. Rcvd 28 Times in 10 Posts
Thanks Given: 0
Thanks Rcvd at 52 Times in 40 Posts
ricnar456 Reputation: 28
armadillo with copymem2

armadillo with copymem2 and nanomites are not hard to unpack, is only hard mechanichal work.
If you have the correct scritps made for help you in the task, the hard task is made by your machine and you go to sleep and when you return the 90% of the work is made automatically and with injects and scripts.
I unpack the armadillo.exe (3.77 version), make the dump takes 10 minutes with known methods, repair the table is a little more slow for the found of magic call is more difficult than previous versions but in 30 minutes the table is repaired and you are in the oep with all table perfect.
The last task is the nanomites, the first time is difficult for is needed write the scrits and injects to make the work this take me 1 or 2 days, but this will be write one only time, for the futures armadillos you have the hard work maded.
Next you put the injects and scripts to work for bruteforce the original program to try injecting in the nanomite routine starting in GetThreadContext and ending in SetThreadContext) you inject the address of the first nanomites and try for this value the 8 flag conbination for look all posibilities and store the results for each nanomite and posibilities of combination of flags,the second phase, with other script with the values stored you determine what type of jump is, where go to jump, and is ready, the last script acomodate the correct values in the dumped.
Is the better solution to the hard encription of the tables 1 to 4 than in newer versions are imposible to find and look for the values.
With this method you only need adjust your scripts to the new version (slightly changes) and the machine work for you, only you need a little manual adjust and the dumped is running.

Ricardo Narvaja
Reply With Quote