View Single Post
  #5  
Old 06-03-2006, 21:08
deroko's Avatar
deroko deroko is offline
cr4zyserb
 
Join Date: Nov 2005
Posts: 217
Rept. Given: 13
Rept. Rcvd 30 Times in 14 Posts
Thanks Given: 7
Thanks Rcvd at 33 Times in 16 Posts
deroko Reputation: 30
Once you fix magic jmp set hardware breakpoint on read on instructio above it, then later during some checkum check your hardware breakpoint will be hit, change fixed jmp to old value and continue to oep. Also armadillo has 0xcc check in first few bytes of api during virtual.dll initialization. But after that there are no check so when you hit magic jmp set bpx on CreateThread and it should work. Also you may set bpx on 2nd layer API (that's how I call them - situation when some API is wrapper for other API - VirtualAlloc -> VirtualAllocEx or CreateThread -> CreateRemoteThread for example) and that will solve any int3h detection in all protectors so far

Usually I use expresion in sice to solve this problem by simple typing:

bpm magic_jmp x do "r eip good_place;x;" and let sice to popup a few times till iat isn't fixed

I hope this helps
__________________
http://accessroot.com

Last edited by deroko; 06-03-2006 at 21:11.
Reply With Quote