Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 07-05-2005, 07:04
Maltese
 
Posts: n/a
New OllyDbg detection by Armadillo?

I just ran across something quite strange today. I am examining the target TheaterTek 2.11 with OllyDbg.

I have HideDebugger and the OutputDebugStringA patch installed. I also renamed Ollydbg.exe to "this.exe"

When I examine the code with Version 2.0 of TTek, I find there are 3 subroutines concerning ArmAccess. VerifyKey, InstallKey, and EnvironmentUpdate.

When I step through version 2.0 these routines confirm LoadLibraryA of armaccess.dll (inside the packed exe) and it jumps into the 39xXXX range which is where the Armadillo code is located within TTek 2.0.

This is good. Now here is where it changes.

I installed the 2.11 patch and now the same 3 routines fail to LoadLibraryA of armaccess.dll. Matter of fact there are a bunch of CALL ESI routines for checking USERNAME, USERKEY that no longer point to the 39xXXX range. They now show CALL ESI; kernel32.GetEnvironmentVariableA.
*NOTE: When you unpack the armadillo .exe file these CALL ESI do show as kernel32.GetEnvironmentVariableA, but never inside the original packed code till now.

When you close Olly and execute the original 2.11 exe file, it does check the ArmAccess information.

Does anyone know why the original packed Armadillo .exe would no longer point towards the internal Armadillo code between 2 versions of the program?

PeID .93 reports Armadillo 3.78

Any help would be appreciated.
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to disable VM detection? te$ter General Discussion 3 05-16-2015 17:06
OllyDbg Script for Armadillo Standard 3.xx-4.xx - Full IAT Red. fix Newbie_Cracker General Discussion 14 01-29-2006 20:40
Unseen Debugger Detection (Ollydbg) Peter[Pan] General Discussion 27 10-17-2005 09:34


All times are GMT +8. The time now is 21:07.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )