Unpack mpress 1.2xx

[RedBlkJck]

@axl936
AFAIK registration at tuts4you is open. Unpacking different targets are well covered there. The post was a little long with having to solve a problem with olly setup, etc. Here is a shortened version of what I posted with some selective editing.


mpress is easy to unpack as there is very little to prevent unpacking. There is a generic pattern that can be used RET JMP, step, POPAD JMP = OEP There are olly scripts that will do this. Load the packed file in Olly. Scroll down in Olly until the code goes to all null bytes, scroll back up and you will see RET followed by JMP C3E9. Break on JMP and run. Step in after break. Scroll down in Olly again looking for the POPAD followed by JMP 61E9. Break on JMP and run. The JMP destination is your OEP. Step once and you are at OEP. Dump and rebuild your taget. It should run but this app is compiled with MS VC++ and uses floating point literal constants. Your dump will have a R6002 error msg.

The problem of R6002 error can be seen across other packers also. If UPX was used to pack the same file and you dumped it, the same error would occur in your dump. Just like Mpress your dump would have all the sections placed into the first section .UPX0 If you used UPX -d flag or a program like PE Explorer the unpacked UPX file would not have the error. This is because a copy of the original PE would be used to rebuild it back to the origial sections. Mpress doesn't include this so you would have to rebuild the original sections manualy.

This blog posting covers the problem of MSVC++ floating point that packers will have to deal with. It has an example not packed to demostrate the problem and how to track it. Read this to get an understanding of the R6002.
http://nezumi-lab.org/blog/?p=73

Ghandi posted some more indepth details on the tuts4you thread with other code list examples. I'm only quoting a small portion of ghandi's post.
Quote Ghandi
But it is sufficient to say that the following check is performed and if the call to IsNonWiteableInCurrentImage returns FALSE, it will throw that error. The fix is simple when the sections haven't been mangled, just change the permissions of '.rdata' to read only and if the sections have been mangled you can always patch the code itself to bypass this check.

PHP Code:

013E30C1                391D A8573E01    cmp dword ptr [__dyn_tls_init_callback],ebx
013E30C7                74 19                    je short 013E30E2
013E30C9                68 A8573E01        push offset __dyn_tls_init_callback
013E30CE                E8 BD040000        call _IsNonwritableInCurrentImage
013E30D3                59                              pop ecx
013E30D4                85C0                      test eax,eax
013E30D6                74 0A                    je short 013E30E2 


For a better understanding of what was going on, I used the example of r6002 bug from that blog posting and packed it with Mpress 2.17. Attached below with the original source.


Mpress takes all the sections and places them into one, the resource mappings are kept in their own section but the raw resources are placed into mpress1 section. .mpress2 section is packer code. If you change permissions to read only on .mpress1 of your dump, you are changing it for all the original sections and the app will crash with different error. The packer is dealing with the same problem of the rdata section, this is why the app doesn't crash while packed.

Basically a section of the file PE header will be read and checked for what permission attributes it has. It does not verify the permissions of the section as it is actually loaded in memory, just the PE. If the attributes of the section is read only then EAX = 00000001 on the RET to the call. When TEST EAX, EAX is performed, the next conditional jump JE SHORT will not jump. If EAX = 00000000 JE SHORT will JMP causing the R6002 msg. You can see this in the same code above from Ghandi @013E30D6. In testing with other examples of this, the result is the same.

So how you patch it is up to you. Just so the call causing the error msg is not the next instruction at JE SHORT. Using the packed demo and the break point method from the blog, I added some observation notes. Follow the same method with your Gearotic target and you will come to the same solution.

PHP Code:

0040719E        PUSH r6002dum.0041D680
004071A3        CALL r6002dum.0040E780

0040E780        MOV EDI, EDI
0040E782        PUSH EBP
......
......
0040E7D5        PUSH EAX
0040E7D6        PUSH r6002dum.00400000                  ; Image base
0040E7DB        CALL <r6002dum.ReadThePESections>       ;0040E730

0040E730        MOV EDI, EDI                            ;<ReadThePESections>
0040E732        PUSH EBP
0040E733        MOV EBP, ESP
0040E735        MOV EAX, DWORD PTR [EBP+8]              ; Stack SS:[0018FF0C]=00400000
0040E738        MOV ECX, DWORD PTR [EAX+3C              ; 0040003C ; Offset to PE signature
0040E73B        ADD ECX, EAX                            ; [00400054]
0040E73D        MOVZX EAX, WORD PTR [ECX+14]            ; 00400054 ; SizeOfOptionalHeader = E0 (224.)
0040E741        PUSH EBX
0040E742        PUSH ESI                                ; [00400046]
0040E743        MOVZX ESI, WORD PTR [ECX+6]             ; 00400046 ; NumberOfSections = 4
0040E747        XOR EDX, EDX
0040E749        PUSH EDI
0040E74A        LEA EAX, DWORD PTR [EAX+ECX+18]         ; 00400138 Address=00400138, (ASCII ".MPRESS1")
0040E74E        TEST ESI, ESI
0040E750        JBE SHORT r6002dum.0040E76D
0040E752        MOV EDI, DWORD PTR [EBP+C]
0040E755        MOV ECX, DWORD PTR [EAX+C]              ; 00400144 ; VirtualAddress = 1000
0040E758        CMP EDI, ECX
0040E75A        JB SHORT r6002dum.0040E765
0040E75C        MOV EBX, DWORD PTR [EAX+8]              ; 00400140 ; VirtualSize = 26000 (155648.)
0040E75F        ADD EBX, ECX                            ; ECX=00001000 EBX=00026000
....
....
0040E772        POP EBP
0040E773        RET                                     ; RET to 0040E7E0

0040E7E0        ADD ESP, 8
0040E7E3        TEST EAX, EAX
0040E7E5        JE SHORT r6002dum.0040E822              ; EAX+24 below is where your breakpoint should have brought you from blog post
0040E7E7        MOV EAX, DWORD PTR [EAX+24]             ; DS:[0040015C]=E00000E0; Characteristics = CODE|INITIALIZED_DATA|UNINITIALIZED_DATA|EXECUTE|READ|WRITE
0040E7EA        SHR EAX, 1F
0040E7ED        NOT EAX
0040E7EF        AND EAX, 1                              ; EAX becomes 00000000
0040E7F2        MOV DWORD PTR [EBP-4], -2
0040E7F9        MOV ECX, DWORD PTR [EBP-10]
0040E7FC        MOV DWORD PTR FS:[0], ECX
....
....
0040E809        POP EBP
0040E80A        RET                                     ; Return to 004071A8

004071A8        POP ECX                                 ; 
004071A9        TEST EAX, EAX                           ; Test EAX, if 0 we jump on JE to the error msg
004071AB        JE SHORT r6002dum.004071B7              ; If no jump the .section is read only, no error msg
004071AD        PUSH DWORD PTR [EBP+8]                  ; Patch JE to nop or inc eax before test so no jump
004071B0        CALL DWORD PTR [41D680]                 ; 


Anyway that is pretty much the posted summed up into one. Hope that explains it easier.
Credits to Ghandi (ARTeam) and KPNC blog post explaining the R6002 error.