Another Armadillo question

[MaRKuS-DJM]

you are trying to break CopyMem II enhanced version of Armadillo. put EBFE on the start of the 1000 bytes is wrong and so you won't get OEP.

a description how it works:
the main-process act as a debugger on the second, the second process is crypted. the second process throws an exception @OEP because OEP is crypted, so the main-process decrypts it, but only 1000 bytes. now the second process will be executed till it lands again at crypted code, throws an exception and the main-process decrypts again a 1000 byte block and the other block will be encrypted which was executed before. you have to manage to decrypt the second process completely and then dump. WaitForDebugEvent is the key to get OEP and put it in a endless loop.
i think you should read Ricardos tutorial on GetRight 5. it's great for this type of Armadillo. there's also an OllyScript plugin which can do it automatically, but it doesn't work in all cases.

best regards,
MaRKuS TH-DJM

PS: WaitForDebugEvent is the communicator between main-process and second process, so it's the key for all, i think.

there is also an ollyscript for detaching the parent from client (hxxp://ollyscript.apsvans.com/scripts/arma_unpack.txt)

[*RemedY*]

Hi,

first of all, thanks a lot for your answers. I really appreciate any help.
I tried the Ollyscript mentioned by Eggi, but it failed with an error-message from Olly ("Dont know how to bypass command at xxxxxxxx. Try to change EIP or pass exception to program"). If I pass the exception to the program, Olly fails at the same place as before, when I tried to set a breakpoint at "WriteProcessMemory". I tried it with Ollyscript 0.8 and the new 0.92. I guess it won´t work with this target.

@MaRKuS-DJM
I think reading a good tutorial on such a version of Arma is really the best way to understand whats going on within this protection. Unfortunally Ricardos FTP seems to be down. I did a Google-Search for this tut with several keywords such as "ARMADILLO FOR DUMMIES", "Ricardo Narvaja+GetRight" and so on, but all I found was two links to the OllyDbg-Forum where the tut is just mentioned - and two links to an unreachable site in China. So I would like to ask if someone knows where to get Ricardos tut for GetRight 5. Maybe someone can attach it here.

Thank you all very, very much for your help.

Best Regards *RemedY*

the ftp is also not working for me atm :/.