How to defeat Password Reminder 1.6 ? (An unknown protector)

The most powerful tool is FrogsIce - this reports type of antidebugging protection
and EIP address.However, it exists only for Win98 ...

regards.

[Newbie_Cracker]

Only IceExt could bypass its SoftIce detection. But in OllyDbg...

The only possible ways for OllyDbg detection are describied in Pumqara's article. All of the methods could be bypassed except APi Redirection of OllyDbg. When I try to set Memory Breakpoint on GetProcAddress, SDProtector detetcs the BP and cuases an exception which OllyDbg could not process it.
When I set Harware Breakpoints, SDProtector caused below exception :

004EB707   |74 08                 JE SHORT PASSWORD.004EB711
004EB709   |D0AB 0A120010   SHR BYTE PTR DS:[EBX+1000120A],1

The address contanis nothing and debugging will be finished. I converted the JE to JMP and execption never occured.
After that, the second exception occured :

004FBB7A    8038 CC         CMP BYTE PTR DS:[EAX],0CC
004FBB7D    74 0A            JE SHORT PASSWORD.004FBB89

The first line could not be processed. I tried to NOPed it (before executing), but there was alot this CMP, more than 40 (I became tired to count it ).
After NOPing about 6th of them, program debugged normally. Then a message poped up :

Don't know how to continue because memory at address 76ADF 3F7 is not readab. Try to change EIP or pass exception to program.

After pressing SHIFT+F9, the famous strings of Debugger detected appeared it STACK WINDOW, without any messagebox.

That was the whole story.

One question is important :
Is there a fixed address in memory which used by OllyDbg for storing breakpoint addresses? How SDProtector detects them?


And I have another question. Please somebody answer me :
Why existing loader generators couldn't grap ProcessID of protected program by SDProtector?

Thanks for reading this damn post.
Please share your information about SDProtector.

Best regards.

[taos]

Originally Posted by newbie_cracker

[CODE]

004FBB7A    8038 CC         CMP BYTE PTR DS:[EAX],0CC
004FBB7D    74 0A            JE SHORT PASSWORD.004FBB89

This code "maybe" a BP detection because CC is the opcode of INT 3.

Originally Posted by newbie_cracker

Is there a fixed address in memory which used by OllyDbg for storing breakpoint addresses? How SDProtector detects them?

AFAIK when you set a BP, Olly puts a CC to use its handler, so I think no memory is used to store it, only wait until INT 3.
If you're talking about Hardware BP, I think Olly stores its addresses in a local var, so no fixed address...Ummh!! I know that Registers DR0-DR3 are for debug breakpoints and curiously Olly only can set 4 Hardware BP .
The protection can read and compare this registers.
Maybe that uses a code-execute time detection too.

Regards

[Newbie_Cracker]

Thanks taos.

Originally Posted by taos
This code "maybe" a BP detection because CC is the opcode of INT 3.

When I set only hardware BP, SDProtector checks the presence of "int 3" ? The above mentioned CMP could not be done and...debugging will be finished. It's unusual !

How could I know where it reads dr0 to dr3 values?
There is a jungle of junk codes

I red somewhere about fs:[20h] and fs:[30h] tricks used by ACProtect. Maybe SDProtector uses them too. The question is method of finding them.
Is it possible using conditional tracing like this ?
TC EIP=="some opcodes"

Regards.

today i played with this target.. check if all is OK.
btw, it's marked as SD1.1 at start of 1st section??

original IT restored; OEP bytes restored from 00495C50h;
resource restored by PExplorer; there was 7 crypted code blocks,
wich decrypted on runtime;

..
shit, failed for attach!

at hxxp://www.angelfire.com/indie/zong


EnJoy

[hosiminh]

@newbie_cracker

For Imprec - it looks for file "ImportREC.exe" and for title "Import REConstructor v1.6..."

You can easy change title with Customizer or similar program.


For LordPE - SDpacker absolutely hates this tool . Apply the same steps as for ImpRec

btw. It shows wrong Image_Size of process ( 0x00036000 ). Use any other tools for dumping .



@KaGra

I like your tuts , but what would you do if your target is packed with regged version of packer and you don't have intro Nag to attach ?