Armadillo IAT Rebuild

[Newbie_Cracker]

This is an old version of Armadillo with debug blocker protection.

After reaching OEP by famous CreateThread method, put hardware bp on one of its imports found by ImpRec. You'll stop here :

00E22266    8B85 74FCFFFF   MOV EAX,DWORD PTR SS:[EBP-38C]
00E2226C    8B8D 6CFCFFFF   MOV ECX,DWORD PTR SS:[EBP-394]
00E22272    8908            MOV DWORD PTR DS:[EAX],ECX               -> IAT writing
00E22274    8B85 74FCFFFF   MOV EAX,DWORD PTR SS:[EBP-38C]

Scroll up a little and you've this code :

00E22200    E8 EB2B0000     CALL 00E24DF0
00E22205    59              POP ECX
00E22206    59              POP ECX
00E22207    40              INC EAX
00E22208    8985 9CFEFFFF   MOV DWORD PTR SS:[EBP-164],EAX
00E2220E    FFB5 64FCFFFF   PUSH DWORD PTR SS:[EBP-39C]
00E22214    FFB5 88FCFFFF   PUSH DWORD PTR SS:[EBP-378]
00E2221A    E8 3929FFFF     CALL 00E14B58                  -> Redirection call
00E2221F    8985 6CFCFFFF   MOV DWORD PTR SS:[EBP-394],EAX
00E22225    83BD 6CFCFFFF 0>CMP DWORD PTR SS:[EBP-394],0
00E2222C    75 38           JNZ SHORT 00E22266
00E2222E    8B45 08         MOV EAX,DWORD PTR SS:[EBP+8]
00E22231    8B00            MOV EAX,DWORD PTR DS:[EAX]
00E22233    C700 03000000   MOV DWORD PTR DS:[EAX],3
00E22239    FF15 C4B0E200   CALL DWORD PTR DS:[E2B0C4]               ; ntdll.RtlGetLastWin32Error
00E2223F    50              PUSH EAX
00E22240    FFB5 64FCFFFF   PUSH DWORD PTR SS:[EBP-39C]
00E22246    FFB5 70FCFFFF   PUSH DWORD PTR SS:[EBP-390]
00E2224C    68 80E5E200     PUSH 0E2E580                             ; ASCII "File "%s", function "%s" (error %d)"
00E22251    8B45 08         MOV EAX,DWORD PTR SS:[EBP+8]
00E22254    FF70 04         PUSH DWORD PTR DS:[EAX+4]
00E22257    E8 502C0000     CALL 00E24EAC

Enter the mentioned call :

00E14B58    55              PUSH EBP
00E14B59    8BEC            MOV EBP,ESP
00E14B5B    53              PUSH EBX
00E14B5C    56              PUSH ESI
00E14B5D    57              PUSH EDI
00E14B5E    33FF            XOR EDI,EDI
00E14B60    33DB            XOR EBX,EBX
00E14B62    66:F745 0E FFFF TEST WORD PTR SS:[EBP+E],0FFFF
00E14B68    75 03           JNZ SHORT 00E14B6D
00E14B6A    8B5D 0C         MOV EBX,DWORD PTR SS:[EBP+C]
00E14B6D    57              PUSH EDI
00E14B6E    FF15 A4B0E200   CALL DWORD PTR DS:[E2B0A4]               ; kernel32.GetModuleHandleA
00E14B74    8B4D 08         MOV ECX,DWORD PTR SS:[EBP+8]
00E14B77    3BC8            CMP ECX,EAX
00E14B79    75 07           JNZ SHORT 00E14B82
00E14B7B    B8 18D3E200     MOV EAX,0E2D318
00E14B80    EB 30           JMP SHORT 00E14BB2
00E14B82    393D D8D7E200   CMP DWORD PTR DS:[E2D7D8],EDI
00E14B88    B8 D8D7E200     MOV EAX,0E2D7D8
00E14B8D    74 0C           JE SHORT 00E14B9B
00E14B8F    3B48 08         CMP ECX,DWORD PTR DS:[EAX+8]
00E14B92    74 1B           JE SHORT 00E14BAF
00E14B94    83C0 0C         ADD EAX,0C
00E14B97    3938            CMP DWORD PTR DS:[EAX],EDI
00E14B99  ^ 75 F4           JNZ SHORT 00E14B8F
00E14B9B    FF75 0C         PUSH DWORD PTR SS:[EBP+C]
00E14B9E    FF75 08         PUSH DWORD PTR SS:[EBP+8]
00E14BA1    E8 41000000     CALL 00E14BE7
00E14BA6    59              POP ECX
00E14BA7    59              POP ECX
00E14BA8    5F              POP EDI
00E14BA9    5E              POP ESI
00E14BAA    5B              POP EBX
00E14BAB    5D              POP EBP
00E14BAC    C2 0800         RETN 8
00E14BAF    8B40 04         MOV EAX,DWORD PTR DS:[EAX+4]
00E14BB2    3BC7            CMP EAX,EDI
00E14BB4  ^ 74 E5           JE SHORT 00E14B9B              -> Patch to JMP
00E14BB6    3978 08         CMP DWORD PTR DS:[EAX+8],EDI
00E14BB9    8BF0            MOV ESI,EAX
00E14BBB  ^ 74 DE           JE SHORT 00E14B9B

If you patch the above JE to JMP, import redirection will be defeated.