Contribute  :  Web Resources  :  Past Polls  :  Site Statistics  :  Downloads  :  Forum  
    BiW ReversingThe challenge is yours    
 Welcome to BiW Reversing
 Tuesday, February 19 2019 @ 08:20 AM CET
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Armadillo 4.x + Debug Blocker

 
Post new topic   Reply to topic    www.reversing.be Forum Index -> Unpacking
View previous topic :: View next topic  
Author Message
shinobiX
New to the board
New to the board


Joined: 24 Jul 2006
Posts: 3

PostPosted: Thu Jul 27, 2006 2:58 am    Post subject: Armadillo 4.x + Debug Blocker Reply with quote

I was trying to follow haggars tutorial on Armadillo with debug blocking. I used the IsDebuggerPresent plugin and set the proper breakpoints, but as I run the program I end up here.

0045F5C4 F0:C7 ??? ; Unknown command
0045F5C6 C8 64678F ENTER 6764,8F
0045F5CA 06 PUSH ES
0045F5CB 0000 ADD BYTE PTR DS:[EAX],AL
0045F5CD 83C4 04 ADD ESP,4
0045F5D0 C3 RETN

Although I continue to press f9 i get an error
"Don't know how to bypass command at address 0045f5c5. Try to change EIP or pass exception to program."

Does anyone have a clue whats happening here, or know what I am doing wrong?
Back to top
View user's profile Send private message
SKiLLa
Frequent poster
Frequent poster


Joined: 29 Mar 2005
Posts: 79

PostPosted: Thu Jul 27, 2006 1:30 pm    Post subject: Reply with quote

Quote:
ADD BYTE PTR DS:[EAX],AL


Since the code above is frequently used to generate exceptions when Arma detects that the program is being debugged; I guess you're being detected and the code is just some 'crash the program'-code ...

Perhaps you're being caught by the 'GetTickCount()' ? Otherwise try the OllyAdvance plugin and then try your target again ....
Back to top
View user's profile Send private message
shinobiX
New to the board
New to the board


Joined: 24 Jul 2006
Posts: 3

PostPosted: Fri Jul 28, 2006 3:26 am    Post subject: Running Reply with quote

I am currently using OllyAdvance but even so, I'm not even able to run the application from the debugger at all.
Back to top
View user's profile Send private message
Knight
Regular
Regular


Joined: 21 Aug 2005
Posts: 122

PostPosted: Fri Jul 28, 2006 5:35 am    Post subject: Reply with quote

And what happens if you hit Shift+F9? If it breaks on other exception, then again on some other... while program start running without any exceptions, then it's normal. Protectors are usually full of exceptions, we can use them for our own purposes (to easier find oep) or we can configure olly to pass them to program (Check Options->Debuging Options->Exceptions).

Regards,
Knight
Back to top
View user's profile Send private message
shinobiX
New to the board
New to the board


Joined: 24 Jul 2006
Posts: 3

PostPosted: Fri Jul 28, 2006 6:03 am    Post subject: Reply with quote

Without exceptions I land on another piece of code:

004561B3 8F00 POP DWORD PTR DS:[EAX] ; 0012FFE0
004561B5 64:67:8F06 0000 POP DWORD PTR FS:[0]
004561BB 83C4 04 ADD ESP,4
004561BE 58 POP EAX


But the application still does not run.

Also:
0045F5C4 F0:C7 ??? ; Unknown command
is an illegal instruction. And no matter if i have exceptions or not if i continue to shift-f9 I always end up with this.
Back to top
View user's profile Send private message
BioDuo
New to the board
New to the board


Joined: 03 Mar 2006
Posts: 1

PostPosted: Sun Sep 10, 2006 8:43 pm    Post subject: Reply with quote

I think the problem is that your olly doesn't send the exception to Armadillo.
Go to debugging options --> SFX
Be sure that you've checked the first and last option.

Also like Knight said, be sure that you've checked all Exceptions in the debugging options.

Good luck!
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    www.reversing.be Forum Index -> Unpacking All times are GMT + 1 Hour
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group
 Copyright © 2019 BiW Reversing
 All trademarks and copyrights on this page are owned by their respective owners.
Powered By Geeklog 
Created this page in 0.05 seconds