Posted: Mon Jul 31, 2006 2:02 pm Post subject: A new Magic Jump?
I came across a series of Armadilloed programs over the weekend which seem to have a new Magic Jump, so I thought I'd share it with you. At least I'm guessing this is a new version of Armadillo, but maybe it's one of the older versions that I haven't seen yet. Anyway, the programs are protected by the standard protection options; that is, no code splicing or any of the other goodies. As all armadillo mongers know, all armadilloed programs have an import stealing routine in which certain Dll files are sent off into armadillo land and rely on the armadillo stub to function. Our job as crackers is to prevent this by patching a jump routine which selects these dlls to be stolen. The Magic Jump usually looks like this at DB5ACA:
The import table will be complete if the program is run with the above jump patched to an unconditional jump as shown.
However, as I was cracking a new program I noticed the import table wasn't being restored when this Magic Jump was patched. So I followed Haggar's tutorial and placed a BP on the beginning of the import table and broke at the point below. After a while, I noticed that position EF8EF9 has a jump that has to be NOP'd in order to eliminate stealing of the imports.
I'm not sure if it's against forum rules to divulge the program, but if the moderators tell me it's OK, I'll come back and tell you where you can get it. Otherwise, I guess you can PM me.
Until then, the looping routine that seems to be new--at least it was new to me--- is pasted below:
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You can attach files in this forum You can download files in this forum