Armadillo5 x64 Unpacking

From UIC

Armadillo v5 x64 basic unpacking

Infos
Author:	Pnluck
Email:	Pnluck@virgilio.it
Website:	http://pnluck.netsons.org
Date:	03/03/2008 (dd/mm/yyyy)
Level:
Language:	English
Comments:	Della serie alla tv c'è il grande fratello :(, ma per fortuna che c'è il Rev e la Radio trasmette il rock!!

Introduction

Armadillo is one of the most popular executable protectors, and it's one of the few that support PE+ executables.

Tools

Ida: I used this debugger
Explorer Suite: Task Explorer and CFF Explorer
Attached file: Unpackme, Security.dll and ItRebuilder demo

Tutorial infos

We're going to unpack the windows calc.exe protected by Armadillo with basic protection options.
Before reading this tutorial you should know how x64 architecture works: I advise you to read these articles:
Everything You Need To Know To Start Programming 64-Bit Windows Systems
Moving to Windows x64

I'm so impatient to write the first (I believe) unpacking tutorial on x64 executable in the RCE scene =)

Essay

A look inside the Armadillo Loader

Let's disasm the file with IDA: the EP of the loader is a normal Visual C++ EP, IDA actually recognises the WinMain at: 0x000000010001F000. We are looking for the Armadillo MainProc:

This call has another call inside it, that leads us to the real Armadillo_MainProc RVA_Section_EntryPoint + 000283A0 (00000001000283A0).
We notice a first check that uses a Mutex: this checks if the process is already running

If this check is passed the execution proceeds, and we reach this interesting code:

What is the Work_with_Dll thing? Well it's a loader function that loads in memory a packed dll (Security.dll), that is embedded in the executable: it is the core of the Armadillo protection.

FindSignatureOfPackedDll finds the first section of the executable image that begins with "PRDATA00".
Let's continue the analysis...

MemExtractDll extracts in memory the packed dll. DllLoad is a LoadLibrary-like function: it tries to load the dll at the correct ImageBase, then loads the ImportTable, calculates Relocations, and saves the entrypoint address in a variable.

Actually after call DllLoader there's this:

So I dumped the dll with Task Explorer to analyse it.
Now, on with the Work_with_Dll function:

What does the Security.SetFunctionAddress routine do?

This function saves in some variables the addresses of the functions that unpack the executable and are used to call the OEP of the executable.
Let's return to Work_with_Dll: after some useless code (useless to us), there's an interesting call:

Security.UnpackExecutable calls a function that executes some antidebug controls, and then calls other functions that implement these protections: Debug-Blocker, Copymem II, Nanomites, Import table elimination, Import redirection, Code Splicing etc...
After that we exit from Word_With_Dll and come back to Armadillo_MainProc. In the end there's the call to OEProc

Now we can see what Security.OEProc (at 0000000180060610) does:

That two "call rax" are used to call the real OEP of the executable, that (in this case) is:

Now we must talk briefly about IT: the IAT of the dumped file is not correct at all as you can see from this log:

Many API addresses were replaced by Security.dll functions: some useful, some not.
Useless functions were inserted in place of null qwords: an example is 1eda720

Others, the useful ones, replace -as I said- the real APIs: look at 1eda850:

Many Security.dll functions are inserted into the IAT, and act as wrappers of real APIs. They are used to replace null qword as many functions that call CreateProcess or CreateFile: in this case, you should decide if it is an api wrapper or a null qword.
That's all you need to know in order to be able to unpack ;)

Armadillo Unpacking

After that short introduction to the Armadillo loader, we can make a running dump.
Set a bp at 00000001000288B6, and step until a "call rax", and then press step into: we are at the OEP, who is at 00018CD0(RVA).
Now we can dump the process with Task Explorer, don't close the debugger or the debuggee!.
Open the dump file with CFF Explorer and delete the following from the Section Table: text1, pdata2 and rsrc.
After that we can null the IAT Directory, and we must change the .text section flags: select "Is executable", "is writable", "is readable".
Extract from the attached file ItRebuilder.exe (it's an IT Rebuilder built ad-hoc for this target) copy it into the same directory of the dumped file and run it. Enter the name of the dump, the entrypoint RVA and wait for the message "The file was successfully rebuilt".
Run the dumped file, does it work? Yeahh it works!! ;)

Pn[L]uck

Note Finali

Thx to Ntoskrnl, Que, Evilcry, ZaiRoN, Quake2, Ermes, 0x87k, Locu, Evo, StarzBoy (indian friend of mine), and everyone who I met ops also Pincopall, Active85k e DrWatson (me li stavo a scordà, nun sia mai :P)

Disclaimer