RE FORUM

[REVERSE ENGINEERING] => General Discussion => Topic started by: mIRACLELive on July 31, 2010, 07:07:37 PM

Title: EntryPoint v OllyDBG
Post by: mIRACLELive on July 31, 2010, 07:07:37 PM: Mam otázku. Každý súbor čo otvorím v OllyDBG (WinXP) mi začína JMP, ale pred mesiacom som to nemal. (unpack armadillo programu vo voľnom čase), ked som na Win7 tak tam mam hned PUSHAD.

ako napr

004B3000 armad>- E9 FBCFAE7F JMP 7FFA0000
004B3005 005D 50 ADD BYTE PTR SS:[EBP+50], BL
004B3008 51 PUSH ECX
004B3009 0FCA BSWAP EDX
004B300B F7D2 NOT EDX
004B300D 9C PUSHFD
004B300E F7D2 NOT EDX
004B3010 0FCA BSWAP EDX
004B3012 EB 0F JMP SHORT 004B3023 ; armadill.004B3023
004B3014 B9 EB0FB8EB MOV ECX, EBB80FEB
004B3019 07 POP ES ; Modification of segment register
.
.
.

ten JMP je stale ten isty

7FFA0000 68 00304B00 PUSH 4B3000
7FFA0005 60 PUSHAD
7FFA0006 68 2C02FA7F PUSH 7FFA022C
7FFA000B 6880000000 PUSH 80
7FFA0010 68 3402FA7F PUSH 7FFA0234
7FFA0015 68 3002FA7F PUSH 7FFA0230
7FFA001A 68 FFFFFFFF PUSH -1
7FFA001F E8 CAD696FC CALL 7C90D6EE ; ntdll.ZwProtectVirtualMemory
7FFA0024 B8 60E80000 MOV EAX, 0E860
7FFA0029 3E:A3 00304B00 MOV DWORD PTR DS:[4B3000], EAX
7FFA002F B8 00005D50 MOV EAX, 505D0000
7FFA0034 3E:A3 04304B00 MOV DWORD PTR DS:[4B3004], EAX
7FFA003A 6810000000 PUSH 10
7FFA003F 68 00304B00 PUSH 4B3000
7FFA0044 68 FFFFFFFF PUSH -1
7FFA0049 E8 F0D296FC CALL 7C90D33E ; ntdll.ZwFlushInstructionCache
7FFA004E 68 2402FA7F PUSH 7FFA0224
7FFA0053 68 0402FA7F PUSH 7FFA0204
7FFA0058 6800000000 PUSH 0
7FFA005D 6800000000 PUSH 0
7FFA0062 E8 5C6397FC CALL 7C9163C3 ; ntdll.LdrLoadDll
7FFA0067 BF A87E917C MOV EDI, 7C917EA8
7FFA006C 85C0 TEST EAX, EAX
7FFA006E 75 2B JNZ SHORT 7FFA009B
7FFA0070 68 2802FA7F PUSH 7FFA0228
7FFA0075 6800000000 PUSH 0
7FFA007A 68 1402FA7F PUSH 7FFA0214
7FFA007F 3E:A1 2402FA7F MOV EAX, DWORD PTR DS:[7FFA0224>
7FFA0085 50 PUSH EAX
7FFA0086 FFD7 CALL NEAR EDI
7FFA0088 85C0 TEST EAX, EAX
7FFA008A 75 0F JNZ SHORT 7FFA009B
7FFA008C 3E:A1 2802FA7F MOV EAX, DWORD PTR DS:[7FFA0228>
7FFA0092 50 PUSH EAX
7FFA0093 5F POP EDI
7FFA0094 6800000000 PUSH 0
7FFA0099 FFD7 CALL NEAR EDI
7FFA009B 61 POPAD
7FFA009C C3 RETN

Po tomto kode som naspet na EP ale pozmenenom:

004B3000 armad> 60 PUSHAD
004B3001 E8 00000000 CALL 004B3006 ; armadill.004B3006
004B3006 5D POP EBP
004B3007 50 PUSH EAX
004B3008 51 PUSH ECX
004B3009 0FCA BSWAP EDX
004B300B F7D2 NOT EDX
004B300D 9C PUSHFD
004B300E F7D2 NOT EDX
004B3010 0FCA BSWAP EDX
004B3012 EB 0F JMP SHORT 004B3023 ; armadill.004B3023
004B3014 B9 EB0FB8EB MOV ECX, EBB80FEB
004B3019 07 POP ES ; Modification of segment register

ked sa niekto s tým stretol nech mi odpise
Title: Re: EntryPoint v OllyDBG
Post by: HypnotiX on August 01, 2010, 01:55:07 PM: Mam odpoved, pred mesicem jsi nemel v pocitaci vir.
Title: Re: EntryPoint v OllyDBG
Post by: mIRACLELive on August 01, 2010, 03:22:04 PM: C: som preskenoval AVAST-om, Win Defender , a portable kaspersky a nic mi na HDD nenaslo. Mam preinstalovat?
Moze to byt aj nejakym programom, na ochranu?
Title: Re: EntryPoint v OllyDBG
Post by: pr0p4g4nd4 on August 02, 2010, 05:51:38 AM: jedine NOD32 a nikdy inak! skus ten, urcite ti najde vsetky viri :D :D
Title: Re: EntryPoint v OllyDBG
Post by: NeptuN on August 02, 2010, 03:11:48 PM: Pokud to mas opravdu v kazdem otevrenem soubore, tak se take domnivam, ze se jedna o virus.

Doporucuji reinstall, jakmile je tvuj pocitac kompromitovan, tak nikdy nevis ...

Pokud chces odstranit pouze virus (automaticky ocekavas, ze drive ci pozdeji ti nejaka havet kompa zas napadne a reinstall se bude opakovat), reinstall Windowsu by mohl stacit. Vazne ale doporucuji udelat si po nove instalaci bitovou kopii systemu. V pripade pristiho napadeni tak ti obnova zabere maximalne par hodin.

Pokud chces problem vyresit jednou provzdy (napriklad jako ja ;D ) tak unix je podminkou. Ubuntu je na install docela easy (hry pod Win clovek k zivotu stejne nepotrebuje, a vetsinou nestoji za nic), pokud jses vetsi drsnak, doporucuji openbsd ( bez grafickeho rozhrani, s diskovym sifrovanim samozrejme + bitova kopie systemu nikdy neuskodi ) ;)

A do tretice, pokud reinstall nepripada v uvahu, stale muzes kazdy program spustit v ollym, a ty jumpy vynopovat ::)

You choice, enjoy ;D
Title: Re: EntryPoint v OllyDBG
Post by: pr0p4g4nd4 on August 03, 2010, 08:36:49 AM: pokial nepomahaju antiviry, tak si system skontroluj rucne. najst virus by nemalo byt tazke(aj ked zalezi od viru) - teda dufam, ze si na to dostatocne zrucny, ze? :)
Title: Re: EntryPoint v OllyDBG
Post by: mIRACLELive on August 04, 2010, 08:58:30 AM: Pre: NeptuN
Na notebooku mam WinXP+Win7+OpenSuse.
Pre WinXP a Win7 mam OneKey Recovery, tak nie je problem obnova niektorého windowsu.
Pre: pr0p4g4nd4
Hľadal som aj manualne ale nič.

-Ale často som v openSuse, kvoli internetu :D, Provider tu vysiela internet cez wifi (4Mb), kde IP adresa je viazana na MAC adresu a v openSuse sa da pekne menit MAC adresa. ;) IP a MAC adresy cez CommView for WiFi v6.2 vo Win7.-

Už som to preinstaloval, a je to ako ma byť.
??Ale neviem či to nebol ZoneAlarm, trocha som to ladil a stále tam načitalo len súbor ForceShield.dll z adresara ZoneAlarm.??

Som este len začiatočník. Trocha som kódoval v delphi 6, C++, a crackol-unpakol nejaké crackme, sice aj programy, ale len tak rekreačne (armadillo, aspack, asprotect)

Vďaka za odpovede
Title: Re: EntryPoint v OllyDBG
Post by: ilm on August 05, 2010, 01:38:30 PM: Menit MAC adresy ide celkom v pohode aj v XP... ;), to len pre info. Nechcem Ta odhovarat od Linuxu...
Title: Re: EntryPoint v OllyDBG
Post by: llAmElliK on August 05, 2010, 09:52:42 PM: Quote from: ilm on August 05, 2010, 01:38:30 PM
Menit MAC adresy ide celkom v pohode aj v XP... ;), to len pre info. Nechcem Ta odhovarat od Linuxu...

Samozrejme (i ve Viste) - V XP dokonce bez nejakych dalsich aplikaci (aMac apod)...
Bud primo v nastaveni advanced, nebo v registrech... :)
Title: Re: EntryPoint v OllyDBG
Post by: mIRACLELive on August 08, 2010, 02:39:48 PM: Niektoré Wifi to nepodporujú napr. ta moja - Intel(R) WiFi Link 5100 AGN. Skúšal som to aj cez registry ale stále si drží tu svoju MAC adresu. Ale v OpenSuse ju zmením v pohode :)