Armadillo 3.76 - tips needed
 

Hello!

Got some problems with an Armadillo 3.76 target.

I successfully detach the child process, attach a new OllyDbg to it and patch the EP bytes from JMP EIP to the original ones. But then I really don't know what to do. Breakpoint on CreateThread gets me nowhere.

If I try the old method (setting a mem breakpoint on the code section and running) it breaks somewhere that is NOT OEP.

When I don't do anything (just patch in the original bytes and run passing exceptions back to program) the program terminates! I guess it somehow detects it's not attached to the parent process anymore... (?)

Can someone please give me some tips?

PS Of course I've read the tuts (by ricardo and mephisto), but those are for older versions and doesn't seem to work anymore?

is your application coded in vb or delphi?

does it make a difference ? :cool:

Humm, I think its vc with mfc

GetProcAddress
 

use Bp GetProcAddress on midle (after happen some exceptions), it will take a bit delay but you can place your self to oep, count how much api after your soft working, e.g after 50 break your soft running, restart and do same step until 49 ctrl-f9 and follow code ....

here, maybe this can help you:

http://66.98.132.48/fravia/Armadillo_3.xx_tutorial-MEPHiST0.rar

xzz: thats actually the issue at question - when the child process is disconnected from the parent (DebugActiveProcessStop) the child process just terminates - it doesnt run as usual.

bEaST: thanks, but the techniques described there dont apply to dildo 3.76. =)

Posibility is used Advanced Softice Detect :) i thing terminate caused by bp or debuggerpresents, can you look there eax 0 ?

Crassy,
have you resolved the problem?
why i have the same problem!
I follow the good Mephisto tutorial at:

http://www.absolutelock.de/construction/files/infobase/New/arma_debugblocker/tutorial.html

But on CreateThread i have the same problem ..
i also tried with break SetProcessWorkingSetSize .. but nope!
Write if you have news.
Bye

Hi,
On a similar target I landed on OEP by setting a memory access breakpoint on text section! Maybe it's the same?