Funny Armadillo Behaviour

[hosiminh]

When Olly stops at "Single step event" , put BP on WriteProcessMemory (normal BP), you will see this is copymem2 + iat elimination is used...

magic call:
005E1DED E8 73000000 CALL 005E1E65


0012DA78 005DEE97 /CALL to WaitForDebugEvent from 005DEE91
0012DA7C 0012EB54 |pDebugEvent = 0012EB54
0012DA80 000003E8 \Timeout = 1000. ms

0012D918 005E2EAF /CALL to WriteProcessMemory from 005E2EA9
0012D91C 00000048 |hProcess = 00000048 (window)
0012D920 00524000 |Address = 524000
0012D924 003A8998 |Buffer = 003A8998
0012D928 00001000 |BytesToWrite = 1000 (4096.)
0012D92C 0012DA34 \pBytesWritten = 0012DA34


0012EB54 01 00 00 00 DC 07 00 00
...Ü..
0012EB5C 40 0D 00 00 01 00 00 80 @...
..��
0012EB64 00 00 00 00 00 00 00 00 ........
0012EB6C 0C 4D 52 00 02 00 00 00 .MR....
0012EB74 00 00 00 00 0C 4D 52 00 .....MR.
0012EB7C 0C 4D 52 00 01 00 00 00 .MR.
...
0012EB84 00 00 00 00 20 A0 02 83 ....  ƒ


oep== 00524D0C (in little endian)

00524D0C (oep) - 524000 (address) = D0C (delta)

D0C + 003A8998 (buffer) = 003A96A4

003A96A4 55 PUSH EBP
003A96A5 8BEC MOV EBP,ESP
003A96A7 6A FF PUSH -1
003A96A9 68 A0035900 PUSH 5903A0
003A96AE 68 F8955200 PUSH 5295F8
...


oep :
00524D0C > 55 PUSH EBP
00524D0D 8BEC MOV EBP,ESP
00524D0F 6A FF PUSH -1
00524D11 68 A0035900 PUSH 005903A0
00524D16 68 F8955200 PUSH 005295F8
....
00524D32 FF15 D0F6ED00 CALL DWORD PTR DS:[EDF6D0]
...