Armadillo 3.50a giving trouble

Ihad experienced your case.
In my case, I remaked new IAT.

First check the code.

00A7EA9E FF15 3461A800 CALL DWORD PTR DS:[A86134]

A86134 is virtual table of armadillo.


Set hardware breakpoint at 00A7EA9E+2. //00A7EAA
and trace..
3461A800<--- Armadillo patched code (Original code? I don't know..)
so You can find like this

Mov CS:[EAX],ECX
jmp yyyyyy // It will patch all code that access IAT.
KK: //end address of routine

EAX is 00A7EAA, & ECX is 00A86134
if you know ollyscript, you can make some script.

bp xxxxxx
bp kk
l_start:
esto
log eax
log ecx
cmp eip,kk
jne l_start
ret

then you will get like this log msg
XXXXXXXX Breakpoint at XXXXXXXX
eax = 00402C02
mem0 = 77E61BEA | kernel32.Sleep

and You have to make your own IAT maually or not.
(Some Address pointed Virtual table, you can trace and repair!!)

Sorry My english is so poor..

Thank you. I will try your method. I am reading on Nanomite in mean time. I hope to have a running exe soon.

Update:
OrionOnion you were 100% correct. It uses Nanomites. A shitload of them. Table 1 has 507 entries. Whoa!!!

00955208  E9 15 40 00 05 16 40 00  �@.@.
00955210  1B 16 40 00 33 16 40 00  @.3@.
00955218  5B 16 40 00 67 16 40 00  [@.g@.
00955220  8A 16 40 00 A4 16 40 00  Љ@.¤@.
.............

This is a weird beast though, the magic binary search "03 00 00 80" failed. Again back to a lot of F7's and F8's.

Hey Flagmax!

I Missing some information.

My previous answer is not perfect answer.

My arm 3.70a case used previous "mov [eax],ecx"
But arm 3.76 does not have that routine. (raw unpacked body already patched.)

you must repair IAT manually.
so I attach OllyScript script for Gathering IAT.

It maybe help you.

Hey OrionOnion

Can you send me the armadillo script for Gathering IAT,or post a link? Thanks

My email is [email protected]