More Armadillo - import reconstruction

FEARHQ,

Your on the right track with your app ;-)
He is using import elimination. In a previous thread about zclient i attached 2 tutorials in spanish. one of them is about arma 3.X who's using code splicing and import elimination, there a recently posted 2 news tuts about arma
I used a ollyscript with OpenMutexA to run the app in one olly process
Run the app and break at the OEP (screenshot)
on the call GetVersionExA do a follow in dump memory address
put a hw on access dword breakpoint on a right import (screenshot)
restart olly, run the app in single olly instance (OpenMutexA) end after several
incorrect breaks you'll land at the end of the import loop (screenshot)

Hope this will bring you on the right track...

Lownoise

[FEARHQ]

Thanks for the help lownoise, it encourages me to know I was on the right path I knew more or less how to get to the import elimination loop, but the problem is that to defeat debug blocker I need to start a new olly process and attach to the child, loosing any hw breakpoints... I cannot seem to find how to make it work in one single olly process - what script do you use to do that? I'm gonna try to translate the spanish tutorials in the meantime BTW, I know the target also uses code splicing because I saw jumps to wierd places in the code.