Funny Armadillo Behaviour

[hosiminh]

When Olly stops at "Single step event" , put BP on WriteProcessMemory (normal BP), you will see this is copymem2 + iat elimination is used...

magic call:
005E1DED E8 73000000 CALL 005E1E65


0012DA78 005DEE97 /CALL to WaitForDebugEvent from 005DEE91
0012DA7C 0012EB54 |pDebugEvent = 0012EB54
0012DA80 000003E8 \Timeout = 1000. ms

0012D918 005E2EAF /CALL to WriteProcessMemory from 005E2EA9
0012D91C 00000048 |hProcess = 00000048 (window)
0012D920 00524000 |Address = 524000
0012D924 003A8998 |Buffer = 003A8998
0012D928 00001000 |BytesToWrite = 1000 (4096.)
0012D92C 0012DA34 \pBytesWritten = 0012DA34


0012EB54 01 00 00 00 DC 07 00 00
...Ü..
0012EB5C 40 0D 00 00 01 00 00 80 @...
..��
0012EB64 00 00 00 00 00 00 00 00 ........
0012EB6C 0C 4D 52 00 02 00 00 00 .MR....
0012EB74 00 00 00 00 0C 4D 52 00 .....MR.
0012EB7C 0C 4D 52 00 01 00 00 00 .MR.
...
0012EB84 00 00 00 00 20 A0 02 83 ....  ƒ


oep== 00524D0C (in little endian)

00524D0C (oep) - 524000 (address) = D0C (delta)

D0C + 003A8998 (buffer) = 003A96A4

003A96A4 55 PUSH EBP
003A96A5 8BEC MOV EBP,ESP
003A96A7 6A FF PUSH -1
003A96A9 68 A0035900 PUSH 5903A0
003A96AE 68 F8955200 PUSH 5295F8
...


oep :
00524D0C > 55 PUSH EBP
00524D0D 8BEC MOV EBP,ESP
00524D0F 6A FF PUSH -1
00524D11 68 A0035900 PUSH 005903A0
00524D16 68 F8955200 PUSH 005295F8
....
00524D32 FF15 D0F6ED00 CALL DWORD PTR DS:[EDF6D0]
...

[TmC]

Stuck on the IAT. I succesfully recovered 2082 Splices but when i'm recovering the IAT i can't proceed.

I found the magic jump and modified it, then HE on GetModuleHandleA 3 times, go on memory map, do a search for kernel32.FindResourceA, hilight everything and paste on previous scrambled IAT.

The addresses do not change and are Identical in both olly windows. ArmInline so does not find the IAT and can't rebase it.

Where is the mistake?

Below there is my IAT.

[hosiminh]

InstVise.exe : armadillo 3.6x -> Copymem2 + iat elimination + codesplicing + nanomytes

I fixed iat elimination & nanos with ArmInline... dump now run without error .