OllyDbg Script for Armadillo Standard 3.xx-4.xx - Full IAT Red. fix

[Newbie_Cracker]

Originally Posted by codeX

Good work.
Is it gonna work on the detached child process??

yeah, as I tested, it worked for them.

Originally Posted by DappA

I've only managed to test this on a Notepad protected Armadillo 4.40 custom with IAT elimination and copymemII. Didnt seem to work.

I tested the attched file at this address, a tut from fly [CUG] for Armadillo standard 4.0-4.40, and my Ollydbg hanged !

http://forum.exetools.com/showthread.php?t=8457

I couldn't solve the problem on my WinXP SP1 !

Can you attach your packed notepad.exe?
Did you test script on detached child process or on father process?

But thanks, I chaned patching routine to your method (previous method is working too !)


Script is updated. Download it from first post

[fly [CUG]]

Originally Posted by newbie_cracker

I tested the attched file at this address, a tut from fly [CUG] for Armadillo standard 4.0-4.40, and my Ollydbg hanged !
http://forum.exetools.com/showthread.php?t=8457
I couldn't solve the problem on my WinXP SP1 !

It's Only for Armadillo V4.0-V4.4 Standard Only and Standard plus Debug Blocker Protection.

[Newbie_Cracker]

Finally I fixed it. But I was compelled to remove logging of import addresses. Doing manual steps, as in first script, is only solution to log the addresses. Logging is necessary in case of CopyMem-II & Import Elimination.

Now it's compatible with all versions of Armadillo (as I tested).

As I see, logging and stopping at oep is not possible in Arma 4.4 by using current version of script plugins. Only one of them is applicable !
Maybe there is a little bug in OllyScript and ODBGScript.
Stepping the script using ODBGScript window, gives a fully working script, but running it, causes troubles !

I've a question :
Logging import addresses is more important, or stopping at OEP?
If first, I can change script to stop after fixing and logging imports, then user should put bp on CreateThread and find CALL OEP, manually, or use a 2nd script.

Which one is better?

PS:
I devided first script in two scripts :
1- Import Redirection Fixer
2- OEP Finder

They work perfect !