Flag: Tornado! Hurricane!


Packer Name Packer Author Classification Analysis By Last Updated
FSG 1.33 dulek Compressor quig June 15 2005
Allocation Anti-Debug Anti-Disassembly Section Name Sample
PE Header (sect 1) yes yes [blank] N/A
Notes
IAT built at runtime, all DLLs explicitly loaded with calls to LoadLibrary().

Stub is basically straight line logic with some built in functions that it calls out to them returns back to mainline stub.

JE to OEP stands out because of its address range see above block..it is close to end of stub.

offsets should line up in sample

Transfer Command
JE in middle of loop

00405FAA   79 05            JNS SHORT length2.00405FB1
00405FAC   46               INC ESI
00405FAD   AD               LODS DWORD PTR DS:[ESI]
00405FAE   50               PUSH EAX
00405FAF   EB 09            JMP SHORT length2.00405FBA
00405FB1   FE0E             DEC BYTE PTR DS:[ESI]
00405FB3  -0F84 B3B2FFFF    JE length2.0040126C     -----OEP-------
00405FB9   56               PUSH ESI
00405FBA   55               PUSH EBP
00405FBB   FF53 04          CALL DWORD PTR DS:[EBX+4]
00405FBE   AB               STOS DWORD PTR ES:[EDI]
00405FBF  ^EB E0            JMP SHORT length2.00405FA1
00405FC1   33C9             XOR ECX,ECX
00405FC3   41               INC ECX
00405FC4   FF13             CALL DWORD PTR DS:[EBX]
00405FC6   13C9             ADC ECX,ECX
00405FC8   FF13             CALL DWORD PTR DS:[EBX]
00405FCA  ^72 F8            JB SHORT length2.00405FC4
00405FCC   C3               RETN
00405FCD   02D2             ADD DL,DL
00405FCF   75 05            JNZ SHORT length2.00405FD6
00405FD1   8A16             MOV DL,BYTE PTR DS:[ESI]
00405FD3   46               INC ESI
00405FD4   12D2             ADC DL,DL
00405FD6   C3               RETN
00405FD7   FF5F 00          CALL FAR FWORD PTR DS:[EDI]       
00405FDA   0000             ADD BYTE PTR DS:[EAX],AL
00405FDC   0000             ADD BYTE PTR DS:[EAX],AL
00405FDE   0000             ADD BYTE PTR DS:[EAX],AL
00405FE0   0000             ADD BYTE PTR DS:[EAX],AL
00405FE2   005401 00        ADD BYTE PTR DS:[ECX+EAX],DL
00405FE6   00FF             ADD BH,BH
00405FE8   5F               POP EDI
00405FE9   0000             ADD BYTE PTR DS:[EAX],AL
00405FEB   0000             ADD BYTE PTR DS:[EAX],AL
00405FED   0000             ADD BYTE PTR DS:[EAX],AL
00405FEF   0000             ADD BYTE PTR DS:[EAX],AL
00405FF1   0000             ADD BYTE PTR DS:[EAX],AL
00405FF3   0000             ADD BYTE PTR DS:[EAX],AL
00405FF5   0000             ADD BYTE PTR DS:[EAX],AL
00405FF7   0000             ADD BYTE PTR DS:[EAX],AL
00405FF9   0000             ADD BYTE PTR DS:[EAX],AL
00405FFB   0000             ADD BYTE PTR DS:[EAX],AL
Entry Point Signature
BE [4Bytes]      MOV ESI,Address
AD               LODS DWORD PTR DS:[ESI]
93               XCHG EAX,EBX
AD               LODS DWORD PTR DS:[ESI]
97               XCHG EAX,EDI
AD               LODS DWORD PTR DS:[ESI]
56               PUSH ESI
96               XCHG EAX,ESI
B2 80            MOV DL,80
Known Unpackers
/*
//////////////////////////////////////////////////
	FSG 1.33 OEP Finder v0.2
	Author:	loveboom
	Email : bmd2chen@tom.com
	OS    : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
	Date  : 2004-4-2
	Config: N/A
	Note  :If you have one or more question 
		email me please,thank you!
//////////////////////////////////////////////////
*/

var addr
var addr1

gpa \"LoadLibraryA\",\"kernel32.dll\"
bp $RESULT
run

lbl1:
  bc $RESULT
  rtu
  gpa \"GetProcAddress\",\"kernel32.dll\"
  bp $RESULT
  eob lbl2
  run

lbl2:
  bc $RESULT
  eob lbl3
  rtu

lbl3:
  mov addr,eip
  sub addr,B
  bp addr
  eob lbl4
  run

lbl4:
  sto
  mov addr1,eip
  sub addr1,6
  cmp addr1,addr
  jne lblend

loop:
  run
  jmp lbl4

lblend:
  bc addr
  cmt eip,\"OEP Found,please dumped it!\"
  msg \"Script by loveboom[DFCG],Thank you for using my Script!\"
  ret

Active in Last 5 Minutes
waleedassar

There are 28,220 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

waleedassar
Jan/01
Another OllyDbg Anti-Debug ...

More ...


Recent Blog Comments
NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

NirIzr on:
Jan/31
Yet Another Anti-Debug Trick

jackchen on:
Jan/10
nike mercurial vapor iii

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit