A paranoic protection: Remote administrator viewer |
||||
 Advanced |
|
|
||
|
Fravia's comment |
A very interesting listing programmed by staier, that will help all readers that are tackling this kind of targets... AND will show "paranoid" protectors the way to obfuscate even further their code, eheh. I have slightly edited this essay, mainly directed to advanced IDA users. |
||
Paranoic protection (expression by Marigold) of Radmin Target : Remote administrator viewer v1.1.0.1 from http://www.mtu-net.ru/radmin/ let us begin investigating. first time after starting the program we can see a nag screen with three buttons "ok","register",and "cancel",let us move our time a year ahead. and press "ok" button.Ups-messagebox with message: 'Evalution period is expired,enter the registration code to continue using the program.' so >>bpx messageboxa and try again pop up in sice with address c797a8 (after F11) ok, let us disassemble the program. at first in wdasm, and what we see? nothing, no such addresses,and within the offset from base there is no such instructions, and it means - we have packed(or crypted ) target. let us start procdump to view what module is in the location - :( - NONE NUTTING! A PARANOID PROTECTION! so going to sice >>addr radmin >>d c97a8 and let us determine the bounds of memory occupied by the strange code after some >>d c90000 >>d c80000 ... >>d cf0000 >>d cd0000 ve can found that a module boundz with "MZ"...."PE" signatures at c70000 and un allocated memory at cf0000 Ok.here we are ? let us dump the memory. as i sayed procdump is of no use in the case (and i think in most other - opinion from my experience - may be i am just not able to undestand it) and i have quickly written a small program, with CreateProcess and ReadProcessMemory and dumped the memory to disk after this i have loaded it into ida (great tool!) as binary file,setting the load offset to c70000 and do not create segments to on then, in ida, i have created a 32 bit segment, named code and started my work. first, let's >>G c71000 and press c so here is a code - it is clear some time after all i have pressed here and there some keys, defining what is code, data and offsets and, finally applyed a flirt signatures vcrtf32 3/4/5 and mfc 32 bit then go to our messageboxa call at c97a8 and see such a code LISTING 1.
code:00C7974C test eax, eax code:00C7974E* code:00C7974E*jmpok: ; DATA XREF: code:00C7B553vw code:00C7974E* jnz short close_to_fin code:00C79750 push 40h ; '@' code:00C79752 push offset aInformation ; "Information" code:00C79757 push offset aEvalutionPerio ; "Evalution period is expired,\nenter the "... code:00C7975C mov ecx, [ebp+arg_0] code:00C7975F push ecx code:00C79760 call dword ptr ds:0C9721Ch code:00C79766 xor eax, eax code:00C79768 code:00C79768 newend: code:00C79768 jmp return code:00C7976D ; --------------------------------------------------------------------------- code:00C7976D code:00C7976D close_to_fin: ; CODE XREF: nagproc+85E^j code:00C7976D cmp [ebp+var_1B0], 14h code:00C79774* jbe short ok_proseed code:00C79776 mov edx, 1Eh code:00C7977B sub edx, [ebp+var_1B0] code:00C79781 push edx code:00C79782 push offset aThisProgramIsS ; "%This program is shareware.\nYour 30-day"... code:00C79787 lea eax, [ebp+days_left] code:00C7978D push eax code:00C7978E call _sprintf code:00C79793 add esp, 0Ch code:00C79796 push 40h ; '@' code:00C79798 push offset aInformation ; "Information" code:00C7979D lea ecx, [ebp+days_left] code:00C797A3 push ecx code:00C797A4 mov edx, [ebp+arg_0] code:00C797A7 push edx code:00C797A8 call dword ptr ds:0C9721Ch code:00C797AE code:00C797AE ok_proseed: ; CODE XREF: nagproc+84F^j code:00C797AE ; nagproc+884^j
EOL listing so going to 0c9721c we can see a table of addresses
... code:00C97210 dd 77E721DFh code:00C97214 dd 77E72575h ; DATA XREF: nagproc+730^r code:00C97214 ; nagproc+8E4^r code:00C97214 ; nagproc+91E^r code:00C97214 ; nagproc+945^r code:00C97214 ; main_prg+19A^r code:00C97214 ; main_prg+29F^r code:00C97218 dd 77E71C61h ; DATA XREF: nagproc+D79^r code:00C9721C dd 77E8A590h ; DATA XREF: nagproc+495^r code:00C9721C ; nagproc+5D7^r code:00C9721C ; nagproc+662^r code:00C9721C ; nagproc+702^r code:00C9721C ; nagproc+870^r code:00C9721C ; nagproc+8B8^r code:00C9721C ; main_prg+2BF^r code:00C9721C ; code:00C7B677^r code:00C97220 dd 77E71C53h ; DATA XREF: nagproc+9AA^r code:00C97224 dd 77E72567h ; DATA XREF: nagproc+3FE^r code:00C97228 dd 77E76D8Eh code:00C9722C dd 77E74841h code:00C97230 dd 77EB0C3Eh code:00C97234 dd 77E73F14h code:00C97238 dd 77E72441h code:00C9723C dd 77E75BF5h ...
it is clear that it is a table of imported functions, but it seems to me that strings with names of the functions and modules are absent(or erased). here is the point to start learning ida C scripting. after some learning and RE of availiable IDCs i have written myself the following script LISTING 2.
#include >idc.idc> /* ******************************************************************************** the script is intended to recover imported functions names from dumped files with erased fuctions names i.e. only import table with function addreses present (c) staier from http://staier.cjb.net All rights reserved you can use & modify it freely as far as the above comment is NOT erased format of *.exp file: ---------------------- gdi32.dll Number of Exported Functions = 0401 (decimal) Addr:77EE9BB6 Ord: 1 (0001h) Name: AbortDoc Addr:77EEA5A1 Ord: 2 (0002h) Name: AbortPath Addr:77EDB23F Ord: 3 (0003h) Name: AddFontResourceA Addr:77EE69BA Ord: 4 (0004h) Name: AddFontResourceTracking Addr:77EE6C06 Ord: 5 (0005h) Name: AddFontResourceW ... Addr:77EE80AC Ord: 401 (0191h) Name: gdiPlaySpoolStream --------------- taken from wdasm .alf file original file http://staier.cjb.net/fname.zip contains kernel32.exp, advapi32.exp,gdi32.exp user32.exp ********************************************************************************/ static getfuncnames() { auto c,c2,c3; auto hndl,start; hndl=fopen(AskFile(0,"*.exp","enter export file name"),"rt"); Message("opening exports file "); if (!hndl) {Message("opening exports file failed "); Exit(1); }; start=AskAddr( BADADDR,"enter start address"); if (start == BADADDR) {Message(" can not obtain an address"); Exit(1); }; c=readstr(hndl); Message("module export:%s ",c); c=readstr(hndl); Message("starting analyse from :%x \n",start); Message(c); while ((c=readstr(hndl))!=-1) { c2=start; Message(c); Message("address:%s,name:%s \n",substr(c,6,14),substr(c,38,strlen(c))); while (Dword(c2)!=0) //end of table for a given imported module {// Message("address:%s,indisasm:%x \n",substr(c,6,14),Dword (c2)); -for debugging if (Dword (c2)==xtol(substr(c,6,14))) {MakeName(c2,substr(c,38,strlen(c)-1)); MakeComm(c2,"exported function"); Message("found function"); break; } else c2=c2+4; }; }; fclose(hndl); } static main() { getfuncnames(); }
EOL 2. so starting the script here and there we'v got:
code:00C97210 BeginPaint dd 77E721DFh ; exported function code:00C97214 SendMessageA dd 77E72575h ; DATA XREF: nagproc+730^r code:00C97214 ; nagproc+8E4^r code:00C97214 ; nagproc+91E^r code:00C97214 ; nagproc+945^r code:00C97214 ; main_prg+19A^r code:00C97214 ; main_prg+29F^r code:00C97214 ; exported function code:00C97218 ReleaseDC dd 77E71C61h ; DATA XREF: nagproc+D79^r code:00C97218 ; exported function code:00C9721C MessageBoxA dd 77E8A590h ; DATA XREF: nagproc+495^r code:00C9721C ; nagproc+5D7^r code:00C9721C ; nagproc+662^r code:00C9721C ; nagproc+702^r code:00C9721C ; nagproc+870^r code:00C9721C ; nagproc+8B8^r code:00C9721C ; main_prg+2BF^r code:00C9721C ; code:00C7B677^r code:00C9721C ; exported function code:00C97220 GetDC dd 77E71C53h ; DATA XREF: nagproc+9AA^r code:00C97220 ; exported function code:00C97224 InvalidateRect dd 77E72567h ; DATA XREF: nagproc+3FE^r code:00C97224 ; exported function code:00C97228 SetScrollPos dd 77E76D8Eh ; exported function code:00C9722C SetScrollRange dd 77E74841h ; exported function code:00C97230 ShowScrollBar dd 77EB0C3Eh ; exported function code:00C97234 SetWindowPos dd 77E73F14h ; exported function code:00C97238 GetWindowRect dd 77E72441h ; exported function code:00C9723C SetWindowLongA dd 77E75BF5h ; exported function
and our code fragment is looking no like this LISTING 3.
code:00C7974C test eax, eax code:00C7974E* code:00C7974E*jmpok: ; DATA XREF: code:00C7B553vw code:00C7974E* jnz short close_to_fin code:00C79750 push 40h ; '@' code:00C79752 push offset aInformation ; "Information" code:00C79757 push offset aEvalutionPerio ; "Evalution period is expired,\nenter the "... code:00C7975C mov ecx, [ebp+arg_0] code:00C7975F push ecx code:00C79760 call ds:MessageBoxA code:00C79766 xor eax, eax code:00C79768 code:00C79768 newend: code:00C79768 jmp return code:00C7976D ; --------------------------------------------------------------------------- code:00C7976D code:00C7976D close_to_fin: ; CODE XREF: nagproc+85E^j code:00C7976D cmp [ebp+var_1B0], 14h code:00C79774* jbe short ok_proseed code:00C79776 mov edx, 1Eh code:00C7977B sub edx, [ebp+var_1B0] code:00C79781 push edx code:00C79782 push offset aThisProgramIsS ; "%This program is shareware.\nYour 30-day"... code:00C79787 lea eax, [ebp+days_left] code:00C7978D push eax code:00C7978E call _sprintf code:00C79793 add esp, 0Ch code:00C79796 push 40h ; '@' code:00C79798 push offset aInformation ; "Information" code:00C7979D lea ecx, [ebp+days_left] code:00C797A3 push ecx code:00C797A4 mov edx, [ebp+arg_0] code:00C797A7 push edx code:00C797A8 call ds:MessageBoxA code:00C797AE code:00C797AE ok_proseed: ; CODE XREF: nagproc+84F^j code:00C797AE ; nagproc+884^j
EOL 3. here we are we can see that passing the jumps at code:00C7974E and code:00C79774* we can pass the expiration routine right way let us therefore go to softice and >>addr radmin >>bpx 00C7974E and let us gentle cpass the gumps changing the flag register ok, me have passed , but after trying to connect to radmin server we are crashed what is the hell? the answer is that there is a control sum check on the code of verification routine and we can be aware of the fact by setting bpm 00C7974E r it will be a pup up of sice in address 00009c... (another hidden module) the point is that sice bpx is an int 3 instruction embedded into the code so let us clear the bpx after passing the routine this time everything works fine. now it's time to write a path for the program. we must perform 3 steps: 1.wait for code will be unpacked 2.change jump at 00C79760 to our code 3.restore virginity and jump to 00C797AE i have used my favourite method of installing new thread into the code. me must first to chanje entrypoint and virtual size of .code cection of the program 200h would be fine and in hex editor fill the place of our code with nops and et the end of it jmp to old entrypoin. (this is because of ida's behavour, that translates unused bytes to ORG -org 400 in the case) and let us code our prog directly in ida. LISTING 4(from produced ASM file)
start: ; "KERNEL32.dll" push offset aKernel32_dll call cs:GetModuleHandleA push eax push 44h push eax call cs:GetProcAddress mov CreateThread, eax pop eax push eax push 6Dh push eax call cs:GetProcAddress mov ExitThread, eax pop eax push 243h push eax call cs:GetProcAddress mov Sleep, eax push offset return push 0 push 0 push offset thr_fn push 0 push 0 call cs:CreateThread jmp entry ; _WinMainCRTStartup ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� db 1 ; db 0 ; ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� thr_fn: ; DATA XREF: .text:01409D99o push 5DCh call cs:Sleep mov eax, base_of_1_9c000;address of dword, containing address of module ? wich unpacks module at c90000 loc_0_1409DC1: add eax, 2FA18h mov ebx, [eax] add ebx, 272ECh loc_0_1409DCE: ; CODE XREF: .text:01409DD4j cmp dword ptr [ebx], 0 jz short loc_0_1409DCE sub ebx, 272ECh add ebx, 974Eh mov byte ptr [ebx], 0E9h mov eax, 7906ADh sub eax, ebx add eax, 0C7974Eh mov [ebx+1], eax push 0 call ss:ExitThread retn 4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� mov eax, base_of_1_9c000 ;jump from target code here add eax, 2FA18h mov eax, [eax] add eax, 974Eh mov byte ptr [eax], 75h ;restore mov dword ptr [eax+1], 68406A1Dh ;virginity add eax, 60h push eax xor eax, eax retn ;jump back to target code ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� xor eax, eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� nop nop nop nop nop nop nop nop nop nop nop nop nop nop nop nop nop nop ...
EOL 4. after writing,produce the DIFF file right from the Ida IDE and make patch. that's all. some notes 1. i do not bother to show you all the right addreses, as we are reversers and we can find them easily. They can be found by setting "bpm ... w" to start addresses of hidden modules. Note that there are other modules.(dump them and disassemble them, using described techniques...) by the way, i have spent about a week to handle the tasks (yeah - i'm not a reverser GOD). 2. the patched program works only on nt 4.0 rus.(i think relocations problem is the point,but i have no other WIN32 OS for debugging. 3. using of Sleep api sucks, i know and i know now how to do this right way. 4. i have not eliminated nagscreen .it is possible. 5. my skills in writing assembler and writing in English suck... so what? 6. The program http://www.mtu-net.ru/radmin/ is great, netbus and BO is far behind it, it coasts only 25$ and it can be turned back online by resetting clocks back. (and must be by reinstalling). 7. DMITRI ZNOSHKO is a good programmer: it is no doubt that reversing this program in order to use it was not worth $25. 8. thanks to fravia+, +ORC, and all other teachers and publishers who did show me the way to RE art.
(c) 1999 Staier from http://staier.cjb.net -mainly russian site
homepage
links
search_forms
+ORC
how to
protect
academy database
reality cracking
how
to search
javascript wars
tools
anonymity academy
cocktails
antismut CGI-scripts
mail_fravia+
Is
reverse engineering legal?