Inline Patching a PE-Compact packed file (PE-Compact v2.66)

Required Knowledge

Basic assembly knowledge and knowledge of OllyDbg will prove useful.

---

Inline Patching a PE-Compact packed file (PE-Compact v2.66)

Level : Beginner / Intermediate

Author : minderbinder

Target : dhx.cme.1.exe
Tools : OllyDbg with CommandBar Plugin

The crackme file∞

---

Ok, i packed this crackme (dihux's n2c crackme #1) with PE-Compact v2.66 (the latest version as of this writing).

When we first load the file in olly, wee see this:

Here is the interesting part:

eax is 0, so this instruction will thow an exception (access violation), which is our gatway to the OEP ;)

Step until you get to this instruction (F8), step one more time to execute the instruction and we will be inside the exception handler.

Step until we get to the 77F510AF E8 FFD40200 CALL ntdll.ZwContinue instruction.

Press F7 to step into this call and we will be here:

Step into the 77F7E5BD FFD2 CALL EDX instruction.

Inside the call we will see this code:

Single-step (F8) to execute the 7FFE0302 0F34 SYSENTER instruction and we will be where we want to be.

Now press control+F and search for 'jmp eax' instruction, or simply scroll down until you find it (will be at the end of the code), and this is the jump to OEP. Set a breakpoint on this instruction so that you wont have to do all of this again ;)

Now run the program (F9) and it will break on the jmp eax instruction.

Ok, this is the hard way to find the OEP, the easy way is to press alt+m to view memory once the PE-Compacted file is loaded on olly, select the .rsrc section of the file that is packed, press ctrl+b to binary search, and enter the binary code that represent the instructions immediately before the jmp to OEP.

(5A 5E 5F 59 5B 5D FF E0 are the bytes we want to search for)

Write down the offset that is found, then close the memory dump window and module window and go to the jmp oep offset (press ctrl+g and enter the offset) and you will be there, but i find the other way just as fast ;)

Either way you choose to do it, once you get to the jmp OEP, single step over it to execute the jmp and you will be at the OEP of the packed application ;) Now press ctrl+a to analyse the code and start looking for the offsets you need to patch. This crackme is for beginners, so its pretty easy to figure out that this instruction needs to be nop'ed.

Write down the offset and restart olly (ctrl+F2).

Now run the program again (with the breakpoint on jmp to OEP).

The few bytes after the jmp are written over upon execution with this instruction:

NOP this instruction so that our inline patch can be placed immediately after the jmp eax instruction. This could be the few bytes saved that means you don't have to add a new section to the PE in some compacted files, but this one has enough room either way.

NOP the jmp eax, and in its place assemble 'mov word ptr [004010FA], 09090h'.

Set the next instruction to 'jmp eax'

The code should now look like the following:

Now save the file and run it and you will have a cracked crackme ;)

Note : Sometimes more bytes will be written after the OEP, you can either patch the instructions that write to these offsets, or make the jmp eax instruction jump over these bytes to your own code (inline patch).

---

Related pages

---

	Attachment	Size	Date Added
	dhx.cme.1.zip	3.4 KB	11/17/2005 6:08 am

---

Categories

CategoryTutorialsIntermediate