Packing and Unpacking

Please read complete article without skipping any part to understand everything.

What is packing a program ? Packing is a way to obfuscate and compress the program in order to make the program small and less in size. Packing is done by obfuscating a program, and including some code in the original exe to deobfuscate the original program. This obfuscation is done in many ways, according to the type of packer. In this Article, i will write about how the UPX packer packs, and unpack it by using ollydbg.

To identify what type of packer the program is using, we use PEiD ( Download here )

ImpREC ( Import Reconstructor ) is also used: Download
LordPE is also used in this article. Download it here : Download

Download this packed program : Download

--------------------------------------------------------------------------------------------------------------------------

UPX stands for Ultimate Packer for Executables. When an executable is packed with UPX, all the sections in the PE header like text,resource, and data section etc. will be compressed and will be given names as UPX0, UPX1 etc. You can see this in PEiD . And then, after the compression of the sections in PE header, a stub will be added in the code of the original program. What this stub will do is, it contains some code which will decompress all the compressed code while execution of that packed program.

You can download UPX from here : download

I have packed the program by the following command :

We can directly unpack any UPX packed file by using the UPX packer itself by the following command from command prompt : upx.exe -d "file name.exe"

But sometimes, the UPX packer can be fooled and the above command wont work. So, the only thing we can will be unpacking the file manually. To do that, first open the file in OllyDbg. ( You might want to do this whole thing in a WinXP VMware because ImpREC and LordPE seems to be not working on windows 7)

When you do that, you will land on a "PUSHAD" instruction.

 Many cases, this is the first instruction, and also EIP will be pointed to this. But sometimes, it might be after a few instructions. PUSHAD is similar to PUSH, but PUSHAD will push all registers onto the top of the stack. Scroll down and you will find a POPAD instruction .

 And beneath it the will be a JMP instruction which is the Original Entry point of that program.Set a break point on that and run the file in ollydbg.

 The program pauses on that JMP instruction. Press F8 to JMP to that address and note that address ( which is the current value of EIP) .

Now while Olly is running, open LordPE and select the process you are debugging(i.e., the program) to dump it and name it as dumped.

Launch ImpREC and select the process you are debugging and enter the actual OEP in the OEP box and click on "IAT Autosearch" button. It will show Import table.

 Now click on "Get Imports" to get all the imported functions and you will see the the function names which are imported according to their dll.

 If you find any not-valid functions, just delete them by clicking on it and selecting "Delete Thunks". Once you do this to all the invalid functions, click on "Fix Dump" and select the File which we have previously dumped with LordPE . It will be saved as dumped_.exe . You can see and compare the file sizes of both packed.exe and unpacked.exe, there is a huge difference. The packed file is 16KB, while the unpacked file is 40KB. It shows the compression of UPX.

Now run the final dumped file to see if it is normal. (If you did the whole process in WindowsXp as recommended , the file will work only in Windows XP )

Also, there is another way of doing this. This can be done directly in Windows 7, if you are using. You can directly use an OllyDbg Plugin called OllyDump. It does all the work of LordPE and ImpREC by itself, so it makes life easy ( but not all the times) . 

Download this plugin and place it in OllyDbg folder. Use normal version of ollydbg not any modified version. Download Ollydump

Select Plugins--->OllyDump---->Dump debugged process

And click on "Get EIP as OEP" and click Dump at last. Check if the Entry Point is modified to the current EIP value. Click Dump and Save file as Dumped1.exe

Run the final file, and it should be all good !

That is Packing and Unpacking. Thanks bros :)

Self keygenning with OllyDbg

All the information shared in this website is seriously, only for educational purposes.

In our previous post, we learnt about codecaving ( Read this previous post if you havn't. It is important to understand this post.) . In this tutorial, we will learn about how to self keygen a simple crackme program. Self keygenning means, to make a program print its real serial number or any other string by itself.
You can download the program from here : Download

Open up the crackme in OllyDbg, and search for all referenced strings( This is not a very good idea to check the referenced strings while dealing with real life applications, but its ok to use here) . You will see a string "Key:" . Double click on it.

Now, put a Breakpoint ( These break points are used to run till the selected instruction. All the code above it will be executed and the debugger(ollydbg) will stop executing at the point where we kept a breakpoint). Put a break point on the instruction "CALL 00403000" by pressing F2 .  

Now click the play button on the top to run it. The program will run and stop at that point. You need to enter your name in program.

Now, you will have to Step over( by pressing F4) each instruction. Do that continuously , until the program asks you to enter the key too. Once it asks to enter the key, type anything simple like 1234.

Now, again Step over until you see your key in the program i.e., the next instruction to be executed should be "MOV EAX, 402521" . Just like in the pic :

Below our key "1234" , we see another string "3d7z6H262679d" . It is our key which was calculated by the algorithm in that program from our name( In next tutorial, I will show how to find these algorithms). We can see, that it is moved into edx at "MOV EDX, 402922" . So, all we need to do is, turn the program to print the value of EDX after it calculates the real key from the name we entered. To do that,  just NOP the code below our key at "MOV EDX. 402922" till "PUSH EAX" as shown in the image : 

Now, edit PUSH EAX and change it into PUSH EDX . Save this file and run it. It will print our key by applying an algorithm on our entered name.

                            

And thats how Self keygenning is done :) Thank you. In next post I will show how to make a keygen by ourself by learning the algorithm of that program.

Codecave and patching

All the information shared in this website is seriously, only for educational purposes.

Before we continue, I suggest you to read these posts :
Introduction to Reverse Engineering & Starting with OllyDbg

** Read this full post to understand all the things without skipping any line.

I am going to write about Codecaving and patching . The program used in this post can be downloaded here : Download

What we are going to do is , write some of our own code in the program's empty space and make it run at the starting of the program and attach the real starting of the program to it too. This method is called as Codecave. 

Extract and open InjectMe #1. Our goal is to inject a message box at start up of that program. With that, I will show you how to change things inside the program too.

Open InjectMe #1 in OllyDbg.

Now, Right click on 1st windows and go to 

Search for ----> All referenced text strings

Now you will see some strings including "Inject a messageBox at startup: 'Injected by [your pseudo here]' "
Double click on that and you will see where that string was actually used. Note the address of that push command, i.e., 0040152D

Now scroll down, and you will see some empty area like this :

Select a few of them, right click and select "Binary ------> Edit"

Click on edit, and in the Ascii coloumn, type "Injected by 0xl33t" and click ok.

Note the starting of that string which is, in my case, 00404394

Scroll up and go back to 0040152D and double click on the instruction "PUSH 406028" to edit it. 

Now, replace it with the instruction "PUSH *your string address here*" . My string address was 00404394. So, i did "PUSH 00404394". And then, click on assemble.

                                   

Now, again scroll down to another empty area and make another string as shown above, saying "Injection".
Now, pick any empty area again and edit each line with the code given below :

PUSH 0
PUSH *new string address ( Injected )*
PUSH *your string address here*
PUSH 0
CALL MessageBoxA

Now, note down the value of EIP register which is 00401000

and below "CALL MessageBoxA" instuction, Add another instruction "JMP 00401000"

Now, right click on the first PUSH 0 instruction and select "New origin here".

Now, right click the Play symbol on the top to run our program. You will see this :

What we actually did, wrote some of our own code in the program's empty space and made it run at the starting of the program and attached the real starting of the program to it too. This method is called as Codecave. 

Now if we try to save that program, it wont give this popup because EIP will change back to its original value. So, we need to do something else for a messagebox at start up.

If we look at 004010B0 ( press Ctrl + g to goto that address ) You will see a CALL 004014D3 instruction. And 004014D3 is just after the whole NOP ( NOP means NO OPERATION) instructions below it. So, we can just remove that CALL instruction because its use less. Now, the whole NOPs can be used to write any code and they will be executed well. So, Just write this code in the place of  "CALL 004014D3". You might need to restart the program and create new strings again in empty areas.

PUSH 0
PUSH *new string address ( Injected )*
PUSH *your string address here*
PUSH 0
CALL MessageBoxA

 It should look like this (before and after) :

Now you can save it by right clicking and selecting "Copy to Executable ---> All modifications" and select "Copy all"

Now again right click on the windows that popups and click save file. It will ask for a name. Give it a name and save it. Thats it !

If you have any kinds of doubts or facing any problems, Please comment them and I will respond ASAP.

Credits : +XyliboxFrance for the InjectMe.

How Computers really work ?

We know, the main part of computer is the CPU. But how does CPU does all the work physically ? Lets learn about it. All Processors mainly consists of TRANSISTORS. A transistor is like a switch in a circuit. I suggest you to read the  complete post without skipping so that you will understand better.

A transistor looks like this :

The transistor is made up of a Semiconductor(Green base in the image), such as Silicon. There is some gap between the yellow places and the current will not flow in between these two areas, unless a metal(Grey in image) is placed above it and wrapped with an insulator. When some current passes through the Input ( shown in image above ), unless the gate is also charged, the current will not pass to the Output. For better understanding, follow these GIFs :




When the Current passes through gate, it makes the current flow between the INPUT and OUTPUT, thus letting the current pass through the transistor. Its like a switch, but to on the switch , we need to pass the current through gate. And here comes the binary into play.

In binary numbering system, there are only 2(0,1) digits unlike the decimal system which has 10 digits(0-9).

"1" in binary means on, and "0" means off. So, if we pass the current through gate of transistor, it means "1" and sending no current means "0". Since there are only two options, On or Off, we are using binary, which has only 0 and 1.

Now, by using two of these transistors, we can make some LOGIC GATES.

Logic gates are the main parts of any kind of integrated circuits. All the integrated circuits contain logic gates. The logical arrangement of these transistors give us different kinds of gates. We will discuss about one Logic gate, the "OR" logic gate .

The OR GATE:

If we think of transistors as switches, and make a circuit like the above diagram, we made an OR gate. Turning on any of the two switches, i.e., Passing current through any of Gates of the two transistors will make the bulb glow. 

So, we can say this:

These 1s and 0s means, sending and not-sending current into the Gates of the transistors.

1 in output means, the bulb is glowing, and 0 in output means bulb is not glowing.

Similarly, There are many other logic gates. Here are their Inputs and outputs :

Now, we have covered all the Logic Gates. A Wise arrangement of these logic gates is what makes Integrated circuits. A CPU of a modern computer, by which you are reading this blog, consists of nearly A BILLION TRANSISTORS which makes up many of these logic gates, thus helping to do calculations and reading instructions faster . As the distance between the INPUT & OUTPUT of the transistor decrease, it helps to fit more and more transistors on a small CPU. According to Moore's law, every 18 months, the number of transistors on the CPU doubles.

A modern CPU has transistors , which are very very small i.e., the length between input and output of the transistors is nearly 10-20 nanometers = 0.0000001 cm .

Here is an image of the SCOTT cpu:

And thats how the core of the CPU is structured. Thank you. :)

Credits for the GIFs: InOneLesson 

Starting with OllyDbg

In the Last post , we learnt the basics of x86 Assembly. In this post we are gonna use them.

We need to know about DEBUGGING. Debugging is a process of analyzing code or a program, to find mistakes, bugs or anything else. To do thus, we use DEBUGGERS. Debuggers help us to learn how a program is structured and see whats the code of that program. They also allow us to Execute the code line after line, which helps us in observing the behavior of the program.

We Use OllyDbg debugger, as it is easy to use. This tool helps us to see the Assembly code of any executable and run instructions one after another, thus helping us to analyse how the program works.

Download OllyDbg from www.ollydbg.de. I use modified version of ollydbg. You can download it from here: Download

After you download, open it. You should see a windows like this:

"1" is the disassemble window. All the Disassembled code of any executable will be shown here.

"2" is the register windows. It shows the values of all the registers.

"3" is the stack windows. It shows all the information in stack.

"4" is the hex windows. It shows the Hexadecimal code of the executable.

Now click on file and open notepad.exe . You should see this:

if u see the disassembled code in the 1st window,it means that ollydbg succesfully worked.

In ollydbg, we can analyze the code instruction after instruction by two ways : Step Into & Step Onto.

Step Into helps us to see each and every line of the program, not only the main code but also the code of each and every function that the program calls.

Step Onto will just execute the main code of the program, and not the codes of the functions called.

For example, here is some code:

mov ebx, 2

mov eax, 3

call 00401250

jnz 00401000

push 00401823

In the above code, if you Step Into each instruction one after another, you will see the code of the function at 00401250 . If you step onto each instruction, the whole CALL 00401250 will be considered as a single instruction. In ollydbg, we use F7 to step into & F8 to step onto.

This feature of debuggers very helpful us to learn how a program or a malware works.

Another amazing feature of debuggers is, Breakpoints . Breakpoints help us to choose till where we want to execute the code. In ollydbg, we use F2 to set breakpoints on any kind of instruction. In the above given example code, if we set a breakpoint at jnz 00401000 and run the program, the debugger will run only till call 00401250 and will wait for us to step into or step onto.

And that is the basics of OllyDbg. Thnk you ! :)

Intro to reverse engineering - x86 Assembly

Reverse Engineering (RE) is an art of learning how things were made. It can be related to anything, like reverse engineering a car, or reverse engineering a mobile phone, in order to know how they were made. RE is a very useful skill. In this blog we will discuss about reverse engineering computer applications and programs, to learn how things were made.

Not only that, but reverse engineering is also useful for malware analysis. To analyse malware and make counter attacks.

In order to learn computer reverse engineering, one should be familiar with basic programming languages like C,C++. And learning x86 Assembly will be a plus point. Basics of x86 Assembly will be taught here.

X86 ASSEMBLY
*********************

The Central Processing Unit (CPU) is the main part of any computer. The CPU makes all the operations which are needed to run a computer normally. CPU generally does this operations as instructions. Instructions are executed by the CPU one after another. To do this, the CPU needs some space to store some information. This information is stored in small boxes in CPU, call REGISTERS. Using registers instead of the memory (RAM) is more efficient and time saving for CPU.
The Registers are of three types :

1. General Purpose Registers : There are used to manipulate the data, to pass parameters when calling any function, and to store the immediate results of any king of operations done which can be later transferred to the memory.

2. Status Registers

3. Segment Registers : These are used to store the addresses of programs, or Stack (I will explain it later) or anything to be loaded .

AX, BX ,CX & DX are the most used registers. These are the 16-bit representation of those registers. By , adding E i.e., EAX, EBX, ECX, EDX, and so on, we can get the full 32-bit registers.

AX,BX,CX,DX, so on and be divided into 8 bit registers again, for example,

EAX(32bit) ----> AX(16bit) ----> AL(lower 8bits of AX) & AH(Upper 8bits of AX)

Logically these registers can contain only values equals to their capacities. Actually the amount of bits (8, 16 and 32) corresponds to these capacities, that is to say: 8 bits = 255d, 16 bits = 65535d, 32 bits = 294 967 295d (“d” to say decimal, and these are the maximum values a register can contain).

Regarding Status Registers, they do not have 8-bit parts, so they contain neither H nor L. These registers are:

DI – Destination Index: mainly used when handling string instructions, and is generally associated with Segment Registers DS or ES.
SI – Source Index: used as source data address when it comes to manipulating strings, and is generally associated with Segment Register DS.
BP – Base Pointer: when a subroutine is called by a “CALL“, this register is partnering with the SS Segment Register to access data from the stack and is generally used for registering indirect addresses.
IP – Instruction Pointer: associated with the Segment Register CS to indicate the next instruction to execute, and indirectly modified by jumps instructions, subroutines and interrupts.
SP – Stack Pointer: used with Segment Register SS (SS: SP) to indicate the last element of the stack.
(EDI, ESI, EBP, EIP, and ESP are all 32bit registers)

Now, STACK : The stack is the memory set aside as scratch space for a thread of execution. When a function is called, a block is reserved on the top of the stack for local variables and some bookkeeping data. When that function returns, the block becomes unused and can be used the next time a function is called. The stack is always reserved in a LIFO (last in first out) order; the most recently reserved block is always the next block to be freed. This makes it really simple to keep track of the stack; freeing a block from the stack is nothing more than adjusting one pointer.

Push and Pop commands are used to push the information to the top of the stack and pop(take out) the information from top of the stack/

Some important instructions in Assembly :

MOV instruction (used as: mov destination,source) is used to move the data from one place to another, i.e., from source to the destination.

LEA instruction is similar to mov, but lea AX,[BX+CX] computes the value of BX+CX , and then stores its address in AX. where as, Mov AX,[BX+CX] moves the value at the address BX+CX into AX. It is important to keep this in mind.

JMP instruction is used to jump directly to any address in the program. There are no If conditions to use in assembly. So, we use conditional jumps instead. Ex: JZ(Jump if equal), JNZ(Jump if not equal), JE, JNE, etc. these instructions are used for different status registers.
jge -Jump if they're greater or equal ; This will not work on negative registers
jg - Jump if they're greater than ; Neither will this
jle -Jump if they're less or equal ; ..this..
jl - Jump if they're less ; ...Or this
jne - Jump if they're not equal ; This conditional jump and all the following will work with both negative and positive numbers alike
je - Jump if they're equal
jne - Jump if they're not equal
jae - Jump if they're above/greater than or equal
ja - Jump if they're above/greater than
jbe - Jump if they're below/less than or equal

jb - Jump if they're below/less than

These condtional jumps are used after a comparison instruction like cmp(used as cmp ax,bx). After any type of comparison instruction,the flags, or status registers will be manipulated and according to those, the conditional jumps will be taken. For example, consider this small code:

push 0
xor eax,eax
mov ebx,eax
pop ecx
cmp ecx,ebx
jz 402342
jmp 402124

So, first we pushed 0 on top of the stack, and then we XORed eax which makes eax 0. Then, we moved the value of eax into ebx, making ebx 0. Pop ecx will put the value on the top of the stack into ecx, so we know 0 is on the top of stack, so it will make ecx 0. Now, comparing ecx,ebx since the both are equal, jump will be taken at jz 402342 and will be jumped to 402342. If they both are not equal, the jump will be not taken and the code continues to run.

Sometimes, you will also see instructions like this : 

Mov Eax, DWORD PTR DS:[01009000]

DWORD is a 32-bit value. PTR stands for "pointer", meaning that the data at address 01009000 is being loaded, not the number 01009000. DS stands for "data segment", meaning the loaded value is from the .data section.

Now, we almost covered the basics of x86 Assemby