2

recently i am analyzing a malware which is packed with NSPack. when i am trying to unpack it using this blog link,i landed over two instruction PUSHFD,PUSHAD in ollydbg. so i put a breakpoint on the jmp instruction which will do unpack

004DF425                       9D              POPFD
004DF426                      -E9 A5D4FFFF     JMP 5df0b1b0.004DC8D0

after stepover, i have landed over below instruction which is not start of a pe file

004DC8D0                         60            DB 60                               ;  CHAR '`'
004DC8D1                         BE            DB BE
004DC8D2                         00            DB 00
004DC8D3                         20            DB 20                               ;  CHAR ' '
004DC8D4                         4C            DB 4C                               ;  CHAR 'L'
004DC8D5                         00            DB 00
004DC8D6                         8D            DB 8D
004DC8D7                         BE            DB BE
004DC8D8                         00            DB 00
004DC8D9                         F0            DB F0
004DC8DA                         F3            DB F3
004DC8DB                         FF            DB FF
004DC8DC                         57            DB 57                               ;  CHAR 'W'
004DC8DD                         83            DB 83
004DC8DE                         CD            DB CD

the above instruction is very strange i should expect instruction like

PUSH EBP
PUSH EBP,ESP

so how can i unpack the malware and where i am wrong during unpacking.Help will be appreciated Hash of malware:59c661ba0c7c485f4480f7b142a9c084

2

The blog post to which you linked has incorrect information. 0x004DC8D0 is not the OEP. Rather, 0x0041A4E3 is the OEP.

After reaching 0x004DC8D0, right-click on the machine code in the disassembly pane and select Analysis → Remove analysis from module. Then scroll down a bit to 0x004DCA84; you'll see there's a JMP from that address to 0x0041A4E3, which is the correct OEP:

JMP to OEP

  • HI Jason,even after following (Remove code analysis from module),i got these instructions 004DC8D0 60 PUSHAD 004DC8D1 BE 00204C00 MOV ESI,5df0b1b0.00> 004DC8D6 8DBE 00F0F3FF LEA EDI,DWORD PTR [> 004DC8DC 57 PUSH EDI 004DC8DD 83CD FF OR EBP,FFFFFFFF 004DC8E0 EB 10 JMP SHORT 5df0b1b0.> 004DC8E2 90 NOP 004DC8E3 90 NOP 004DC8E4 90 NOP 004DC8E5 90 NOP 004DC8E6 90 NOP 004DC8E7 90 NOP – Bikash Dash Mar 7 '16 at 14:21
  • And also if i am going 0041A4E3,i am viewing these instruction which is not seems to be a start of a PE file.0041A4E3 0000 ADD BYTE PTR [EAX],AL 0041A4E5 0000 ADD BYTE PTR [EAX],AL 0041A4E7 0000 ADD BYTE PTR [EAX],AL 0041A4E9 0000 ADD BYTE PTR [EAX],AL etc – Bikash Dash Mar 7 '16 at 17:37
  • You have to let the code execute until 0x0041A4E3 is reached. – Jason Geffner Mar 7 '16 at 18:25
  • Thanks @jason .i got the instruction 0041A4E3 > 55 PUSH EBP 0041A4E4 ? 8BEC MOV EBP,ESP 0041A4E6 ? 6A FF PUSH -1 – Bikash Dash Mar 8 '16 at 8:52
  • Great, feel free to accept my answer then. – Jason Geffner Mar 8 '16 at 14:06
0

 so ollydbg didn't understand the code put unnecessary code.so after doing "Remove analysis" from the assembly pane i got OEP Now NS based packed got unpacked Thanks @jason Geffner

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.