Unpacking ASpack Malware

Question

I'm trying to unpack a binary packed with aspack I loadded it into ollydbg 1.0 with ollydump tool. I setup hardware breakpoint at ECX and then I step over it and it is stopping at this statement:

MOV DWORD PTR DS:[EDI],EBX

I bypassed it by shift+F8 but it keeps giving access violation error multiple times. How can I proceed further in UnPacking Binary. Binary is working fine when executed without debugger.

Answer 1

Use the ASPack 2.xx.txt script from the Collection of x64dbg scripts.

Alternatively, I copied the content of this script file here:

//////////////////////////////////////////////////
//  FileName    :  ASPack 2.xx.txt
//  Comment     :  OEP Find For ASPack 2.xx
//  Author      :  _pusher_
//  Date        :  2015-07-08
//////////////////////////////////////////////////

//start
msg "ASPack 2.xx OEP Finder"
msg "make sure you're at the entry point of the program before you continue"
pause

//clear breakpoints
bc
bphwc

//find oep jump
find cip,"617508B801000000C20C0068" //some pattern
log "found: {0}", $result
cmp $result,0
je error

//go there
bp $result
erun
bc

$dw = 4:[cip+c]
log "OEP: {0}", $dw

//Go to OEP
bp $dw
erun
//clear breakpoints
bc

cmt cip,"OEP"
TimeToDump:
msgyn "Successfully found OEP! Wanna use Scylla to dump the target?"
cmp 0,$result
je finishScript
scylla

finishScript:
//finish script
ret

error:
msg "didn't find oep jump"
ret 

so

• you may copy/paste/save it in your favorite editor for loading it later, or
• copy/paste it directly to the Script tab of the x64dbg.

Instructions in detail:

Supposing you have

• a freshly loaded / reloaded ASPacked debugee, and
• the freshly loaded / pasted / reloaded the above script (you may see it in the Script tab).

Then

1. Press F9 key - only once! - to run debugee up to its entry point.
2. In the CPU tab check if you see the "EntryPoint" comment of the current instruction.
3. Switch to the Script tab.
4. Press space bar to run the script. The first message box appears.
5. Click OK. The second message box appears.
6. Click OK. The script is now paused. Press space bar to continue it.
7. The message box with the message "Successfully found OEP! Wanna use Scylla to dump the target?" appears.
8. Press "No" for now. (Later you may repeat this procedure and press "Yes".)
9. The message box "Script finished!" Appears. Click OK.

The script performed the unpacking code of your ASPacked debugee and stopped at the first instruction (OEP in the comment means "Original Entry Point") already in-memory unpacked code.

Now you may analyze your already unpacked debugee.

Answer 2

Try to use newer version of ollydbg or x64dbg (a modern and open-source ollydbg-like) with anti-debug tricks plugins like a TitanHide or ScyllaHide to avoid detection by the packer.