2

I'm trying to figure out how to unpack kkruncy executable, sources here and binaries here, anyone knows how to do it?

My main idea was testing out some little hello world exes compressed with kkrunchy but for some reason the exes will crash. Ie:

#define UNICODE

#include <windows.h>

void start()
{
    MessageBox(NULL, L"X", L"Y", MB_OK);
}

or:

global start
; kernel32.lib Exports
extern _ExitProcess@4
extern _GetStdHandle@4
extern _WriteFile@20

section .text

start:
    ; DWORD  bytes;
    mov     ebp, esp
    sub     esp, 4

    ; hStdOut = GetstdHandle( STD_OUTPUT_HANDLE)
    push    -11
    call    _GetStdHandle@4
    mov     ebx, eax

    ; WriteFile( hstdOut, message, length(message), &bytes, 0);
    push    0
    lea     eax, [ebp-4]
    push    eax
    push    (message_end - message)
    push    message
    push    ebx
    call    _WriteFile@20

    ; ExitProcess(0)
    push    0
    call    _ExitProcess@4

    ; never here
    hlt
message:
    db      'Hello', 10, 13, 0
message_end:

I've used the default parameters but the executables are broken. In any case, how could i figure out how to unpack kkrunchy executables?

4

For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip.

Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option to say Ctrl+/.

trace record entry point

Next up, press G (for graph) and you should see the return blocks marked in red.

graph return

Put a breakpoint on both of them, run, step and you will notice a function with a suspiciously large graph...

large graph

Now go ahead and use that Trace into beyond trace record function to keep stepping through while skipping the instructions that were already traced over. You will quickly notice that this algorithm is exhausting the (default) 50000 step count and a bit of clicking around will tell you where the loop condition is.

loop condition

Put a hardware breakpoint on that destination, run and you should see the original entry point.

oep

Next up open Scylla Ctrl+I, hit IAT Autosearch, OK, Get Imports, Dump, Fix Dump and you have an unpacked executable. I will leave it upto you to properly clean out the garbage from that dump...

  • Thanks for your answer! I've been able to get a dump of the exe following some of your steps but i needed to cheat here (put a hw breakpoint directly :(). I didn't understand the step where you say "Now go ahead and use that Trace into beyond trace record function to step through while skipping the instructions that were already traced over." , I haven't been able to see that label "OEP Jump" , look at my screen , i don't see the same labels than you, once i've step after the ret i've pressed "ctrl+/" till i've reached 0x005F214E , +1 – BPL Nov 24 '16 at 19:26
  • Btw, with this another executable it seems there isn't those 2 ret blocks in the graph anymore. – BPL Nov 24 '16 at 19:46
  • Yes you have to keep stepping with Ctrl+/ until you no longer get to new places. That's where you can see that location. I marked it with comments, but you can see the counts in the info box below. See here for a video mega.nz/#!7lpGyZha!20jgbFvV9z2zBIBSujLW694m_meJ70p786LhT4qlP28 – mrexodia Nov 24 '16 at 20:05
  • The other example you linked has a single return block. If you break there and step out, you can see a similar (but different) procedure doing the decompression. You can find the entry point jump at 005EC514 in a similar way. – mrexodia Nov 24 '16 at 20:10
  • 1
    Fair enough, in any case, thanks a lot for your nice explanations. I've been using these debuggers for ~2weeks and i've started with olly... after discovering x64dbg i don't miss ollydbg at all :D – BPL Nov 24 '16 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.