1

I am working on Lab13-01.exe from "Practical Malware Analysis" (you can download it from here).

When I run it without debuggers in my VMWare it runs without errors.

I started to analyze it with OllyDbg 2.01.

There is some point in the code that it receives exception and I don't understand why.

It has resource that contains encoded string:

LLLKIZXORXZWVZWLZI^ZUZWBHRHXTV

This resource is saved at address 0x408060
At 0x4011C1 it overwrites the first byte of the string with AL (0x77):

MOV BYTE PTR DS:[ECX], AL

Then I received:

Access violation when writing to [00408060]

enter image description here

When I press Shift+Run/Step, it succeed to run.

There number of things I don't understand here.

  1. If it can't write to [00408060], how come when I press Shift+Run/Step it succeed ?
  2. Why it can't write to [00408060] ? Is there some flag that prevent from writing to this aread (if yes, where can I see it?) ?
2
  • Probably virtual protected against write access and trapping the exception for handling differently based on presence or absence of debugger follow the exception chain and single step. The handler
    – blabb
    Apr 8, 2017 at 15:51
  • did you check if it installs an exception handler which catches the exception?
    – Igor Skochinsky
    Jun 9, 2017 at 17:16

2 Answers 2

1

I went to the memory map window.
I searched for the memory address range for 408060.
It was under .rsrc (Resources).
It had only read permissions, I set it with write permissions too and now it works:

enter image description here

0

It could easily be that it is code/data segregation.

In Windows it is called Data Execution Protection.

A lot of malware will load their code as if it were data, then maybe rewrite it after decryption, then attempt to execute it.

DEP should always be on, but for purposes of this demonstration maybe you could turn it off and see if you get different results.

Then turn it back on.

1
  • I checked with Pestudio and DEP is off. See printscreen here: imgur.com/dzaCXmR
    – E235
    Apr 10, 2017 at 10:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.