I am currently analysing some crackme with Olly and IDA. Initially it was packed. I managed to find the OEP (a JMP soon after POPAD and right before a bunch of nulls):
0040E978 . 53 PUSH EBX 0040E979 . 57 PUSH EDI 0040E97A . FFD5 CALL NEAR EBP 0040E97C . 58 POP EAX 0040E97D . 61 POPAD 0040E97E . 8D4424 80 LEA EAX, DWORD PTR SS:[ESP-80] 0040E982 > 6A 00 PUSH 0 0040E984 . 39C4 CMP ESP, EAX 0040E986 .^ 75 FA JNZ SHORT crackme_.0040E982 0040E988 . 83EC 80 SUB ESP, -80 0040E98B .- E9 7062FFFF JMP crackme_.00404C00 0040E990 00 DB 00 0040E991 00 DB 00 0040E992 00 DB 00
But I might have done something incorrectly or, may be, it's some sort of obfuscation technique, cause the unpacked program is full of something like that:
lea ecx, ds:2186C225h ; Load Effective Address UPX0:00403042 mov ebx, 0C11A8EBBh UPX0:00403047 lea ebx, [ebx-6CFE17B8h] ; Load Effective Address UPX0:0040304D add ecx, ecx ; Add UPX0:0040304F lea ebx, [eax-68FB1E76h] ; Load Effective Address UPX0:00403055 sub ecx, eax ; Integer Subtraction UPX0:00403057 lea eax, [ebp-6Ch] ; Load Effective Address UPX0:0040305A push eax UPX0:0040305B call $+5 ; Call Procedure UPX0:0040305B UPX0:00403060 pop eax UPX0:00403061 add eax, 0Ah ; Add UPX0:00403064 push eax UPX0:00403065 jmp loc_408EF0 ; Jump
What confuses me most (other than UPX prefix, although it seems to be unpacked), are instructions like these:
UPX0:00403047 lea ebx, [ebx-6CFE17B8h] ; Load Effective Address UPX0:0040304F lea ebx, [eax-68FB1E76h] ; Load Effective Address
Moreover, throughout the code there are lots of call-jumps, that point to the next instruction, rather than somewhere else in the code (which is much more common):
0040327B 50 PUSH EAX 0040327C E8 00000000 CALL crackme2.00403281 00403281 58 POP EAX ... 0040321A 50 PUSH EAX 0040321B 8B45 08 MOV EAX, DWORD PTR SS:[EBP+8] 0040321E 50 PUSH EAX 0040321F E8 00000000 CALL crackme2.00403224 00403224 58 POP EAX
How common is that?
I thought, that may be I did the unpacking wrongly, but the program seems to work properly. My next though was that it might be self-modifying, but when I put BP on GetWindowTextA, where first, last names and serial are loaded, and then go through the code, it doesn't seem to be changing.
Is it possible, that there are addresses like this?:
lea ecx, ds:2186C225h ; Load Effective Address ... lea ebx, [eax-68FB1E76h] ; Load Effective Address
Or may be there is something wrong with the OllyDbg's interpretation of the code?
Thank you in advance!