3

I have taken a dump of a game using Explorer Suite, and while looking at some obfuscated parts of the game PE's text section in IDA, I've seen code that follows this form:

mov rbp, 7FF633CE2790h
jmp rbp

From what I understand, code is meant to be relocatable, so why would a hardcoded address - which appears to be referring to a virtual address not known until runtime - be here?

To deal with these "hardcoded" jump addresses, do I need rebase the PE in IDA to the virtual address it was located at when the program ran? I believe that the dumper I used rebases to 140000000, which of course causes IDA to be unable to analyze the above code.

Edit: here's a concrete example:

 game.exe+1B9E0E1E - 45 85 C0              - test r8d,r8d              ; ZF = r8d == 0
 game.exe+1B9E0E21 - 48 89 6C 24 F8        - mov [rsp-08],rbp          ; rsp = &a
 game.exe+1B9E0E26 - E9 D8897FFF           - jmp game.exe+1B1D9803

 game.exe+1B1D9803 - 48 8D 64 24 F8        - lea rsp,[rsp-08]          ; rsp = &b
 game.exe+1B1D9808 - 48 BD 7527F508F77F0000 - mov rbp,game.exe+1382775 ; rbp = addr1
 game.exe+1B1D9812 - 48 87 2C 24           - xchg [rsp],rbp            ; b = addr1, rbp = rbp
 game.exe+1B1D9816 - E9 E6F33C02           - jmp game.exe+1D5A8C01

 game.exe+1D5A8C01 - 48 8D 64 24 F8        - lea rsp,[rsp-08]          ; rsp = &c
 game.exe+1D5A8C06 - 48 89 1C 24           - mov [rsp],rbx             ; c = rbx
 game.exe+1D5A8C0A - 48 89 44 24 F8        - mov [rsp-08],rax          ; d = rax
 game.exe+1D5A8C0F - 48 8D 64 24 F8        - lea rsp,[rsp-08]          ; rsp = &d
 game.exe+1D5A8C14 - E9 D8151C00           - jmp game.exe+1D76A1F1

 game.exe+1D76A1F1 - 48 8B 5C 24 10        - mov rbx,[rsp+10]          ; rbx = b
 game.exe+1D76A1F6 - 48 B8 9027F508F77F0000 - mov rax,game.exe+1382790 ; rax = addr2
 game.exe+1D76A200 - E9 CA476400           - jmp game.exe+1DDAE9CF

 game.exe+1DDAE9CF - 48 0F44 D8            - cmove rbx,rax             ; rbx = (r8d == 0) ? addr2 : addr1
 game.exe+1DDAE9D3 - 48 89 5C 24 10        - mov [rsp+10],rbx          ; b = rbx (addr1 or addr2)
 game.exe+1DDAE9D8 - 48 8B 04 24           - mov rax,[rsp]                      
 game.exe+1DDAE9DC - 48 8D 64 24 08        - lea rsp,[rsp+08]          ; rsp = &c
 game.exe+1DDAE9E1 - E9 08F408FD           - jmp game.exe+1AE3DDEE              

 game.exe+1AE3DDEE - 48 8B 1C 24           - mov rbx,[rsp]
 game.exe+1AE3DDF2 - 48 8D 64 24 08        - lea rsp,[rsp+08]          ; rsp = &b
 game.exe+1AE3DDF7 - 48 8D 64 24 08        - lea rsp,[rsp+08]          ; rsp = &a
 game.exe+1AE3DDFC - FF 64 24 F8           - jmp qword ptr [rsp-08]    ; r8d == 0: jmp addr2, else jmp addr1

 ; addr1
 game.exe+1382775 - E9 234F0800           - jmp game.exe+140769D

 ; addr2
 game.exe+1382790 - E9 FDAD991C           - jmp game.exe+1DD1D592
  • Could you provide the assembly code of the referenced memory location? – Elian Kamal May 26 '18 at 19:14
  • @ElianKamal, added it. – P. Private May 26 '18 at 21:07
2

From reading up about the obfuscation tool in use here, this is a technique it uses to make the analysis a little harder.

Now the question is how to work around this:
I'm thinking I could use a script to find these absolute addresses in the dumped PE, and convert them to ones that IDA can find.

Any other ideas?

Edit:

After loading the dumped executable into IDA with a couple of different base addresses, I've found that the address constant changed. I've also found an entry in the executable's relocation directory for game.exe+1B1D980A (which is where the address constant in the code example is located).

If I could disable the relocation that IDA is performing on these addresses, the analysis would work properly. I will submit a new question on that.

  • Have you read the last paragraph of my answer? Also, a workaround should be a different question, this question is about identifying the cause of such call and both answers cover it. – Elian Kamal May 27 '18 at 5:24
  • @ElianKamal, yes, see the updated answer. – P. Private May 27 '18 at 5:43
1

One possible explanation could be dealing with a game which incorporates Absolute code.

Usually most of the games you run on a regular daily machine are fully relocatable for ensuring maximum stability across different machines. However especially in the case of ROMs such as games for consoles and such there are some predefined memory locations which the manufacturer / OS could provide / specify for say making it easier and faster to run console-specific functions.

Basically, a code like that usually relies on a known memory location which the linker / programmer trusts and is certain that it contains the appropriate code, locations like that could e explicitly specified in the machine documentation / developer guide.

As this is a PE which is on Windows it looks a little weird, especially since the address is I the range of the per process VA space, probably this address indeed points to some special function or that the process itself requested this location to be allocated and loaded with code for usage as a part of the obfuscation which might pose a justification to such call and to trusting this address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.