0

I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.

When I put the executable through Detect It Easy, the results show that the executable was protected with Armadillo 3.x-9.x.

I will be using x64dbg to unpack the executable. Most Armadillo unpackers available at https://www.exetools.com/unpackers.htm do not work with my executable because they only support an older version of Armadillo.

0

I'm not able to comment, so i'll just answer here.

If you have to perform the unpacking manually, you should ask yourself - to what extent do you need it unpacked? What are you trying to achieve with the unpacked file? More often than not, you don't need it fully unpacked, such that it looks similar, if not the same, as the original file.

In any case, with any packers, I suggest you just load up x64dbg with anti-anti-debugging plugins. Try a few configurations here and there - the standard hooks etc should work.

If you are looking at static analysis, you will want to use tools like Scylla to dump the program at runtime, and reconstruct the IAT (Import Address Table), which will give you information for calls to windows api / dlls.

If the unpacker scripts don't work, perhaps there are tutorials online on how you can unpack it by hand - fully or partially ? Even if the tutorial is an old one, it can usually still be a good reference. The packer's protection techniques do not really change at the core most of the time.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.