Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.
When I put the executable through Detect It Easy, the results show that the executable was protected with Armadillo 3.x-9.x.
I will be using x64dbg to unpack the executable. Most Armadillo unpackers available at https://www.exetools.com/unpackers.htm do not work with my executable because they only support an older version of Armadillo.
I'm not able to comment, so I'll just answer here.
If you have to perform the unpacking manually, you should ask yourself - to what extent do you need it unpacked? What are you trying to achieve with the unpacked file?
More often than not, you don't need it fully unpacked, so that it looks similar, if not the same, as the original file.
In any case, with any packers, I suggest you just load up x64dbg with anti-anti-debugging plugins. Try a few configurations here and there - the standard hooks etc. should work.
If you are looking at static analysis, you will want to use tools like Scylla to dump the program at runtime and reconstruct the IAT (Import Address Table), which will give you information for calls to windows API / dlls.
If the unpacker scripts don't work, perhaps there are tutorials online on how you can unpack it by hand - fully or partially? Even if the tutorial is an old one, it can usually still be a good reference. The packer's protection techniques do not really change at the core most of the time.
