1

I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a "subst" directory, or from a virtual CD ROM / Hard drive . Of course, I can use a USB Hub to plug the key and my mouse, but it will be less funnier.

I load the EXE with x32dbg, I activated the ScyllaHide to prevent debugging detection and I disabled ASLR . A few set of instruction after the OEP, I can trace a loop that modify the code : the EDI point to code after the loop, and when stepping into the loop, I can see the asm code is modified (there is a few of xor and shr ops in the loop). This process is repeated several times. It is not a code unpacking routine, it looks more than decrypting.

With Scylla I can dump the executable after theses first decryption routine, with a OEP setted just after the execution of the decrypt routines, so there is no need to run them each time I debug the exe.

But the exe seems to do more dynamic code loading / decrypting during its early execution, and at some time I trace some unusuall call like : call dword ptr ds:[4356A0] . And the address is different from a run to an other. If I set the EOP after this routines, the program crash.

So i'm unable to set accurate breakpoints on the code, because the address is changing on each execution. For example, at first run, I set a bp on

022C5DA2 | E8 E393FFFF | call <JMP.&GetDiskFreeSpaceExA> |

And when reloading the exe, the address of this instruction has changed :

022B5DA2 | E8 E393FFFF | call <JMP.&GetDiskFreeSpaceExA> |

From a debugging session to an other, all my breakpoints and labels are lost (they are marked as "Inactive" with no assembly code). So it makes the analysis task quite difficult.

Is there a way with x32dbg, or eventually IDA Free, to fix this behavior ? The exe itself is quite small (300Kb)

4
  • Can you share the file in question or the sha256 of it?
    – Utkonos
    Commented Nov 5, 2022 at 8:20
  • Thank you for having a look. I droped the sample here : filetransfer.io/data-package/3QG0VtXg SHA256 of the zip is b2e5a05e81f5c0ebe86952778e29233f45df9d3ca2f46a78638c00255bfa4c24
    – JayMore
    Commented Nov 6, 2022 at 17:32
  • Can you share exactly the address of the call that you're looking at? I noticed that the binary makes a number of calls to GlobalAlloc. I am not going to go through the full reversing process, but if you can point me to exactly where you're looking, I can tell you why the addresses are different per execution. I am going to make an educated guess that the call is being made to an address in memory that was allocated during the execution, and therefore has a different address each time. I can't help you unless you're more specific, however.
    – Utkonos
    Commented Nov 7, 2022 at 3:33
  • Load the exe, go to the EntryPoint, and set BP on GetDriveTypeA. Then run the program until it breaks. Callee of GetDriveTypeA is 0x002D6E21 the 1st time. Restart the program, apply the same procedure, and calling address may have changed. Did it helps ?
    – JayMore
    Commented Nov 7, 2022 at 18:42

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.