I'm not sure if there are any legal hinderances to me asking this question, so if asking for unpacking advice is against the rules I apologize.
I am new to reverse engineering and trying to manually unpack a PEtite 2.2/2.3 as a learning experience and have been trying to follow this guide: http://users.freenet.am/~softland/tutorials/Petite.v2.3.MUP.txt. The program I'm unpacking is the original PEtite packer itself.
I have disabled passing on exceptions as it feels like cheating and I haven't fully grasped how exceptions work in this context, seemingly used here to derail the debugger, so I'd like to know why and how to work around it myself. I've come to this part in the guide:
and this exception program generates for jumping to exception handler, so at that line put breakpoint on exception handler (goto to 4164E3 and press F2), then press SHIFT+F9 and you are at the beginning of exception handle
When using OllyDbg 1.10 (non-patched), this is what I find at the address of the exception handler (this address is also where Olly said the OEP would be when I tried out the auto-unpacker SFX ability):
In the guide it says that I should find the line
004164E3 CALL PETGUI.00416537 here. As you can see there is really nothing here, however it was the address I always ended up at no matter the method I tried to use (or saw in tutorials etc.), so I did a process dump and suddenly I got this:
Now it struck me that since the program is self-modifying that might naturally confuse Olly, so I told Olly to re-analyze the code (before dumping the process), and I ended up with this:
I got the expected result, but there's something missing... the
CALL instruction can be seen in the opcode section but it hasn't been parsed by Olly. Now to my questions:
- Why doesn't Olly parse this
- How come
E8 4F000000somehow magically becomes
CALL 416537? I don't see any
416537in the opcodes. Found this answered here, leaving it for reference: https://stackoverflow.com/questions/10376787/need-help-understanding-e8-asm-call-instruction-x86.
- At the
MOVSinstruction where the exception is raised before ending up in the exception handler, if I press
Shift-F8to single-step instead of
Shift-F9I somehow end up at 4E3137 which is full of
ADD BYTE PTR DS:[EAX], ALinstructions, presumably an area of filler instructions that will later be overwritten. How come I ended up here? If I try to keep stepping I'm told
EIPis set to
00000000and can't proceed. This seems to be the case whenever I choose to exception-single step; errors show up that would be smoothly ignored if I had just used
I have the same problem in OllyDbg 2.01 aswell.