1

I have a dll file which I want to analyze/debug. To do that, I use ollydbg. But when I open the file with ollydbg then the following message appears :

    File 'C:\..........\Conficker.exe' is a Dynamic Link Library. Windows can't
    execute DLLs directly. Launch LOADDL.EXE ?

(notice: as you can see, the mentioned dll file is a sample of Conficker) In a analysis paper about Conficker, they wrote the following:

    After unpacking, we find that the UPX packed binary file is not the original code
    but incorporates an additional layer of packing. We use IDA Pro to remove this 
    second layer of obfuscation and dump the original code from memory. 
    To do so, we first run the Conficker service, snapshot the core Conficker library
    as a memory image, and from this code segment reconstruct a complete Windows
    executable program. The program requires a PE-header template, 
    and we compute an entry point that allows the program to enter Conficker's code 
    segment. 
    (source : http://mtc.sri.com/Conficker/)

Honestly, although I want to learn all that things, I didn't understand what they try to explain or how one can reach that. The only thing what I understand, that they somehow turn the dll into a "complete Windows executable program". So, I search in the inet and I found this:

   We all have our own methods for debugging DLLs, and my personal choice is to modify 
   the DLL bit flag to turn it into an EXE to the eyes of the debugger 
   Among other PE editors, CFF Explorer from ntcore is a tool that allows to do that.
   (source: http://blog.fortinet.com/post/the-art-of-unpacking-conficker-worm)

So, I have downloaded CFF Explorer but I dont know how to "modify the DLL bit flag to turn it into an EXE." Although I search in the inet for that I couldnt find anything about that.

Can somebody help me?

best regards,

3
  • 1
    They didn't just flip a bit to turn the DLL into an EXE, and though you could do that, it wouldn't help you in this context. As the text you pasted above says, they deobfuscated a second layer of packing (after UPX), dumped the unpacked code from memory, and wrote a PE header for it. This is not the same as turning a DLL into an EXE. Commented Oct 24, 2014 at 20:20
  • ok, then I need to read some paper about obfuscation and deobfuscation. And how one can write a PE header for a file. Commented Oct 24, 2014 at 23:07
  • - Understating PE struct is a must really -- for changing dll flag and lots more :) - Portable Executable File Format – A Reverse Engineer View - Also there tools like shellcode2exe, ImpREC and OllyDump plugin that can help you rconstruct the PE. - In CFF Explorer, to change from DLL to EXE you just need to open a file --> File Header --> Characteristics -- Done
    – Sigtran
    Commented Oct 26, 2014 at 10:21

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.