I wanted to learn something about unpacking malware manuelly and found the following link:
writequit.org/blog/?p=165.
As you can see, the malware in that example begins with the PUSHAD instruction. (I thought it would be a good link because 2 days ago I started to analyze a malware which begins with the same PUSHAD instruction. It was also packed with UPX like the malware in that example of the given link)
So, I downloaded the malware of the example for testing purpose.
What I did:
When I step into PUSHAD instruction(pressing F7), double-clicking ESP in combination with "Following in Dump", then I choose the first 4 bytes of the first row (ESP address) in the hex window. Then I go to Breakpoint -> Hardware, on access -> Dword. Then F9. (I hope I could explain it right but you can be sure that I did exactly the same things as in the example of the link)
My problem:
The first thing:
After I click ESP -> "Follow in Dump" , the 4 bytes of the first row looks like this: 00 00 00 00. (So, only zeros. Not the same like in the example which was 08 02 91 7c as you can see)
The second thing:
When I choose the 00 00 00 00 -> Breakpoint -> Hardware, on access -> Dword, then I let it run (F9) but the malware does not run to a location where I can find POPAD or JMP .... as in the example. In my case, after all that it runs to a location (especially, running ends in a LEAVE instruction) with the following:
...
...
LEA EAX, DWORD PTR SS:[EBP-3C]
PUSH EAX
CALL DWORD PTR DS: [<&ntdll.RtlRaiseException>]
LEAVE <----- here, it ends
RETN 10
MOV DWORD PTR SS: [EBP-40], EAX
...
...
So, even if I scroll hundreds of lines upwards or downwards, I could not find a POPAD instruction.
My question:
Why it is so? Do I need to configure something in the ollydbg settings ?
I hope someone can help me in that case, because although I do the same steps as in the example, I have different results.
best regards,
pushed
. 3. Do you see, that EDI has 7c910208? 4. In addition, scroll down from 0x424231 and you should findpopad
at 0x424386.