Unpacking and dumping using ollydump

Question

I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error "Bad DOS signature!!". Could someone help me with this?

What I found so far is:

• Malware is calling VirtualAlloc (allocated region is readable/writable and executable/)
• I kept a hardware breakpoint on the allocated address
• when the control reached that memory, I ran ollydump. It throws "Bad DOS Signature"

Any pointers to unpack this malware?

Answer 1

The malware could destroy its PE Headers at runtime so you might want to look for a tool that is capable of handling those cases. Scylla should do the job.

Answer 2

if you dont wanna unpack exe manually;

1. use peid to identify packing type. -- download peid

2. search in the same site for that packing type(in picture its aspack 2.001). you'll see tutorial for it.
3. search google for aspack 2.001 unpacker . maybe even you get an app to unpack it automatically

---

peid tutorial - tuts4you.com/download.php?view.398

Answer 3

As there are little data about the unpack flow, here is the general approach you should follow in most packed malwares. This will probably be more complicated if we are talking about some custom and sophisticated packers.

I also strongly suggest to avoid various automatic unpacking plugins as they leaving you without the understanding of the process.

So in most cases unpackers (in terms of unpack process) will try to:

• validate their payload
• allocate new memory to store the unpacked code (data). This will (in most cases) be done with the help of VirtualAlloc(Ex)
• unpack routing will take the obfuscated code and write the clean one to the allocated space
• at the end of the process transfer control to the payload

What you should try to do:

• place the HW breakpoint on the VirtualAlloc(Ex) as there are packers which will check the preamble for the BP placements. Press execute till ret and at the EAX you will get the allocated memory area address
• right click on the EAX to follow the address in Dump
• place the Memory On Write breakpoint or HW on write breakpoint which should get you to the actual unpack routine
• analyze the flow of the unpack routing to place another breakpoint at the end of the unpack process
• once the unpacking is done, right click on the Dump windows to save the unpacked payload to the file.

In your case, the payload will probably will not be the clean MZ file or in contrary, the unpack routing intentionally had crippled the payload.

Probably this will be an iterative process as you also need to validate that the unpacked payload is actually the code. Try to use

• Trace
• in addition place HW on Execute at the beginning of the unpacked payload
• dump unpacking routine / area and open it in IDA to understand (find) if there are any control transferring process near by.

Have Fun!

Answer 4

If it is as standard packer there are tools that will unpack it. If you are looking to learn how to manually unpack or if it is not a standard unpacker then you can proceed. It does not look like it has finished unpacking. You may have to keep going to get to a valid "original" entry point.