Re: Absolute addresses, relative addresses

Article View: comp.lang.asm.x86

Article #40

#40

From: Eric Minso
Date: Sat, 06 Sep 2003 21:46

30 lines
3534 bytes

no_spam@aol.com (Bob Masta) wrote in message news:

> <snip>
> 1)  Treat the final exe, including its PE header, as simple data.
> A stub loader will decrypt it into memory and invoke some
> Windows API function to run it as if from a file.  (I assume
> such function exists, but haven't checked.)  This would put
> the relocation burden on the API, but I would think it would
> be vulnerable to crackers who would only have to watch
> for that API function in their debugger, and grab the memory
> image.

I first tried this approach.
Unfortunately, I didn't succeed in starting this program from the memory.
And using a temporary file is unthinkable.


> 2) You could do the PE relocation as part of your
> decryptor, and jump to the start address.  The cracker
> won't have an easy target for his debugger.  But you
> will have the whole burden of the relocation.  You
> may need special consideration of the fact that
> Windows sees your loader/decryptor and the final exe
> as one program, which it will load to 400000h like
> normal programs.  To simplify that, put your code 
> after the (encrypted) exe and change the PE start
> point to your code, after saving the true start point
> which you can jump to when ready.  (Just like a virus!)

That's what I am trying to do.

Technical Details

Message-ID: <7db38e60.0309061346.36ae24a7@posting.google.com>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-04!sn-xit-01!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mail

References:

<7db38e60.0308250121.6135ebc1@posting.google.com> <bigi38$36e$1@titan.btinternet.com> <7db38e60.0308270023.1d3f4cf@posting.google.com> <bij247$3j$1@titan.btinternet.com> <7db38e60.0308280508.6205dd69@posting.google.com> <bilu4t$g7n$1@titan.btinternet.com> <7db38e60.0308290140.1817fff2@posting.google.com> <fZi5b.138$qL6.113704@newsfep1-win.server.ntli.net> <7db38e60.0309030837.18c5f094@posting.google.com> <3f574278.3926611@news.itd.umich.edu>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: feaef,44f17f79ebe31523
X-Google-Attributes: gidfeaef,public
X-Google-Thread: 114917,44f17f79ebe31523
X-Google-Attributes: gid114917,public
X-Google-Thread: f7d8d,44f17f79ebe31523
X-Google-Attributes: gidf7d8d,public
X-Google-Thread: 1093da,44f17f79ebe31523
X-Google-Attributes: gid1093da,public
X-Google-ArrivalTime: 2003-09-06 20:55:50 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-04!sn-xit-01!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mail
From: minso@altern.org (Eric Minso)
Newsgroups: comp.lang.asm.x86,alt.lang.asm,alt.os.assembly,borland.public.tasm
Subject: Re: Absolute addresses, relative addresses
Approved: CLAX86 Moderators <ccrayne@crayne.org>
Date: 6 Sep 2003 14:46:27 -0700
Organization: http://groups.google.com/
Message-ID: <7db38e60.0309061346.36ae24a7@posting.google.com>
X-CLAX86-Policy: http://www.pacificsites.com/~ccrayne/clax86.html
X-CLAX86-Faq: http://www.faqs.org/faqs/by-newsgroup/comp/comp.lang.asm.x86.html
X-CLAX86-Info-1: Send submissions to comp-lang-asm-x86@moderators.isc.org
X-CLAX86-Info-2: Send technical complaints to    ccrayne@crayne.org
X-CLAX86-Info-3: Send complaints about policy to ccrayne@crayne.org
X-Comment: moderators do not necessarily agree or disagree with this article.
References: <7db38e60.0308250121.6135ebc1@posting.google.com> <bigi38$36e$1@titan.btinternet.com> <7db38e60.0308270023.1d3f4cf@posting.google.com> <bij247$3j$1@titan.btinternet.com> <7db38e60.0308280508.6205dd69@posting.google.com> <bilu4t$g7n$1@titan.btinternet.com> <7db38e60.0308290140.1817fff2@posting.google.com> <fZi5b.138$qL6.113704@newsfep1-win.server.ntli.net> <7db38e60.0309030837.18c5f094@posting.google.com> <3f574278.3926611@news.itd.umich.edu>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-MailScanner-Information: Please contact the ISP for more information
X-MailScanner: Found to be clean
X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=-1,
 required 4, QUOTED_EMAIL_TEXT -0.48, REFERENCES -0.50)
X-UIDL: 'kY!!Z;Z"!@6b"!6[?"!
X-Complaints-To: abuse@supernews.com
Lines: 31

Reply to Parent Message