Re: Absolute addresses, relative addresses

Article View: comp.lang.asm.x86

Article #45

#45

From: Beth
Date: Tue, 09 Sep 2003 05:45

45 lines
4700 bytes

Eric Minso wrote:
> Bob Masta wrote:
> > <snip>
> > 1)  Treat the final exe, including its PE header, as simple data.
> > A stub loader will decrypt it into memory and invoke some
> > Windows API function to run it as if from a file.  (I assume
> > such function exists, but haven't checked.)  This would put
> > the relocation burden on the API, but I would think it would
> > be vulnerable to crackers who would only have to watch
> > for that API function in their debugger, and grab the memory
> > image.
>
> I first tried this approach.
> Unfortunately, I didn't succeed in starting this program from the
memory.
> And using a temporary file is unthinkable.

You'll have to look into it, as I never actually used it to know how
well it actually works...but, under Windows, there is a switch thing
that can be passed to "CreateProcess" which requests that the
executable is executed from the swap file (used for running things
from read-only devices like CD-ROMs :)...

Although, why wasn't this working, I'm not sure...dynamically allocate
some memory in the address space of the main program, unpack into that
and then just "JMP" or "CALL" to this memory...that really should
work...

> > 2) You could do the PE relocation as part of your
> > decryptor, and jump to the start address.  The cracker
> > won't have an easy target for his debugger.  But you
> > will have the whole burden of the relocation.  You
> > may need special consideration of the fact that
> > Windows sees your loader/decryptor and the final exe
> > as one program, which it will load to 400000h like
> > normal programs.  To simplify that, put your code
> > after the (encrypted) exe and change the PE start
> > point to your code, after saving the true start point
> > which you can jump to when ready.  (Just like a virus!)
>
> That's what I am trying to do.

Well, is it working or not?

Beth :)

Technical Details

Message-ID: <hOe7b.74$dq5.44543@newsfep2-gui.server.ntli.net>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-04!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mail

References:

<7db38e60.0308250121.6135ebc1@posting.google.com> <bigi38$36e$1@titan.btinternet.com> <7db38e60.0308270023.1d3f4cf@posting.google.com> <bij247$3j$1@titan.btinternet.com> <7db38e60.0308280508.6205dd69@posting.google.com> <bilu4t$g7n$1@titan.btinternet.com> <7db38e60.0308290140.1817fff2@posting.google.com> <fZi5b.138$qL6.113704@newsfep1-win.server.ntli.net> <7db38e60.0309030837.18c5f094@posting.google.com> <3f574278.3926611@news.itd.umich.edu> <7db38e60.0309061346.36ae24a7@posting.google.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 1093da,44f17f79ebe31523
X-Google-Attributes: gid1093da,public
X-Google-Thread: f7d8d,44f17f79ebe31523
X-Google-Attributes: gidf7d8d,public
X-Google-Thread: feaef,44f17f79ebe31523
X-Google-Attributes: gidfeaef,public
X-Google-Thread: 114917,44f17f79ebe31523
X-Google-Attributes: gid114917,public
X-Google-ArrivalTime: 2003-09-08 23:57:01 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-04!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mail
From: "Beth" <BethStone21@hotmail.NOSPICEDHAM.com>
Newsgroups: comp.lang.asm.x86,alt.lang.asm,alt.os.assembly,borland.public.tasm
Subject: Re: Absolute addresses, relative addresses
Approved: CLAX86 Moderators <ccrayne@crayne.org>
Date: Tue, 9 Sep 2003 06:45:16 +0100
Organization: ntl News Service
Message-ID: <hOe7b.74$dq5.44543@newsfep2-gui.server.ntli.net>
X-CLAX86-Policy: http://www.pacificsites.com/~ccrayne/clax86.html
X-CLAX86-Faq: http://www.faqs.org/faqs/by-newsgroup/comp/comp.lang.asm.x86.html
X-CLAX86-Info-1: Send submissions to comp-lang-asm-x86@moderators.isc.org
X-CLAX86-Info-2: Send technical complaints to    ccrayne@crayne.org
X-CLAX86-Info-3: Send complaints about policy to ccrayne@crayne.org
X-Comment: moderators do not necessarily agree or disagree with this article.
Reply-To: "Beth" <BethStone21@hotmail.com>
References: <7db38e60.0308250121.6135ebc1@posting.google.com> <bigi38$36e$1@titan.btinternet.com> <7db38e60.0308270023.1d3f4cf@posting.google.com> <bij247$3j$1@titan.btinternet.com> <7db38e60.0308280508.6205dd69@posting.google.com> <bilu4t$g7n$1@titan.btinternet.com> <7db38e60.0308290140.1817fff2@posting.google.com> <fZi5b.138$qL6.113704@newsfep1-win.server.ntli.net> <7db38e60.0309030837.18c5f094@posting.google.com> <3f574278.3926611@news.itd.umich.edu> <7db38e60.0309061346.36ae24a7@posting.google.com>
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2720.3000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300
X-Inktomi-Trace: pc3-ptal1-5-cust12.swan.cable.ntl.com 1063090445 18616 81.103.82.12 (9 Sep 2003 06:54:05 GMT)
X-Spamscanner: mailbox1.ucsd.edu  (v1.2 May 26 2003 01:55:38, -0.8/5.0 2.55)
X-Spam-Level: Level 
X-MailScanner: PASSED (v1.2.7 87131 h896s9qH094376 mailbox1.ucsd.edu), Found to be clean
X-MailScanner-Information: Please contact the ISP for more information
X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=-0.8,
 required 4, EMAIL_ATTRIBUTION -0.50, FROM_ENDS_IN_NUMS 0.74,
 PRIORITY_NO_NAME 0.46, QUOTED_EMAIL_TEXT -0.48, REFERENCES -0.50,
 REPLY_WITH_QUOTES -0.50)
X-UIDL: 7-6!![`6!!J5g"!TQb"!
X-Complaints-To: abuse@supernews.com
Lines: 47

Reply to Parent Message