Today I will be showing you all how you can unpack a sample which is packedwith ThemIDA. This tutorial will show you how to do the process withoutrequiring to manually use a debugger yourself.
What you will learn in this thread:
- What Themida is
- A bit about how Themida works
- Why packers/obfuscators may be used with not only malicious software butsafe, legitmate software
- Why unpacking is useful to Malware Analysis
- How you can unpack samples packed by Themida without requring knowledge ofhow to use a Debugger yourself manually
1). What Themida is
Themida is software specifically engineered to help software stay betterprotected from becoming cracked and/or it's source code was being stolen.
If someone comes along and they can read the code you wrote for your software,if you have not made the software opensource and did not wish the code to begiven out and/or read by someone, would you be happy about them having found away to read your source code? I don't think you would.
The purpose of Themida is to help prevent the protected software from becomingvulnerable to reverse engineering attempts. It can also help against piracy.
2). A bit about how Themida works
Themida will pack the executable. When you execute the packed sample, it willunpack the executable in memory and use that to continue executing to performand do what it's meant to do. If the unpacking of the packed executable intomemory fails for whatever reason, then the program will not work.
3). Why packers may be used in legitimate software
Packers may be used in legitimate software so the developer's software isbetter protected against attacks. If someone can read your code, or useDisassembly to understand how it works, they can try to find vulnerabilitiesand then use them to create zero-day exploits.
Packers are also quite frequent with malware. Your Antivirus product may pickupdetections for software packed in a certain way/type of packer used.
4). Why unpacking is useful in Malware Analysis
If the sample is packed, then this essentially protects against Disassembly. Wewon't be able to understand how the program works, we'll just be reading theinstructions from the packer wrapper. For example, the process of theunpacking. However, we want the original executable (unpacked executable) and wewant to perform Disassembly with that executable so we can try to make sense ofand understand how the program works to know if it's malicious or not.
5). How we can actually identify and unpack Themida packed executables
To start off, you'll need a few things:
Ok the first thing we need do is set path in the Themida - Winlicense UltraUnpacker 1.4.txt for your "ARImpRec.dl", so we open the txt withnotepad and search it. Quote:
HERE_ENTER_YOUR_DLL_PATH_TO_ARIMPREC_DLL:
mov ARIMPREC_PATH, "C:\Documents and Settings\Admin\Desktop\OllyDBG\plugin\ARImpRec.dll"
Open up ProtectionID and as can see first icon like a paper with a pencil,press there and drop your executable. It should process the information (if itcan). As we can see in the below screenshot, it detects the Themida packing:
1. First time we open Olly we need set the plugin directory because is notconfigured, for do it we go to --> Option-Appareance, in the tab Directorieswe can set where we stored plugins, so do it, press ok and restart Olly.
3. Ok now we go open the target to unpack or just press F3, after opened we gota pop up, just press Yes and the file continue Analysing, just wait to finish.
5. Good the next move is run script, so for this we go can do it via pluginmenu-ODBGScript-Run Script and we search for "Themida - Winlicense UltraUnpacker 1.4.txt" download before.
6.Ok after we load nothing happen becase we terminated the debug before, sowhat we need do is reopen the target, just press in the X to close target.
7.After reopened target run script again or if you get this pop up asking forbegin unpacking process we press Yes.
So now the unpacking process has begun, we can check status in the down bar asthe right side of screen, after some seconds, we got pause, now to resume andcontinue unpacking maximize main thread windows and press right click and go to-> Script Functions-Script Windows, so now we have a Window of Scriptopened, right click there and press Resume.
17. Ok this pop ask for compress the dumped file, but in this case we won't doit because is a good size, is not a file of 120MB or 200MB so I think is finepress No.
发表于 2020-6-18 18:46
发表于 2018-4-12 18:25
|
发表于 2018-8-24 17:31
|楼主
收藏
淘帖
有用
分享到朋友圈
