- open ida
- find bottom of "start" (using graph overview window)
- notice all to "WinMain", take it
- find "ret" near bottom of "WinMain" (using graph overview window)
- look just above & around to find any "call" statements, choose "call" closest to the "ret"
- find return of VirtualAlloc
- follow as it's moved from EAX to a "var_**"
- then moved to a register
- then moved to another "var_**"
- until you find a "call var_**" to near the end of the chain
- switch from graph to text view, find the memory address of the "call" statement (0x0040153F)
- open x32dbg
- right-click in CPU tab, "Go To -> Expression", enter that address "0x0040153F"
- cursor should be at same "call" statement as we had in IDA
- set a breakoint in x32dbg on that "call" statement (F2)
- push the play arrow (twice) and run to the breakpoint
- right-click on the "call" statement, choose "Follow in Dump -> Value" (no MX value yet)
- step into the "call" (F7)
- notice code has lots of Stack Strings (API calls like VirtualAlloc, VirtualProtect, etc.)
- when you see "VirtualAlloc", good time to put a breakpoint on all future calls (command: bp VirtualAlloc)
- scroll down until you find either a "call REGISTER", "jmp REGISTER", or "call/jmp DWORD that was a register"
ex: mov dword ptr ss:[ebp-54],eax
call word ptr ss:[ebp-54]
- set a breakpoint (F2) on the registry call
- then run by hitting play arrow
- If "VirtualAlloc" breakpoint is hit, right-click on EAX and "Follow in Dump"
- Keep going until the "Follow in Dump" shows a value at the bottom starting with "MZ" header
- open Hex Editor
- compare original EXE first chars after "MZ" header with what is in "Follow in Dump"
- if same, then hit play arrow again to keep running
- if different, then you may have the unpacked EXE
notes: It may take a while (unpacking can be slow)
When you hit a breakpoint you're looking at the content of "previous" memory regions
- right click "Follow in Memory Map"
- right click "Dump Memory to File"
- how do you know if you did it right?
drop into PE Studio, look at strings, do you see the actual "Ammyy.Service" or "ammy\svn" strings?