Software mechanism of Genesis --- a cheating software for Warcraft3 Yang Chen Wen Sun
A little bit about Genesis The new version of ZeroCraft Contains two main pieces: (1) Launcher.exe (2) Genesis.dll
Our adventure 1 - Launcher.exe part 1st try: Load the EXE file with Ollydbg directly. We got the following error message from Ollydbg
Our adventure 1 - Launcher.exe part Maybe this file is self-extracting or self-modifying
Our adventure 1 - Launcher.exe part Try again to load the.exe file with IDA directly. We got the following error message too.
Our adventure 1 - Launcher.exe part
Our hypothesis : The software has been packed !
Our adventure 1 - Launcher.exe part 2nd try: Unpack the EXE file with the existed unpackers (1) upx Didn’t work (2) GUW Didn’t work (3) ProcDump By using this universal unpacking approach, got Good News!
Our adventure 1 - Launcher.exe part
We also tried to unpack DLL file with ProcDum too. But it didn’t work. At this point, our conclusion is: the EXE file and the DLL file may be packed by different packers.
Our adventure 1 - Launcher.exe part 3rd try: Load the unpacked EXE file with IDA Everything seems good
Our adventure 1 - Launcher.exe part
However, things appear to be not that “normal” then…. Problems we got: By looking at the assembly code and checking the contents in the registers, we saw some invalid address acesses (2) We set the breakpoint and let the debugger run step by step At “add ss:dword_4093DB[ebp], ebx” line, we get error message. At the same time, the debugger is disabled.
Our adventure 1 - Launcher.exe part Launcher_unpacked.exe:The instruction at 0x7C referenced memory at 0x7CC01D77. The memory could not be read
Our adventure 1 - Launcher.exe part After directly running the unpacked EXE file, we also got an error message.
Our adventure 1 - Launcher.exe part
Our hypothesis : The PE file may have been damaged when we unpacked the EXE file Our Solution: Use ProcDump “Rebuild PE” function to rebuild the PE file
Our adventure 1 - Launcher.exe part
Run the unpacked file directly after PE rebuilder, get the following error message :
Our adventure 2 - Launcher.exe part (1) We finally realized that the unpack process done by Procdump actually may not be finished successfully as we were informed. (2) We decided to manually unpack it instead.
Our adventure 1 - Launcher.exe part Use PeiD for the last try before we start to manual unpack the Software. Luckily it offers us the information about the packing tools used – PEcompact 1.56
Our adventure 2 - Launcher.exe part
Our adventure 2 – Laucher.exe Using Ollydbg - locate ESP - full dump ESP - set breakpoint at the first dword pointed by ESP - run code - step into - got OEP Using LordPE, full-dump the binary in memory Using Imprec to relocate Virtual Address in PE
Our adventure 2 – Laucher.exe Step in until we get here Dump
Our adventure 2 – Laucher.exe Run(F9) code in Ollydgb and step in(F7) until …
Our adventure 2 – Laucher.exe OEP
Our adventure 2 – Laucher.exe
Step1 Step2 Step3 Step4
Our adventure 2 – Laucher.exe Fix PE
Our adventure 2 – Laucher.exe Strings the unpacked PE
Our adventure 2 – Laucher.exe We manually unpacked EXE file successfully
Our adventure 3 – Genesis.dll Then We tried to unpack the DLL file - Only one significant difference from the EXE file
Our adventure 3 – Genesis.dll Change to 010E
Our adventure 3 – Genesis.dll We unpacked DLL successfully We tried to launch unpacked.exe and.dll Unpacked genesis.dll does not work Something must be wrong
Our adventure 3 – Genesis.dll Checksum failure
Our adventure 3 – Genesis.dll We tried to fix checksum
Our adventure 3 – Genesis.dll Problem is still there Have to resort another way From PE specification, we got: - Authenticode PE image hash relating to the integrity of a file - In an Authenticode signature, the file hash is digitally signed by using a private key known only to the signer of the file
Conclusion Reverse engineering is hard Too many tools, too many software versions, many ways to anti-reversing For unpacking, the key point is to locate OEP Launcher.exe is coded in VB - call - msvbvm60.dll is VB virtual machine runtime library - ThunRTMain is VB code entry point However we believe genesis.dll is programmed in C or C++