Tages.5.5.Generic.Unpacker-iND

[caki]

Actually, I was thinking of something a bit different TippeX... like logging all access in between protection API and game, and then figuring stuff out from there

[TippeX]

Originally Posted by caki

Actually, I was thinking of something a bit different TippeX... like logging all access in between protection API and game, and then figuring stuff out from there

well if you have the beginning, the middle and the end all recorded in a nice log file, you can see the instruction 'flow' and what its actually doing...

example :

[p] Probable. Sf3 Protect.dll as -> c:\Program Files\Breed\Run\PROTECT.DLL
... Analysing ***
[!] Protect.dll Found @ va : .000DA0000h -> Profiling.. please wait
... Export Table : 0014F1200h | Size : 00000008Eh
... IAT : 0014F02D4h | Size : 000000078h
... Import Table : 0014F0000h | Size : 0000002D4h
[i] StarForce Version : 3.03 | Build : 3.03.033.006, 19.02.04

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : GetProcAddress
-> Retp .000DA4038h
. . Module : 077E60000h -> IsDebuggerPresent
. VA Returned : .001B868A4h

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : IsDebuggerPresent
-> Retp .000DA403Eh

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : GetModuleFileNameA
-> Retp .000DA41A4h

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : GetSystemDirectoryA
-> Retp .000DA41C5h

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : CompareStringA
-> Retp .000DA5644h
. . String #1 : (00000001Bh) -> c:\Program Files\Breed\Run\
. . String #2 : (000000014h) -> C:\WINDOWS\System32\
. . Result (01) : String #1 < String #2

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : GetWindowsDirectoryA
-> Retp .000DA41EEh

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : CompareStringA
-> Retp .000DA5644h
. . String #1 : (00000001Bh) -> c:\Program Files\Breed\Run\
. . String #2 : (00000000Bh) -> C:\WINDOWS\
. . Result (01) : String #1 < String #2

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : CreateFileA
-> Retp .000DA21AEh
. FileName : \\.\PROSYNC1 | Axs : Read/Write
. . File Handle : 0000000A0h

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : DeviceIoControl
-> Retp .000DA22B9h
. . File Handle : 0000000A0h | Control Code : 092002400h
In : .000000000h | Size : 000000000h
Out : .00012F9BCh | Size : 000000004h

*** Before DIoC ***

--- DIoC [OUTPUT] DataGram Start ---

.00012F9BCh: 01 00 00 00 | ....

--- DIoC [OUTPUT] DataGram Finish ---

*** After DIoC ***

--- DIoC [OUTPUT] DataGram Start ---

.00012F9BCh: 05 00 00 00 | ....

--- DIoC [OUTPUT] DataGram Finish ---

. DIoC Return Code : 000000001h

APi -> tID : 0000000E0h -> cs:0001Bh -> ADVAPI32.dll : RegOpenKeyA
-> Retp .000DA8022h
. . Key : HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\NTice
.x. Return Error -> Eax : 000000002h

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : CreateFileA
-> Retp .000DA3F80h
. FileName : \\.\NTICE0000 | Axs : Read
. . File Handle : 0FFFFFFFFh

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : CreateFileA
-> Retp .000DA3F80h
. FileName : \\.\NTICE | Axs : Read
. . File Handle : 0FFFFFFFFh

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : CreateFileA
-> Retp .000DA3F80h
. FileName : \\.\WINICE | Axs : Read
. . File Handle : 0FFFFFFFFh

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : CreateFileA
-> Retp .000DA3F80h
. FileName : \\.\SICE | Axs : Read
. . File Handle : 0FFFFFFFFh

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : GetProcAddress
-> Retp .000DA4038h
. . Module : 077E60000h -> IsDebuggerPresent
. VA Returned : .001B868A4h

APi -> tID : 0000000E0h -> cs:0001Bh -> KERNEL32.dll : IsDebuggerPresent
-> Retp .000DA403Eh

APi -> tID : 0000000E0h -> cs:0001Bh -> msvcrt.dll : __set_app_type
-> Retp .0004EDC07h

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

*** First Api Hit @ VA : .0004EDC07h -> True Ep Nearby... Profiling

ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

[S] Sf3 Hooked Api Scan Report

[s] -> Scanning d3d8thk.dll
[s] -> Scanning d3d9.dll
[s] -> Scanning protect.dll

r .0004EE048h -> Unknown.. Attempting Calculation
... Sf3 Api Reroute . 001D50D4Ah -> .000DA9000h
.001D50D4A 6883FF9DB3 push B39DFF83 ô¿
Ø
.001D50D4F E9AC8205FF jmp 00DA9000 ô¿
Ø
.000DA9000 EB14 jmp short 00DA9016 ô¿
Ø
.000DA9002 EB04 jmp short 00DA9008 ô¿
Ø

r .0004EE04Ch -> Unknown.. Attempting Calculation
... E9 Reroute .001D6043Ah -> 001D603C0h .. Analysing
... Looks like a copier.. -> KERNEL32.dll -> Ord : 00327h -> SetThreadPriority

r .0004EE050h -> Virgin -> KERNEL32.dll -> Ord : 00138h -> GetCurrentThreadId

r .0004EE054h -> Unknown.. Attempting Calculation
... Looks like a copier.. -> ntdll.dll -> Ord : 0023Eh -> RtlFreeHeap
forwarded -> KERNEL32.dll -> Ord : 00202h -> HeapFree

just some examples (from starforce)...

and so on...

[caki]

I have no starforce experience to brag about, but with the Safedisc API, its actually a developer library integrated into the protected game exe. The devs then encrypt some game values, and pass them on to the library, which then decrypts them.

Example:

mov eax, 0FBA70441h
mov edx, 059013221h
push eax
push edx
call SDAPI_routine

...goes into safedisc dlls, calculations....

Return values:

EAX = 0173B49Bh <- pointer to some string in .data
ECX & EDX have junk values that are discarded.... but EAX is later used in the game to load string and stuff like that.

Problems arise when its called 100's of time repeatedly :P And when its badly integrated it can come to a major slowdown in the game I imagine.

However, its very easy to crack these days since the devs sometimes forget to remove the original library from the exe... so all you have to do is decrypt some tables, reroute execution to the original library code, and you have a nice little unwrapped exe

Other times its a bitch to crack. /me points to Black & White 2 v1.0

[TippeX]

wasnt bragging, it was just an example post... and the sd api is just 'magic' crap, and tables... nothing 'super interesting'... and rerouting to the library code isnt exactly 'clean'... and could well screw things later on...

[caki]

You misunderstand me I didn't want to imply that you were bragging, I was just saying that I never touched Starforce

And yes, I agree with you SDAPI is nothing interesting in particular, but it was the first time that I had ever seen a protection like it when I started playing around with it, so thats why I find it so interesting

As for rerouting to the library code... well it beats coding an emulator. And it works Although you do need an emulator if the library code is removed...