oalabs
patreon
Tracing The Pain Away Module 1 Part 2 - Code Obfuscation Basics With VM Protection
🕑 Added 2024-08-26 14:02:01 +0000 UTCA brief overview of how VM protection works.
References
Applied Emulation Tutorial Series
https://www.patreon.com/collection/155915?view=expanded
Lab 0 - Introduction
This is a good time to make sure your tools are installed and working. Read through the Introduction Tooling Setup (first tutorial video) and ensure you have the required software installed. If you need a hand getting anything setup just ask on discord!
Introduction to VM Obfuscation: Reference Binary
The good.exe binary is a non-obfuscated reference which is used to demonstrate a simple word build function using the EAX register.
Open good.exe in IDA
When prompted to open a .pdb for the binary confirm, and when the .pdb is not found opt to search for it on disk and open good.pdb
Navigate to the _good function and observer the letters moved into the EAX register
What word is contained in the EAX register?
OPTIONAL — open good.exe in x64dbg and debug until the return from the _good function. Observe the EAX register.
Introduction to VM Obfuscation: VM Binary
The goodvm.exe binary is an obfuscated version of the good.exe binary. A simple VM has been created that accepts two instructions and contains one register.
AA [op0] = mov al, op0
BB CC [op0] = shl eax, op0
EAX —> Register0
The same good.exe word build function has been implemented with the VM instruction set. You can observe this by debugging the application and observing the memory address in the VM that is used to represent the EAX register.
Open goodvm.exe in IDA
When prompted to open a .pdb for the binary confirm, and when the .pdb is not found opt to search for it on disk and open goodvm.pdb
Observer the _bytecode data, this is the raw code for our VM
Copy the _bytecode data as hex bytes and save it in a notepad for later
Highlight the bytes
Edit —> Export data
Select hex string (spaced) and copy the bytes in the Preview window
Navigate to the emulate function and compare this with the good function in the other binary… they look nothing alike, this is the VM obfuscation!
Open the emu.py file in a text editor and paste the _bytecode data bytes into the code replacing the string "!! BYTE CODE GOES HERE !!"
Save the updated emu.py file and run it from the command line using Python
What is the result?
OPTIONAL — open goodvm.exe in x64db, the goodvm.pdb file should be loaded automatically by the debugger as long as it is located in the same directory.
Run until the entrypoint of the binary
Navigate to the Symbols tab and click on the goodvm.exe module
If the .pdb was loaded correctly the emulate function should be listed in the symbols
Double click to navigate to the emulate function and place a breakpoint at the return of function before the stack has been cleaned up.
Run until the breakpoint is hit and observe the local variable at ESP, this is the memory address that represents the EAX register in the VM!
** We are able to dynamically observe the results of the VM even without understanding the VM code
