Hello,

My target use Armadillo 5.2 or higher (surely 6.04). The target use only debugblocker

I do this :
1- Bypass debugBlocker with OpenMutexA trick
2- Find the MagicJump and nop it (BP on CreateFileMappingA, GetModuleHandleA, noping the magic jump, VirtualAlloc, then redirect it in pdata section)
3- Find the OEP with BP CreateThread and follow the last CALL EDX

I dump the target using lordpe then I use Imprec, but Imprec didn't find any valid IAT :\ and the PE Header is false.
I've tried to binary copy/paste the Pe HEADER from a new instance into my debugged one, but not good.

I can PM you the target if you want.
I can also post a video of what I've done so far

I don't want a crack solution, but just know how to unpack it and have a working dump file.
I've already unpack some old armadillo 3.x 4.x but this target give me @x_!@

I'm sure it should be easy and I must miss something but what ?

Thanks for your help
sQualB3TA

| Сообщение посчитали полезным:

Import table almost always is invalid in arma. Click the button show invalid in imprec, then press right mouse button->cut thunks and fix dump

-----
Лень - это подсознательная мудрость

| Сообщение посчитали полезным:

Del

-----
Лень - это подсознательная мудрость

| Сообщение посчитали полезным:

What you target & what options in Armadillo protect enable ?

| Сообщение посчитали полезным:

squalb3ta
You need to paste valid header into the debugee before dumping. It's easy - just luanch the target under debugger and when you are at EP you have to open PE Header in Olly and make binary copy, after that open another one copy of Ollydbg, go to the OEP, and when you have reached the OEP you need to overwrite the current header because it was damaged by Armadillo. Just do binary paste and the first header that was valid will be pasted.
Or you can do better - just dump the target with PeTools using option PASTE HEADER FROM DISK
And about IAT - try to find it manually
good luck

-----
Stuck to the plan, always think that we would stand up, never ran.

| Сообщение посчитали полезным: