Using DilloDumper

Using DilloDumper (all versions), a short essay by [Lunar_Dust]

As some may know, DilloDumper is a generic dumping program I wrote to eliminate Armadillo protection from programs. It will not eliminate ALL protections from Arma, but about 90% of them :) It dumps the file out, and helps you rebuild a valid import table so the program will run.

This tool is mostly designed for those already familiar with unpacking. It's not really a click once and done tool. If it were, I would never had made it pause at the end. Since I'm too lazy to write my own IAT rebuilding engine that isn't buggy right now, I chose to use a third-party tool that will do the job very well for us, that of ImpREC. Since an amateur user probably isn't going to know how to use ImpREC, I am writing this tutorial.

I have to say first however, that I believe that such a one should study other packers, and learn how to use the tools over time in that way. There are some details I may neglect to share due to their rarity in occurence. In those cases it is good to have internal knowledge to work with on your own, than to just follow a tutorial. But everyone has to start somewhere, I understand. So here we go.

So, for starters, we can see here I have a protected Arma file (one of my test files). The file is "TestOrdinal.exe".

This file is protected, if I remember, with Arma 2.85 or so. If I try and run the file on my system, I get an error. That's how I know it's protected with Arma for sure. It detects my SoftICE running.

So we will dump this program using DilloDumper. I Fire up DilloDumper and then I select "TestOrdinal.exe" and press "Open". DilloDumper goes to work, also removing the formentioned SoftICE protection, and dumps the program:

The program has been dumped, and we will be sitting in an infinite loop, waiting for the user to rebuild the Import Tables, "Semi-manually". ImpREC will rebuild them for us, but we have to intervene a little. So now Fire up ImpREC and select the process ID that DilloDumper gave us. Also note that DilloDumper gives us an OEP of 004016C0. It already sets this correct in the dump but we should also know it for use of ImpREC, as it may come in handy. Here's the first step with ImpREC:

As you can see, there are lots of bad thunks at the end of the table, but it looks like the entire table otherwise is valid. That means these bad thunks are not part of the original table. We need to trim off the bad thunks on the end before we rebuild the IAT. The reason these bad thunks are here in the first place is DilloDumper can't predict the size of import table (it can if I wish it, but I chose not to), so I just left size at 0x1000, which is actually too large in this program.

I would like to note two things for your inspection:

1. DilloDumper only takes a very well educated guess at the location of the import table. Sometimes it may get it wrong. In this case, you will see nothing correct in ImpREC, and will have to search on your own. Be assured, the table is present and valid, you only have to find it in this case.

2. Sometimes, with larger programs, you may have to scroll down a while to find the valid entries, which is where the table really starts. DilloDumper, once again, only give you a very educated guess. In this case, you also will have to trim invalid thunks off of the beginning of the table as well.

So here we see the thunks being deleted:

You will arrive with a clean IAT table. NOW to note another thing. I've found a bug in ImpREC 1.3, which even if you tell it not to, when you press "Fix Dump", it pastes the OEP in the dump that it thinks is OEP. So this means is will break our dumped EXE's OEP value unless we insert the correct one into ImpREC first. The value you put into ImpREC is only an RVA, which means it's OEP - IMAGEBASE. ImageBase for this protected program was 0x00400000. So we take 0x004016c0 and subtract 0x00400000 from it, arriving at 0x16c0 to put into OEP in ImpREC. Then we can press "Fix Dump" button.

Select "Dumped.exe", which is always named this way by DilloDumper...:

And now you will be done. You can exit ImpREC and DilloDumper. The fixed EXE should now run, unless it has further protection such as Nanomites, or file size checks, etc, etc. Like I said before you still need experience in these matters.

So there you have it.

-[Lunar_Dust]