Armadillo

[crypto2011]

How can I add new unpacker (for example, for Armadillo)?

[Masrepus]

First you need a yara rule identifying the packer. This needs to be placed in packer_signatures.yar. Suppose the rule is named "armadillo". Then, in unpackers.py, you need to create a new class inheriting from AutomaticDefaultUnpacker. This class needs to set some parameters in its constructor: The default constructor that is to be implemented is def __init__(self, sample) where you first need to call the super constructor and then set self.name to the string identifying your unpacker, e.g. "armadillo".

Then, there is self.allowed_sections, which is a list of section names where execution should be allowed. Whenever these sections are about to be left, we assume that the unpacking process is done and then the dumping begins. If you do not update self.allowed_sections, by default it will only contain the section where the entrypoint is located.

If you changed the allowed sections, you then need to update self.allowed_addr_ranges. This is simply done by calling self.allowed_addr_ranges = self.get_allowed_addr_ranges().

The last thing that needs to be specified is the memory-to-exe dumping process. The default value of self.dumper is ImageDump() from imagedump.py, which does not perform any import table fixing. If import fixing is desired (usually needed for correct execution on Windows), select ImportRebuilderDump(), which is the most comon choice for most packers.

You can look at the different unpacker classes for further info about how different values can be modified, but if you have any additional questions or need to modify something in a more complex way for an unpacker to work, just ask here.

One small side note about Armadillo: To my knowledge, it is a VM-based packer, which does not fully unpack the executable in memory but rather performs some form of emulation. Thus, the unpacking process is not so straightforward, as currently supported unpackers assume that by dumping the binary from memory and changing the entrypoint, we will have an unpacked file. This is not the case with VM-based packers.