FindOEPPin

KO | EN

gitlite — search

#git #tensorflow #database #typescript #anthropic #php #http #reactjs #github #bash

(★ 8)

No description available.

File Explorer

ZIP Download

- - config.json
  - HeapLoader.py
- - dummy_test.txt
- - EnterForever.ahk
  - FolderImportLister.py
  - importLister.py
  - ImportsTester.bat
  - ImportsTester.py
  - MalTester.bat
  - MalTester.py
  - MalwrTest.py
  - Test.py
- Config.cpp
- Config.h
- Debug.h
- DumpHandler.cpp
- DumpHandler.h
- EntropyHeuristic.cpp
- EntropyHeuristic.h
- FakeReadHandler.cpp
- FakeReadHandler.h
- FakeWriteHandler.cpp
- FakeWriteHandler.h
- FilterHandler.cpp
- FilterHandler.h
- GdbDebugger.cpp
- GdbDebugger.h
- HeapModule.cpp
- HeapModule.h
- Helper.cpp
- Helper.h
- Heuristics.cpp
- Heuristics.h
- HookFunctions.cpp
- HookFunctions.h
- HookSyscalls.cpp
- HookSyscalls.h
- InitFunctionCall.cpp
- InitFunctionCall.h
- json.h
- jsoncpp.cpp
- JumpOuterSectionHeuristic.cpp
- JumpOuterSectionHeuristic.h
- LibraryHandler.cpp
- LibraryHandler.h
- Log.cpp
- Log.h
- LongJumpHeuristic.cpp
- LongJumpHeuristic.h
- makefile
- makefile.rules
- md5.cpp
- md5.h
- MyPinTool.sln
- MyPinTool.vcxproj
- MyPinTool.vcxproj.filters
- OepFinder.cpp
- OepFinder.h
- PatternMatchModule.cpp
- PatternMatchModule.h
- PINdemonium.cpp
- PINdemonium.rc
- PINshield.cpp
- PINshield.h
- PolymorphicCodeHandlerModule.cpp
- PolymorphicCodeHandlerModule.h
- ProcessInjectionModule.cpp
- ProcessInjectionModule.h
- ProcInfo.cpp
- ProcInfo.h
- PushadPopadHeuristic.cpp
- PushadPopadHeuristic.h
- Report.cpp
- Report.h
- ReportDump.cpp
- ReportDump.h
- ReportEntropy.cpp
- ReportEntropy.h
- ReportGeneralInformation.cpp
- ReportGeneralInformation.h
- ReportImportedFunction.cpp
- ReportImportedFunction.h
- ReportJumpOuterSection.cpp
- ReportJumpOuterSection.h
- ReportLongJump.cpp
- ReportLongJump.h
- ReportMainModule.cpp
- ReportMainModule.h
- ReportObject.cpp
- ReportObject.h
- ReportYaraRules.cpp
- ReportYaraRules.h
- resource.h
- ScyllaWrapper.cpp
- ScyllaWrapper.h
- ScyllaWrapperInterface.cpp
- ScyllaWrapperInterface.h
- TimeTracker.h
- WriteInterval.cpp
- WriteInterval.h
- WxorXHandler.cpp
- WxorXHandler.h
- YaraHeuristic.cpp
- YaraHeuristic.h
- - PINdemoniumPluginTemplate.sln
- - PINdemoniumPluginTemplate.sln
- - SimpleApiRedirection.dll
  - SimpleApiRedirection.sln
- - index.html
- .babelrc
- .bowerrc
- bower.json
- package.json
- README.md
- webpack.config.js
- - PECompact.dll
  - PESpin_x64_v1.dll
  - ScyllaPlugins.sln
  - ScyllaPlugins.vcxproj
  - ScyllaPlugins.vcxproj.filters
- - AboutGui.cpp
  - AboutGui.h
  - ApiReader.cpp
  - ApiReader.h
  - Architecture.cpp
  - Architecture.h
  - check.ico
  - Configuration.cpp
  - Configuration.h
  - ConfigurationHolder.cpp
  - ConfigurationHolder.h
  - DeviceNameResolver.cpp
  - DeviceNameResolver.h
  - DisassemblerGui.cpp
  - DisassemblerGui.h
  - DllInjection.cpp
  - DllInjection.h
  - DllInjectionPlugin.cpp
  - DllInjectionPlugin.h
  - DonateGui.cpp
  - DonateGui.h
  - DumpMemoryGui.cpp
  - DumpMemoryGui.h
  - DumpSectionGui.cpp
  - DumpSectionGui.h
  - error.ico
  - FunctionExport.cpp
  - FunctionExport.h
  - hexedit.h
  - IATReferenceScan.cpp
  - IATReferenceScan.h
  - IATSearch.cpp
  - IATSearch.h
  - ImportRebuilder.cpp
  - ImportRebuilder.h
  - ImportsHandling.cpp
  - ImportsHandling.h
  - Logger.cpp
  - Logger.h
  - main.cpp
  - MainGui.cpp
  - MainGui.h
  - MainGui.rc
  - multitree.h
  - NativeWinApi.cpp
  - NativeWinApi.h
  - OptionsGui.cpp
  - OptionsGui.h
  - PeParser.cpp
  - PeParser.h
  - PeRebuild.cpp
  - PeRebuild.h
  - PickApiGui.cpp
  - PickApiGui.h
  - PickDllGui.cpp
  - PickDllGui.h
  - PluginLoader.cpp
  - PluginLoader.h
  - ProcessAccessHelp.cpp
  - ProcessAccessHelp.h
  - ProcessLister.cpp
  - ProcessLister.h
  - resource.h
  - Scylla.cpp
  - Scylla.h
  - scylla.ico
  - Scylla.vcxproj
  - Scylla.vcxproj.filters
  - scylla_export_functions.def
  - StringConversion.cpp
  - StringConversion.h
  - SystemInformation.cpp
  - SystemInformation.h
  - Thunks.h
  - TreeImportExport.cpp
  - TreeImportExport.h
  - warning.ico
- - Scylla.ini
  - Scylla_Exports.txt
  - Scylla_README.txt
  - Scylla_x64.dll
- - ScyllaDllTest.sln
- - README
  - tinyxml.vcxproj
  - tinyxml.vcxproj.filters
  - tinyxml.vcxproj.user
- - README
- .gitignore
- COMPILING
- LICENSE
- README.md
- Scylla.sln
- Scylla_Exports.txt
- scylla_release.bat
- - README
  - tinyxml.vcxproj.filters
- diStorm.rar
- README.md
- tinyxml.rar
- WTL.rar
- - debug.h
  - Log.cpp
  - Log.h
  - ReadMe.txt
  - ScyllaDumper.cpp
  - ScyllaDumper.sln
  - ScyllaTest.vcxproj
  - ScyllaTest.vcxproj.filters
  - stdafx.cpp
  - stdafx.h
  - targetver.h
- .gitignore
- ScyllaTest.sln
- debug.cpp
- debug.h
- dllmain.cpp
- Log.cpp
- Log.h
- ReadMe.txt
- ScyllaWrapper.cpp
- ScyllaWrapper.def
- ScyllaWrapper.h
- ScyllaWrapper.vcxproj
- ScyllaWrapper.vcxproj.filters
- stdafx.cpp
- stdafx.h
- targetver.h
.gitignore
PinUnpacker.sln
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

An unpacker for windows executables exploiting the capabilities of PIN.

## Dependencies

* [PIN](http://software.intel.com/sites/landingpage/pintool/downloads/pin-2.14-71313-msvc10-windows.zip)

* [Scylla](https://github.com/NtQuery/Scylla)

* Visual studio 2010

## Installation

1. Download the linked version of PIN

2. Unzip PIN to the root directory and rename the folder to **pin**

3. Clone this repository

4. Extract the archive in PINdemonium/ScyllaDependencies/diStorm.rar into PINdemonium/Scylla/

5. Extract the archive in PINdemonium/ScyllaDependencies/tinyxml.rar into PINdemonium/Scylla/

6. Extract the archive in PINdemonium/ScyllaDependencies/WTL.rar into PINdemonium/Scylla/

5. Open the file **PinUnpacker.sln** with Visual Studio 2010 ( **NB: The version is mandatory** )

6. Create a folder C:\\pin and copy the folders **PINdemonium\PINdemoniumDependencies** and **PINdemonium\PINdemoniumResults** in **C:\pin\\**

7. Be sure that you are compiling in Release mode

8. Be sure that all the module inside the project are compiled using the platform toolset v100 ( you can see this with right click on the module -> Properties -> platform toolset field )

9. Compile the solution

10. **Optional** : Create a folder called **PINdemoniumPlugins** in **C:\pin\\**

## Usage

1. Run this command from the directory **C:\pin\\**

```
	pin -t PINdemonium.dll [-flags] -- <path_to_the_exe_to_be_instrumented>
	```

**Flags :**
	- **-iwae <number_of_jump_to_dump>** : specify if you want or not to track the inter_write_set analysis dumps and how many jump

- **-poly-patch**: if the binary you are analyzing has some kind of polymorphic behavior this activate the patch in order to avoid pin to execute the wrong trace.

- **-plugin <name_of_the_plugin>**: specify if you want to call a custom plugin if the IAT-fix fails (more information on in the Plugin system section).

2. Check your result in **C:\pin\PINdemoniumResults\\< current_date_and_time >\\**

## Plugin System
PINdemonium provides a plugin system in order to extend the functionalities of the IAT fixing module.

To write your own plugin you have to:

1. Copy the sample project called **PINdemoniumPluginTemplate** located in **PINdemonium\PINdemoniumPlugins\\**  wherever you want.

2. Change the name of the project with a name of your choice

3. Implement the function **runPlugin**

4. Compile the project

5. Copy the compiled Dll in **C:\pin\PINdemoniumPlugins**

6. Launch PINdemonium with the flag **plugin** active followed by your plugin name (EX : -plugin PINdemoniumStolenAPIPlugin.dll)

Inside the template two helper function are provided:

- **readMemoryFromProcess** : this function reads the memory from the specified process, at the specified address and copies the read bytes into a buffer

- **writeMemoryToProcess** : this function writes the bytes contained inside a specified buffer into the process memory starting from a specified address

## Yara Rules
Every time a dump is taken yara is invoked and the rules contained inside **C:\pin\PINdemoniumDependencies\Yara\yara_rules.yar** are checked. The current rule comes from https://github.com/Yara-Rules/rules:
	- rules\evasion_packer : Try to identify antiVM/antiDebug techniques and the presence of a known packer
	- rules\malware: Try to identify the malware family of the unpacked stage
## Config
Config file located at C:\pin\PINdemoniumDependencies\config.json contains variables which allow to set the location of the outputs

## Results
Results are located at **C:\pin\PINdemoniumResults\\< current_date_and_time >\\** and contains:
- **report_PINdemonium**: Json file which contains the most important information about the unpacking process;
- **log_PINdemonium.txt**: Log which contains useful debugging information

### Report Structure
```javascript
{  
	//Array containing information for each dump
   "dumps":[             
      {  
         "eip":4220719,         	 //EIP where the dump was taken     
         "start_address":4220439,	 //start address of the Write-set block
         "end_address":4221043,		 //end address of the Write-set block
         "heuristics":[
            {	
            	//Yara Rules Heuristic
               "matched_rules":["ASProtectv12AlexeySolodovnikovh1"],
                "name":"YaraRulesHeuristic",
                "result":true
            },
            {  
            	//Long Jump Heuristic
               "length":1801,					
               "name":"LongJumpHeuristic",
               "prev_ip":4218918,
               "result":true
            },
            {  
            	//Entropy Heuristic
               "current_entropy":5.7026081085205078,    
               "difference_entropy_percentage":0.0014407391427084804,
               "name":"EntropyHeuristic",
               "result":false
            },
            {  
            	//Jump Outer Section Heuristic
               "current_section":".data",			
               "name":"JumpOuterSectionHeuristic",
               "prev_section":".data",
               "result":false
            }
         ],
         "imports":[  
			//.... Imported functions....
         ],
         "intra_writeset":false,
         "number":0,
         "reconstructed_imports":0
       
      },
   ]
}
```

FindOEPPin

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README