Welcome and first entry

I’ve always thought blogging is retarded, but since that can be used to describe me too I thought I’d give it a shot :)

So, for first entry You can feast on : Under the hood in FSG

 FSG (Fast Small Good) is a packer that’s widely used to pack various malwares. It was originally created to pack assembly demos, but later on adapted to more malicious purposes. FSG it pretty easy to recognize, and even easier to unpack. If you take a look at the entrypoint you’ll see something like this:

FSG entrypoint

 The first command it executes is a xchg esp, ds:off_<memory address>. Xchg stand for “Exchange Register/Memory with Register”. When loading a binary packed with FSG into OllyDbg, make sure you have “Stop at entry of self-extractor” tapped in the SFX tab of Debugging Options. After singlestepping through the xchg command, take a look at the stack:

FSG stack start

Now, remember FSG wasn’t built to protect? The real entrypoint address is revealed right above the kernel32.LoadLibraryA reference in the stack, in this case the real entrypoint lies at offset 0041C570.

So, to unpack this file you need to set a hardware breakpoint (on execute) at 0041C570, and let the bugger run to it. Always remember to use hardware breakpoints when unpacking binaries, since you can’t be absolutely sure whether a normal software breakpoint will get overwritten or not.

Dumping with OllyDump comes out clean enough that IDA will recognize the imports, thus import table fixing is not necessary.

There is also a unpacker for FSG publicly available. You can grab a copy of it from here

 

Leave a Reply

You must be logged in to post a comment.

If you want to comment on this article please send e-mail
to authors(_at_)teamfurry.com or go to the forums.


InspectorWordpress has prevented 2 attacks.