[frz]

I have been trying to reproduce the results of the article by rinn "Turla container parsing and decryption » Thu Mar 13, 2014 10:17 am."
All of the code seems to work correctly (it compiles) including the memcpy and memset fixups as shown in the post however I have not been successful in getting the executable to run and consequently decrypt the container data. I am compiling it in Visual Studio (I have tried 2008 and 2013 Express Editions) and stepping through it in IDA Pro.

The code flow does eventually jump into the "root.dmp" decryption routine and as I mentioned, both the memset and memcpy calls are resolved however it eventually errors out. Has anyone been able to/or tried to reproduce these results?

I think this is a valuable tool and I am hoping to eventually be able to get it to run properly. Hopefully someone will be able to share their tricks in being able to get this code to run and decrypt the container.

~frz

[EP_X0FF]

Post your decrypter project, including project files (vcproj/sln) and container you want to decrypt.

[frz]

Solution files - container and root.dmp

thanks,
frz

[EP_X0FF]

Change your project to x64 and try again. Root.dmp is x64 driver.

[frz]

EP_X0FF - recompiled for 64 bit - pointers to memcpy and memset now are wrong. any suggestions?
please see attached -
pwd is "infected"
thanks
frz

[EP_X0FF]

Everything work as expected except in your code you killed actual dump of decrypted data.

Code: Select all

     f = CreateFile(textbuf, GENERIC_WRITE | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, 0, NULL);

variable textbuf is not initialized.

[frz]

EP_X0FF - fixed textbuf - CreateFile is successful - still not properly resolving pointers to memcpy and memset on my machine. Included .png to show.

thanks for the help,

frz

[EP_X0FF]

Your code seems identical to that posted in thread, as well as container you wanted to decrypt and rootkit driver. Check your project settings. Also why don't you use built in MSVS debugger?

[frz]

EP_X0FF - yes, code is straight from original post. I have tried multiple setting changes in Visual Studio. Program is still not setting pointer to memcpy and memset correctly for some reason. Have you or anyone else reading this post got any suggestions? It would be great to get this to work :D . This process is a good tool to have in your bag for RE.
Thanks,
frz

[EP_X0FF]

Correct offsets yourself then. Whats the problem?