GREM Bypassing Packers and Obfuscation 2

Question 1

Which OllyDbg plugin is specifically designed to automatically unpack many common packers by monitoring the OEP transfer?

Accepted Answer

OllyDbg Unpacker (OUP)

Answer

OllyDbg Unpacker (OUP) monitors execution for OEP discovery and can automate unpacking for many known packers.

Question 2

When a packer uses a 'TLS callback' to execute code before the debugger's initial breakpoint, the analyst should:

Accepted Answer

Set a breakpoint on the TLS callback address listed in PE headers before execution begins

Answer

TLS callbacks execute before the entry point, so breakpoints must be placed on the TLS callback addresses found in the PE TLS directory.

Question 3

The 'tail jump' technique in manual unpacking refers to:

Accepted Answer

A JMP instruction at the end of the stub that transfers control to the original entry point

Answer

The tail jump is the final JMP or CALL in the unpacking stub that redirects execution to the OEP of the original code.

Question 4

Which Windows API function is most commonly used by packers to allocate a new executable memory region for decompressed code?

Accepted Answer

VirtualAlloc

Answer

VirtualAlloc allows setting PAGE_EXECUTE_READWRITE permissions, making it the preferred choice for packers writing and executing decompressed code.

Question 5

An analyst observes that a packed sample checks the BeingDebugged flag in the PEB. The most direct way to bypass this check is:

Accepted Answer

Manually patch the BeingDebugged byte to 0 in memory while debugging

Answer

Setting PEB.BeingDebugged (offset 0x2 in 32-bit) to 0 directly defeats this specific anti-debug check.

(GREM) Giac Reverse Engineering Malware Practice Test