Unpack eso.live.1.0.0.709717

[blar0]

So apparently some guys try to unpack the eso binary, and other guys spam my PM box with question, so I decided to make this short tutorial.
The OS version used to unpack the binary is "Windows XP SP3", so there is no ASLR applied on the binary, and ollyDBG v1 can work (I prefere the version one than two).
At the end of this tutorial you will find, a link to an archive with the original eso binary, ollydbg v1 and the plugin I used.

First open ollydbg and configure the phant0m plugin like this :


Go the menu "File" and choose "Open", and select the file "eso.exe".
Olly detect that the binary is packed stop the analysis.


The binary is loaded press F7 for steping to the instruction aftter PUSH EBX, so that the value of EBX has been pushed on the stack.
Right click in the registry window on ESP and choose "Follow in Dump", it will display the content of the stack in the dump window.
Select the first DWORD, right click and put an hardware breakpoint on access on it.


Press SHITF + F9 until the value will be accessed by this adress, you can recognize that the call is the "call security_init_cookie" (you can follow the assembly to see that), and the jump is the "jmp mainCRTStartup". So you are at OEP !


You can now dump the process like that.



And you can load the binary in IDA !



Link to ollydbg + bin + plugins : HERE

That's it. Btw I will not answer to some n00b ollydbg or IDA questions.

[Distiny]

or use PETOOLS for a full dump

[blar0]

But the full dump of PETOOLS will fix the raw offset automatically with the value of section aligned, and you will have to rebuild IAT.
Here all the offset inside all the data directories are correct if you don't fix the raw offset of sections.

If you say that about the fact that you have to load the binary in manual mode, it's because there is a lot of (obfuscated) code inside .reloc section, and IDA doesn't load it by default has segment of code.

[nippel]

thank you very much, didnt know about ASLR

[Sirmabus]

You can disable/enable ASLR with the "Enhanced Mitigation Experience Toolkit".
It helps quite a bit while you reverse and what not.
As I write this the latest version of EMET:
Download Enhanced Mitigation Experience Toolkit 4.1 from Official Microsoft Download Center

[awesomeb]

Thanks for the unpacked files,
I have the dumped .exe file, how can I extract .DAT to review some LUA scripts? I'm trying to build simple addons.

[Sirmabus]

Currently with this method some imports will be lost with a straight dump.
Need to use ImpREC or some other imports fixer if you want a real clean dump.

This can be handy here "setdllcharacteristics":
setdllcharacteristics | Didier Stevens
Copy "eso.exe" to say "_eso.exe" and run this like:
setdllcharacteristics -n -d _eso.exe
That'll clear the ASLR flag on the copy.

There is a new thread just now where someone released their unpacker for the .dat file.
You don't really need to look at the game Lua files to make addons, but there is extra info there though.

The site for addons is: ESOUI
IMHO the central place for ESO addons. A wiki there that shows the Lua API, and global constants et al.
And a forum where people can get help, etc.

EDIT: Actually I've been looking at a lot of the internal Lua files recently (currently 281 of them).
A lot of the popular AddOns use internal functions. A lot have too, just that there is not a lot of talk about it getting into the "gray" area
of reversing, "3rd party", no official support for it, etc.
So if you want to make addons well, you probably want to look at some of these..

[cute_star]

Hello , Guys . Nice to meet you .
after dumped the ESO with imprec or ollydump , you can find some parts obfuscated .
How did you guys remove the parts ?

[JohnnyKing94]

wrong topic, remove the post