PESpin is a Windows executable files compressor & protector. It has some of the best protection techniques to protect the binary against  disassembling and debugging. When you try to unpack any PESpin protected file, you will experience several obstacles and one of them is API redirection. This cannot be circumvented by just using ImpREC as PESpin uses API redirection in combination with API emulation technique.

ImpREC is the popular tool in the reverse engineering world. It is a most powerful import rebuilder known for its amazing features. It supports various mechanisms to trace the API calls and also allows the users to write their own custom plugins. It comes bundled with several plugins for tracing binaries protected with teLock, ASProtect etc. This article will explain on how to write such a plugin for tracing API calls for PESpin and how one can break its protection against reconstructing import table. It can also serve as guide to write the API tracer plugin for any such protection software.

Before we proceed to write a plugin we have to understand how the API redirection is implemented in PESpin. To start with, protect any binary file with PESpin. I have used my LDAPSearch application which you can find here.

Here I will explain only the portion of unpacking which is relevant to breaking API redirection technique. Now launch the target application in Ollydbg and make it to break on OEP. Once you are at the OEP, your next job is to rebuild the import table. Launch ImpREC and select the LDAPSearch application from the drop down list. Enter the current OEP and press "IAT  Autosearch" button. ImpREC kindly reports that it could not find anything. This is due to API Redirection technique used by PESpin. There is one more way to get the API calls. Now on the ImpREC right click and select "Get API Calls" from "Advanced Commands" and then click 'OK' on the new dialog box. It will list some of the valid DLL entries along with many invalid entries. Lets check what evil this PESpin is doing with import table.

Some of the invalid entries lies in the address range 18000 - 19000. These are really INVALID ones. You can make out if you are into this unpacking business since quite long time. Next entries starts with address 25*** . Lets consider the first one which is at address 0x2542A. Click on that node and you observe that its pointing to address 0x880000. Now go back to OllyDbg and start disassembling at the address 0x880000. There you will find the instructions listed below.

These are actually first few instructions copied from the actual API function. Next follow the JMP instruction at 0x0088000E. You will see this.

This code is jumping to one of the kernel32 function. Lets follow it and once you are in kernel32 just scroll above and look at those instructions. You will find that those instructions exactly matches the instruction we have just encountered. So the function actually begins at address 77E7849F and looking at export table of kernel32 you can find that this address points to the function GetCPInfo.

With this information in hand lets see how can we write a ImpREC plugin for automating this process.

Writing plugin for ImpREC is simple and straight forward. You can have look at plugin samples bundled with it to get better idea. To start with you need to create a DLL with empty DLLMain() function and must export function called Trace(...) whose prototype is given below.

During actual operation while tracing, this DLL will be injected into target process and the trace code will be executed in the context of target process. For each address, ImpREC calls the function 'Trace' with dwToTrace value set to the address to be resolved. In our case this address is 0x880000 and the return address will be 0x77E7849F. That's all we have to do.

Now we know how the PESpin has implemented API redirection. Lets summarize the steps to get actual API address.

Now build the plugin DLL and put into ImpREC's plugin directory. Next launch the ImpREC again and then select the target process from the drop down list. Now right click on the panel, select "Get API Calls" from "Advanced Commands" and then click OK on the new dialog box. It will list some of the valid DLL entries along with many invalid entries. Now click on "Show Invalid" button and all the invalid entries will get highlighted. Next right click, select plugin tracers and then select our PESpin plugin from the list. ImpREC will happily display the APIs as they are resolved one by one.

Well, we have finished with our first PESpin plugin for ImpREC. Now you have to just delete remaining invalid ones and continue with rest of unpacking process.