Skip to content

Instantly share code, notes, and snippets.

@michal-kapala

michal-kapala/metaeditor.md

Last active June 23, 2023 17:57
Show Gist options
  • Save michal-kapala/a1c87bbce3690d15a8b60e4f3136965a to your computer and use it in GitHub Desktop.
Save michal-kapala/a1c87bbce3690d15a8b60e4f3136965a to your computer and use it in GitHub Desktop.
Download ZIP
Debugging ICMarket's MetaEditor 5.00
Raw
metaeditor.md

Debugging MetaEditor

MetaEditor is used as an IDE integrated into MetaTrader. The binary is statically obfuscated, for which the below section are used:

  • .cod0
  • .cod1
  • .cod2
  • .reloc

The executable is standalone, only loads system DLLs initially.

Prereq

I'm using x32dbg.

Register and download MetaTrader 4 and remove ASLR from metaeditor.exe binary for ease of use.

Debugging steps

  1. Set a conditional breakpoint in the obfucated code loop:
RVA Condition
0xD75F91 $breakpointcounter==E8F5
  1. Wow64Transition gets called at 0x77A38A90 (win32u.dll).
  2. Message box appears at 0x779A7000:
A debugger has been found running in your system.
Please, unload it from memory and restart your program.

Although IsDebuggerPresent is in the import list, it does not get called until this point.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment