During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done.
I took the bin/ls file, and checked with readelf -h that the entry point is 0x404870. I packed it with upx, and in gdb set a breakpoint at this address: b *0x404870. I expected that the program will stop there, but apparently it terminates without stopping at this address. Am I misinterpreting something?
-
there is no guarantee that the packer will use the same entry point it can write the unpacked stuff to any section and jump haywire over hoops and loops to trick you into failing. btw you are on wrong track when you are in the unpacking world you wont have access to original unpacked binary to set any predetermined breakpoints so read up and start unpacking manually– blabbCommented Dec 10, 2015 at 12:22
-
I know that I won't have access to the original unpacked binary. All the tutorials are for 32 bit Windows, I am on 64bit linux. I just want to get to the point when the code reaches the original entry point. Isn't the esp trick (used by the tutorials I have found) assuming that the packer uses the same entry point?– robertCommented Dec 10, 2015 at 12:30
-
no, the esp trick is used to allow an arbitrary entrypoint value, by watching for the write to the esp, which you can then examine, and then set a breakpoint at the true entrypoint.– peter ferrieCommented Dec 10, 2015 at 16:55
-
Another reason your approach might not work is if your target was compiled as a position-independent executable.– Jason GeffnerCommented Dec 10, 2015 at 20:33
-
Somebody is downvoting all my questions without a comment.– robertCommented Feb 20, 2016 at 20:46
Add a comment
|
2 Answers
Your approach doesn't make much sense, since the packer is free to move the original executable around and to map it at a different offset.
Old version of upx on Linux just wrote the file to a temporary location, then execve'd it, but I think that modern ones are now writing it in memory : You can find the OEP by breaking on stack/heap execution in GDB, like everyone is doing on Windows with OllyDBG.
My idea is to use LordPE to find what's packed with. Once you have unpacked it, ImportREC can help reconstruct your executable without the packer. I don't know what you 're dealing with, but if you check out a video of how each of them work and get the basics, you will most likely succeed.
