I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for
popad instructions. I have a 64 bit executable, so I assume I have to look for a push and pop of all registers.
What I acieved until now is that I can get the entry point with
readelf -h, and set a breakpoint in
gdb at this address. With
layout asm I can follow the disassembled instructions too. As I understand at the
popad instruction the unpacking is done, and I can get the original entry point. However, because on 64bit there is no
popad, I am not sure where the original entry point will be. All registers will be popped or only a few?
I also do not know how to fix imports.
JMPfollowed by a long trail of null (
00) bytes. The destination of the
JMPis the OEP. Illustrated here: deamonftp.free.fr/deamoncrack/Tuts/Kef/UPX/Cours%20upx_fichiers/… (Obviously, you won't be using OllyDbg, but the same approach can be used on Linux.)