How to unpack manually an upx packed elf file

Question

I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions. I have a 64 bit executable, so I assume I have to look for a push and pop of all registers.

What I acieved until now is that I can get the entry point with readelf -h, and set a breakpoint in gdb at this address. With layout asm I can follow the disassembled instructions too. As I understand at the popad instruction the unpacking is done, and I can get the original entry point. However, because on 64bit there is no popad, I am not sure where the original entry point will be. All registers will be popped or only a few?

I also do not know how to fix imports.

Answer 1

Use a hex editor to open the file and locate the UPX header. The UPX header typically starts with the bytes 0x50 0x5A and is followed by a version number and other metadata.

Once you have located the UPX header, you will need to locate the offset of the compressed data and the original entry point of the file. This information can be found in the UPX header.

Next, use the UPX command-line tool to decompress the file. The -d option is used to decompress the file, and the -o option specifies the output file.

upx -d -o output.elf input.elf

Once the file has been decompressed, use a disassembler or a debugger to analyze the file and understand its functionality.

Hope this helps.